Appendix A 

Letter to agencies 
TREY GOWDY, SOUTH CAROLINA 

CHAIRMAN 

ONE HUNDRED FIFTEENTH CONGRESS 

(!Congress of tbe mlntteb $tates 

J!)ouse of l\epresentatibes 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

2157 RAYBURN HOUSE OFFICE BUILDING 

WASHINGTON, DC 20515-6143 

MAJORITY {202) 225-507 4 

MINORITY {202) 225-5051 

http://oversight.house.gov 

December 8, 2017 

The Honorable R. Alexander Acosta 

Secretary 

U.S. Department of Labor 

200 Constitution Avenue, N.W. 

Washington, D.C. 20210 

Dear Mr. Secretary: 

ELIJAH E. CUMMINGS, MARYLAND 

RANKING MINORITY MEMBER 

Agencies issue a wide variety of policy documents for different purposes. Generally, 

when a policy is intended to be binding, agencies issue a regulation. 1 Other times, agencies issue 

statements of policy, interpretive rules, and other guidance regarding how the agency plans to 

interpret laws and legislative rules.2 

These various forms of guidance are not legally binding, but, according to the 

Government Accountability Office (GAO), the documents have wide-ranging effects on public 

and private sector behavior. In a 2015 report, GAO stated: "guidance documents can have a 

significant effect on regulated entities and the public, both because of agencies' reliance on large 

volumes of guidance documents and the fact that the guidance can prompt changes in the 

behavior of regulated parties and the general public. "

3

The GAO also found agencies' use of guidance varied significantly, ranging from as few 

as ten at some agencies to more than one hundred guidance documents each year at others. 4 The 

reason for this discrepancy is unclear. It is also unclear whether there are uniform practices or 

strategies throughout the executive branch for developing and issuing guidance documents. 

To help the Committee better understand how and when federal agencies issue guidance 

documents, please provide a list of all guidance documents issued by your agency since January 

1, 2008, including the following for each guidance document listed: 

1 Gov'T ACCOUNT ABILITY OFFICE, GAO-l 7-404T, REGULA TORY GUIDANCE PROCESSES: SELECTED DEPARTMENTS 

COULD STRENGTHEN INTERNAL CONTROL AND DISSEMINATION PRACTICES 14 (April 2015), available at

http://www.gao.gov/assets/670/669688.pdf. 

2 Agencies use a variety of names to refer to guidance documents, such as memoranda, policy statements, manuals, 

circulars, bulletins, advisories, or guidance. The Office of Management and Budget defines a guidance document as 

an agency statement of general applicability and future effect that sets forth a policy or interprets a statutory or 

regulatory issue. Id. at 7. 

3 Id. at 8. 

4 Id. at 13. 
The Honorable R. Alexander Acosta 

December 8, 2017 

Page 2 

1. The title;

2. The name of the form of guidance, such as circular, guidance, frequently asked questions,

bulletin, memoranda, or statement;

3. A brief description of the subject;

4. The date of issuance;

5. The issuing agency, component, office, or program;

6. An indication of whether:

a. The guidance was considered significant;

b. The agency submitted the guidance for review by the Office of Information and

Regulatory Affairs, and if it was:

1. The title of the guidance used in the submission; and

11. The date submitted;

c. The agency submitted the guidance to Congress and GAO, and if it was:

1. The title of the guidance used in the submission; and

11. The date submitted; and

d. The Regulatory Reform Task Force has reviewed or has plans to review the

guidance document, and any results of such review; and

7. To the extent applicable:

a. The Federal Record citation;

b. A hyperlink to a copy of the document;

c. The Regulation Identification Number; and

d. Any other identification number for the document.

Provide the requested documents and information as soon as possible, but no later than 

5:00 p.m. on December 22, 2017. An attachment to this letter provides additional instructions for 

responding to the Committee's request. 
The Honorable R. Alexander Acosta 

December 8, 2017 

Page 3 

Please contact Katy Rother of the majority staff at or 

with any questions about this request. Thank you for your 

attention to this matter. 

/ Trey Gowdy 

Chairman 

an 

Subcommittee on Healthcare, Benefits, 

;f i;;inii::�//) 

Blake Farenthold 

Chairman 

Subcommittee on the Interior, Energy, 

and Environment 

Enclosure 

Sincerely, 

A1L/fd4L {ef,;jt Meadows ____..;> 

Chairman 

Subcommittee on Intergovernmental Affairs 

cc: The Honorable Elijah E. Cummings, Ranking Member 

Committee on Oversight and Government Reform 

The Honorable Gerald E. Connolly, Ranking Member 

Subcommittee on Government Operations 

The Honorable Raja Krishnamoorthi, Ranking Member 

Subcommittee on Healthcare, Benefits, and Administrative Rules 

The Honorable Val Butler Demings, Ranking Member 

Subcommittee on Intergovernmental Affairs 

The Honorable Stacey E. Plaskett, Ranking Member 

Subcommittee on the Interior, Energy, and Environment 
Responding to Committee Document Requests

1. In complying with this request, you are required to produce all responsive documents that are 

in your possession, custody, or control, whether held by you or your past or present agents, 

employees, and representatives acting on your behalf. You should also produce documents 

that you have a legal right to obtain, that you have a right to copy or to which you have 

access, as well as documents that you have placed in the temporary possession, custody, or 

control of any third party. Requested records, documents, data or information should not be 

destroyed, modified, removed, transferred or otherwise made inaccessible to the Committee. 

2. In the event that any entity, organization or individual denoted in this request has been, or is 

also known by any other name than that herein denoted, the request shall be read also to 

include that alternative identification. 

3. The Committee’s preference is to receive documents in electronic form (i.e., CD, memory 

stick, or thumb drive) in lieu of paper productions. 

4. Documents produced in electronic format should also be organized, identified, and indexed 

electronically. 

5. Electronic document productions should be prepared according to the following standards: 

(a) The production should consist of single page Tagged Image File (“TIF”), files 

accompanied by a Concordance-format load file, an Opticon reference file, and a file 

defining the fields and character lengths of the load file.

(b) Document numbers in the load file should match document Bates numbers and TIF file 

names.

(c) If the production is completed through a series of multiple partial productions, field 

names and file order in all load files should match.

(d) All electronic documents produced to the Committee should include the following fields 

of metadata specific to each document;

BEGDOC, ENDDOC, TEXT, BEGATTACH, ENDATTACH, 

PAGECOUNT,CUSTODIAN, RECORDTYPE, DATE, TIME, SENTDATE, 

SENTTIME, BEGINDATE, BEGINTIME, ENDDATE, ENDTIME, AUTHOR, FROM, 

CC, TO, BCC, SUBJECT, TITLE, FILENAME, FILEEXT, FILESIZE, 

DATECREATED, TIMECREATED, DATELASTMOD, TIMELASTMOD, 

INTMSGID, INTMSGHEADER, NATIVELINK, INTFILPATH, EXCEPTION, 

BEGATTACH.

6. Documents produced to the Committee should include an index describing the contents of 

the production. To the extent more than one CD, hard drive, memory stick, thumb drive, box 

or folder is produced, each CD, hard drive, memory stick, thumb drive, box or folder should 

contain an index describing its contents. 
7. Documents produced in response to this request shall be produced together with copies of file 

labels, dividers or identifying markers with which they were associated when the request was 

served. 

8. When you produce documents, you should identify the paragraph in the Committee’s 

schedule to which the documents respond. 

9. It shall not be a basis for refusal to produce documents that any other person or entity also 

possesses non-identical or identical copies of the same documents. 

10. If any of the requested information is only reasonably available in machine-readable form 

(such as on a computer server, hard drive, or computer backup tape), you should consult with 

the Committee staff to determine the appropriate format in which to produce the information. 

11. If compliance with the request cannot be made in full by the specified return date, 

compliance shall be made to the extent possible by that date. An explanation of why full 

compliance is not possible shall be provided along with any partial production. 

12. In the event that a document is withheld on the basis of privilege, provide a privilege log 

containing the following information concerning any such document: (a) the privilege 

asserted; (b) the type of document; (c) the general subject matter; (d) the date, author and 

addressee; and (e) the relationship of the author and addressee to each other. 

13. If any document responsive to this request was, but no longer is, in your possession, custody, 

or control, identify the document (stating its date, author, subject and recipients) and explain 

the circumstances under which the document ceased to be in your possession, custody, or 

control. 

14. If a date or other descriptive detail set forth in this request referring to a document is 

inaccurate, but the actual date or other descriptive detail is known to you or is otherwise 

apparent from the context of the request, you are required to produce all documents which 

would be responsive as if the date or other descriptive detail were correct. 

15. Unless otherwise specified, the time period covered by this request is from January 1, 2009

to the present. 

16. This request is continuing in nature and applies to any newly-discovered information. Any 

record, document, compilation of data or information, not produced because it has not been 

located or discovered by the return date, shall be produced immediately upon subsequent 

location or discovery. 

17. All documents shall be Bates-stamped sequentially and produced sequentially. 

18. Two sets of documents shall be delivered, one set to the Majority Staff and one set to the 

Minority Staff. When documents are produced to the Committee, production sets shall be 

delivered to the Majority Staff in Room 2157 of the Rayburn House Office Building and the 

Minority Staff in Room 2471 of the Rayburn House Office Building. 
19. Upon completion of the document production, you should submit a written certification, 

signed by you or your counsel, stating that: (1) a diligent search has been completed of all 

documents in your possession, custody, or control which reasonably could contain responsive 

documents; and (2) all documents located during the search that are responsive have been 

produced to the Committee. 

Definitions

1. The term “document” means any written, recorded, or graphic matter of any nature 

whatsoever, regardless of how recorded, and whether original or copy, including, but not 

limited to, the following: memoranda, reports, expense reports, books, manuals, instructions, 

financial reports, working papers, records, notes, letters, notices, confirmations, telegrams, 

receipts, appraisals, pamphlets, magazines, newspapers, prospectuses, inter-office and intraoffice communications, electronic mail (e-mail), contracts, cables, notations of any type of 

conversation, telephone call, meeting or other communication, bulletins, printed matter, 

computer printouts, teletypes, invoices, transcripts, diaries, analyses, returns, summaries, 

minutes, bills, accounts, estimates, projections, comparisons, messages, correspondence, 

press releases, circulars, financial statements, reviews, opinions, offers, studies and 

investigations, questionnaires and surveys, and work sheets (and all drafts, preliminary 

versions, alterations, modifications, revisions, changes, and amendments of any of the 

foregoing, as well as any attachments or appendices thereto), and graphic or oral records or 

representations of any kind (including without limitation, photographs, charts, graphs, 

microfiche, microfilm, videotape, recordings and motion pictures), and electronic, 

mechanical, and electric records or representations of any kind (including, without limitation, 

tapes, cassettes, disks, and recordings) and other written, printed, typed, or other graphic or 

recorded matter of any kind or nature, however produced or reproduced, and whether 

preserved in writing, film, tape, disk, videotape or otherwise. A document bearing any 

notation not a part of the original text is to be considered a separate document. A draft or 

non-identical copy is a separate document within the meaning of this term. 

2. The term “communication” means each manner or means of disclosure or exchange of 

information, regardless of means utilized, whether oral, electronic, by document or 

otherwise, and whether in a meeting, by telephone, facsimile, email (desktop or mobile 

device), text message, instant message, MMS or SMS message, regular mail, telexes, 

releases, or otherwise. 

3. The terms “and” and “or” shall be construed broadly and either conjunctively or disjunctively 

to bring within the scope of this request any information which might otherwise be construed 

to be outside its scope. The singular includes plural number, and vice versa. The masculine 

includes the feminine and neuter genders. 

4. The terms “person” or “persons” mean natural persons, firms, partnerships, associations, 

corporations, subsidiaries, divisions, departments, joint ventures, proprietorships, syndicates, 

or other legal, business or government entities, and all subsidiaries, affiliates, divisions, 

departments, branches, or other units thereof. 
5. The term “identify,” when used in a question about individuals, means to provide the 

following information: (a) the individual's complete name and title; and (b) the individual's 

business address and phone number. 

6. The term “referring or relating,” with respect to any given subject, means anything that 

constitutes, contains, embodies, reflects, identifies, states, refers to, deals with or is pertinent 

to that subject in any manner whatsoever.

7. The term “employee” means agent, borrowed employee, casual employee, consultant, 

contractor, de facto employee, independent contractor, joint adventurer, loaned employee, 

part-time employee, permanent employee, provisional employee, subcontractor, or any other 

type of service provider. 
COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

U.S. HOUSE OF REPRESENTATIVES

115TH CONGRESS

NOTICE OF APPEARANCE OF COUNSEL

Counsel submitting: ____________________________________________________________

Bar number: ________________ State/District of admission: ______________

Attorney for: __________________________________________________________________

Address: _____________________________________________________________________

Telephone: ( _______ ) _______ - ___________

Pursuant to Rule 16 of the Committee Rules, notice is hereby given of the entry of the 

undersigned as counsel for ___________________________________________ in (select one):

All matters before the Committee

The following matters (describe the scope of representation):

____________________________________________________________________

____________________________________________________________________

All further notice and copies of papers and other material relevant to this action should be 

directed to and served upon:

Attorney’s name: ____________________________________________________

Attorney’s email address: _____________________________________________

Firm name (where applicable): _________________________________________

Complete Mailing Address: ____________________________________________

___________________________________________

I agree to notify the Committee within 1 business day of any change in representation.

___________________________________________ __________________

Signature of Attorney Date
Appendix B

Consumer Financial Protection Bureau



Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 1

Title Form Brief description Issue date Agency FR Cite URL RIN

Letter from Len Kennedy regarding timing of 

financial institutions' obligations under 1071 Letter

This letter was issued in response to multiple inquiries the Consumer Financial 

Protection Bureau (“CFPB” or “Bureau”) had received regarding the timing of 

financial institutions’ obligations under section 1071 of the Dodd-Frank Wall 

Street Reform and Consumer Protection Act (“Dodd-Frank Act”). 11-Apr-11 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/general-counsel-letter-regarding-section1071-dodd-frank-act/ N/A

Bulletin 2011-1, amendments to AMTPA Bulletin

The Bureau issued amendments to the Alternative Mortgage Transaction Parity 

Act (“AMTPA”) pursuant to section 1083 of the Dodd-Frank Wall Street Reform 

and Consumer Protection Act (“Dodd-Frank Act”). The amendments affect what 

laws apply to mortgage loans issued by state chartered or licensed lenders after 

that effective date. 27-Jun-11 CFPB N/A https://www.consumerfinance.gov/policy-complianceN/A

Bulletin 2011-2, Interstate Land Sales Full 

Disclosure Act Bulletin

The Bureau of Consumer Financial Protection (CFPB) issued this bulletin (Interim 

ILS Guidance) to address certain administrative issued relating to the Interstate 

Land Sales Full Disclosure Act (ILS). 21-Jul-11 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-interstate-land-sales-fulldisclosure-act/ N/A

Bulletin 2011-4, Notice and Opportunity to 

Respond and Advise (NORA) prior to 

enforcement proceedings Bulletin

Before the Office of Enforcement recommends that the Bureau commence 

enforcement proceedings, the Office of Enforcement may give the subject of 

such recommendation notice of the nature of the subject’s potential violations 

and may offer the subject the opportunity to submit a written statement in 

response 7-Nov-11 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-notice-opportunity-respondadvise/ N/A

Interagency statement for determining asset 

size of institutions for supervisory and 

enforcement purposes Statement

The Statement explains how the total assets of an insured depository institution 

or insured credit union (“Institution”) will be measured for purposes of 

determining supervisory and enforcement responsibilities under sections 1025 

and 1026 of the Dodd-Frank Wall Street Reform and Consumer Protection Act 

(Dodd-Frank). 17-Nov-11

CFPB and 

prudentials N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/interagency-statement-determining-assetsize-institutions/ N/A

Bulletin 2011-5, Whistleblower information, 

law enforcement tips, and anti-retaliation 

protections Bulletin

The Consumer Financial Protection Bureau issued this bulletin to solicit 

information from knowledgeable sources about potential violations of Federal 

consumer financial laws. 15-Dec-11 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-whistleblower-law-enforcementinformation-protections/ N/A

Bulletin 2012-1, The Bureau's supervisory 

authority and treatment of confidential 

supervisory information Bulletin

The Consumer Financial Protection Bureau ("Bureau") issued this letter to 

provide guidance regarding its collection of information through the supervisory 

process and the confidentiality protections that this process provides to 

supervised institutions. 4-Jan-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-supervision-authority-confidentialinformation/ N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 13-Feb-12 CFPB 77 FR 8034 https://www.consumerfinance.gov/policy-complianceN/A

Bulletin 2012-2, The payment of 

compensation to loan originators Bulletin

This Bulletin was issued in response to several inquiries the Consumer Financial 

Protection Bureau (“Bureau”) has received regarding the payment of 

compensation to loan originators under Regulation Z, 12 C.F.R. § 1026.36 

(“Compensation Rules”). 2-Apr-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-payment-compensation-loanoriginators/ N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 3-Apr-12 CFPB 44 U.S.C. 3502(5)

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ 3170–AA06
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 2

Title Form Brief description Issue date Agency FR Cite URL RIN

Bulletin 2012-4, Lending discrimination Bulletin

In response to recent inquiries, the Consumer Financial Protection Bureau 

(“CFPB” or “Bureau”) issued this bulletin to provide guidance about compliance 

with the fair lending requirements of the Equal Credit Opportunity Act (“ECOA”), 

and its implementing regulation, Regulation B. 18-Apr-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-lending-discrimination/ N/A

Bulletin 2012-5, SAFE Act and transitional 

licensing of mortgage loan originators Bulletin

This Bulletin was issued in response to several inquiries the Consumer Financial 

Protection Bureau (CFPB or Bureau) has received regarding whether states may, 

consistent with the Secure and Fair Enforcement for Mortgage Licensing Act of 

2008 (SAFE Act), permit transitional licensing of mortgage loan originators. 19-Apr-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-SAFE-act-transitional-licensingmortgage-loan-originators/ N/A

Interagency guidance on mortgage servicing 

practices concerning military homeowners 

with permanent change of station orders Guidance

This guidance was issued to address mortgage servicer practices that may pose 

risks to homeowners who are serving in the military and to ensure compliance 

with applicable consumer laws and regulations. Specifically, this guidance 

addresses risks related to military homeowners who have informed the servicer 

that they have received military Permanent Change of Station (PCS) orders 

(hereafter, “homeowners with PCS orders”). 21-Jun-12

Board, CFPB, 

FDIC, NCUA, 

OCC N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/interagency-guidance-mortgage-servicingpractices/ N/A

Disclosure of Certain Credit Card Complaint 

Data

Policy 

statement

The CFPB (the Bureau) issued a final policy statement (the Policy Statement) to 

provide guidance on how the Bureau plans to exercise its discretion to publicly 

disclose certain credit card complaint data that do not include personally 

identifiable information. 22-Jun-12 CFPB 77 FR 37558-01

https://www.consumerfinance.gov/policycompliance/notice-opportunities-comment/archiveclosed/disclosure-of-consumer-complaint-data/ N/A

Bulletin 2012-6, Marketing of credit card addon products Bulletin

Credit card issuers market various “add-on” products to card users, including 

debt protection, identity theft protection, credit score tracking, and other 

products that are supplementary to the credit provided by the card itself. This 

bulletin outlined the Consumer Financial Protection Bureau’s (“CFPB” or “the 

Bureau”) expectation that institutions under its supervision and their service 

providers offer such products in compliance with Federal consumer financial 

law. 27-Jun-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-marketing-credit-card-add-onproducts/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Oct-12 CFPB N/A

http://files.consumerfinance.gov/f/201210_cfpb_su

pervisory-highlights-fall-2012.pdf N/A

Consumer reporting exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4544

/102012_cfpb_consumer-reporting-largerparticipants_procedures.pdf N/A

Debt collection exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4760

/201210_cfpb_debt-collection-examinationprocedures.pdf N/A

Consumer Leasing Act exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4562

/102012_cfpb_consumer-leasing-act_procedures.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 3

Title Form Brief description Issue date Agency FR Cite URL RIN

Fair Credit Reporting Act exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4564

/102012_cfpb_fair-credit-reporting-actfcra_procedures.pdf N/A

Fair Debt Collection Practices Act exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4566

/102012_cfpb_fair-debt-collections-practices-actfdcpa_procedures.pdf N/A

Home Mortgage Disclosure Act exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4568

/102012_cfpb_home-mortgage-disclosure-acthmda_procedures.pdf N/A

Homeowners Protection Act exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4570

/102012_cfpb_homeowners-protection-act-hpa-pmicancellation-act_procedures.pdf N/A

Secure and Fair Enforcement for Mortgage 

Licensing exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4572

/102012_cfpb_secure-fair-enforcement-formortgage-licensing-safe-act_procedures.pdf N/A

Truth in Savings Act exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4574

/102012_cfpb_truth-savings-act-tisa_procedures.pdf N/A

UDAAP exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-12 CFPB N/A

https://www.consumerfinance.gov/documents/4576

/102012_cfpb_unfair-deceptive-abusive-actspractices-udaaps_procedures.pdf N/A

Statement to advise supervised entities that 

CFPB encourages them to work with 

consumers affected by Hurricane Sandy Statement

The Consumer Financial Protection Bureau (CFPB) issued this statement to 

advise our supervised entities that the CFPB encourages them to work with 

borrowers and other consumers affected by Hurricane Sandy. Like the Federal 

Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the 

Comptroller of the Currency, the CFPB will provide regulatory flexibility to 

entities working with borrowers affected by the hurricane. 16-Nov-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/statement-supervisory-practices-affectedhurricane-sandy/ N/A

Bulletin 2012-8, Implementation of the 

remittance rule (Regulation E, Subpart B) Bulletin

The Consumer Financial Protection Bureau (CFPB or the Bureau) issued a 

bulletin in advance of a proposal to refine three elements of its rule regarding 

foreign remittance transfers. The proposal will be narrowly targeted to address 

the rule’s provisions on: (1) errors resulting from incorrect account numbers 

provided by senders of remittance transfers; (2) the disclosure of certain foreign 

taxes and third-party fees; and (3) the disclosure of sub-national, foreign taxes. 27-Nov-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-implementation-remittance-rule/ N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 4

Title Form Brief description Issue date Agency FR Cite URL RIN

Bulletin 2012-9, FCRA streamlined process 

for consumers to obtain free annual reports 

from nationwide specialty consumer 

reporting agencies Bulletin

The Fair Credit Reporting Act (FCRA) requires nationwide specialty consumer 

reporting agencies (NSCRAs) to provide, upon request of a consumer, a free 

annual disclosure of the consumer’s file, commonly known as a consumer 

report. The FCRA’s implementing Regulation (Regulation V) includes a rule 

mandated by the FCRA that requires each NSCRA to establish a “streamlined 

process for consumers to request [their free annual] consumer reports . . . which 

shall include, at a minimum, the establishment by each such agency of a tollfree telephone number for such requests.” 15 U.S.C. § 1681j; 12 C.F.R. § 

1022.137. 29-Nov-12 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-FCRA-process-requirementconsumers/ N/A

Fair Lending Report Report

The Bureau provides a comprehensive overview of our fair lending program and 

describes our work in this area, while also fulfilling congressional reporting 

requirements under § 1013(c)(2)(D) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act. 1-Dec-12 CFPB N/A

http://files.consumerfinance.gov/f/201212_cfpb_fairlending-report.pdf3 N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 18-Dec-12 CFPB 77 FR 74831-01

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 8-Jan-13 CFPB 78 FR 1652

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Bulletin 2013-2, Indirect Auto Lending and 

Compliance with the Equal Credit 

Opportunity Act Bulletin

This bulletin provides guidance about compliance with the fair lending 

requirements of the Equal Credit Opportunity Act (ECOA) and its implementing 

regulation, Regulation B, for indirect auto lenders that permit dealers to 

increase consumer interest rates and that compensate dealers with a share of 

the increased interest revenues. This guidance applies to all indirect auto 

lenders within the jurisdiction of the Consumer Financial Protection Bureau 

(CFPB), including both depository institutions and nonbank institutions. 21-Mar-13 CFPB N/A

http://files.consumerfinance.gov/f/201303_cfpb_ma

rch_-Auto-Finance-Bulletin.pdf N/A

Disclosure of Consumer Complaint Data

Policy 

statement

The CFPB (Bureau) issued a final policy statement (Policy Statement) to provide 

guidance on how the Bureau plans to exercise its discretion to publicly disclose 

certain consumer complaint data that do not include personally identifiable 

information. 10-Apr-13 CFPB 78 FR 21218-01

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/disclosure-consumer-complaint-data/ N/A

Electronic Fund Transfers; Determination of 

Effect on State Laws (Maine and Tennessee) Notice 

The CFPB (Bureau) published a final determination as to whether certain laws of 

Maine and Tennessee relating to unclaimed gift cards are inconsistent with and 

preempted by the Electronic Fund Transfer Act and Regulation E. 25-Apr-13 CFPB 78 FR 24386-05

https://www.consumerfinance.gov/consumerfinanc

e.gov/201304_cfpb_Preemption-Determination N/A

Bulletin 2013-5, SAFE Act – uniform state 

test for state-licensed mortgage loan 

originators Bulletin

The Consumer Financial Protection Bureau (CFPB) issued this guidance in 

response to questions about whether states may use the Uniform State Test 

(UST) developed by the Nationwide Mortgage Licensing System and Registry 

(NMLSR) as part of a qualified written test under the Secure and Fair 

Enforcement for Mortgage Licensing Act of 2008 (SAFE Act). 20-May-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-SAFE-act-uniform-state-test/ N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 5

Title Form Brief description Issue date Agency FR Cite URL RIN

Bulletin 2013-6, Responsible business 

conduct: self-policing, self-reporting, 

remediation, and cooperation Bulletin

The Bureau considers many factors in the exercise of its enforcement discretion. 

These include, for example: (1) the nature, extent, and severity of the violations 

identified; (2) the actual or potential harm from those violations; (3) whether 

there is a history of past violations; and (4) a party’s effectiveness in addressing 

violations. This guidance is being provided to inform those subject to the 

Bureau’s enforcement authority that in addition to these and other factors, 

there are activities they can engage in both before and after the conduct in 

question has occurred that the Bureau may favorably consider in exercising its 

enforcement discretion. 25-Jun-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-responsible-business-conduct/ N/A

Bulletin 2013-8, Representations regarding 

effect of debt payments on credit reports 

and scores Bulletin

In response to practices observed during supervisory examinations and 

enforcement investigations, the Consumer Financial Protection Bureau (CFPB or 

Bureau) issued this bulletin to provide guidance to creditors, debt buyers, and 

third-party collectors about compliance with the Fair Debt Collection Practices 

Act (FDCPA) and sections 1031 and 1036 of the Dodd-Frank Wall Street Reform 

and Consumer Protection Act of 2010 (Dodd-Frank Act) when making 

representations about the impact that payments on debts in collection may 

have on credit reports and credit scores. 10-Jul-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-effect-debt-payments-creditreports-scores/ N/A

Bulletin 2013-7, Prohibition of UDAAPs in the 

collection of consumer debts Bulletin

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (DoddFrank Act), all covered persons or service providers are legally required to 

refrain from committing unfair, deceptive, or abusive acts or practices 

(collectively, UDAAPs) in violation of the Act. The Consumer Financial Protection 

Bureau (CFPB or Bureau) issued this bulletin to clarify the contours of that 

obligation in the context of collecting consumer debts. 10-Jul-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-prohibition-practices-collectionconsumer-debts/ N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 23-Jul-13 CFPB 78 FR 44350

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Aug-13 CFPB N/A

http://files.consumerfinance.gov/f/201308_cfpb_su

pervisory-highlights_august.pdf N/A

Short-term, small-dollar lending exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Sep-13 CFPB N/A

https://www.consumerfinance.gov/documents/4754

/201309_cfpb_payday_manual_revisions.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 6

Title Form Brief description Issue date Agency FR Cite URL RIN

Bulletin 2013-9, FCRA requirement to 

investigate disputes and review "all 

relevant" information Bulletin

The Fair Credit Reporting Act (FCRA) generally requires a consumer reporting 

agency (CRA) to notify a furnisher when a consumer disputes the accuracy or 

completeness of an item of information provided by the furnisher to the CRA. 

The CRA must also promptly provide the furnisher “all relevant information” 

regarding the dispute that the CRA timely received from the consumer. The 

furnisher, in turn, must “conduct an investigation with respect to the disputed 

information,” “review all relevant information” provided by the CRA, and 

respond appropriately based on the result of the investigation. The CFPB 

expects CRAs and furnishers to comply fully with these FCRA requirements, 

thereby promoting the accuracy and completeness of information in the 

consumer reporting system. 4-Sep-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-FRCA-requirement-investigatedisputes/ N/A

Bulletin 2013-10: Payroll card accounts 

(Regulation E) Bulletin

The Consumer Financial Protection Bureau (CFPB or the Bureau) issued this 

bulletin to reiterate the application of the Electronic Fund Transfer Act (EFTA) 

and Regulation E, which implements the EFTA, to payroll card accounts. 12-Sep-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-payroll-card-accounts/ N/A

Interagency guidance on privacy laws and 

reporting financial abuse of older adults Guidance

The agencies issued this guidance to financial institutions to clarify the 

applicability of privacy provisions of the Gramm-Leach-Bliley Act (GLBA) to 

reporting suspected financial exploitation of older adults. 24-Sep-13

Board, CFTC, 

CFPB, FDIC, FTC, 

NCUA, OCC, SEC N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/interagency-guidance-reporting-financialabuse-older-adults/ N/A

Remittance transfer exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-13 CFPB N/A

https://www.consumerfinance.gov/documents/4756

/201310_cfpb_remittance-transfer-examinationprocedures.pdf N/A

Electronic Fund Transfer Act exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-13 CFPB N/A

https://www.consumerfinance.gov/documents/4752

/201310_cfpb_updated-regulation-e-examinationprocedures_including-remittances.pdf N/A

HMDA resubmission schedule and guidelines 

exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-13 CFPB N/A

https://www.consumerfinance.gov/documents/4748

/201310_cfpb_hmda_resubmission-guidelines_fairlending.pdf N/A

Bulletin 2013-11, the Home Mortgage 

Disclosure Act (HMDA) and Regulation C – 

Compliance management; CFPB HMDA 

resubmission schedule and guidelines; and 

HMDA enforcement Bulletin

In this bulletin, the Consumer Financial Protection Bureau (CFPB or Bureau) 

addresses mortgage lenders’ compliance with the Home Mortgage Disclosure 

Act (HMDA) and its implementing regulation, Regulation C. 9-Oct-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-compliance-HMDA-regulation-C/ N/A

Bulletin 2013-12, Implementation guidance 

for certain mortgage servicing rules Bulletin

The Consumer Financial Protection Bureau (CFPB) issued this bulletin to provide 

guidance in implementing certain of the 2013 Real Estate Settlement Procedures 

Act (RESPA) and Truth in Lending Act (TILA) Servicing Final Rules. 15-Oct-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-implementation-mortgageservicing-rules/ N/A

Policy To Encourage Trial Disclosure 

Programs; Information Collection Policy

The CFPB (Bureau) issued its Policy to Encourage Trial Disclosure Programs 

(Policy), which is intended to carry out the Bureau's authority under of the DoddFrank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank 

Act). 29-Oct-13 CFPB 78 FR 64389-01

files.consumerfinance.gov/f/201310_cfpb_1032etrial-disclosure-policy.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 7

Title Form Brief description Issue date Agency FR Cite URL RIN

Electronic Fund Transfers (Regulation E) Notice

On September 26, 2012, the CFPB (Bureau) issued a safe harbor list of countries 

that qualify for an exception in subpart B of Regulation E, which implements the 

Electronic Fund Transfer Act, and published this list on its Web site. The Bureau 

then published this list, which is unchanged from the prior release, in the 

Federal Register. The Bureau recognizes that the list may change, and it intends 

to revise the list periodically. 5-Nov-13 CFPB 78 FR 66251-01

https://www.consumerfinance.gov/policycompliance/notice-opportunities-comment/archiveclosed/notice-of-publication-electronic-fundtransfers-regulation-e-remittance-rule-safe-harborlist/ 3170–AA33

Bulletin 2013-13, Homeownership 

counseling list requirements Bulletin

The Consumer Financial Protection Bureau (CFPB) issued this bulletin to provide 

guidance to lenders regarding the homeownership counseling list requirement 

finalized in the High-Cost Mortgage and Homeownership Counseling 

Amendments to the Truth in Lending Act (Regulation Z) and Homeownership 

Counseling Amendments to the Real Estate Settlement Procedures Act (RESPA 

Housing Counselor Amendments) Final Rule (2013 HOEPA Final Rule). 8-Nov-13 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/homeownership-counseling-listrequirements/ N/A

Homeownership Counseling Organizations 

Lists Interpretive Rule

Interpretive 

rule

This rule describes data instructions for lenders to use in complying with the 

requirement under the High-Cost Mortgage and Homeownership Counseling 

Amendments to the Truth in Lending Act (Regulation Z) and Homeownership 

Counseling Amendments to the Real Estate Settlement Procedures Act (RESPA 

Homeownership Counseling Amendments) Final Rule to provide a 

homeownership counseling list using data made available by the Bureau or 

Department of Housing and Urban Development (HUD). 14-Nov-13 CFPB 78 FR 68343-01

http://files.consumerfinance.gov/f/201311_cfpb_int

erpretive-rule_homeownership-counselingorganizations-lists.pdf 3170-AA37

Social Media: Consumer Compliance Risk 

Management Guidance Guidance

The Federal Financial Institutions Examination Council (FFIEC), on behalf of its 

members, issued this final supervisory guidance entitled “Social Media: 

Consumer Compliance Risk Management Guidance” (Guidance). 17-Dec-13 FFIEC 78 FR 76297-01

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/FFIEC-guidance-social-media/ N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 30-Dec-13 CFPB 78 FR 79410-01

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Jan-14 CFPB N/A

http://files.consumerfinance.gov/f/201401_cfpb_su

pervisory-highlights-winter-2013.pdf N/A

ECOA valuation small entity compliance 

guide

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Jan-14 CFPB N/A

http://files.consumerfinance.gov/f/201401_cfpb_co

mpliance-guide_ecoa.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 8

Title Form Brief description Issue date Agency FR Cite URL RIN

TILA HPML appraisals small entity 

compliance guide

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Jan-14 CFPB N/A

http://files.consumerfinance.gov/f/201401_cfpb_tilahpml_appraisal-rule-guide.pdf N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 7-Jan-14 CFPB 79 FR 1242

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Bulletin 2014-01, FCRA requirement that 

furnishers conduct investigations of disputed 

information Bulletin

Debt buyers, debt collectors, and others who furnish information to credit 

reporting agencies have a variety of obligations under the Fair Credit Reporting 

Act (FCRA) and Regulation V. The Consumer Financial Protection Bureau (CFPB) 

issued this bulletin to highlight one of those obligations – the obligation of 

furnishers to investigate disputed information in a consumer report. 27-Feb-14 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-fcra-requirement-furnishersconduct-investigations/ N/A

Fair Lending Report Report

The Bureau provides a comprehensive overview of our fair lending program and 

describes our work in this area, while also fulfilling congressional reporting 

requirements under § 1013(c)(2)(D) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act. 1-Apr-14 CFPB N/A

files.consumerfinance.gov/f/201404_cfpb_report_fai

r-lending.pdf N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-May-14 CFPB N/A

http://files.consumerfinance.gov/f/201405_cfpb_su

pervisory-highlights-spring-2014.pdf N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 13-Jun-14 CFPB 79 FR 34146

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Application of Regulation Z's Ability-ToRepay Rule to Certain Situations Involving 

Successors-in-Interest

Interpretive 

rule

The CFPB (Bureau) issued this interpretive rule to clarify that the Bureau's Abilityto-Repay Rule incorporates the existing definition of assumption under 

Regulation Z. 17-Jul-14 CFPB 79 FR 41631-01

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/applicationregulation-zs-ability-repay-rule-certain-situationsinvolving-successors-interest/ 3170–ZA00

Policy Guidance on Supervisory and 

Enforcement Considerations Relevant to 

Mortgage Brokers Transitioning to MiniCorrespondent Lenders

Policy 

guidance

The CFPB (CFPB or Bureau) issued supervisory and enforcement guidance 

entitled Policy Guidance on Supervisory and Enforcement Considerations 

Relevant to Mortgage Brokers Transitioning to Mini-Correspondent Lenders, 

(Policy Guidance) which relates to the Bureau's exercise of its authority to 

supervise and enforce compliance with RESPA and Regulation X and TILA and 

Regulation Z in certain transactions involving mini-correspondent lenders. 17-Jul-14 CFPB 79 FR 41671-02

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/guidance-brokers-mini-correspondentmodel/ N/A

Guidance regarding certain consumer credit 

practices Guidance

The Board of Governors of the Federal Reserve System (Board), Consumer 

Financial Protection Bureau (CFPB), Federal Deposit Insurance Corporation 

(FDIC), National Credit Union Administration (NCUA), and Office of the 

Comptroller of the Currency (OCC) (collectively, the Agencies) issued this 

guidance regarding certain consumer credit practices. 22-Aug-14 FFIEC N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/FFIEC-credit-practices-guidance/ N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 9

Title Form Brief description Issue date Agency FR Cite URL RIN

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Sep-14 CFPB N/A

http://files.consumerfinance.gov/f/201409_cfpb_su

pervisory-highlights_auto-lending_summer2014.pdf5 N/A

Bulletin 2014-2, Marketing of credit card 

promotional offers Bulletin

The Consumer Financial Protection Bureau (CFPB or Bureau) issued this Bulletin 

to inform credit card issuers of the risk of engaging in deceptive and/or abusive 

acts and practices in connection with solicitations that offer a promotional 

annual percentage rate (APR) on a particular transaction over a defined period 

of time. These transactions include, but are not limited to, convenience checks, 

deferred interest/promotional interest rate purchases, and balance transfers. 3-Sep-14 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-marketing-credit-cardpromotional-APR-offers/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Oct-14 CFPB N/A

http://files.consumerfinance.gov/f/201410_cfpb_su

pervisory-highlights_fall-2014.pdf N/A

Compliance Bulletin and Policy Guidance, 

Mortgage Servicing Transfers; CFUB Bulletin 

2014-1 Bulletin

The CFPB (CFPB) issued a compliance bulletin and policy guidance entitled 

Compliance Bulletin and Policy Guidance, Mortgage Servicing Transfers in light 

of potential risks to consumers that may arise in connection with transfers of 

residential mortgage servicing rights. 23-Oct-14 CFPB 79 FR 63295-01

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-mortgage-servicing-transfers/ N/A

Bulletin 2014-3, Social Security disability 

income verification Bulletin

The Consumer Financial Protection Bureau (Bureau) issued this compliance 

bulletin to remind creditors of (1) their obligations under the Equal Credit 

Opportunity Act (ECOA) and its implementing regulation, Regulation B, with 

respect to consideration of public assistance income; and (2) relevant standards 

and guidelines regarding verification of Social Security Disability Insurance (SSDI) 

and Supplemental Security Income (SSI) income (collectively, Social Security 

disability income) received by mortgage applicants. 18-Nov-14 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-social-security-disability-incomeverification/ N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 15-Dec-14 CFPB 79 FR 74068-02

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 22-Dec-14 CFPB 79 FR 76808

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Credit card account management exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Feb-15 CFPB N/A

https://www.consumerfinance.gov/documents/4762

/201502_cfpb_credit_card_account_management_e

xamination_guide.pdf N/A

Compliance Bulletin 2015-1, Treatment of 

Confidential Supervisory Information Bulletin

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 25-Feb-15 CFPB 80 FR 10072-01

https://www.consumerfinance.gov/aboutus/newsroom/consumer-financial-protection-bureauissues-supervisory-compliance-bulletin/ N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 10

Title Form Brief description Issue date Agency FR Cite URL RIN

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Mar-15 CFPB N/A

http://files.consumerfinance.gov/f/201503_cfpb_su

pervisory-highlights-winter-2015.pdf N/A

Loan originator small entity compliance 

guide

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Mar-15 CFPB N/A

http://files.consumerfinance.gov/f/201503_cfpb_20

13-loan-originator-rule-small-entity-complianceguide.pdf N/A

Disclosure of Consumer Complaint Narrative 

Data

Policy 

statement

The CFPB (the Bureau) issued a final policy statement (Final Policy Statement) to 

provide guidance on how the Bureau plans to exercise its discretion to disclose 

publicly unstructured consumer complaint narrative data (narratives or 

consumer narratives) via its web-based, public facing database (the Consumer 

Complaint Database or Database). 24-Mar-15 CFPB 80 FR 15572-01

http://files.consumerfinance.gov/f/201503_cfpb_dis

closure-of-consumer-complaint-narrative-data.pdf N/A

Fair Lending Report Report

The Bureau provides a comprehensive overview of our fair lending program and 

describes our work in this area, while also fulfilling congressional reporting 

requirements under § 1013(c)(2)(D) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act. 1-Apr-15 CFPB N/A

http://files.consumerfinance.gov/f/201504_cfpb_fair

_lending_report.pdf N/A

Homeownership Counseling Organizations 

Lists and High-Cost Mortgage Counseling 

Interpretive Rule

Interpretive 

rule

The CFPB (Bureau) reissued a prior interpretive rule regarding the provision of 

lists of HUD-approved housing counseling agencies to mortgage loan applicants 

with additional interpretations describing permissible addresses for list 

generation, as well as additional details for generation. This interpretive rule 

also provides guidance, in addition to existing commentary, on the qualifications 

for providing high-cost mortgage counseling and on lender participation in such 

counseling. 21-Apr-15 CFPB 80 FR 22091-01

http://files.consumerfinance.gov/f/201504_cfpb_ho

using-counselor-interpretive-rule.pdf 3170–AA52

Bulletin 2015-2, Section 8 housing choice 

voucher homeownership program Bulletin

The Consumer Financial Protection Bureau (Bureau) issued this compliance 

bulletin to remind creditors of their obligations under the Equal Credit 

Opportunity Act (ECOA) and its implementing regulation, Regulation B, to 

provide non-discriminatory access to credit for mortgage applicants using 

income from the Section 8 Housing Choice Voucher (HCV) Homeownership 

Program. 11-May-15 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-section-8-housing-choice-voucherhomeownership-program/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Jun-15 CFPB N/A

http://files.consumerfinance.gov/f/201506_cfpb_su

pervisory-highlights.pdf N/A

Auto finance exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Jun-15 CFPB N/A

https://www.consumerfinance.gov/documents/4764

/201506_cfpb_automobile-finance-examinationprocedures.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 11

Title Form Brief description Issue date Agency FR Cite URL RIN

Final Interagency Policy Statement 

Establishing Joint Standards for Assessing 

the Diversity Policies and Practices of 

Entities Regulated by the Agencies

Policy 

statement

The OCC, Board, FDIC, NCUA, CFPB, and SEC issued a final interagency policy 

statement establishing joint standards for assessing the diversity policies and 

practices of the entities they regulate, as required by the Dodd-Frank Wall Street 

Reform and Consumer Protection Act of 2010. 10-Jun-15

OCC, Board, 

FDIC, NCUA, 

CFPB, SEC 80 FR 33016

https://www.federalregister.gov/articles/2015/06/1

0/2015-14126/joint-standards-for-assessing-thediversity-policies-and-practices-of-entities-regulatedby-the N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 18-Jun-15 CFPB 80 FR 35116

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Bulletin 2015-3, Private mortgage insurance 

cancellation and termination Bulletin

The Bureau of Consumer Financial Protection (CFPB) issued this compliance 

bulletin to provide guidance to assist residential mortgage servicers and 

subservicers (collectively, servicers) in their compliance with the private 

mortgage insurance (PMI) cancellation and termination provisions of the 

Homeowners Protection Act of 1998 (HPA). This compliance bulletin explains 

HPA requirements and describes examples from CFPB’s supervisory experience 

of PMI cancellation and termination procedures that violate the HPA or create a 

substantial risk of noncompliance. 4-Aug-15 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-private-mortgage-insurancecancellation-termination/ N/A

Compliance Bulletin 2015-4, Amendment to 

the Interstate Land Sales Full Disclosure Act Bulletin

The CFPB issued a compliance bulletin titled Amendment to the Interstate Land 

Sales Full Disclosure Act to provide information to developers and other 

interested parties relating to a recent Congressional amendment to the 

Interstate Land Sales Full Disclosure Act. 17-Aug-15 CFPB 80 FR 49127-01

http://files.consumerfinance.gov/f/201508_cfpb_bul

letin-on-interstate-land-sales-full-disclosure-actamendment-federal-register.pdf N/A

Mortgage origination exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Sep-15 CFPB N/A

https://www.consumerfinance.gov/documents/4758

/201509_cfpb_mortgage-origination-examinationprocedures.pdf N/A

Real Estate Settlement Procedures Act exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Sep-15 CFPB N/A

https://www.consumerfinance.gov/documents/4746

/201509_cfpb_regulation-x-real-estate-settlementprocedures-act-exam-procedures.pdf N/A

Truth in Lending Act exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Sep-15 CFPB N/A

https://www.consumerfinance.gov/documents/4744

/201509_cfpb_truth-in-lending-act-examprocedures.pdf N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 1-Oct-15 CFPB N/A

http://files.consumerfinance.gov/f/201510_cfpb_su

pervisory-highlights.pdf N/A

Equal Credit Opportunity Act exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-15 CFPB N/A

https://www.consumerfinance.gov/documents/4750

/201510_cfpb_ecoa-narrative-and-procedures.pdf N/A

ECOA baseline review exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-15 CFPB N/A

https://www.consumerfinance.gov/documents/4676

/102013_cfpb_equal_credit_opportunity_act_ecoa_

baseline.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 12

Title Form Brief description Issue date Agency FR Cite URL RIN

Bulletin 2015-5, RESPA compliance and 

marketing services agreements Bulletin

The Consumer Financial Protection Bureau (CFPB or the Bureau) issued this 

compliance bulletin to remind participants in the mortgage industry of the 

prohibition on kickbacks and referral fees under the Real Estate Settlement 

Procedures Act (RESPA) (12 U.S.C. 2601, et seq.) and describe the substantial 

risks posed by entering into marketing services agreements (MSAs). 8-Oct-15 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-RESPA-compliance-marketingservices-agreements/ N/A

Joint Statement of Principles on Student 

Loan Servicing Statement

On September 29, 2015, the CFPB (Bureau) joined with the U.S. Department of 

the Treasury and the U.S. Department of Education to release a Joint Statement 

of Principles on Student Loan Servicing as a framework for policymakers and 

market participants looking to improve student loan servicing practices, 

promote borrower success, and mitigate defaults. This Policy Guidance sets 

forth those joint principles. 2-Nov-15

CFPB, Treasury, 

Ed 80 FR 67389-02

http://files.consumerfinance.gov/f/201509_cfpb_tre

asury_education-joint-statement-of-principles-onstudent-loan-servicing.pdf N/A

Appeals of Supervisory Matters Policy

In this guidance, the CFPB laid out a supervisory appeals process for financial 

service providers, including depository institutions. 3-Nov-15 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/supervisory-matters-appeal-process/ N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 20-Nov-15 CFPB 80 FR 72711-02

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ N/A

Bulletin 2015-6, Requirements for consumer 

authorizations for preauthorized electronic 

fund transfers Bulletin

The CFPB issued this Compliance Bulletin to industry to remind entities of their 

obligations under the Electronic Fund Transfer Act (EFTA) and Regulation E 

when obtaining consumer authorizations for preauthorized electronic fund 

transfers (EFTs) from a consumer’s account. 23-Nov-15 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-consumer-authorizationspreauthorized-EFT/ N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 15-Dec-15 CFPB 80 FR 78056

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Bulletin 2015-7, In-person collection of 

consumer debt Bulletin

The Consumer Financial Protection Bureau (CFPB or Bureau) issued this 

compliance bulletin to provide guidance to creditors, debt buyers, and thirdparty collectors about compliance with sections 1031 and 1036 of the DoddFrank Wall Street Reform and Consumer Protection Act of 2010 (DoddFrank Act) 

and the Fair Debt Collection Practices Act (FDCP A) when collecting debt from 

consumers. 16-Dec-15 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/bulletin-personal-collection-consumerdebt/ N/A

Compliance Bulletin, The FCRA's 

Requirement That Furnishers Establish and 

Implement Reasonable Written Policies and 

Procedures Regarding the Accuracy and 

Integrity of Information Furnished to All 

Consumer Reporting Agencies. Bulletin

This document highlights existing obligations under the Fair Credit Reporting Act 

(FCRA) for furnishers of consumer information to consumer reporting agencies 

(CRAs) to establish and implement reasonable written policies and procedures 

regarding the accuracy and integrity of information furnished to all CRAs. 4-Feb-16 CFPB 81 FR 5992-01

http://files.consumerfinance.gov/f/201602_cfpb_su

pervisory-bulletin-furnisher-accuracy-obligations.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 13

Title Form Brief description Issue date Agency FR Cite URL RIN

Policy on No-Action Letters; Information 

Collection

Policy 

statement

The CFPB (Bureau) issued a final policy statement on No-Action Letters (Policy), 

which is intended to further objectives under section 1021 of the Dodd-Frank 

Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act). 22-Feb-16 CFPB 81 FR 8686-02

http://files.consumerfinance.gov/f/201602_cfpb_noaction-letter-policy.pdf N/A

ATR/QM small entity compliance guide

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Mar-16 CFPB N/A

http://files.consumerfinance.gov/f/201603_cfpb_atrqm_small-entity-compliance-guide.pdf N/A

HOEPA small entity compliance guide

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Mar-16 CFPB N/A

http://files.consumerfinance.gov/f/201603_cfpb_ho

epa-compliance-guide.pdf N/A

Escrows small entity compliance guide

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Mar-16 CFPB N/A

http://files.consumerfinance.gov/f/201603_cfpb_tilahpml-escrow_compliance-guide.pdf N/A

Fair Lending Report Report

The Bureau provides a comprehensive overview of our fair lending program and 

describes our work in this area, while also fulfilling congressional reporting 

requirements under § 1013(c)(2)(D) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act. 12-May-16 CFPB 81 FR 29533-02

https://www.consumerfinance.gov/documents/3654

/201704_cfpb_Fair_Lending_Report.pdf N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 16-May-16 CFPB 81 FR 30257-01

http://files.consumerfinance.gov/f/201603_cfpb_su

pervisory-highlights.pdf N/A

Interagency Guidance Regarding Deposit 

Reconciliation Practices Guidance

The Board of Governors of the Federal Reserve System, the Consumer Financial 

Protection Bureau, the Federal Deposit Insurance Corporation, the National 

Credit Union Administration, and the Office of the Comptroller of the Currency 

(collectively, the Agencies) issued guidance to ensure that financial institutions 

are aware of the Agencies’ supervisory expectations regarding customer 

account deposit reconciliation practices. 18-May-16

CFPB, Board, 

FDIC, NCUA, 

OCC N/A

http://www.consumerfinance.gov/f/documents/201

605_cfpb_interagency-guidance-regarding-depositreconciliation-practices.pdf N/A

Mortgage servicing exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Jun-16 CFPB N/A

https://www.consumerfinance.gov/documents/657/

11.5_Mortgage_Servicing_Exam_Procedures_June_2

016.pdf N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 9-Jun-16 CFPB 81 FR 37412

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 14

Title Form Brief description Issue date Agency FR Cite URL RIN

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 15-Jul-16 CFPB 81 FR 46063-01

http://files.consumerfinance.gov/f/documents/Mort

gage_Servicing_Supervisory_Highlights_11_Final_we

b_.pdf N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 18-Jul-16 CFPB 81 FR 46652-02

http://files.consumerfinance.gov/f/documents/Supe

rvisory_Highlights_Issue_12.pdf N/A

Military Lending Act exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Sep-16 CFPB N/A

https://www.consumerfinance.gov/documents/1031

/092016_cfpb_MLAExamManualUpdate.pdf N/A

Notice of Availability of Revised 

Methodology for Determining Average 

Prime Offer Rates Notice

The CFPB (Bureau) announced the availability of a revised methodology 

statement, entitled the Methodology for Determining Average Prime Offer 

Rates. The methodology statement describes the methodology used to calculate 

average prime offer rates for purposes of Regulation C and Regulation Z. The 

Bureau removed from the methodology statement the references to the sources 

of survey data used to calculate average prime offer rates. 19-Sep-16 CFPB 81 FR 64142-01 N/A N/A

Status of New Uniform Residential Loan 

Application and Collection of Expanded 

Home Mortgage Disclosure Act Information 

About Ethnicity and Race in 2017 Notice

The CFPB (Bureau) published a notice pursuant to the Equal Credit Opportunity 

Act concerning the new Uniform Residential Loan Application and the collection 

of expanded Home Mortgage Disclosure Act information about ethnicity and 

race in 2017. 29-Sep-16 CFPB 81 FR 66930-01

https://www.consumerfinance.gov/documents/1007

/092016_cfpb_HMDAEthinicityRace.pdf N/A

Reverse mortgage servicing exam 

procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-16 CFPB N/A

https://www.consumerfinance.gov/documents/1387

/102016_cfpb_ReverseMortgageServicingExaminatio

nProcedures.pdf N/A

Privacy of Consumer Financial Information 

exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Oct-16 CFPB N/A

https://www.consumerfinance.gov/documents/1381

/102016_cfpb_GLBAExamManualUpdate.pdf N/A

Safe Harbors From Liability Under the Fair 

Debt Collection Practices Act for Certain 

Actions Taken in Compliance With Mortgage 

Servicing Rules Under the Real Estate 

Settlement Procedures Act (Regulation X) 

and the Truth in Lending Act (Regulation Z)

Interpretive 

rule

The CFPB (Bureau) issued this interpretive rule under the Fair Debt Collection 

Practices Act (FDCPA) to clarify the interaction of the FDCPA and specified 

mortgage servicing rules in Regulations X and Z. This interpretive rule 

constitutes an advisory opinion for purposes of the FDCPA and provides safe 

harbors from liability for servicers acting in compliance with specified mortgage 

servicing rules in three situations. 19-Oct-16 CFPB 81 FR 71977-01

https://www.consumerfinance.gov/documents/811/

20160804_cfpb_Bureau_Interpretations_Safe_Harbo

rs_from_Liability_under_FDCPA.pdf 3170–AA49
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 15

Title Form Brief description Issue date Agency FR Cite URL RIN

Compliance Bulletin and Policy Guidance; 

2016-02, Service Providers Bulletin

The Bureau reissued its guidance on service providers, formerly titled CFPB 

Bulletin 2012-03, Service Providers to clarify that the depth and formality of the 

risk management program for service providers may vary depending upon the 

service being performedits size, scope, complexity, importance and potential for 

consumer harmand the performance of the service provider in carrying out its 

activities in compliance with Federal consumer financial laws and regulations. 26-Oct-16 CFPB 81 FR 74410-01

https://www.consumerfinance.gov/documents/1385

/102016_cfpb_OfficialGuidanceServiceProviderBullet

in.pdf N/A

Mortgage servicing small entity compliance 

guide 3.0 [and other docs]

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Nov-16 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/mortserv/ N/A

Uniform Interagency Consumer Compliance 

Rating System Guidance

The Federal Financial Institutions Examination Council (FFIEC), on behalf of its 

members, revised the Uniform Interagency Consumer Compliance Rating 

System, more commonly known as the CC Rating System. 14-Nov-16 FFIEC 81 FR 79473 https://www.ffiec.gov/press/pr110716.htm N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 18-Nov-16 CFPB 81 FR 81745-02

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 22-Nov-16 CFPB 81 FR 83811-01

http://files.consumerfinance.gov/f/documents/Supe

rvisory_Highlights_Issue_13__Final_10.31.16.pdf N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 23-Dec-16 CFPB 81 FR 94844

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Compliance Bulletin 2016-03: Detecting and 

Preventing Consumer Harm From 

Production Incentives Bulletin

This bulletin compiled guidance that has previously been given by the CFPB in 

other contexts and highlights examples from the CFPB's supervisory and 

enforcement experience in which incentive programs contributed to substantial 

consumer harm. It also describes compliance management steps supervised 

entities should take to mitigate risks. 18-Jan-17 CFPB 82 FR 5541-01

https://www.consumerfinance.gov/documents/1537

/201611_cfpb_Production_Incentives_Bulletin.pdf N/A

Remittance small entity compliance guide 

4.0 [and other docs]

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 31-Jan-17 CFPB N/A 

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/remittance-transfer-rule/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 6-Apr-17 CFPB 82 FR 16808-02

https://www.consumerfinance.gov/documents/2774

/201703_cfpb_Supervisory-Highlights-ConsumerReporting-Special-Edition.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 16

Title Form Brief description Issue date Agency FR Cite URL RIN

Policy on Ex Parte Presentations in 

Rulemaking Proceedings Policy

The Consumer Financial Protection Bureau (CFPB) adopted the following 

updated policy on ex parte presentations in rulemaking proceedings. The 

original policy was posted on the CFPB's Web site on August 16, 2011. 21-Apr-17 CFPB 82 FR 18687-01

https://www.consumerfinance.gov/documents/4162

/201704_cfpb_ex-parte_policy-guidance-andprocedural-rule.pdf N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 12-May-17 CFPB 82 FR 22119-01

https://www.consumerfinance.gov/dataresearch/research-reports/supervisory-highlightsspring-2017/ N/A

Fair Lending Report Report

The Bureau provides a comprehensive overview of our fair lending program and 

describes our work in this area, while also fulfilling congressional reporting 

requirements under § 1013(c)(2)(D) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act. 1-Jun-17 CFPB 82 FR 25250-01

https://www.consumerfinance.gov/documents/3654

/201704_cfpb_Fair_Lending_Report.pdf N/A

Education loan exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Jun-17 CFPB N/A

https://www.consumerfinance.gov/documents/4858

/201706_cfpb_Education-Loan-Servicing-ExamManual.pdf N/A

Prepaid small entity compliance guide [and 

other docs]

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Jun-17 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/prepaid-rule/ N/A

Policy Guidance on Supervisory and 

Enforcement Priorities Regarding Early 

Compliance With the 2016 Amendments to 

the 2013 Mortgage Rules Under the Real 

Estate Settlement Procedures Act 

(Regulation X) and the Truth in Lending Act 

(Regulation Z)

Policy 

guidance

The Consumer Financial Protection Bureau (Bureau) issued policy guidance on 

its supervisory and enforcement priorities regarding early compliance with the 

final rule it issued in August 2016 (2016 Mortgage Servicing Final Rule) 

amending certain of the Bureau's mortgage servicing rules. 30-Jun-17 CFPB 82 FR 29713-01

https://www.consumerfinance.gov/documents/4882

/201706_cfpb_guidance-on-early-compliance-with2016-amendments-to-reg-x-and-reg-z.pdf N/A

CMS exam procedures Exam manual

The Bureau's examination manual describes how we supervise and examine 

these companies and gives our examiners direction on how to assess 

compliance with federal consumer financial laws. 1-Aug-17 CFPB N/A

https://www.consumerfinance.gov/documents/5236

/201708_cfpb_compliance-managementreview_supervision-and-examination-manual.pdf N/A

Compliance Bulletin 2017-01: Phone Pay 

Fees Bulletin

The Consumer Financial Protection Bureau (CFPB or Bureau) issued this 

Compliance Bulletin to provide guidance to covered persons and service 

providers regarding fee assessments for pay-by-phone services (phone pay fees) 

and the potential for violations of sections 1031 and 1036 of the Dodd-Frank 

Wall Street Reform and Consumer Protection Act's (Dodd-Frank Act) prohibition 

on engaging in unfair, deceptive, or abusive acts or practices (collectively, 

UDAAPs) when assessing phone pay fees. 2-Aug-17 CFPB 82 FR 35936-01

https://www.consumerfinance.gov/documents/5090

/201707_cfpb_compliance-bulletin-phone-payfee.pdf N/A
Consumer Financial Protection Bureau

Produced to House Oversight & Government Reform Committee

Page 17

Title Form Brief description Issue date Agency FR Cite URL RIN

Memorandum on financial institution and 

law enforcement efforts to combat elder 

financial exploitation

Memorandu

m 

This memorandum addresses the role financial institutions can play, together 

with law enforcement, Adult Protective Services, and other federal, state, and 

local agencies or programs, to detect, respond to, and protect against elder 

financial exploitation. 8-Aug-17

CFPB, Treasury, 

FINCEN N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/memorandum-financial-institution-andlaw-enforcement-efforts-combat-elder-financialexploitation/ N/A

Unified Agenda Report Twice a year, the CFPB publishes an agenda of its planned rulemaking activities. 24-Aug-17 CFPB 82 FR 40386

https://www.consumerfinance.gov/policycompliance/rulemaking/regulatory-agenda/ N/A

Statement on supervisory practices 

regarding financial institutions and 

consumers affected by Hurricanes Harvey 

and Irma Statement

This statement encourages supervised entities to make use of existing 

regulatory flexibility where doing so would benefit consumers affected by a 

major disaster or emergency and provides related examples. It also advises on 

supervisory practices regarding supervised entities that may have experienced 

difficulties due to a major distaster or emergency. 8-Sep-17 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/statement-supervisory-practices-affectedhurricanes-harvey-and-irma/ N/A

Statement on supervisory practices 

regarding financial institutions and 

consumers affected by Hurricane Maria Statement

This statement encourages supervised entities to make use of existing 

regulatory flexibility where doing so would benefit consumers affected by a 

major disaster or emergency and provides related examples. It also advises on 

supervisory practices regarding supervised entities that may have experienced 

difficulties due to a major distaster or emergency. 22-Sep-17 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/statement-supervisory-practices-regardingfinancial-institutions-and-consumers-affectedhurricane-maria/ N/A

HMDA small entity compliance guide [and 

other docs]

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Oct-17 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementationguidance/hmda-implementation/ N/A

TILA-RESPA integrated disclosure small 

entity compliance guide 5.0 [and other docs]

Small entity 

compliance 

guide

We have resources to help entities understand rules and their implications as 

well as links to various other helpful resources, because timely and efficient 

regulatory implementation of new rules is an important factor in delivering 

consumer protections to the market. 1-Oct-17 CFPB N/A

https://www.consumerfinance.gov/policycompliance/guidance/implementation-guidance/tilarespa-disclosure-rule/ N/A

Supervisory Highlights Report

We periodically publish Supervisory Highlights to share key examination 

findings. These reports also communicate operational changes to our 

supervision program and provide a convenient and easily accessible resource for 

information on our recent guidance documents. 19-Oct-17 CFPB 82 FR 48703-01

https://www.consumerfinance.gov/documents/5386

/201709_cfpb_Supervisory-Highlights_Issue-16.pdf N/A

Fair Credit Reporting Act Disclosures Notice

The Bureau is required to increase the $8.00 amount referred to in Section 

612(f)(1)(A)(i) of the FCRA on January 1 of each year, based proportionally on 

changes in the Consumer Price Index (CPI), with fractional changes rounded to 

the nearest fifty cents. 16-Nov-17 CFPB 82 FR 53481-01

https://www.consumerfinance.gov/policycompliance/rulemaking/final-rules/fair-creditreporting-act-disclosures/ N/A
Appendix C

Commodity Futures Trading Commission


Division Title of Guidance

Form of Guidance 

(Guidance, 

Interpretation, 

etc.)

Brief Description of Subject 

of Guidance Date of Issuance

Was Guidance 

Submitted to 

Congress and GAO 

pursuant to the 

Congressional 

Review Act?

Has the CFTC's 

Regulatory Reform 

Task Force 

announced plans to 

review the 

Guidance?

Federal 

Register 

Citation for 

Guidance Hyperlink to Guidance 

Office of 

General 

Counsel

Interpretive Guidance 

and Policy Statement 

Regarding Compliance 

with Certain Swap 

Regulations

Interpretive Guidance 

and Policy Statement

Cross-border application of the 

swaps provisions of the 

Commodity Exchange Act added 

by Title VII of the Dodd-Frank Act

17-Jul-13 No No 78 FR 45291, 

July 26, 2013

http://www.cftc.gov/idc/groups

/public/@lrfederalregister/docu

ments/file/2013-17958a.pdf 

https://www.gpo.gov/fdsys/pkg

/FR-2013-07-26/pdf/2013-

17958.pdf

Office of 

General 

Counsel

Retail Commodity 

Transactions Under

Commodity Exchange 

Act

Interpretation The meaning of the term "actual 

delivery," as set forth in the 

Commodity Exchange Act

20-Aug-13 No No 78 FR 52426, 

Aug 23, 2013

http://www.cftc.gov/idc/groups

/public/@lrfederalregister/docu

ments/file/2013-20617a.pdf 

https://www.gpo.gov/fdsys/pkg

/FR-2013-08-23/pdf/2013-

20617.pdf

Office of 

General 

Counsel

Forward Contracts With 

Embedded Volumetric 

Optionality

Interpretation The CFTC and the Securities and 

Exchange Commission, after 

consultation with the Federal 

Reserve Board, jointly issued the 

CFTC’s clarification of its 

interpretation concerning 

forward contracts with 

embedded volumetric optionality.

12-May-15 No No 80 FR 28239, 

May 18, 2015

http://www.cftc.gov/idc/groups

/public/@lrfederalregister/docu

ments/file/2015-11946a.pdf 

https://www.gpo.gov/fdsys/pkg

/FR-2015-05-18/pdf/2015-

11946.pdf

Commission Approved Guidance Issued Since January 1, 2008
Office of 

General 

Counsel

Swap Data Repositiories: 

Interpretative Statement 

Regarding the 

Confidentiality and 

Indemnification 

Provisions of the 

Commodity Exchange 

Act (Note that portions 

of this Interpretative 

Statement have been 

superseded by 

amendments to the 

Commodity Exchange 

Act made by Section 

86001 of the FAST Act, 

Pub. L. 114-94)

Interpretive 

Statement

Provides guidance regarding the 

applicabllility of the 

confidentiality and 

indemnification provisions of 

section 21(d) of the Commodity 

Exchange Act. The Statement 

clarifies that the provisions of 

section 21(d) of the Commodity 

Exchange Act should not operate 

to inhibit or prevent foreign 

regulatory authorities from 

accessing data in which they have 

an independent and sufficient 

regulatory interest, even if the 

data has also been report 

pursuant to the Commodity 

Exchange Act and CFTC 

regulations.

25-Oct012 No No 77 FR 65177 

(October 25, 

2012

http://www.cftc.gov/idc/groups/p

ublic/@lrfederalregister/document

s/file/2012-26298a.pdf

Division of 

Swaps and 

Intermediary 

Oversight

Interpretative Statement 

Regarding Funds related to 

Cleared-Only Contracts 

Determined to Be Included 

in a Customer's Net Equity 

(Note that this 

Interpretative Statement 

has been superseded by 

Section 724 of the DoddAct and CFTC 

implementing regulations)

Interpretive Guidance 

and Policy Statement

Clarified the appropriate treatment

under the commodity broker 

provisions

of the Bankruptcy Code and Part 190 

of

the CFTC’s Regulations of claims 

arising from contracts (‘‘cleared-only

contracts’’) that, although not 

executed

or traded on a Designated Contract

Market or a Derivatives Transaction

Execution Facility, are subsequently

submitted for clearing through a 

Futures

Commission Merchant to a 

Derivatives Clearing Organization.

2-Oct-08 No No 73 FR 57235, 

Oct. 2, 2008

http://www.cftc.gov/idc/groups/p

ublic/@lrfederalregister/document

s/file/e8-23277a.pdf
Division of 

Swaps and 

Intermediary 

Oversight

1-FR FCM Instructions 

Manual

Interpretive A Commission approved instructions 

manual detailing guidance for filing 

monthly CFTC Form 1-FR for 

registered Futures Commission 

Merchants. 

1-Mar-10 No No 81 FR 89447 https://www.gpo.gov/fdsys/pkg/FR2016-12-12/pdf/2016-29613.pdf

N/A

http://www.cftc.gov/IndustryOvers

ight/Intermediaries/FCMs/1frfcminstructions
Appendix D

Consumer Product Safety Commission


Title Form of Guidance Description Website Link Issuance Date Significant 

Y/N

OIRA 

Y/N

Congress/G

AO

Issuing Agency, 

Component, Office or 

Program

1

Industry Letter to the Liquid 

Nicotine Packagers/Manufacturers Letter

This letter was sent out to industry to inform them of the Agency's authority for packaging of liquid nicotine product and 

requirements for special packaging of those products. Direct Link Jul-16 No No No Compliance

2

Drawstrings in Children's Upper 

Outerwear: Frequently Asked 

Questions FAQs

CPSC staff answered the most common questions about Drawstrings. Some answers were in regards to the 18 deaths and 38 

nonfatal incidents associated with neck/hood drawstrings on children's outerwear between January 1985 and September 2009, 

involving children 18 months to 10 years of age. Direct Link 2009 No No No Compliance

3

Sleepwear Policy and Loungewear 

Position Letter Letter This letter was sent out to industry to inform them of the Agency's sleepwear policy and position on children's loungewear. Direct Link Dec-11 No No No Compliance

4

CPSC Safety Alert on Halloween 

Safety Alert CPSC staff sent out a safety alert notifying consumers of flame resistant costumes for children. Direct Link Mar-12 No No No Compliance

5

Safety Alert on Children’s 

Sleepwear Safety Alert

CPSC staff sent out a safety alert so that industry and consumers understood the difference between “Flame-resistant” and “tightfitting” children’s sleepwear garments. Direct Link Apr-12 No No No Compliance

6 Drawstring Bulletin Bulletin

A one page bulletin was administered to industry to remind them of the 2012 Commission determination that drawstrings on 

children’s upper outerwear present a substantial product hazard. The Commission then issued a rule, 15 U.S.C. 2064(j), under 

Section 15(j) which states that drawstrings at the hood or neck and waist or bottom areas that do not meet certain requirements 

present a substantial product hazard, present an unreasonable risk of injury and are considered a defect subject to reporting 

requirements and corrective action, including recalls and penalties. Direct Link 2013 No No No Compliance

7

Children’s Apparel Products 

Trifold Pamphlet Pamphlet

A six paged pamphlet was created for CPSC employees to give out as a summarization of children’s general requirements and 

flammability requirements for apparel under the FFA and CPSA. CPSC employees distribute this pamphlet after lectures and 

seminars. The pamphlet contains helpful detailed information such as; testing, testing exceptions, certification documents, 

prohibited textile fabrics, lead limit requirements and direct website links. The pamphlet is available online and also in the 

Spanish language. Direct Link 2014 No No No Compliance

8

FFA Children's Sleepwear Recall 

Roundup Video

In this edition of Recall Roundup: Four companies recalled Children's Sleepwear and Loungewear garments nationwide. These 

garments were found to be in violation of the FFA. The video provided detailed information on the garments and how to return 

them to the recalling company. Direct Link Jun-15 No No No Compliance

9

Sleepwear Policy and Loungewear 

Position Letter Letter

The letter was reissued to restate the agency’s sleepwear policy and position on children’s loungewear and to notify the industry of 

the obligations under the Consumer Product Safety Improvement Act of 2008 (CPSIA). Direct Link Feb-15 No No No Compliance

10

Testing to the Children’s 

Sleepwear Standards, 16 C.F.R. 

Parts 1615 &1616 Laboratory 

Bulletin Bulletin

CPSC staff became aware of cases in which the fabric and seam and trim prototypes pass the flammability testing requirements, 

but the production garments fail the testing requirements. The bulletin had further discussion in the Supplemental Data Analysis 

section. Also, CPSC staff became aware of children’s pajamas being testing incorrectly to The Standard for the Flammability of 

Clothing Textiles, 16 C.F.R. Part 1610, instead of the children’s sleepwear Standards, more detailed information was provided in 

the bulletin in the scope of the Standards section. Direct Link Jan-16 No No No Compliance

11 Self-Balancing Scooters Letter

A request urging those who import, manufacture, distribute or sell in the US the self-balancing scooters, the requirement to 

comply with voluntary standards Direct Link Feb-16 No No No Compliance

12 Bath Seats Bulletin

On June 4, 2010, the Commission published a final rule establishing a Safety Standard for Infant Bath Seats (Standard) under 

section 104(b) of the Consumer Product Safety Improvement Act of 2008. The Standard, which became effective on December 6, 

2010, is published in the Code of Federal Regulations at 16 C.F.R. part 1215, and the Standard currently incorporates by reference 

ASTM F1967-11a, Standard Consumer Safety Specification for Infant Bath Seats. The Standard establishes performance 

requirements, test methods, and labeling requirements to promote the safe use of infant bath seats and reduce the risk of death and 

injury, particularly drownings and near-drownings, when a bath seat is occupied by an infant. Direct Link Jul-13 No No No Compliance

13 Certification FAQs Guidance on responsibility of issuing a certificate, etc. Direct Link No No No Compliance

14 Tracking Requirements FAQs Guidance on requirements for tracking information on a children's product Direct Link No No No Compliance
15 Regulated Product Handbook Manual Guidance for the regulated industry on the statutes and regulations Direct Link May-13 No No No Compliance

16

Certification and the Poison 

Prevention Packaging Act FAQs Guidance for the regulated industry on certification requirements for the PPPA Direct Link No No No Compliance

17 Magnet Sets Bulletin Guidance was provided in 2015 but then removed from the business link page due to the overturn of the magnet set rule Jun-15 No No No Compliance

18

Guidance Document on Hazardous 

Additive, Non-Polymeric 

Organohalogen Flame Retardants 

in Certain Consumer Products (82 

FR 45268 ) Guidance Document

The Commission announces that it has approved a statement that provides guidance for manufacturers, importers, distributors, 

retailers, and consumers of certain consumer products that may contain harmful organohalogen flame retardants in an additive 

form. Direct Link Sep-17 No No No CPSC

19

CPSC Litigation Guidance and 

Recommended Best Practices 

for Protective Orders and 

Settlement Agreements in 

Private Civil Litigation (81 FR 

87023) Guidance

The U.S. Consumer Product Safety Commission is publishing this Litigation Guidance to provide recommendations for best 

practices to all parties in relevant litigation related to providing an exemption in protective orders and settlement agreements for 

reporting information to the CPSC. Direct Link Dec-16 No No No CPSC

20

Statement of Policy on 

Enforcement Discretion 

Regarding General Conformity 

Certificates for Adult Wearing 

Apparel Exempt from Testing 

(81 FR 12587) Statement of Policy

The Consumer Product Safety Commission has approved a Statement of Policy regarding the CPSC’s enforcement of the 

requirement for a general conformity assessment certificate with respect to adult wearing apparel that is exempt from testing 

under the CPSC’s clothing flammability standard. Direct Link Mar-16 No No No CPSC

21

Strong Sensitizer Guidance (78 

FR 15710) Guidance

The U.S. Consumer Product Safety Commission is announcing the availability of a document prepared by CPSC staff titled, 

“Strong Sensitizer Start Printed Page 15711Guidance.” This guidance document is intended to clarify the “strong sensitizer” 

definition, assist manufacturers in understanding how CPSC staff would assess whether a substance and/or product containing 

that substance should be considered a “strong sensitizer,” and how the Commission would make such a determination. Direct Link Mar-13 No No No CPSC

22

Children's Toys and Child Care 

Articles Containing Phthalates; 

Final Guidance on Inaccessible 

Component Parts (78 FR 

10503) Final Guidance

On August 14, 2008, Congress enacted the Consumer Product Safety Improvement Act of 2008 (CPSIA), Public Law 110-314. 

Section 108 of the CPSIA, as amended by Public Law 112-28, provides that the prohibition on specified products containing 

phthalates does not apply to any component part of children's toys or child care articles that is not accessible to a child through 

normal and reasonably foreseeable use and abuse of such product. In this document, the Consumer Product Safety Commission 

(CPSC or Commission) issues guidance on inaccessible component parts in children's toys or child care articles subject to section 

108 of the CPSIA. Direct Link Feb-13 No No No CPSC

23

Codification of Animal Testing 

Policy (77 FR 73286) Statement of Policy

The Consumer Product Safety Commission (CPSC or Commission) codifies its statement of policy on animal testing that provides 

guidance for manufacturers of products subject to the Federal Hazardous Substances Act (FHSA) regarding replacement, 

reduction, and refinement of animal testing methods. Direct Link Dec-12 No No Yes - 2/26/13CPSC

24

Interpretation of Children’s 

Product (75 FR 63067) Final Rule

The Consumer Product Safety Commission (“CPSC,” “Commission,” or “we”) is issuing a final interpretative rule on the term 

“children's product” as used in the Consumer Product Safety Improvement Act of 2008 (“CPSIA”), Public Law 110-314. The final 

interpretative rule provides additional guidance on the factors that are considered when evaluating what is a children's product. Direct Link Oct-10 No No Yes - 1/13/11CPSC

25

Civil Penalty Factors (75 FR 

15993) Interpretive Rule

The Consumer Product Safety Improvement Act of 2008 (“CPSIA”) requires the Consumer Product Safety Commission 

(“Commission”) to issue a final rule providing its interpretation of the civil penalty factors found in the Consumer Product Safety 

Act (“CPSA”), the Federal Hazardous Substances Act (“FHSA”), and the Flammable Fabrics Act (“FFA”), as amended by section 

217 of the CPSIA. These statutory provisions require the Commission to consider certain factors in determining the amount of any 

civil penalty to seek. Direct Link Mar-10 No No Yes - 4/1/10 CPSC
26

Guidelines and Requirements for 

Mandatory Recall Notices (75 FR 

3355) Final Rule

The Consumer Product Safety Commission (“Commission,” “CPSC,” “we”) is issuing a final rule establishing guidelines and 

requirements for mandatory recall notices as required by section 214 of the Consumer Product Safety Improvement Act of 2008 

(“CPSIA”). The rule contains the Commission's interpretation of information which must appear on mandatory recall notices 

ordered by the Commission or a United States district court pursuant to certain sections of the Consumer Product Safety Act 

(“CPSA”). The rule also contains Commission guidelines for additional information that the Commission or a court may order to 

be included on a mandatory recall notice. Direct Link Jan-10 No No Yes - 1/29/10CPSC

27

Interim Enforcement Policy on 

Component Testing and 

Certification of Children’s 

Products and Other Consumer 

Products to the August 14, 2009 

Lead Limits (74 FR 68593) Statement of Policy

The Consumer Product Safety Commission (“CPSC,” “Commission,” or “we”) is announcing an interim enforcement policy 

regarding component testing and certification of children's products and other consumer products to the 90 parts per million (ppm) 

lead in paint limit and to the 300 ppm lead limit for children's products established in section 101 of the Consumer Product Safety 

Improvement Act of 2008 (“CPSIA”). Direct Link Dec-09 No No No CPSC

28

Notice of Availability of a 

Statement of Policy: Testing and 

Certification of Lead Content in 

Children’s Products (74 FR 

55820) Statement of Policy

The Consumer Product Safety Commission (Commission) is announcing the availability of a document titled, “Statement of 

Policy: Testing and Certification of Lead Content in Children's Products.” Direct Link Oct-09 No No No CPSC

29

Notice of Availability of a 

Statement of Policy: Interpretation 

and Enforcement of Section 103(a) 

of the Consumer Product Safety 

Improvement Act (74 FR 41868) Statement of Policy

The Consumer Product Safety Commission (“Commission”) is announcing the availability of a document titled, “Statement of 

Policy: Interpretation and Enforcement of Section 103(a) of the Consumer Product Safety Improvement Act” (“Statement of 

Policy”). Section 103(a) of the Consumer Product Safety Improvement Act (“CPSIA”) requires manufacturers of children's 

products to mark their products so that certain identifying information is ascertainable by the manufacturer and the consumer. Direct Link Aug-09 No No No CPSC

30

Notice of Availability of a 

Statement of Policy: Testing of 

Component Parts With Respect to 

Section 108 of the Consumer 

Product Safety Improvement Act 

(74 FR 41400) Statement of Policy

The Consumer Product Safety Commission (“Commission”) is announcing the availability of a document titled, “Statement of 

Policy: Testing of Component Parts With Respect to Section 108 of the Consumer Product Safety Improvement Act” (“Statement 

of Policy”). Section 108 of the Consumer Product Safety Improvement Act of 2008 (“CPSIA”) prohibits the sale of certain 

products containing specified phthalates. The Statement of Policy establishes the Commission's position with respect to testing 

products to determine whether they contain phthalates in excess of the statutory limits. Direct Link Aug-09 No No No CPSC

31

Children’s Products Containing 

Lead; Interpretative Rule on 

Inaccessible Component Parts (74 

FR 39535) Interpretive Rule

The Consumer Product Safety Commission (“Commission”) is issuing a final rule providing guidance as to what product 

components or classes of components will be considered to be “inaccessible.” Section 101(b)(2)(A) of the Consumer Product 

Safety Improvement Act (“CPSIA”) provides that the lead limits shall not apply to any component part of a children's product that 

is not accessible to a child through normal and reasonably foreseeable use and abuse. Section 101(b)(2)(B) of the CPSIA requires 

the Commission to issue, by August 14, 2009, a rule providing guidance with respect to what product components, or classes of 

components, will be considered to be inaccessible. This final rule satisfies the Commission's statutory obligation. Direct Link Aug-09 No No Yes - 8/10/09CPSC

32

Sling Carriers Business Guidance 

& Small Entity Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 82 FR 8671. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman
33

Frame Child Carriers Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 80 FR 11113. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

34

Soft Infant and Toddler Carriers 

Business Guidance and Small 

Entity Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 79 FR 17422. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

35

Carriages and Strollers Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 79 FR 13208. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

36

Bedside Sleepers Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 79 FR 2581. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

37

Bassinets and Cradles Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 78 FR 77574. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

38

Hand-Held Infant Carriers 

Business Guidance and Small 

Entity Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 78 FR 73415. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

39

Third-Party Testing Laboratory 

Accreditation and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

Requirements Pertaining to Third Party Conformity Assessment Bodies, 16 CFR parts 112 and 1118 Business Guidance and 

Small Entity Compliance Guide. In general, it is the practice of the Small Business Ombudsman—who is responsible for creating 

and publishing business education compliance guides on CPSC.gov in conjunction with the passage of Agency final rules—to 

publish such business guidance documents at a time that occurs between the publication of a final rule in the Federal Register and 

the date at which the final rule becomes effective. Direct Link No No No

Small Business 

Ombudsman

40

Periodic Testing and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

Compliance guide and FAQs to aid entities in complying with 76 FR 69482. In general, it is the practice of the Small Business 

Ombudsman—who is responsible for creating and publishing business education compliance guides on CPSC.gov in conjunction 

with the passage of Agency final rules—to publish such business guidance documents at a time that occurs between the 

publication of a final rule in the Federal Register and the date at which the final rule becomes effective. Direct Link No No No

Small Business 

Ombudsman

41

Infant Swings Business Guidance 

and Small Entity Compliance 

Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 77 FR 66703. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman
42

Play Yards Business Guidance and 

Small Entity Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 77 FR 52220. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

43

Portable Bed Rails Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 77 FR 12182. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

44

Component Part Testing and Small 

Entity Compliance Guide

Business Education Compliance 

Guides

Compliance guide to aid entities complying with 76 FR 69546. In general, it is the practice of the Small Business 

Ombudsman—who is responsible for creating and publishing business education compliance guides on CPSC.gov in conjunction 

with the passage of Agency final rules—to publish such business guidance documents at a time that occurs between the 

publication of a final rule in the Federal Register and the date at which the final rule becomes effective. Direct Link No No No

Small Business 

Ombudsman

45

Toddler Beds Business Guidance 

and Small Entity Compliance 

Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 76 FR 22019. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

46

Full-Size Baby Cribs Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 75 FR 81765. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

47

Non-Full-Size Baby Cribs 

Business Guidance and Small 

Entity Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 75 FR 81765. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

48

Infant Walkers Business Guidance 

and Small Entity Compliance 

Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 75 FR 35266. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

49

Infant Bath Seats Business 

Guidance and Small Entity 

Compliance Guide

Business Education Compliance 

Guides

A compliance guide created by the Small Business Ombudsman to aid entities complying with 75 FR 31691. In general, it is the 

practice of the Small Business Ombudsman—who is responsible for creating and publishing business education compliance 

guides on CPSC.gov in conjunction with the passage of Agency final rules—to publish such business guidance documents at a 

time that occurs between the publication of a final rule in the Federal Register and the date at which the final rule becomes 

effective. Direct Link No No No

Small Business 

Ombudsman

50 Regulatory Robot Tool Business Guidance

The Regulatory Robot Tool is a comprehensive program that asks users to answer a series of product safety questions and gives 

them a customized system generated report with specific business guidance applicable to their product. The Regulatory Robot is a 

unique tool among federal agencies in that it encompasses and provides guidance on all of the Agency’s mandatory regulations 

and requirements in one place. Direct Link Jan-16 No No No

Small Business 

Ombudsman
51 Art Materials Business Guidance Business Guidance

Art materials for consumers of all ages must comply with a number of requirements under federal law. Describes requirements for 

art materials, including those that are designed or intended primarily for children 12 years of age or younger. Direct Link Nov-12 No No No

Small Business 

Ombudsman

52 ATV Action Plans Business Guidance

Provides several examples of ATV action plans, which must be approved by the Commission in accordance with Section 42(e)(2) 

of the CPSA. Direct Link No No No

Small Business 

Ombudsman

53 Best Practices for Safety Business Guidance An outline of recommendations and resources for manufacturers and importers on best practices for design and manufacturing. Direct Link Jan-16 No No No

Small Business 

Ombudsman

54 Children's Products Overview Business Education/FAQs Overview and FAQs on children's products that are subject to a set of federal safety rules. Direct Link May-11 No No No

Small Business 

Ombudsman

55 Consumer Registration Card Business Education/FAQs Information related to the product registration card requirement for durable infant or toddler products. Direct Link Nov-11 No No No

Small Business 

Ombudsman

56 Desktop Reference Guide Guidance A quick reference guide for small businesses. Direct Link Jan-11 No No No

Small Business 

Ombudsman

57 Durable Infant or Toddler Products Business Education/FAQs

FAQs related to durable infant toddler products, including categories, safety rules, registration requirements and third-party 

testing. Direct Link Nov-11 No No No

Small Business 

Ombudsman

58 Fidget Spinner Business Guidance Business Guidance/FAQs An overview of requirements, certifications and obligations related to fidget spinners. Direct Link Aug-17 No No No

Small Business 

Ombudsman / Compliance

59

Apparel, Rugs, and Mattresses: 

What you need to know about the 

Flammable Fabrics Act Business Education Guidance on products covered by the Flammable Fabrics Act. Direct Link May-15 No No No

Small Business 

Ombudsman

60 Electrical Products (Household) Business Education Product safety information related to hair dryers, seasonal lighting and extension cords. Direct Link Jan-15 No No No

Small Business 

Ombudsman

61 Lead Paint Business Guidance Overview of the federal requirements limiting lead in paint and similar surface coatings in children's products. Direct Link Feb-12 No No No

Small Business 

Ombudsman

62 Phthalates Business Education

Provides information for businesses seeking guidance on how to comply with the federal consumer product safety rules on 

phthalates. Direct Link Aug-11 No No No

Small Business 

Ombudsman

63

Buying Promotional Products: A 

Guide to Federal Safety Laws Business Guidance Guide for suppliers or distributors of promotional products complying with federal consumer product safety laws. Direct Link Jan-13 No No No

Small Business 

Ombudsman

64

Resale and Thrift Stores 

Information Center Business Education A collection of resources to aid resellers in keeping unsafe products out of the hands of consumers. Direct Link Jan-13 No No No

Small Business 

Ombudsman

65

Retailers: Product Safety and Your 

Responsibility Business Education Overview for retailers on complying with federal consumer product safety laws. Direct Link Jan-11 No No No

Small Business 

Ombudsman

66

Duty to Report to CPSC: Rights 

and Responsibilities of Businesses Recall Guidance/FAQ Overview and FAQs on the legal obligation to immediately report information to the CPSC. Direct Link Jan-13 No No No

Small Business 

Ombudsman

67 Total Lead Content Business Education An overview on the federal requirements limiting lead in children's products. Direct Link Feb-12 No No No

Small Business 

Ombudsman

68 Toy Safety Business Education Provides information for businesses seeking guidance on how to comply with the federal toy safety standard, ASTM F963-16. Direct Link No No No

Small Business 

Ombudsman

69

Tracking Label Requirement for 

Children's Products Business Education/FAQ Overview of requirements and FAQ to help entities comply with tracking label requirements for children's products. Direct Link Dec-11 No No No

Small Business 

Ombudsman

70

An Update on Formaldehyde 

(Publication 725) Guidance Document

This booklet provides information about what formaldehyde is, what products it may be found in, where you may come in contact 

with it, how exposure to formaldehyde may affect your health, and how you might reduce your exposure to it. Direct Link Feb-16 No No No

Hazard Identification and 

Reduction
71

Remediation Guidance for Homes 

with Corrosion from Problem 

Drywall CPSC/HUD Remediation Guidance

Summarizes what the staffs of CPSC and HUD believe is an effective approach to addressing potential health and safety issues 

related to problem drywall. Direct Link Mar-13 No No No

Hazard Identification and 

Reduction

72

Identification Guidance for Homes 

with Corrosion from Problem 

Drywall CPSC/HUD Remediation Guidance Guidance on identifying problem drywall. Direct Link Mar-11 No No No

Hazard Identification and 

Reduction

73

Guidance for Outdoor Wooden 

Structures (Publication 270)

CPSC/EPA/USDA/US Forest 

Service Document Provides information on chromated copper arsenate (CCA) pressure treated wood. Direct Link Jun-11 No No No

Hazard Identification and 

Reduction

74

What You Should Know About 

Using Paint Strippers Guidance Document Health and safety recommendations on using paint strippers. Direct Link Jan-13 No No No

Hazard Identification and 

Reduction

75

Poison Prevention Packaging Act 

Business Guidance Business Guidance Overview and FAQs related to the Poison Prevention Packaging Act. Direct Link Jun-13 No No No

Hazard Identification and 

Reduction

76 Crumb Rubber Information Center Safety Education Status report on crumb rubber research and advice for communities concerned about playgrounds with recycled tire surfaces. Direct Link Feb-16 No No No

Hazard Identification and 

Reduction

77

Notice of Availability of Draft 

Guidance Regarding Which 

Children's Products Are Subject to 

the Requirements of CPSIA 

Section 108 Guidance Document Draft Guidance on Children's Products Covered by Section 108. Direct Link Feb-09 No No No

Hazard Identification and 

Reduction

78

Public Playground Safety 

Handbook Guidance Document Recommendations related to playground-related injuries and mechanical mechanisms of injury. Direct Link Dec-15 No No No

Hazard Identification and 

Reduction

79

CPSC’s Safety Barrier Guidelines 

for Residential Pools (Publication 

362) Guidance Document Safety barrier guidelines to prevent child drownings. Direct Link Aug-12 No No No

Hazard Identification and 

Reduction

80

Laboratory Test Manual for Toy 

Testing Guidance Document Test manual for testing toys and other articles intended for use by children 12 years and under. Direct Link Jun-10 No No No

Hazard Identification and 

Reduction

81 Hoverboard Safety Alert Safety Education Safety alert and recommendations concerning hoverboards. Direct Link Nov-17 No No No

Hazard Identification and 

Reduction

82 Fireworks (Publication 12) Guidance Document

Examples of deaths caused by fireworks, injury statistics, description of agency action related to the regulation of fireworks and 

information on state fireworks laws. Direct Link Jun-15 No No No

Hazard Identification and 

Reduction

83

Laboratory Test Manual for 16 

CFR part 1610 Manual

A reference guide designed to assist with the testing procedures specified in the Standard for the Flammability of Clothing 

Textiles codified at 16 CFR Part 1610. Direct Link Oct-08 No No No

Hazard Identification and 

Reduction

84

Laboratory Test Manual for 16 

CFR parts 1615 and 1616 Manual

A reference guide designed to assist with the testing procedures specified in the Standards for the Flammability of Children’s 

Sleepwear codified at 16 CFR Parts 1615 and 1616. Direct Link Jul-10 No No No

Hazard Identification and 

Reduction

85

Laboratory Test Manual for 16 

CFR part 1632 Manual

A reference guide designed to assist with the testing procedures specified in the Standards for the Flammability of Mattresses and 

Mattress Pads codified CFR part 1632. Direct Link Dec-14 No No No

Hazard Identification and 

Reduction

86

Laboratory Test Manual for 16 

CFR part 1633 Manual

A reference guide designed to assist with the testing procedures specified in the Standards for the Flammability (Open-Flame) of 

Mattress Sets codified at CFR part 1633. Direct Link Jan-11 No No No

Hazard Identification and 

Reduction
Appendix E

Chemical Safety and Hazard Investigation 

Board
U.S. Chemical Safety and

Hazard Investigation Board 

Honorable Vanessa Allen Sutherland

Chairperson and Member

Honorable Manny Ehrlich, Jr.

Board Member

Honorable Rick Engler

Board Member

Honorable Kristen M. Kulinowski

Board Member

1750 Pennsylvania Avenue NW, Suite 910 | Washington, DC 20006

Phone: (202) 261-7600 | Fax: (202) 261-7650

www.csb.gov

January 25, 2018 

The Honorable Trey Gowdy, Chairman 

The Honorable Mark Meadows, Chairman, Subcommittee on Government Operations 

The Honorable Jim Jordan, Chairman, Subcommittee on Healthcare, Benefits and Administrative Rules

The Honorable Gary Palmer, Chairman, Subcommittee on Intergovernmental Affairs 

The Honorable Blake Farenthold, Chairman, Subcommittee on the Interior, Energy and Environment 

Committee on Oversight and Government Reform

United States House of Representatives

2157 Rayburn House Office Building 

Washington, DC 20515 

Dear Chairman Gowdy, Chairman Meadows, Chairman Jordan, Chairman Palmer, and Chairman 

Farenthold: 

In response to your letter dated January 11, 2018, the U.S. Chemical Safety and Hazard Investigation 

Board (CSB) has thoroughly reviewed the Committee’s request. Enclosed are the CSB’s responses to 

the questions and the requested materials. 

We have made a good faith effort to be fully responsive to the Committee’s request. Our staff conferred 

with the members of your staff in response to the document request. At the suggestion of the Committee 

staff, the CSB staff reviewed the April 2015 GAO report entitled “Regulatory Guidance Processes: 

Selected Departments Could Strengthen Internal Control and Dissemination Practices.” After careful 

analysis, we do not believe that the CSB’s investigative reports would be considered “guidance” as

defined by GAO. 

The CSB is an independent, non-regulatory agency charged with investigating chemical disasters. 

Authorized by the Clean Air Act Amendments of 1990, the agency does not issue fines or citations 

related to regulations, but does make recommendations to plants, regulatory agencies such as the 

Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency 

(EPA), industry organizations, and labor groups. Congress designed the CSB to be non-regulatory and 

independent of other agencies so that its investigations might, where appropriate, review the 

effectiveness of regulations and regulatory enforcement. 

As part of its legislative mandate, the CSB issues recommendations to other Federal agencies to revise 

or expand existing regulations or issue additional guidance related to existing regulations. The CSB has 

included all investigative reports resulting in such recommendations in the attached submission. 
U.S. Chemical Safety and 

Hazard Investigation Board 

2 

Although the CSB does not make statements of general applicability and future effect to “set[ ] forth a 

policy or interpret[ ] a statutory or regulatory issue”1 as the Office of Management and Budget defines 

guidance documents, the CSB has made recommendations to other Federal agencies that relate to their

existing regulations, as Congress directed in the CSB’s authorizing legislation.2 As such, we are 

producing the information requested for those recommendations issued since January 1, 2008. 

Over the last ten years, the CSB has issued twelve investigation reports that include recommendations 

directed to Federal entities to revise, expand or issue guidance related to existing regulations. It is 

important to point out that a CSB recommendation is non-binding and does not preclude an agency from 

complying with all applicable statutes and rulemaking procedures. The CSB has included the relevant 

answers to questions 1-7 as outlined by the Committee and provided a hyperlink to the relevant 

investigative reports. 

If you need any additional information, please contact Communications Manager Hillary Cohen at 

. 

Sincerely,

Vanessa Allen Sutherland

Chairperson & CEO 

cc: The Honorable Elijah E. Cummings, Ranking Member 

Committee on Oversight and Government Reform 

The Honorable Gerald E. Connolly, Ranking Member 

Subcommittee on Government Operations 

The Honorable Raja Krishnamoorthi, Ranking Member 

Subcommittee on Healthcare, Benefits, and Administrative Rules 

The Honorable Val Butler Demings, Ranking Member 

Subcommittee on Intergovernmental Affairs

The Honorable Stacey E. Plaskett, Ranking Member

Subcommittee on the Interior, Energy, and Environment

1

 GOV’T ACCOUNTABILITY OFFICE, GAO-17-404T, REGULATORY GUIDANCE PROCESSES: SELECTED DEPARTMENTS COULD 

STRENGTHEN INTERNAL CONTROL AND DISSEMINATION PRACTICES 7 (April 2015), available at

http://www.gao.gove/assets/670/669688.pdf. 2 42 U.S.C. §7412(r)(6).

Report Title and

Relevant Recommendations Form of Guidance Brief Description Date of Issuance Issuing Agency Guidance Indicator Hyperlink

Barton Solvents Explosions and Fire

 2007-06-I-KS-R1 Final Investigative Report 

On July 17, 2007, explosions and fire erupted at the Barton Solvents facility 

in Valley Center, Kansas, north of Wichita. The incident led to the evacuation 

of thousands of residents and resulted in projectile damage offsite, as well as 

extensive damage to the facility.

June 26, 2008 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=367

Bayer CropScience Pesticide Waste 

Tank Explosion 

 2008-08-I-WV-R11

Final Investigative Report 

Two workers were fatally injured when a waste tank containing the pesticide 

methomyl violently exploded, damaging a process unit at the Bayer 

CropScience chemical plant in Institute, West Virginia.

January 20, 2011 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/assets/1/19/Bayer_Report_Final.pdf

Donaldson Enterprises, Inc. Fatal 

Fireworks Disassembly Explosion 

and Fire

 2011-06-I-HI-R1

 2011-06-I-HI-R2

 2011-06-I-HI-R3

 2011-06-I-HI-R9

 2011-06-I-HI-R10

Final Investigative Report 

On April 8, 2011, at approximately 8:50 am, an explosion and fire occurred at 

a magazine located at Waikele Self Storage in Waipahu, Hawaii, that was 

leased and used by Donaldson Enterprises, Inc. (DEI) for seized fireworks 

storage and disposal-related activities. Five DEI personnel in the magazine at 

the time of the incident were fatally injured.

January 17, 2013 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=409

Caribbean Petroleum Refining Tank 

Explosion and Fire 

 2010-02-I-PR-R1

 2010-02-I-PR-R3

 2010-02-I-PR-R4

Final Investigative Report 

A massive fire and explosion sent huge flames and smoke plumes into the air 

at the Caribbean Petroleum Corporation near San Juan, Puerto Rico. The 

resulting pressure wave damaged surrounding buildings and impacted moving 

vehicles.

October 21, 2015 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=714+

DuPont Corporation Toxic Chemical 

Release 

 2010-06-I-WV-R1

Final Investigative Report 

On January 23, 2010, there was a release of highly toxic phosgene, exposing 

an operator at the DuPont facility in Belle, West Virginia, and resulting in his 

death one day later. The phosgene release followed two other accidents at the 

same plant in the same week, including an ongoing release of chloromethane 

from the plant’s F3455 unit, which went undetected for several days, and a 

release from a spent sulfuric acid unit.

September 20, 2011 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/assets/1/19/CSB%20Final%20Report.pdf

Hoeganaes Corporation Fatal Flash 

Fires 

 2011-4-I-TN-R1

 2011-4-I-TN-R2

 2011-4-I-TN-R3

Final Investigative Report 

The CSB’s investigation report examines multiple iron dust flash fires and a 

hydrogen explosion at the Hoeganaes facility in Gallatin, Tennessee. The first 

iron dust flash fire incident killed two workers and the second injured an 

employee. The third incident, a hydrogen explosion and resulting iron dust 

flash fires, claimed three lives and injured two other workers.

January 5, 2012 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=418

Macondo Well Blowout and 

Explosion

 CSB2010-10-I-OS-R01

 CSB2010-10-I-OS-R06

 CSB2010-10-I-OS-R07

 CSB2010-10-I-OS-R08

 CSB2010-10-I-OS-R11

 CSB2010-10-I-OS-R14

 CSB2010-10-I-OS-R15

 CSB2010-10-I-OS-R16 

Final Investigative Report 

On April 20, 2010, a sudden explosion and fire occurred on the Deepwater 

Horizon oil rig. The accident resulted in the deaths of 11 workers and caused a 

massive, ongoing oil spill into the Gulf of Mexico. The rig was located 

approximately 50 miles southeast of Venice, Louisiana, and had a 126-

member crew onboard.

April 20, 2016 U.S. Chemical Safety Board Not Applicable 

http://www.csb.gov/assets/1/7/20140605_Macondo_Vol2_(0605v1).pdf 

http://www.csb.gov/assets/1/19/Macondo_Vol3_Final_20160527.pdf

http://www.csb.gov/assets/1/19/Macondo_Vol4_Final_20160527.pdf

Oil Site Safety Study 

 2011-1-H-R01 Final Investigative Report 

This investigation focuses on the deaths of two teenagers killed on October 

31, 2009, when an oil tank in Carnes, Mississippi, suddenly exploded. On 

April 14, 2010, a similar tank explosion took the life of a member of the 

public in Weleetka, Oklahoma, at an unattended oil and gas production site. 

October 27, 2011 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=419

Tesoro Refinery Fatal Explosion and 

Fire 

 2010-08-I-WA-R1

Final Investigative Report 

On April 2, 2008, an explosion and fire led to the fatal injury of seven 

employees when a nearly forty-year-old heat exchanger catastrophically failed 

during a maintenance operation to switch a process stream between two 

parallel banks of exchangers at the Tesoro refinery in Anacortes, Washington.

May 1, 2014 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=600

US Ink Fire

 2013-0-I-NJ-R2 Final Investigative Report 

This case study examines the explosion and flash fires that occurred at the US 

Ink manufacturing facility in East Rutherford, New Jersey, on October 9, 

2012. Seven workers suffered burn injuries when they congregated at the 

entrance to the ink mixing room after seeing signs of an initial flash fire from a 

bag dumping station. A second flash fire then occurred, injuring the 

employees.

January 15, 2015 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/assets/1/19/CSB_case_study.pdf 

West Fertilizer Explosion and Fire 

 2013-02-I-TX-R1

 2013-02-I-TX-R2

 2013-02-I-TX-R3

 2013-02-I-TX-R4

 2013-02-I-TX-R5

Final Investigative Report 

A massive explosion at a fertilizer storage and distribution facility fatally 

injured twelve volunteer firefighters, two members of the public and caused 

hundreds of injuries in West, Texas.

January 28, 2016 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=732

Xcel Energy Hydroelectric Plant 

Penstock Fire 

 2008-01-I-CO-R1

Final Investigative Report 

On October 2, 2007, a chemical fire inside a confined space at Xcel Energy‘s 

hydroelectric plant in a remote mountain location 45 miles west of Denver, 

Colorado, killed five and injured three workers. Flammable solvent being used 

to clean the epoxy application equipment in the open penstock atmosphere 

ignited, likely from a static spark. The initial fire quickly grew as it ignited 

additional buckets of solvent and substantial amounts of combustible epoxy 

material, trapping and preventing five of the 11 workers from exiting the 

single point of egress within the penstock. August 25, 2010

August 25, 2010 U.S. Chemical Safety Board Not Applicable http://www.csb.gov/file.aspx?DocumentId=452
U.S. Chemical Safety Board Response to

House Committee on Oversight and Government Reform Request

Guidance Documents from January 1, 2008 to Present

Table of Contents

Barton Solvents Explosions and Fire 000001

 2007-06-I-KS-R1 000003

Bayer CropScience Pesticide Waste Tank Explosion 000015

 2008-08-I-WV-R11 000141

Donaldson Enterprises Inc. Fatal Fireworks Disassembly Explosion and Fire 000184

2011-06-I-HI-R1

2011-06-I-HI-R2

2011-06-I-HI-R3

2011-06-I-HI-R9

2011-06-I-HI-R10

000256

000256

000267

000268

000268

Caribbean Petroleum Refining Tank Explosion and Fire 000275

 2010-02-I-PR-R1

2010-02-I-PR-R3

2010-02-I-PR-R4

000360

000361

000361

DuPont Corporation Toxic Chemical Release 000374

2010-06-I-WV-R1 000479

Hoeganaes Corporation Fatal Flash Fires 000547

2011-4-I-TN-R1

2011-4-I-TN-R2

2011-4-I-TN-R3

000571

000572

000572

Macondo Well Blowout and Explosion 000578

CSB2010-10-I-OS-R01

CSB2010-10-I-OS-R06

CSB2010-10-I-OS-R07

CSB2010-10-I-OS-R08

CSB2010-10-I-OS-R11

CSB2010-10-I-OS-R14

CSB2010-10-I-OS-R15

CSB2010-10-I-OS-R16

000672

000934

000934

000934

001054

001056

001056

001057

Oil Tank Safety Study 001070

2011-1-H-R01 001121
Tesoro Refinery Fatal Explosion and Fire 001131

2010-08-I-WA-R1 001256

US Ink Fire 001291

2013-0-I-NJ-R2 001328

West Fertilizer Explosion and Fire 001331

2013-02-I-TX-R1

2013-02-I-TX-R2

2013-02-I-TX-R3

2013-02-I-TX-R4

2013-02-I-TX-R5

001575

001575

001576

001576

001576

Xcel Energy Hydroelectric Plant Penstock Fire 001598

2008-01-I-CO-R1 001713
Barton Solvents 

Static Spark Ignites Explosion Inside Flammable 

Liquid Storage Tank 

000001
1 . INTRODUCTION 

On July 17, 2007, at about 9 a.m., an explosion and fire occurred at the Barton Solvents 

Wic.bita fac.ility in Valley Center, Kansas. Eleven residents and one firefighter received 

medic.al tr ca anent. The inc.ident triggered an cvac.uacion of Valley Center (approxima tcly 

6,000 residents); destroyed the tank farm; and significantly interrupted Barton's business. 

An investigation by the U.S. Chemical Safety and Hazard InvC'Stigarion Board (CSB) 

bas concluded that the initial explosion occurred inside a vertical above-ground storage 

tank that '\\'35 being filled with Varnish Makers' and Painters' (VM&;P) naphtha. VM8(:P 

naphtha is a National Fire Protection Asooc.iacion (NFPA) Oass JB flammable liquid' that 

can produce ignitable vapor-air mixtures inside tanks and, because of its low eloctricaJ 

conductivity, can accumulate dangerous levds of static electricity.' 

The CSB is publishing this Case Study to help companies understand the hazards 

associated with nacic-acc.umulacing flammable liquids that can form ignitable vapor~ 

mixtures inside storage tanks. In addition, the CSB wants to urge companies to take extrs 

precautions to prevent explosions and fires like the one at Barton. This Case Study also 

examines industry Material Safety Data Sheet (MSDS) hazard communication practices 

and makes recommendations to ensure that MSDSs identify these hazards and outline 

appropriate precautions. 

c ~IOS most llltetj to torm lgnlable vapor41r mbrtt.res dJrtlg tarj( nltlg st amDlent opef8ltlg tempetatures ate normal)' U'io&e deelgiateel as Class 

IB or ciass 1c 1n NFPA 30 (ftammao11ty naz:ara ratng ot "3' " lfFI'. 704). 1n uie Nner1cai Petroleum 1ns11tUte (APO Cl8$$rlcatlcn systan uiese 11qu1e1s 

usuaJ~ fal nto tne •1ntermec:Hite Veplr Presrure Proclocts" cetegof)'. A ootaD• e:icepUOn g motor gasc:ine. an NFPA aass IB 1q1AO 1Nt ts 08S01a1e<I 

asa 'Hlg"IYapot Prees\18 PfOOJct' "tre API system, 1mp~g U'iat (8)X)8pt a1 vwylOW q?e'8tng ~llree) uievapor~r mtictt.re tltme<I aUTlg tanl< 

l'll'l;I rap1a~ Deoomes too r1cn to De Olllatlle. (See N~ 30, secacn 4.3 ·ciassnca11oo or UCfJIOs" ana NFPA 704 creimr 8 tor a aetalea 019CUS$1cn 

or NFPAt>ctasSlncaUOn ena narrma1>11ty nazwo rattig systems. see API 2003 (2008 eamoo). Sectloi 3 "Defrll!IO'IS" fOran e:wpianatlOn or 'Hl!Jl," 

·intermediate.' ena "LCW' vapor preeaJre proaoct c:iassies. 

1 an Octooer 29. 2001. ftf8 oestro)oea a targe pO'Uorl ora Barton raany " Dea Matise. IOM. Aal11Tlll:lle ICfJIOS eno staae eiectrlc:tt,' wn eJso hVCIWICJ " tnat 

ric:ian. BecaJse otuie 1rc:10Ent ~nc tr1arigs asooclllte<l •flroftl tie WICtfta 1rc:1oert rwes1Qabcn. uits case Stuc7jfOCUS'6S ~ 01 uie Wlenl!a 1rc:10Ent. 

000002
F1GORE 1 

2. INCIDENT DESCRIPTION 

The initial explosion occurred soon after the tank. farm supervisor srartcd the transfer of 

the final compartment of a ranke r·trailer containing VM&P naphtha into a 15,000 gallon 

above-ground storage tan k (Figure 1 ). 

~ _j\ ____ ~t\_ --

000003
-ntnk top prqectfle struCI( 

a moble r.orne 

FIGURE 3 

~vac m varve 

projectle structc 

ne"'11XXrl9 tiusriess 

The explosion sent the VM&P tank roc.k.C"Cing into the ~ trailing 3 doud of smoke and 

fire from the burning liquid; it !:anded approxim:atdy 130 feet away. Witnesses heard the 

explosion an d saw the fireball from se\•eral miles away. Withi.n moments, two more tanks 

ruptured and relC"ased their contents into the rapidly C"SCalati.ng fire that was concentrated 

inside the C'3rthen spi.U cont:ii.nmcnt area surrounding the tank fa rm! As the fire burned, 

the contents of other t:inks over-pressurized or ignited, launching steel tank tops (10-12 feet 

in diameter); vent \•aJves; pipes; and steel pans off.site and into the adjoining community. 

A tank top struck a mobile home in the community (approximately 300 feet av.·ay) and a 

pressure/\•acuum valve hit a neighboring business nearly 400 feet away (Figures 2 and 3). 

000004
3. FLAMMABLE LIQUIDS AND STATIC ELECTRICITY 

Fire occurs \l•hen there is an ignitable vapor-air mixture and a source of ignition, suc.b as a 

static docttic spark. At normal handling temperatures, flammable storage tanks, like those 

containing gasoline, may contain vapor~ mixrurcs that typically cannot be ignited by a 

static electric spark because the vapor-air mixture is too rich (i.e., contains too much fuel 

and not enough oxygen) to bum. VM&cP naphthas, however; and other flammable liquids 

(e.g., many NFPA Oass IB Flammables), may form ignitable vapor4i.r mixnucs inside tanks 

at normal handling temperatures. 

Sta tic doctricicy is generated as liquid flows 

through pipes, valves, and filters \l'hilc being 

transferred• It can also be produced by entrained water or air, splashing or agitation, 

and '\\•hen sediment in the bottom of the 

tank becomes suspended (Brinon, 1999). 

Because nonconductive liquids, such as 

VM&P naphtha and other flammable 

liquids, dissipate (or •rctax•) static doctriciry 

slowly, they pose a risk of dangerous static 

doc.tric accumulation that can produce sparks 

inside tanks! 

4. KEY FINDINGS 

Con1mon Static-Ac~11nulating 

Flan1n1.ab!e Liquid8 Thdt f,1ay 

Fom1 Ignitable Vapor-Air f.1ixtures 

• \IM&P nap htha 

• Cycld~xan0 

• n-H;;ptan$ 

• 8$1u.0n0 

• Tdu.:n0 

• n-H .;. 

• Xylen;>. 

• Ethyl l:'*'lzenl) 

• Styr.:n.;. 

The CSB detennino.:l that several fac.tors likely combined to produce the initial explosion: 

• The tank contained an ignitable vapor~ mixture in its bead space. 

•Stop-start filling, air in the transfer piping, and sediment and water (likely present in the 

tank) caused a rapid static c.barge accumulation inside the VM&cP naphtha tank. 

• The tank bad a liquid level gauging system float 'O\tith a loose linkage that likely separated 

and crea tcd a spark during 6.lli.ng. 

•The MSDS for the VM&P naphtha involved in this incident did not adequately 

communicate the explosive hazard 

Nornldl Bonding .and Grounding M.ay Not Be Enough! 

Ccinp ni ~ tha t hand!;:., transf.:r, and .storl) flammab l$ liquid~ ehculd <:ontaet manufacturl)rs 

to d etennin$ if th""3;;. liquid e c an accu1nulate dar191ilroue k-v,..1$ o f liltatic oiJl.,,.: tricity, ar'ld if th;;.y 

can fcrm .;.xplooiv.e< vai:-or~ irmixtur!le ineid« etcrag.., tanke. If e o. !l~ra. pr!l uti n~beyond 

normal bonding and g-oun<lintrmay b e rulcee.oo.1y. 

' The rats ot statle c:narge gennuoo o.inng ION lrlrough p"e lncrea&ee ro.ilJ'I~ wltl the &Cf.Jere ot the nON Yelodly. A ~ti ¥otiose ooncid>;ft/ IS less 

!nan 100 plCO sbTIEl'ls pa" rooter {p&m'l) IS gereral~ CO'l&IOerea nmc:oMUC'IW l,'Brtttln. 1999). The VM&P nepl'lttla ~ " tre Barton ric:iosnt haO a 

oonat.lcit\'ty or 3 p&'m. some oommm nmcor.:1t.ICl1"e 1q1Jas are 11Stec1 " NFPA 77 ~nae e - 1\IClle B.2J. eee the ResouroeG secum at tre ena ot tnb 

case stuoy fer weo access 1nstructtns. 

• The b'lgttl ot the tren81'8' p1p1ng nm tne Pll'll> to tne storage tank'MSS approxtnatety 215 met (Ei8 meters): lrle p1prig was 2.5 ticn NPS ScnedJle 40, 

l,'8.3 an 1ns1oe atametel): ano tne Pll'll> ION WloctyMS 4.&meters per seoona (15 •et per seocna~ A425mlaon 1,0.011 ricn) meen sin.Iner was 

IOCa'teCI at the PU"lll outlet. 

000005
=& • -

FIOS't ltlkage al'l:l 

areav.tiere tne spa11< 

llke>j OOCU'red 

4.1. FLAMMABILITY OF \l'M&P NAPHTHA 

The CSB t<'Sled the VM&-P naphtha involved in rhe Sanon explosion to determine if an 

ignitable vapor-air mixture could have been present inside the tank a.t the time of the 

explosion.• The rC'SUlts rC\•eakd that, at approximatdy 77"F (25.C) (the handling temperature 

of the VM&:P naphtha a t the time o f the i.ncidenr), the t3nk head space likely contained a 

readily ignitable vapor4 3ir mixture. The energy from a st3tic spark \\1ould have been adeqtt:lte 

to ignite this V:tpor-3i.r mixture.' 

4.2. TANK LEVEL FLOAT DESIGN 

The design o f the tank liquid levd gauging system Root used by Barton incorporates a loose 

linkage at the float/tape junctlon that a n SC'parate slightly, interrupting grounding (see Section 

4..3) and creating the potential for a spark. (Figure 4}.• The CSB concluded that turbulence and 

bubbling d uring the storrst:irt transfer pumping, in addition to creating r-apjd sra.tic charge 

accumulation, also likely created slack in the gauge tape connected to the float, a using the 

linkage: to separate and spark.• 

-

-

•Its ~was S8'F (t4 "C): lls ~ pnmuewasap!J'O)IJmatltf 0.7 !IPa (5 mm~ at 68'F [20'C) USl"lQ an tsob:rl~ In! Its nammaDle ~ 

'4.'8S~a1ely0 s.6..7%10alt rte RdCI VPdtne \IM&Pnaptlllla'4.'8S3.1 pslaC2'1A kPa)al t001' (38'q. 1 The CSB eGttma1es 1te1 h mrimlln Qrtttri oo«gy req,JreCI tor a spar1C. to Qrtte trie Barton VMW ~ was 0.22 mJ ¢11JS/l11rus a.02 m.J). 

• Beclrcal: eGIJ~ or an exemp;r 11¥'1k 1e11e1 llOal mlCated Iha! a 1oa;e rk.age oaJd prcdJce a spw1< wtn sumciart rsr«gf to 1g1te a ~ vapor-air 

rrtx!ule hstle a tat1<. 

$\~le 1t1e csa has ocnctJCleCI aw Irle 1oooe "3ge k'l\'el fl08I was 1t1e roost lkefy span< k>Ca!lon. a span< ll'Om a "tJl'UStl ~ .. carrot De rulEICI wt. Brusn<IScMWS eroo:rpma varlalyot "nal-spark" sta!lc~ 1tlat oocu ~a~ ~ti surraceano a groin:JeCI CO'lOLCI~ cqeci. su:n as a ap ~ a olJw metal componenl acll~ as an eieoroae. or e>Jef'l lhe tank wall llsetr. arusn dscnargas can occu &Jen 'M'IE!n al eq~oot IS 

propertf con:leo an:i grot.nlEICI [Brttton, 1999). see tne Rasol..roessectlcrl a11tte Enl or lr1S case Sillery tor more ll10n'f'la!lcf1 ont:ru>h<1tschage. 

000006
FIGURES 

Bondl1'9 ano grot.ndl"9 

4.3. BONDING ANO GROUNDING 

Bonding is the process of dectrically connecting conductive objects, like tanker-trailers, to 

U'3nsfer pumps to equalize their individual ekctrKal potenti:als and prC'Vent sparking {F'tgttre 5). 

'''"•' - ........ ...--~,·~~----

1.__""' 

Grounding (earthing} means connecting a cooducri,·e objea to the earth to dissipatedcctticity, 

like accumuJated static, lightning strikes, and equipme,nt faults, into the ground, av.·ay from 

emp1oy«'Slequipmcnt and igni.tabk mixtures. 

According to witnesses at Ba.non, the t:lnktt-tnlikt-, pump, piping, a nd storage- t:tnl:: V.'Ct'C' 

bonded and wounded at the rime of the incidcnt. •t Ho"'t'Vct, published S3fety guidance lndicatcsthat bonding and grounding measures appLied to typical transfer and stot'3ge operations tt13Y 

not be enough if nonconduc:tive flamm:ible liquids are involved. Nonconduc:tive liquids 

accumulate static electricity and dissipate (relax) it more slowly than conductive liquids, 

and therefore require a dditional precautions {SC'C' Section 5}. 

4..4. STATIC ACCUMULATION IN THE PUMPED LIQUID 

&non pumped the VM&:P naphtha from three separate compartments in the tanker-traik,r 

to the VM&:P tank. Air pockets "'t:re i.ntroduccd into the 611 piping, and then transferred into 

the tank w hen the transfer hose y,.·as rcconnetted to the t:tnker-tnliJer ahcr companmmts 

were changed. Stuclics have found that static dectricity accumulate> 13picfly during pump 

startup when nonconductive liquids are transfer-red to stot3ge tanks {Watmsley. 1996). Jn 

this asc, the static dectricity accumulation v.·as likely e.nc.crbated by che air pockets (bubbling) and the likdy presence of suspended sediment and Y.':lttt in the tank.11 In a ddition, 

the VM&P tank was a pproximately 30 percent 6Jled at the time o f the explosion, w hich 

would have produced a liquid surface potential (\·oltage) dose to the maximum expected 

during filling. 

111Thetransb' rose was sewrert ctarrageOOtttlg1he rue . 'Midi pmvenlea ~cr:s l'A:ITlcre1B11• • g lfDOne!t'q'gotnll'lgwssetrectMI. 

'' Barton 

~ 

mrcaleCl that It reo no recon:1s or tre VMtJ? tar1< &.Er belrg aeanea. aN:I tre bwlk naa no marway cs access openrg to tacll!ite Cllal1rg. stataa that they scoopea sedmoot nm the bottans or Slrriar un:s to p-epare 1hem ta nsped:M 

000007
tt29 CFR. 1910. 1200. 

0 29 CFR. 1910. 1200(:aX1)ana (2). 

4.5. MATERIAL SAFETY DATA SHEETS 

Acc.ording to the Occupational Safety and Health Administration (OSHA) Hazard 

Communication Standard (HCS)," employees both need and have the right to know the 

identities and hazards of the chemicals they arc exposed to when '\\"Or king. The purpoElC of 

the HCS is to ensure that c.hemical manufacturers and importers evaluate the hazards 

and communicate them, along y;·ith appropriate precautionary measures, to employers 

and employees through a hazard c.ommunication program.• The primary method of 

communicating this information is via detailed rcc.hnical bulletins called Material Safety 

Data Sheets (MSDSs). 

The MSDSs supplied by the manufacturer of the Barton VMBc.P naphtha indicated that 

the material may accumulate a static dectrical charge that could discharge and ignite 

accumulated vapors. It did not, however, provide c.ritical physical and c.hemical property 

data and ~wnings that the material may fo-rm an ignitable vapor-air mixru.re inside stora&e 

tanks. Nor did it list any precautionary measures, bey·ond normal bonding and grounding 

practices, or reference rdevant consensus guidance that Barton could have used to help 

prevent this explosion. 

To prevent explosions with flammable liquids like VMBc.P naphtha, MSDSs 

should communicate 

•warnings that the material is a static acc.umulator and can form an ignitable vapor-air 

mixture inside storage tank~ 

• that bonding and grounding may not be enough; 

• speci1ic examples of additional precautions (sec Soc.ti.on 5) and references to the published 

guidance targcttd at preventing static doc.tr.ic disc.barge; and 

• conductivity testing data, .. so that companies know the degree to y;·hicb the material ,.tjll 

accumulate static and can compare it to the published guidance. In.formation abour the published guidance is included in the En.formation Resources section at the end of this report. 

Materiel Safety Data Sheets (MSDS'-') 

MS0$$ do not typically <:anmu1icate <:ritical phyei<:al and <:h.:1nical prop.orti,;.s, ai1d epecific 

pr~Lrtions or r.;.f;:r.;o¢;;. guklan'* for flammable liqu•js that may poee a eta tic ignition hazard. 

Companies shculd contact lhe manufa.<:b.r;';f (or an .;."1'01t fumiliar ·,\·ilh the r.:.k vsnt ccns.;;nsus 

guidan<>=o) f.:< this informa.ticn. Manufactur0rs sh.:uld in tu1n updat.., their t.! $~ to provi6'- !his 

criti<:al eaf,..ty iiformaticn. 

" The 1.1111S roJllne~ uaecl to report conclUCOVty are pleo Siemens per met8' ¢'SJITJ~ 

000008
4.li.1. INDUSTRY MSOSs REVIEW 

The CSB rcvie"•ed 62 ~tSOSs of some of the most wideJy ltScd nonconductive flammable 

liquids to determine if they provided the wsrnings, pr«3utionary messures and references, 

and conductivity testing data discussed above. 

•Static Accumula tor and Storage-Tank Ignitable Vapor-Air Mixture-Potential: Of the 

MSDSs tc\•iev•cd, 39 {67 perant) contained a warning about the potential for the material 

to accumulate static elettricicy. Nearly a ll {97 percent) incJudC'd a W3rning about ignitable 

flamrmble vapors. HowC\•er, o nly one specific3Uy ""3rned of the potential for the material to 

form a n ignitable vapor~ir mixture inside a storage tsnk.. 

•Specific Precautions and References to PrC'\·cnt Explosions: Of the MSOSs reviev.rcd, 52 

{84 percent) advised companies to properly bond and ground equipment, bur only scvm 

{all prepared by the same monufacturer) indicated that bonding and grounding alone 

may not be enough to prevent a static di.scha rge. Eac.h of the seven a lso referenced NFPA 

77 s nd API 2003,

11 and 11 others referenced NFPA 77 and/or API 2003, but did not 

specifically "'3m that bonding and grounding may not be enough. Only eight of the 62 

provided one or more specific precautionary measures such as adding nonflammable 

{inert) gaS-CS to tank. head spaces, sdding an anti-ststic sgent, or reducing the pump f1o"' 

velocity d uri.ng transfer. 

• Conductiviry Testing Data: Only three MSDSs (all prepared by the same manufacturer) 

included conductivity testing data. 

4.5.2. REGULATORY AND CONSENSUS GUIDANCE FOR PREPARING MSOSs 

The three chemical hazard classi.6C3tion systems discussed in this section cont-sin guidanO!' 

to assist manufacturen who pcepare MSOSs. OSHA estsblishes the reguhttory requirements 

go\•eming the content of sn MSDS. 

•Occupational Safety and Health Administration: OSHA describes the HCS as brgdy a 

pcrfortll:3nce-oriented stanc:brd that gi\'CS employers the flexibility to ad::ipt the rule to the 

needs of the workplace, instead of having to follow specific, rigid requirements. Conscquendy, 

the HCS gmerslly identifies categories of information ro be included in the MSDS, including 

physical and chemiciil characteristics, physical hamrds, and applie:tble prCCJ.utions and/ 

or control measures for handling matc:rials safely. Ho"'e\·er, neither the standard nor its 

compliance directive,. identifies the specific phys.teal and chanicsl data, hazard wamiOJPi or 

ptce3utions necessary to address some chemical hszards. The HCS plao:s the responsibility 

on the preparer to identify the specific. hazards within these broad categories .. 

The OSHA advisory document, •Guidsncc for Hazard Determination For Compltance with 

the OSHA Haz.ard Communiation Standard (29 CFR 1910.1200)," is i.ntended to help 

MSDS preparetS identify and communicate chemical hazards .. While the document lists cer· 

tai.n data and physical h:323rds rccommcnded for indusion in b.bds and MSDSs, it does not 

address relevant data and hszards associstcd with staric·accumubting 8amm:able liquids. 

<$ NFPA 77 ano N'l 2003 am oc:nserc;us ~ 1hat pCMOe static erictnc sa1Elty · 

lllG'I. 0'2-02·038 - CPL 2·2.360. ~onPtoeec1tes tor tte HaUUO comm111i::at!M S1ancfai:i.-

000009
•Globally Harmonized System of Classification and labding of Chemicals (CHS): The GHS, 

first adopted by the Sub-Committee on the Globally Harmonized System of Oassification 

and Labeling of Chemictls (SCEGHS> in Dcccmber 2002, ts an initiati~-e to est3blish international consensus on criteria for cb.sslfying chcmiaJ hazards for i.nternational disttibutio~ 

and to crcate consistent requirctnC'nts for MSDSs. The GHS has been tt'Vised rv.·ice: once in 

2005, and :tg:.lin in 2007. According to the GHS Sub-Committee of Ex.pens, the GHS is 

now ready for "'uld"'•ide i.mplemcntation. 

The GHS provides specific criteria for identifying and classifying flammable liquids, but it 

docs not provide identification criteria or warning guic.hnce for liquids that, in addition to 

being ignitable inside tanks at ambient temper3tures, also accumulate static eloctriciry th3t 

can ignite them. In addition, the GHS docs not require a ptC'l'J<i.tC'f to include conductivity 

testing data i.n an MSDS, data tfutt are essential to identify a material as nonconducti.ve. 

OSHA panicipates in the GHS criteria de\•clopment process, and o n September U, 2006, 

published an Advance Notice of Proposed. Rulemaking (71 FR 53617), indicating i.ts intenr 

to adopt thC' GHS guidana into the requirements of the HCS. 

•American National Standards Institute (ANSI) Z400. 1-2004 .. American National 

Standard for Hazardous Industrial Chemicals - Material Safety Data Sheets - Preparation"': 

ANSI Z400.1-2G04 is a voluntary consensus standard, and is recognized by OSHA's 

HCS complianc.e directive as a consensus standard that provides valuable guidance to 

MSOS prepar e.rs. 

&c:!use the OSHA HCS is performance-based, it provides minilll:ll substanrive guidance 

for MSDS preparers. ANSI Z400.1 v.·as de,·elopcd to provide such guidance; it identi.fies 

information that must be included in an MSDS to comply with OSHA's HCS, and includes 

3dditional guidance to heJp MSDS prepare.rs c.omply with state and federal en\•ironmental 

and s:afety rules. 

ANSI ZA-00.1 giYes the foUov.·ing enmple of a general warning about what Pf3Cl:iccs to avoid 

or restrict: · ·ro reduce the potential for static discharge, bond and ground containecs when 

transferring material"' Ho.,.,"CVe:r, the example docs not: w3m that bonding and grounding msy 

be insufficient to eliminate the potential for static discharge, panicul:arly if the material is a 

nonconductive Cbmmable liquid. The standard includes no additional pttelUtions or relevant 

consensus guidance references, a nd no requirements for a preparer to include conductivity 

testing d3ta in an MSDS. 

000010
5. ADDITIONAL PRECAUTIONS 

Companies that banclle, transfer, and store nonconductivc flammable liquids, such as 

naphthas, toluene, benz.cnc, and heptane, should take additional precautions to avoid an 

incident like the one at Barton. 

5.1. REQUEST ADotTIONAl MANUFAcnJRER GUIDANCE 

As discussed, MSDSs do not typically pro~de conductivity testing data or specific examples 

of additional precautions that should be observed, and do not typically reference the rdevant 

consensus guidance pertaining to static electricity and storage tank vapor-air mixture hazards. 

Therefore, to determine if additional precautions to eliminate the potential for an c:xplosion 

are necessary, companies that transfer flammable liquids should contact the manufacturers, 

or a qualified expert, to determine if the flammable liquid is 

• nonconducrivc (a static accumulator); and 

• capable of producing an ignitable vapor-air mixture inside a storage tank. 

5.2. ADO A NONFLAMMABLE. NONREACTIVE ~NERT) GAS TO TANK HEADSPACES11 

Using an inert gas such as nitrogen, if done corroc.dy, is cffoc:rivc in reducing the potential 

for an ignitable inc.idcnt (explosion) as it renders tank bead spaces incapable of supporting 

ignition from a static spark." However, because this practice can produce oxygcn<leficient 

environments inside tanks, extreme caution should be exercised when opening tanks for 

routine inspections and maintenance.• 

• 8ee NFPA 89 ''8!8ncl!rd on etpioom Pf6IMl!lon systems• l,200BJ n:ir g!Jda'lce pertaNrg to proper lruta'lg p-actbes. 

• aecore usrig 1ret gases 1n tancs. corrpnres #Wl:I o:ntact tre llQIJO marutactuf8' to oeterrnrie 1r111e proposec1 gas ts appropoote b' 1ne partlo.Jtar •l:llJd. 

s Enl>b)<ers v.no reqlJre e~ t> tnter cootneo EJl9C: a partb.Jli:WPJ f\ose '..ntl ~ent rs otner nazan1C1Js etmoepiete9--R'IJ!lt oomp~'Mltl 

tre reqtJf8TU'llsOl1ne OSHA 'Pem11 ReqJreo comneospace Progrern" (29CFR 1&10.14f0. 

cee. 8lltOn Q:lllG'U er... etu::1y 11 

000011
Tank level tlOat 

Derlalng Wire 

5.3. MOotFY OR REPLACE LOOSE LINKAGE TANK LEVEL FLOATS 

Companies with tanks tha.t may contain ignit:tble ' 'apor-air mixtures a nd that are equipped 

with co nducti,·e loosc li ks~ Je,·d floats should take one or mo re of the follO\\ring mea ur~ 

• Use an appropriate gas to inert tan.k head spaces. 

• Inspect and repla ce , as appro priate, Roats with level meisuring devices tha t will not 

promote spar ks inside the t:tnk . 

• Modify floots so tha t they are properly bonded and grounded (sec: Figure 6)."' 

•Reduce the liquid flow (pumping) vdocity." 

• Remove an y slack in the ta pe connected to the float mcdlanism that could allow a spark 

gap to form. 

5A. ANTI-STATIC ADDITIVES 

Anti-static (conductivicy-rohancing} add.iti\•es increase the conductivity o f liquids, beJping 

miuce static accumulation. Before reJying solely on these add.itn·cs.. howc,·er, companies should 

con.tact the flammable liquid manufscturer to determine if such an 3dditive is appropriate 

and effecti,•e for the particular liquid. 

5.5. REDUCED FLOW {PUMPING) VELOCITY 

Various guidance suggests that nonconducti,·e fbmmabLe liquids capabJe of forming ignitable 

V3por4 air mixtures inside tanks should be tr3nsfarcd a t reduced flow (pumping} velocities to 

minimize the potential for a static ignitton ... 

:iolh

wrtn 

t> 

1

lglle 

oa;e 1r1<ages 

asstrates 

snou

tt>e modncatkrl 

a oonlllcl tre 

motmT1El10ea 

m<nJf8Cli.rer !Or 

tr,' the 

mooitcatm 

rmnunctlter 

recommenaa'llons

ot lhe roats u;00 

. at earton-<s Wttlla tadlfy. CCll'f8'lle3 ·Mth nce1s ~ 

71 NFPA 77 (2007Jt API 20CX3 (2008.l: ana Brll1M (1999) recommena a fbrl (PLITlptlg) VtZIOclly Of 1 mel« per second Y>flf!n Irle tt Of statlC lg:'llllal Is 

11gl\ urtl tne spa'!( polenbal nsrae tr>e lll'lk IS eil11nataa. oxrp¥11es sl'l:ltAa use a p.1mp now veioclty at {Of Mar) 1 me!« per secooa to lranSKt 

nonoonaucUve 11amrnati1e 11q.11ds. 

lnTne gumnoe perla rj~ to raaucee1 b.' ~m rig) ve1oc111es ricllae /IPf 2003 l2008J. seciloos4.2.5.6ana .t.5.1: NFPA 77 (2007). TaDle B.B 

{l'OO!note fJ: and Laurence Britton. • A'i'Ok:lrig Slsl!c lgrttlOO Haz.aras in criern1ca1 Operabons·. cnapters 24 1.B !l'la 5-4. WtCle tOluene ano neptare 

are spec111ca1ty lelenl1teo In NFPA 77. 'RltllEI as {TOOlnota fJ, fyplcal \IM&P napnaias emblt slmlar crwacterlsllcs ana snou1t1 eiso be transrerrea 

al recll.Joea 10W rates.. Reocmrnenoea rrnoomum llcm (pLITlplng) va-octt1es provklea In tre valfous gtJasioe amer. However. tre most protecth'e 

reoommanaea ncm (Ptnl:ll~ VUOdty is 1 me1er per seoona. 

000012
6. RECOMMENDATIONS 

6.1. OCCUPATIONAL SAFETY ANO HEAL'TH AOMfNJSlRATION 

2007-06-1-KS·Al 

Revise the "'Guidsnce fo r Ha:zard Determination for compliance with the OSHA Hazard 

Communication Standard" to advise chemical manufacturers and importers that prepare 

MSOSsto 

•Evaluate fbmmablc liqulds to deter-mine rhelr potential to accumulate static eJ«tticity and 

form ignitable wpor-air mixtures in storage tanks. 

• Test the conductivity of the flammable liquid and include the testing results in the ~1SDS. 

2007-06·1·KS-R2 

Prior to the next revision, communiC3tc to the Sub-Committee on the Glob3Uy Harmonized 

System of Classification and Labeling of Chcmicsls (SCEGHS) the need to amend the GHS 

to advise c.hemical manufacturers and i.mporters that prepare MSDSs to 

• Identify and indudc a vi.rsrning for materials that a re static accumulatOf'S and that tn3f 

form ignitable wpor·air mixtures in storage tanks. 

•Advise users that bonding and grounding may be insufficient to e1imirt3te the hazard from 

static-accumulating flammable Liquids, and provide examples of additional precautions 

and references to the relevant consensus guidance (e.g., NFPA n , Recommended Practice 

on Static Electricity (2007), and API Recommended Practice 2003, Protection Agsinst 

Ignitions Arising Out of Static, Llghming, an d Strsy Currents (2008)). 

•Provide conductivity testing cbtt3 for materia ls that arc static accumulators and that moy 

form ignitabJe wpor-ai.r mixtures in st~ tanks. 

6.2. AMERICAN NATIONAL STANDARDS INSTITUTE (ANSQ 2400.1 COMMITTEE 

2007-06-1-KS-R3 

Revise ANSI ZAOO. 1 to advise chemical manufacturers and importers that prepare MSD~ to 

• Identify and include a warning for materia ls that arc static-accumulators and that may 

form ignitabJe wpor-alr mixtures in storage tan.lest 

•Advise users trui.r bonding and grounding may be insufficient to diminate the hazard from 

static-accumulating flammable liquids, and provide examples of sdditional precautions and 

refe:rences to the relevant consensus guidance (e.g.., NFPA 7i, Recommended Practice on 

Static FJectricity (2007 >, and API Recommended Procticc 2003, Protection Against Ignitions 

Arising Out of Static, lighming, and Stray Currents {2008)); a nd 

•Provide conductivity testing dat3 for materials that are static accumulatOf'S and that tn3Y 

form ignitable wpor-ai.r mixtures in storage tanks. 

6.3. INDUSTRY ASSOCIATIONS 

AMERICAN CHEMISTRY COUNCIL 

'2007-06-1-KS-R4 

AMERICAN PETROLEUM INSTmJTE 

2007-06-1-KS-RS 

NATIONAL ASSOClATION OF CHEMICAL OISTRIBlJT'OAS 

2007-06-1-KS-R6 

NATIONAL PAINT AND OOATINGS ASSOCIATION 

'2007-06-l-KS-R7 

000013
NATIONAL PETROCHEMtcA.l. ANO REFINERS ASSOC&ATION 

2007-06-1-KS-RS 

SOCIETY FOR CHEMICAL HAZARD COMMUNICATION 

2007-06-1-KS-R9 

R«ommmd to your membership companies that prepare MSDSs to update the MSDSs to 

•Identify and include a W3rning for mat('rials that are static accumul:ttOfS and that may 

form ignitsble wpor-alr mixtures in st~ tan.ks. 

• Inc.Jude a statement tM.t bonding and grounding may be insufficient to climinat(' the 

hsurd from staric-ac.cumulating fbmtn3ble liquids, and provide CX!lmplcs of additional 

precautions and references to the rdevant consensus guidance (e.g., NFPA 77, Recommended 

Practice on Static E:lectricicy (2007), and APf Reoommended Practic(' 2003, Protection Against 

Ignitions Arising Out of Static, Lighming, snd Str3y Currents (2008}). 

• lnc:Jude conductivity tC'Sting dsts for the materials chst are static sccumulators and that 

msy fonn ignit:tbl(' vapor-air mixtures in storage t:tnk.s. 

7. INFORMATION RESOURCES 

The following reJercnccs indude additional information on the saf(' USC' of static-accumulating 

flammable liquids: 

1. American Petroleum Institute {API}, .. API Recommended Practice 2003: Prot«tion 

Against Ignitions Arising Out of St:ttic, Lightning, and Str3y Currents," 7th ed., 2008. 

2. Btitton, L.G., and J.A. Smith, .. Static Hazards of Orum Filling," Plant/Operatiorts 

Pmgr,,,, Vol. 7, No. I (1988} pg. 5l-78. 

3. Britton, L.G., .. Avoiding Static Ignition J./O.l,Ords in CJwnical Operatio11s.," AIChE-CCPS 

Concept Book, 1999. 

4. N'3tionsl Fite Ptoc:ection Association {NFPA), .. NFPA 30: Flsmmable and Combustible 

liquid Code>" 2008. 

5. NFPA, '"NFPA 69: St!lndard on Explosion Prevention Systems." 2008 ed. 

6. NFPA, '"NFPA 77: Recommended Practice on Static Electricity, .. 2007 ed. NA>A 77 can 

be viewed, free of charge, on the NFPA v.·ebsite (wv."•.nfpa.org). Access directions.: At 

the NFPA Homepage, go the .. Codes snd Standsrds" pull down ta.b> then dick on '"Code 

dcvdopment process" 3nd scroll down to .. Online access.'" 

7. Walmsley, H.l., .. The Electrost!ltic Potenrisls Genet'3ted by Loading Multiple Batches of 

Product into a Rood Tanker Companment," } . Electrostatics, Vol. 38, 1996, pg.177-186. 

The w' .S. Ct'oamk:..3.1 S..lfBfy an:::J Han re :r'l"JStJ:jatlOf'. Ek.<3.rd ·:C.-SB: IS an rtCl~naflnt tl';(leral agerty ctlatge<l 'lll!n ~tlgatrtg !nc9Js:rtal 

c:r.em!Cal acc1aents. me agenc.ors ooard memoers are appontecl oy tne t ana eonnrrneo t11 tne Senate. csa ·ions 

IOOk mo an aspects ot enetroca1 accJOents. lnciJCl!/'9 p..,ys·ca1 causes sucn as equ1~rrt fSJlJre as VAill as riaoeql.taCles n reg.iianorro. 

n:lustry stariaaras. ano: safely manage-.-nent systems. 

The sow <roes not issue cltatx:ns or 1l"les out aoos ma.:<a sar<rty reoommenae.Uons to eompanll!G. 1naustry agan!U!t~s. iaoor ~ 

ana fll!1J!ator)' agencias S\lcn as OSHA ana EPA. Please V1Slt o.ir'til'eDSlte. 'tr1m.cso.ga-... 

No part or tr.a CSB"S conclJsiOrr>. Q"ICJ!ngs, or racornrruinaations ma1 oe aomttted as evi0¥lce or useo n any action or suit ror oamages: 

sse42 U.S.C. § 741 (rJ~(G). 

000014
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

Report No. 2008-08-I-WV

January 2011

Pesticide Chemical Runaway Reaction

Pressure Vessel Explosion 

(Two Killed, Eight Injured) 

BAYER CROPSCIENCE, LP

INSTITUTE WEST VIRGINIA

AUGUST 28, 2008 

KEY ISSUES:

• PROCESS HAZARDS ANALYSIS

• PRE-STARTUP SAFETY REVIEW

• PROCESS SAFETY INFORMATION AND TRAINING

• EMERGENCY PLANNING AND RESPONSE

000015
i 

Contents

EXECUTIVE SUMMARY .......................................................................................................................... 1

1.0 INTRODUCTION ........................................................................................................................... 7

1.1 Background ......................................................................................................................... 7

1.2 Investigative Process ......................................................................................................... 11

1.2.1 Agency Access to Security Related Documents .................................................. 11

1.2.2 CSB Interim Public Meeting ................................................................................ 13

1.3 Facility Description ........................................................................................................... 13

1.3.1 Institute Manufacturing Industrial Park ............................................................... 13

1.3.2 Facility Ownership History .................................................................................. 14

1.4 Bayer CropScience, LP ..................................................................................................... 15

1.4.1 Institute Operations .............................................................................................. 16

1.5 Bayer Operating Organization .......................................................................................... 16

1.6 Process Chemicals ............................................................................................................ 18

1.6.1 Methomyl ............................................................................................................. 18

1.6.2 Phosgene .............................................................................................................. 19

1.6.3 Methyl Isocyanate ................................................................................................ 21

1.7 Methomyl-Larvin Unit ...................................................................................................... 23

1.7.1 Methomyl Synthesis ............................................................................................ 24

1.7.2 Control System Upgrade ...................................................................................... 26

1.7.3 Residue Treater .................................................................................................... 28

2.0 INCIDENT DESCRIPTION .......................................................................................................... 33

2.1 Pre-Startup Activities ........................................................................................................ 33

2.1.1 Solvent Flush and Equipment Conditioning ........................................................ 34

2.2 Unit Restart ....................................................................................................................... 34

2.2.1 Equipment Malfunctions ...................................................................................... 35

2.2.2 Methomyl Synthesis and Crystallization ............................................................. 36

2.2.3 Solvent Recovery ................................................................................................. 37

2.2.4 Residue Treater Startup ....................................................................................... 38

2.3 Explosion and Fire ............................................................................................................ 40

000016
ii

2.4 Emergency Notification and Response ............................................................................. 43

2.4.1 Bayer CropScience Response .............................................................................. 43

2.4.2 Local and State Emergency Response Agencies ................................................. 44

2.4.3 Emergency Operations Center Activations .......................................................... 48

2.5 Air Monitoring .................................................................................................................. 49

3.0 INCIDENT ANALYSIS ................................................................................................................ 51

3.1 Residue Treater Replacement ........................................................................................... 51

3.2 Internal Compliance Auditing........................................................................................... 51

3.2.1 Corporate Process Safety Management Audits .................................................... 51

3.2.2 Audit Action Tracking System Upgrade.............................................................. 52

3.2.3 Process Safety Management Self Assessments ................................................... 52

3.3 Process Hazards Analysis ................................................................................................. 53

3.3.1 PHA Duration and Staffing Deficiencies ............................................................. 53

3.3.2 PHA Assumptions Deficiencies ........................................................................... 53

3.3.3 Inadequate Process Safety Information Reviews ................................................. 55

3.3.4 Analysis Deficiencies .......................................................................................... 56

3.4 Pre-Startup Safety Review ................................................................................................ 57

3.5 Human Factors Deficiencies ............................................................................................. 58

3.5.1 Control System Upgrade ...................................................................................... 58

3.5.2 Operator Training ................................................................................................ 60

3.5.3 Operator Fatigue .................................................................................................. 63

3.6 Shift Change Communications ......................................................................................... 63

3.7 Procedure Deficiencies ..................................................................................................... 64

3.8 Process Chemistry Problems ............................................................................................ 65

3.9 Unit Restart Equipment Problems .................................................................................... 69

3.9.1 Residue Treater Heater Performance ................................................................... 69

3.9.2 Broken, Missing, and Misaligned Valves ............................................................ 70

3.9.3 Other Process Equipment Problems..................................................................... 73

3.10 Air Monitoring Systems Deficiencies ............................................................................... 74

3.10.1 Fenceline Air Monitors ........................................................................................ 74

3.10.2 Unit Air Monitors ................................................................................................ 75

3.11 Organizational Deficiencies .............................................................................................. 76

000017
iii

3.12 Previous Methomyl-Larvin Unit Incident ......................................................................... 78

3.13 Emergency Planning and Response .................................................................................. 79

3.13.1 National Incident Management System ............................................................... 79

3.13.2 Kanawha Putnam Emergency Planning Committee ............................................ 81

3.13.3 Kanawha Putnam Emergency Management Plan ................................................ 81

3.13.4 Chemical Release Notification Law .................................................................... 82

3.14 Incident Response and Communication Deficiencies ....................................................... 83

3.14.1 Bayer CropScience Facility ................................................................................. 83

3.14.2 Facility and Emergency Responders’ Communications ...................................... 84

3.14.3 Kanawha Valley Emergency Communications Process Improvement 

Initiatives ............................................................................................................. 85

3.15 Environmental Impact ....................................................................................................... 87

3.16 MIC Day Tank Blast Shield Analysis ............................................................................... 88

4.0 METHYL ISOCYANATE RISK REDUCTION AT THE INSTITUTE FACILITY ................... 90

4.1 Congressional Action ........................................................................................................ 90

4.2 Alternative MIC Technology Analysis History ................................................................ 91

4.2.1 Union Carbide Corporation Studies ..................................................................... 91

4.2.2 Rhone-Poulenc Studies ........................................................................................ 92

4.2.3 Bayer CropScience Studies .................................................................................. 93

4.3 Bayer CropScience MIC Storage Reduction .................................................................... 93

5.0 REGULATORY ANALYSIS ........................................................................................................ 95

5.1 Occupational Safety and Health Administration .............................................................. 95

5.1.1 Process Safety Management Program ................................................................. 95

5.1.2 PSM Inspections at the Bayer Facility ................................................................. 95

5.1.3 PSM Program Deficiency Findings in Other CSB Investigations ....................... 96

5.1.4 OSHA PSM Chemical National Emphasis Program ........................................... 98

5.1.5 OSHA PSM Citations Follow-up Deficiencies .................................................... 98

5.2 Environmental Protection Agency Risk Management Program ....................................... 99

5.2.1 Application of the Bayer CropScience Risk Management Program .................... 99

5.2.2 EPA Inspections at the Bayer Institute Facility ................................................. 101

5.2.3 EPA Office of Inspector General Risk Management Program Review ............. 102

000018
iv

5.3 State and Local Government Programs .......................................................................... 103

5.3.1 Contra Costa County California Hazardous Materials Safety Ordinance .......... 103

5.3.2 New Jersey Toxic Catastrophe Prevention Act ................................................. 105

5.3.3 Hazardous Materials Regulatory Oversight in West Virginia ........................... 107

6.0 KEY FINDINGS .......................................................................................................................... 109

6.1 Process Hazard Analysis ................................................................................................. 109

6.2 Pre-Startup Safety Review .............................................................................................. 109

6.3 Methomyl Unit Startup ................................................................................................... 110

6.4 MIC Day Tank Shield Structure Design ......................................................................... 111

6.5 Emergency Planning, Response, and Communication ................................................... 111

6.5.1 Bayer CropScience ............................................................................................ 111

6.5.2 Outside Responding Agencies ........................................................................... 112

6.5.3 Kanawha County Commission .......................................................................... 112

6.6 Environmental Impact ..................................................................................................... 112

6.7 Regulatory Oversight ...................................................................................................... 112

7.0 INCIDENT CAUSES .................................................................................................................. 113

8.0 RECOMMENDATIONS ............................................................................................................. 114

8.1 Bayer CropScience – Research Triangle Park, NC......................................................... 114

8.2 Bayer CropScience - Institute, West Virginia ................................................................. 114

8.3 Director of the Kanawha-Charleston Health Department ............................................... 116

8.4 Secretary of West Virginia Department of Health and Human Services and the 

West Virginia Department of Environmental Protection ................................................ 118

8.5 Kanawha-Putnam Emergency Planning Committee ....................................................... 118

8.6 West Virginia State Fire Commission ............................................................................ 119

8.7 Occupational Safety and Health Administration ............................................................ 119

8.8 Environmental Protection Agency .................................................................................. 120

9.0 REFERENCES ............................................................................................................................ 121

APPENDIX A – CAUSAL ANALYSIS CHARTS ................................................................................. 123

APPENDIX B – EMERGENCY RESPONSE TIMELINE ...................................................................... 134

APPENDIX C – METHYL ISOCYANATE DAY TANK BLAST SHIELD ANALYSIS .................... 139

APPENDIX D – BAYER CROPSCIENCE PRESS RELEASE ANNOUNCING INSTITUTE 

FACILITY MIC STORAGE REDUCTION ................................................................. 159

000019
v 

Figures 

Figure 1. Residue treater came to rest inside the Methomyl-Larvin unit ...................................................... 8

Figure 2. MIC day tank shield blanket structure ........................................................................................... 9

Figure 3. Institute Manufacturing Industrial Park ....................................................................................... 14

Figure 4. Seven tenants own or operate processes at the Institute Industrial park ...................................... 15

Figure 5. Institute site organization structure. ............................................................................................. 18

Figure 6. Aerial view of Bayer Institute Manufacturing Park .................................................................... 23

Figure 7. Overhead view of the Methomyl-Larvin production unit ............................................................ 24

Figure 8. Methomyl synthesis process flow ................................................................................................ 25

Figure 9. Methomyl centrifuge and solvent recovery process flow ............................................................ 26

Figure 10. Residue treater piping system layout ......................................................................................... 29

Figure 11. Residue treater process variables before the explosion. ............................................................ 39

Figure 12. Residue treater bottom head; vessel shell and top head ............................................................ 41

Figure 13. Residue treater shell and top head recovered from inside the Methomyl-Larvin unit ............... 41

Figure 14. Structural column ripped from the steel baseplate .................................................................... 42

Figure 15. Aerial view of locations of reported offsite property damage ................................................... 43

Figure 16. Methomyl unit explosion emergency communications diagram ............................................... 46

Figure 17. Areas and population affected by the shelter-in-place .............................................................. 47

Figure 18. Typical Siemens work station screen display ............................................................................ 59

Figure 19. Indicated steam flow through the residue treater heater. ........................................................... 72

Figure 20. Closed steam block valve recovered from residue treater heater steam supply valve ............... 72

Figure 21. NIMS incident command structure ............................................................................................ 80

Tables 

Table 1. Characteristics of the toxic chemicals used to manufacture methomyl ........................................ 20

Table 2. New Metro 9-1-1 questionnaire for fixed chemical facilities (Courtesy Metro 9-1-1) ................ 86

Table 3. Common PSM program deficiencies identified in CSB investigations ........................................ 97

Table 4. RMP covered chemicals in the Methomyl/Larvin unit ............................................................... 100

000020
vi

Acronyms and Abbreviations

ATF U.S. Bureau of Alcohol, Tobacco, and Firearms, and Explosives 

CAD (Emergency Operations Center) Computer aided dispatch

CCPS Center for Chemical Process Safety

CFR Code of Federal Regulations 

CPQRA Chemical process quantitative risk assessment 

CSB U.S. Chemical Safety and Hazard Investigation Board

DCS Distributed control system

DEP Department of Environmental Protection

DMDS Dimethyl disulfide

ECC East Carbamoylation Center

EHA Extraordinarily hazardous substance 

EMS Emergency Medical Services

EOC Emergency Operations Center

EPA U.S. Environmental Protection Agency 

FDA U.S. Food and Drug Administration 

FIFRA Federal Insecticide, Fungicide and Rodenticide Act

fps feet per second

GUI Graphical user interface

HAZOP Hazard and operability study 

HSE U.K. Health and Safety Executive 

IC Incident Commander 

ICS Incident Command System 

IDLH Immediately dangerous to life or health

IR Infrared radiation 

KCEAA Kanawha County Emergency Ambulance Authority

KCSD Kanawha County Sheriff’s Department

KPEPC Kanawha-Putnam County Emergency Planning Committee 

LOPA Layer of Protection Analysis

m3 cubic meter

MAWP Maximum allowable working pressure

mg milligram

MIBK Methyl isobutyl ketone

000021
vii

MIC Methyl isocyanate

MOCR Management of change review

MSAO Methylthioacetaldoxime (also called Oxime)

MSDS Material Safety Data Sheet

MSS MIC stripping still

NAS National Academy of Sciences

NIMS National Incident Management System

NIOSH The National Institute for Occupational Safety and Health 

OES West Virginia State Office of Emergency Services

OIG Office of Inspector General

OSHA U.S. Department of Labor, Occupational Safety and Health Administration 

PEL Permissible exposure limit

PFD Probability of failure on demand 

PHA Process hazard analysis

PIO Public Information Officer 

ppm parts per million 

PSSR Pre-startup safety review

PSM Process Safety Management (29 CFR 1910.119) 

REL Recommended exposure limit

RHS Reactive Hazard Substance

RMP Risk Management Program (40 CFR 68)

RRT Regional Response Team

SOP Standard operating procedure 

TCPA (New Jersey) Toxic Catastrophe Prevention Act

TLV Threshold limit value

TQ Threshold quantity (OSHA PSM or EPA Risk Management Program)

UCC Union Carbide Corporation 

UCS Unified Command System 

VOC Volatile organic compound 

WCC West Carbamoylation Complex 

000022
1 

Executive Summary 

On August 28, 2008, at about 10:35 p.m., a runaway chemical reaction occurred inside a 4,500 gallon 

pressure vessel known as a residue treater, causing the vessel to explode violently in the methomyl 

unit at the Bayer CropScience facility in Institute, West Virginia. Highly flammable solvent sprayed 

from the vessel and immediately ignited, causing an intense fire that burned for more than 4 hours. 

The fire was contained inside the Methomyl-Larvin insecticide unit by the Bayer CropScience fire 

brigade with mutual aid assistance from local volunteer and municipal fire departments. 

The incident occurred during the restart of the methomyl unit after an extended outage to upgrade the 

control system and replace the original residue treater vessel. Two company employees who had been 

dispatched by the control room personnel to investigate why the residue treater pressure was 

increasing were near the residue treater when it ruptured. One died from blunt force trauma and burn 

injuries sustained at the scene; the second died 41 days later at the Western Pennsylvania Burn Center 

in Pittsburgh, Pennsylvania. Six volunteer firefighters who assisted in the unit fire suppression 

activities and two contractors working at the facility were treated for possible toxic chemical 

exposure. 

The Kanawha-Putnam County Emergency Management Director advised more than 40,000 residents, 

including the resident students at the West Virginia State University adjacent to the facility, to 

shelter-in-place for more than three hours as a precaution. The fire and drifting smoke forced the state 

police and local law enforcement authorities to close roads near the facility and the interstate 

highway, which disrupted traffic for hours. 

The Chemical Safety Board (CSB) investigation team determined that the runaway chemical reaction 

and loss of containment of the flammable and toxic chemicals resulted from deviation from the 

written start-up procedures, including bypassing critical safety devices intended to prevent such a 

condition. Other contributing factors included an inadequate pre-startup safety review; inadequate 

000023
2 

operator training on the newly installed control system; unevaluated temporary changes, 

malfunctioning or missing equipment, misaligned valves, and bypassed critical safety devices; and 

insufficient technical expertise available in the control room during the restart. 

Poor communications during the emergency between the Bayer CropScience incident command and 

the local emergency response agency confused emergency response organizations and delayed public 

announcements on actions that should be taken to minimize exposure risk. Although Bayer 

CropScience reported that “no toxic chemicals were released because they were consumed in the 

intense fires,” the CSB later confirmed that the only air monitors suitably placed near the unit to 

detect toxic chemicals were, in fact, not operational at the time of the incident. No reliable data or 

analytical methods were available to determine what chemicals were released, or predict any 

exposure concentrations. 

The methomyl unit used the highly toxic chemical, methyl isocyanate (MIC), in a series of complex 

chemical reactions to produce methomyl, a dry chemical used to make the pesticide, Larvin. MIC is 

manufactured in a separate production unit at the facility and stored in large underground pressure 

vessels. Liquid MIC was pumped to a “day tank” pressure vessel near the Methomyl-Larvin unit, 

which provided the daily production quantity of MIC for the methomyl unit and the carbofuran unit, 

which is about 200 feet west of the methomyl unit. The MIC storage tank adjacent to the methomyl 

unit and the MIC transfer piping between the production unit and the manufacturing units were not 

damaged, nor did the MIC storage tank overheat or pressurize above the operating limits during the 

fire.

000024
3 

The CSB investigation identified the following incident causes:

1. Bayer did not apply standard Pre-startup Safety Review (PSSR) and turnover practices to the 

methomyl control system redesign project. The equipment was not tested and calibrated 

before the unit was restarted. 

2. Operations personnel were inadequately trained to operate the methomyl unit with the new 

distributed control system (DCS). 

3. Malfunctioning equipment and the inadequate DCS checkout prevented the operators from 

achieving correct operating conditions in the crystallizers and solvent recovery equipment. 

4. The out-of-specification methomyl-solvent mixture was fed to the residue treater before the 

residue treater was pre-filled with solvent and heated to the minimum safe operating 

temperature.

5. The incoming process stream normally generated an exothermic decomposition reaction, but 

methomyl that had not crystallized due to equipment problems greatly increased the 

methomyl concentration in the residue treater, which led to a runaway reaction that

overwhelmed the relief system and over-pressurized the residue treater. 

 

Many industrial facilities in the Kanawha river valley that surrounds Charleston, West Virginia, the 

state capital, handle thousands of pounds of toxic and flammable materials. Local community 

involvement in safe handling of hazardous chemicals and emergency planning and the Kanawha 

Valley Industrial Emergency Planning Council date back to the 1950s. In 1995, the planning council 

was renamed the Kanawha Putnam Emergency Planning Committee, which functions as the local 

emergency planning committee (LEPC) as required by the Superfund Amendments and 

Reauthorization Act, Emergency Planning and Community Right-to-Know Act (SARA Title III). 

Although federal law requires the owner or operator of the facility to promptly provide information to 

the LEPC necessary for developing and implementing the emergency plan [EPCRA 303(d)(3)], it 

does not provide LEPCs or other local agencies with the authority to conduct reviews of facility 

process safety programs or directly participate in hazard reviews or incident investigations. A few 

000025
4 

state governments have passed laws that authorize local governments to become directly involved 

with industry process safety programs. For example, the New Jersey Toxic Catastrophe Prevention 

Act, 1

 created in 1986, significantly expands the requirements contained in the U.S. Environmental 

Protection Agency Risk Management Program (40 CFR68). In 1999, the Contra Costa County, 

California Board of Supervisors approved an industrial safety ordinance2

Like Contra Costa County, the Kanawha valley has many facilities that handle large quantities of 

hazardous materials, some of which are acutely toxic. Furthermore, the valley contains 

environmentally sensitive areas such as the Kanawha River, which is an important transportation 

corridor. Yet, the local government does not have the authority to directly participate in facility safety 

planning and oversight even though many community stakeholders have long campaigned for such 

authority and involvement. The local government could adopt regulations and implement a program 

similar to Contra Costa County that would likely improve stakeholder awareness and improve 

emergency planning and accident prevention. 

that established broad 

authority to the county health services department to oversee local refining and chemical industries. 

The ordinance includes mandatory safety plan submission by regulated industries, and audit and 

facility inspections by the county. 

The Bayer CropScience investigation was the agency’s first case involving company assertions of 

Sensitive Security Information (SSI) under the Maritime Transportation Security Act of 2002. Federal 

law requires a company to mark all SSI containing documents and notify the recipient that the 

documents must be controlled in accordance with Department of Homeland Security regulations. 

Early in the investigation, Bayer CropScience management asserted that most of their records 

contained SSI information, and therefore the CSB was prohibited from releasing it to the public. The 

 

1 New Jersey Administrative Code Title 7 Chapter 31.

2 Contra Costa County, California, Ordinance Code Title 4 – Health and Safety, Division 450 – Hazardous 

Materials and Wastes, Chapter 450-8 – Risk Management.

000026
5 

CSB consulted with the U.S. Coast Guard and determined that the Bayer claim was without basis. 

The president of Bayer CropScience, LP later admitted in testimony to the U.S. House of 

Representatives Committee on Energy and Commerce “[W]e concede that our pursuit of SSI 

coverage was motivated, in part, by a desire to prevent that public debate [concerning the use of MIC]

from occurring in the first place.” 3

The controversy created by the SSI issue and the Bayer CropScience admission prompted the U.S. 

Congress to enact legislation to amend Section 70103(d) of Title 46, United States Code. The new 

law, titled ‘‘American Communities’ Right to Public Information Act,’’ prohibits designating 

information to be SSI to “prevent or delay the release of information that does not require protection 

in the interest of transportation security, including basic scientific research information not clearly 

related to transportation security.”

Ever since the 1984 tragic accident in Bhopal, India, which released highly toxic MIC into the 

community and killed thousands of nearby residents, many in the Kanawha valley community have 

tried to convince the owners of the Institute facility to drastically reduce or eliminate MIC. In fact, 

the Institute facility is the only facility in the United States that stores and uses large quantities of the 

highly toxic chemical. The August 2008 incident, which could have caused an MIC release into the 

nearby community, reinvigorated community pressure to reduce the MIC risk to the public. 

In 2009, the U.S. House of Representatives Committee on Energy and Commerce asked the CSB to 

provide recommendations to Bayer CropScience, and federal and state regulators to “reduce the 

dangers posed by on-site storage of MIC.” Many of the recommendations contained in this report 

address that request. Also in 2009, the U.S. Congress appropriated $600,000 to the CSB to directly 

 

3

 Statement of William B. Buckner, president and chief executive officer of Bayer CropScience, LP before the 

U.S. House of Representatives Committee on Energy and Commerce Subcommittee on Oversight and 

Investigations, April 21, 2009.

000027
6 

fund a study “by the National Academy of Sciences to examine use and storage of MIC...and 

feasibility of implementing alternative chemicals or processes at the facility.”

Bayer CropScience has taken specific action to reduce the risk of an incident involving MIC. The 

company did not rebuild the damaged methomyl unit and discontinued production of two of the MICbased pesticides. The company also made an investment of more than $25 million to redesign and 

modify the MIC production unit to significantly reduce the on-site inventory of MIC and make other 

process upgrades to reduce the risk associated with handling large quantities of MIC. The 

improvements including eliminating the aboveground MIC storage vessels and replacing the 

underground storage vessels were scheduled to be completed by late 2010. In January 2011, Bayer 

announced it would eliminate the production of the two remaining carbamate pesticides, aldicarb and 

carbaryl, during 2012 and end all production, use, and storage of MIC. 

Based on the findings of this report recommendations are made to Bayer CropScience located in 

Research Triangle Park, North Carolina, and in Institute, West Virginia. The Board also makes 

recommendations to the Secretary of the West Virginia Department of Health and Human Resources

Commissioner of the Kanawha-Charleston Health Department, the West Virginia State Fire 

Commission, Kanawha Putnam Emergency Planning Committee, the Environmental Protection 

Agency, and the Occupational Safety and Health Administration. Implementation of the 

recommendations will improve hazardous chemicals management, and improve local government and 

community involvement with companies that use large quantities of hazardous chemicals. 

000028
7 

1.0 Introduction

1.1 Background

On August 28, 2008, at about 10:25 p.m., two Bayer CropScience employees at the Institute, West 

Virginia, manufacturing facility were asked to investigate why pressure was unexpectedly increasing 

in the residue treater, a pressure vessel located on the south side of the Methomyl-Larvin unit about 

midpoint along an adjacent road. About 10 minutes later, as they approached the newly installed 

residue treater, it suddenly and violently ruptured. Approximately 2,200 gallons of flammable 

solvents and toxic insecticide residues sprayed onto the road and into the unit and immediately 

erupted in flames as severed electrical cables or sparks from steel debris striking the concrete ignited 

the solvent vapor. 

Debris was thrown in all directions, some hundreds of feet. The 5,700-pound residue treater ripped 

out piping, electrical conduit, and a structural steel support column as it split apart and careened 

northeast into the Methomyl-Larvin production unit structure (Figure 1). The blast overpressure 

moderately damaged the unit control building and other nearby structures. Flying debris struck the 

protective steel shield blanket surrounding a 6,700-gallon methyl isocyanate (MIC) “day tank” 

located about 70 feet southwest of the residue treater (Figure 2), but did not damage the day tank. The 

steel blanket also protected the MIC day tank from the radiant heat generated by the nearby fires that 

burned for more than 4 hours. 

One employee died at the scene from blunt force trauma and thermal burn injuries. Responding unit 

personnel helped the second employee out of the unit. He was transported to the Western 

Pennsylvania Burn Center in Pittsburgh, Pennsylvania, and died 41days later. Five Tyler Mountain 

firefighters and one Institute firefighter who assisted the Bayer CropScience fire brigade at the unit 

reported possible chemical exposure symptoms. Two Norfolk Southern railroad employees working 

000029
8 

at the facility the night of the incident also reported chemical exposure symptoms. None reported 

acute or long-term effects. Doctors identified heat exhaustion in at least two of the cases.

Figure 1. Residue treater came to rest inside the Methomyl-Larvin unit

The in-house fire brigade immediately responded to the incident. The Tyler Mountain and Institute 

Volunteer Fire Departments also arrived at the front gate of the facility to assist the fire brigade as 

planned in the mutual aid emergency response protocol. However, poor communications with the 

Metro 9-1-1 call center delayed the community shelter-in-place notification and interfered with 

effective off-site response activities.

The St. Albans, West Virginia, fire chief, unable to obtain specific information about the chemicals 

involved or the extent of the incident, prepared to issue a shelter-in-place for his community after he 

assumed that the smoke drifting across the river might contain toxic chemicals. After many 

unsuccessful attempts to communicate directly with the Bayer incident commander (IC) during the 

first hour of the incident, the Kanawha/Putnam County Emergency Management director declared a 

000030
9 

shelter-in-place, which affected approximately 40,000 residents. Approximately 3 hours later county 

authorities lifted the shelter-in-place about 3 hours later. 

Figure 2. MIC day tank shield blanket structure

As far as 7 miles from the explosion epicenter, residences, businesses, and vehicles sustained 

overpressure damage that included minor structural and minor exterior damage and broken windows. 

Acrid, dense smoke billowed from the fire into the calm night air for many hours. Smoke drifted over 

Interstate 64 and nearby roads to the north of the facility, forcing many road closures and disrupting 

highway traffic.

000031
10 

Methomyl and solvents were released from the residue treater, and solvents and other toxic chemicals 

were released from ruptured unit piping including flammable and toxic MIC. The released chemicals 

rapidly ignited, producing undetermined combustion products. MIC air monitoring devices in and 

near the Methomyl-Larvin unit were not operational the night of the incident. Only two fenceline air 

monitors were operational, but they were more than 800 feet away and not located downwind of the 

smoke; in addition these fenceline monitors were only designed to detect carbon monoxide, hydrogen 

sulfide, flammable gas and oxygen. The four-gas air monitors4

The incident occurred during the first methomyl restart after an extended outage to install a new 

process control system and replace the old carbon steel residue treater with a stainless steel pressure

vessel with equivalent pressure and temperature operating limits. The residue treater was designed to 

decompose methomyl in a heated methyl isobutyl ketone (MIBK) solvent. During normal operations, 

dissolved methomyl and other waste chemicals were fed into the preheated residue treater partially 

filled with solvent. The methomyl safely decomposed inside the residue treater to a concentration of 

less than 0.5 percent by weight.

 worn by emergency responders did not 

detect hazardous chemicals in the air near the unit. There were no reports of river water 

contamination from fire suppression water runoff. 

5

On the night of the incident, methomyl-containing solvent was pumped into the residue treater before 

the vessel was pre-filled with clean solvent and heated to the required minimum operating 

temperature specified in the operating procedure. The emergency vent system was overwhelmed by 

the evolving gas from the runaway decomposition reaction of methomyl, and the residue treater 

 The liquid was then transferred to an auxiliary fuel tank where it was 

mixed with other flammable liquid waste materials and used as a fuel in one of the facility boilers. 

 

4 Fire department and other emergency responder personnel typically wear a “four-gas air monitor” to measure 

concentrations of carbon monoxide and hydrogen sulfide, flammable gas, and oxygen concentration. An 

alarm sounds if any of the measured gases exceed the setpoint programmed in the detector.

5 All percent values used in the report are weight percent unless noted.

000032
11 

violently exploded. The estimated energy of the explosion was equivalent to about 17 pounds of TNT 

(See Appendix C). 

1.2 Investigative Process

The CSB investigation team arrived at the Bayer CropScience facility the morning of August 30, 

2008, and met with the Bureau of Alcohol, Tobacco, and Firearms and Explosives (ATF), 

Occupational Safety and Health Administration (OSHA) investigators, and Bayer management 

personnel to explain the CSB purpose and authority for conducting an investigation independently of 

other agencies and organizations. On September 2, 2008, the ATF concluded that the incident was not 

a criminal act and ceased its on-scene investigative activities. 

Over the following 6 weeks, the CSB investigators examined and photographed the residue treater 

and associated process equipment; MIC day tank, blast blankets, and support structure; surveyed the 

control building damage; mapped the debris field; interviewed employees working at the facility on 

the night of the incident; and interviewed outside emergency personnel who participated in the 

response. The team examined methomyl unit operating procedures, control system data, process 

chemistry documents, worker training records, and maintenance records. Finally, the CSB 

commissioned computer modeling to evaluate the blast shield used to protect the MIC day tank. 

1.2.1 Agency Access to Security Related Documents

The Bayer CropScience investigation is the first incident investigated by the CSB that involves the 

Maritime Transportation Safety Act6

 and Sensitive Security Information (SSI). SSI is information 

that, if publicly released, would be detrimental to transportation security.7

 

6

 46 U.S.C. § 70102

Federal law requires a 

company to mark all documents containing SSI and to notify the recipient that the documents must be 

controlled in accordance with Department of Homeland Security regulations. Bayer’s attempts to use 

7

 49 CFR 1520.

000033
12 

the SSI designation to suppress public disclosure of information related to the investigation forced the 

CSB to delay the planned interim public meeting and ultimately led to congressional action to prevent 

future misuse of the regulation. 

In January 2009, the Head of the Health, Safety, and Environment Expertise Center at the Bayer 

CropScience Institute facility contacted the U.S. Coast Guard Commanding Officer, Marine Safety 

Unit in Huntington, West Virginia and suggested “to discuss this [SSI] further with your headquarters 

so that we can better communicate to the CSB and possibly discourage them from even seeking this 

information.” 8

The controversy created by raising the SSI issue to restrict CSB investigative activities resulted in the 

U.S. Congress enacting legislation on October 8, 2009, to amend Section 70103(d) of title 46, United 

States Code. The new law, titled the “American Communities’ Right to Public Information Act”

Then, in March 2009, Bayer CropScience sent a letter to the CSB asserting that many 

of the documents already delivered to the CSB contained SSI and requested the documents be 

returned to them so each page could be marked as required by the regulation. The company also 

claimed photos, interview records, and other CSB produced investigatory documents might contain 

SSI. The CSB declined the request to return the documents and a later request to examine the 

documents at the CSB office and directed Bayer CropScience to properly label and resubmit all SSI 

containing documents. Bayer CropScience officials later admitted they had attempted to use the 

Maritime Transportation Safety Act to block public disclosure of information related to methyl 

isocyanate and possible negative publicity.

9

 

8

 E-mail from the Head, Health, Safety, and Environment Expertise Center, Bayer CropScience, to the

Commanding Officer, Marine Safety Unit Huntington, U.S. Coast Guard 

(Jan. 29, 2009).

added the following restriction on SSI claims: 

9

 Public Law 111-83.

000034
13 

‘‘(d) Nondisclosure of information, 2) Limitations.—Nothing in paragraph (1) 

shall be construed to authorize the designation of information as sensitive 

security information (as defined in section 1520.5 of title 49,Code of Federal 

Regulations ; (A) to conceal a violation of law, inefficiency, or administrative 

error; (B) to prevent embarrassment to a person, organization, or agency; (C) to 

restrain competition; or (D) to prevent or delay the release of information that 

does not require protection in the interest of transportation security, including 

basic scientific research information not clearly related to transportation security.

1.2.2 CSB Interim Public Meeting 

On April 28, 2009, the CSB held a public meeting in Institute, West Virginia, which was attended by 

more than 250 people. The investigation staff presented the incident timeline, described the processes 

and equipment involved, described the county emergency response activities, and summarized the 

preliminary findings of the investigation. The meeting included presentations from Bayer 

CropScience, the West Virginia State Fire Marshal, the Kanawha Putnam County Emergency 

Management Director, a representative from the International Association of Machinists, a chemical 

industry expert, and a representative from the community advocacy group People Concerned about 

Methyl Isocyanate.

The Board also heard testimony from 16 people in attendance including residents who live near the 

facility, the president of West Virginia State University, workers from Bayer CropScience, and other 

interested individuals.

1.3 Facility Description

1.3.1 Institute Manufacturing Industrial Park 

The Institute facility is located 9 miles west of Charleston, West Virginia, and is bordered on the 

north by Route 25 and Interstate 64, on the east by the West Virginia State University, and along the 

000035
14 

south by the Kanawha River. St. Albans, West Virginia, is across the river 3 miles west (Figure 3). 

Raw materials and products used or manufactured at the facility are transported by truck, rail, and 

barge.

Figure 3. Institute Manufacturing Industrial Park

1.3.2 Facility Ownership History

The site was originally Wertz Field Airport and closed in 1942 to become a large, governmentsponsored synthetic rubber production plant for the World War II effort managed by the Carbide and 

Carbon Chemicals Corporation and the United States Rubber Company. In 1947, the Union Carbide 

Corporation (UCC) purchased the plant to produce carbamate insecticides. In 1986, Rhone-Poulenc, a 

French-owned chemical company, purchased the agricultural division of UCC and operated the 

Institute facility until 2000. Aventis, formed by a merger of Rhone-Poulenc and AgrEvo, took over 

the facility until Bayer CropScience acquired it in 2002. 

000036
15 

In August 2008, the 460-acre, multi-tenant Institute Manufacturing Industrial Park employed 

approximately 645 workers. The seven tenants on the facility included Bayer CropScience, Adisseo, 

FMC Corporation, Dow Chemical, Catalyst Refiners, Reagent Chemical, and Praxair (Figure 4). The 

site contains 16 production units and five utility and support units. Some of the tenants produce 

chemicals that are used as feedstocks in units owned or operated by other tenants. 

Figure 4. Seven tenants own or operate processes at the Institute Industrial park

Bayer owns and operates nine production and utility units. Two additional process units are operated 

by Bayer employees under contractual agreements with the unit owners, Adisseo, and FMC. Bayer 

employs approximately 545 at the Institute facility. 

1.4 Bayer CropScience, LP

Bayer CropScience is an independently operated company within Bayer, AG, (Bayer Group) which is 

the chemical and pharmaceutical parent company headquartered in Leverkusen, Germany. Bayer 

CropScience, Bayer HealthCare, and Bayer Material Science make up the three business areas of the 

Bayer Group. 

000037
16 

The Bayer CropScience business, headquartered in Monheim, Germany, employs more than 18,000 

personnel in more than 120 countries. A 12-member global executive committee, including the Bayer 

Board of Management chairperson, manages Bayer CropScience. Executive committee members 

oversee research, operations, planning, and administrative functions, as well as regional business 

areas. A 12-member supervisory board composed of Bayer Group executives, independent experts, 

and trade union representatives comprise a supervisory board to oversee company operations. The 

Bayer CropScience U.S. headquarters is in Research Triangle Park, North Carolina. 

Bayer CropScience (Bayer) is a global provider of crop protection agents, such as insecticides, 

herbicides, and fungicides for commercial and private consumer use. The Crop Protection division 

serves the agriculture sector and the BioScience division uses gene technology to produce genetically 

modified crops as an alternative to conventional pesticide applications. The Environmental Science 

division provides services for professional weed and pest control customers. 

1.4.1 Institute Operations

Bayer has three insecticide manufacturing complexes on the Institute site supported by two 

powerhouses and a wastewater treatment unit. The East Carbamoylation Complex (ECC) includes the 

MIC and Phosgene production unit and the Aldicarb and Carbaryl units. The MIC and phosgene 

production unit supplies feedstock to the Aldicarb and Carbaryl unit for the production of 

insecticides. The Methomyl-Larvin® unit occupied the West Carbamoylation Complex (WCC), along 

with the FMC-owned carbosulfan and carbofuran unit, which was operated by Bayer. The Adisseoowned Rhodimet® unit makes up the third complex that Bayer also operates. 

1.5 Bayer Operating Organization

For many years the methomyl unit operated in a traditional organizational structure for chemical plant 

operating units; that is, with a first-line supervisor who directed the work of a team of operators. Four 

operating crews typically covered rotating shifts, and each team included a supervisor and a crew of

000038
17 

operators. The supervisor’s responsibilities included monitoring the operators’ work to ensure that 

they were successfully running the process and included completing administrative tasks for those 

operators, such as scheduling, payroll, sick-time call-out, safety and health, and other supervisor 

duties. The supervisor and the operators worked the same rotating shift, and except when filling in as 

substitutes on other shifts or units for worker vacations and sick days, the operators reported directly 

to the same supervisor when they worked their normal schedule. The operators worked with the 

supervisor an average of 40 hours per week. If the operators had questions about their job or 

administrative procedures, they generally asked the supervisor who was in the unit with them at that 

time. 

From 2004 to 2007, Bayer management analyzed and restructured the unit supervisory and technical 

oversight staffing. First-line supervisor positions in each operating unit were eliminated and selfdirected, or self-empowered work teams were implemented. Four teams of operators worked rotating 

shifts, supported by a Technical Advisor and Run Plant Engineer, both day-shift workers. Instead of a 

first-line supervisor, all operators including the Technical Advisor report to the Production Leader 

(Figure 5). 

A single Industrial Park Site Shift Leader, which management describes as a “first among equals,” is 

responsible for all facility operations, rotates on shift with the shift operators, and oversees site 

operations. Some personnel in the Shift Leader role have prior experience as first-line supervisors on 

various operating units. However, the Shift Leader is not a first-line supervisor, as none of the 

operators report to him/ her. Instead, the Shift Leader oversees the entire facility and can advise in 

any area of the plant as necessary. The Shift Leader also serves as the Incident Commander if an 

incident requires emergency response. Bayer management describes Shift Leaders as “very good 

operators who have worked their way through the technical advisor role.” 

Bayer intended the Technical Advisor, who is not a first-line supervisor, to be an experienced 

operator who works the day shift, helps schedule production to meet demand, and advises the on-shift 

000039
18 

operators. The operators can call the Technical Advisor and ask questions any time of the day or 

night. The other operators do not report to him/her, and the Technical Advisor does not have the 

strong work-checking or “looking over the shoulder” function of a historical first-line supervisor or 

foreman. 

Figure 5. Institute site organization structure.

1.6 Process Chemicals 

1.6.1 Methomyl

Bayer produced methomyl for international customers and as an intermediate feedstock used to make 

Larvin® (Thiodicarb), an insecticide and ovicide.10

 

10 An ovicide is a chemical used to control insect larvae. Larvin is used worldwide on crops such as corn, 

cotton, fruits, grapes, sorghum, soybeans, and vegetables. 

Methomyl is a white, crystalline solid with a slight 

sulfurous odor. Methomyl dust is combustible and can form explosive mixtures when dispersed in air. 

It was introduced in 1966 as a carbamate insecticide and registered by the U.S. Environmental 

000040
19 

Protection Agency (EPA) in 1968 as a restricted use pesticide11

Methomyl is a cholinesterase inhibitor that disrupts central and peripheral nervous system functions. 

Routes of exposure include inhalation, ingestion, and skin and eye absorption. Reversible and 

irreversible effects can result depending on the concentration and duration of the exposure. The 

National Institute for Occupational Safety and Health (NIOSH) recommended exposure limit (REL) 

for methomyl is 2.5 mg/m3. When burned, methomyl decomposes to form toxic gases and vapors 

such as nitrogen oxides, sulfur oxides, acetonitrile, hydrogen cyanide, and methyl isocyanate 

(Sittig, 2008). 

 due to its high human toxicity. It is a 

broad-spectrum insecticide used on vegetable, fruit, and cotton crops worldwide and targets insects 

though direct contact and systemic absorption. 

Table 1 lists the exposure limits, characteristics, and OSHA Process Safety Management (PSM) and 

EPA Risk Management Program (RMP) threshold quantities for the principal chemicals used to make 

methomyl. Phosgene is used to make MIC and MIC is used to make methomyl; both phosgene and 

MIC are highly toxic. 

1.6.2 Phosgene

Phosgene is a colorless, dense gas that smells like freshly cut hay or grass. Although highly toxic, 

phosgene is an important industrial chemical used to make thermoplastics such as eyeglass lenses, 

and isocyanates, intermediate chemicals used to make polyurethanes and pesticides.

 

11 Restricted use pesticides are limited to commercial applicators certified by the EPA and the Food and Drug 

Administration (FDA) state programs for pesticide safety education under the Federal Insecticide, Fungicide 

and Rodenticide Act (FIFRA).

000041
20 

Table 1. Characteristics of the toxic chemicals used to manufacture methomyl

Chemical

NIOSH 

IDLH12

NIOSH 

REL 

(ppm) (ppm)

OSHA 

PEL

(ppm)

ACGIH 

TLV

(ppm)

Odor 

Threshold13 Odor 

(ppm)

RMP

Threshold 

(lbs)

PSM 

Threshold 

(lbs)

Chlorine 10 0.5 1 0.5 0.002 characteristic 

odor 2500 1500 

Methyl 

Isocyanate 3 0.02 0.02 0.02 2 sharp, strong 

odor 10,000 250 

Methyl 

Mercaptan 150 0.5 10 0.5 0.002 

garlic or 

rotten 

cabbage

10,000 5000 

Phosgene 2 0.1 0.1 0.1 0.4 hay or grass 500 100 

The NIOSH-recommended time-weighted average concentration limit is 0.1 ppm.14

Bayer produces phosgene at the Institute facility by reacting carbon monoxide and chlorine gas in the 

presence of a carbon catalyst. The phosgene is stored in the ECC until it is used in three nearby 

Phosgene reacts 

with proteins in the pulmonary alveoli, disrupting the blood-air barrier in the lungs. The onset of 

symptoms may be delayed and, based on available information, there appears to be no specific proven 

antidote against phosgene-induced lung injury. However, clinical experience indicates that early 

treatment of suspected phosgene exposure may be more effective than treating clinically overt 

pulmonary edema. Early treatment options include steroids and positive airway pressure ventilation, 

Patients are expected to fully recover from low-dose exposure.

 

12 The NIOSH definition for an IDLH exposure is a condition that poses a threat of exposure to airborne 

contaminants when that exposure is likely to cause death or immediate or delayed permanent adverse health 

effects or prevent escape from such an environment.

13 An odor threshold is the lowest airborne concentration that can be detected by a population of individuals.

14 Time-weighted average concentration is based on up to a 10-hour workday during a 40-hour work week. 

000042
21 

process units and to make methyl isocyanate, an intermediate chemical used to make four additional 

products. 

1.6.3 Methyl Isocyanate

Methyl isocyanate, or MIC, is one of the key chemicals used to make methomyl and two other 

products at the Institute site. MIC is a clear, colorless liquid with a strong, pungent odor, is highly 

reactive with water, and must be stored in stainless steel or glass containers at temperatures below 

40 °C (104 °F) to prevent a highly exothermic15

The NIOSH-recommended time-weighted average concentration limit is 0.02 ppm. MIC can damage 

human organs by inhalation, ingestion, and skin contact in quantities as low as 0.4 ppm. Exposure 

symptoms include coughing, chest pain, dyspnea, asthma, irritation of the eyes, nose, and throat, and 

skin damage. Exposure levels above about 21 ppm can result in pulmonary or lung edema, 

emphysema and hemorrhages, bronchial pneumonia, and death. 

self-polymerization reaction. 

Bayer is the only facility in the U.S. that manufactures, stores, and consumes large quantities of MIC. 

It stores the liquid in underground pressure vessels in the MIC production unit located in the ECC, 

about 2,500 feet east of the Methomyl-Larvin unit. Each pressure vessel is insulated and double-wall 

construction, with leak detection in the annulus between the inner and outer wall. The MIC is 

refrigerated to between -10 °C and 0 °C (14 and 32 °F). 

Prior to the incident, liquid MIC was transferred through an insulated piping system to an 

aboveground pressure vessel called a “day tank” located on the southwest corner of the Methomyl-

 

15 An exothermic reaction is a chemical reaction that generates heat.

000043
22 

Larvin production unit near the control room.16

The maximum MIC inventory in the 6,700-gallon capacity, stainless steel day tank was 

approximately 37,000 pounds (about 75 percent full). The pressure vessel was rated at 100 psig, but it 

was normally operated at 10 psig using a dedicated nitrogen supply system. The MIC was circulated 

through a chiller, and cooling coils were attached to the outside of the insulated day tank to maintain 

the MIC between -10 °C and 0 °C (14 and 32 °F). The chiller used a non-MIC reactive solvent, 

MIBK, rather than a water-ethylene glycol mixture to prevent a possible MIC-water reaction should 

the chiller leak. The MIBK system pressure was maintained greater than the MIC system pressure and 

the refrigerated ethylene glycol-water mixture system pressure in the MIBK chiller to ensure that 

water would not enter the MIC system in the event of a leak in both heat exchangers. 

 After refilling the day tank, operators drained the 

transfer line and purged it with nitrogen. 

The control system contained redundant pressure, temperature, and flow instruments including highpressure and high-temperature alarms and refrigeration system failure alarms. The area around the 

tank was equipped with air monitors to detect MIC. Firewater monitors (stationary spray nozzles) 

were located nearby to mitigate an MIC leak and suppress a fire that might threaten the tank. A wire 

rope blast blanket surrounded the entire tank and top piping connections (Figure 2) to stop debris 

from striking the day tank and to provide a thermal shield from radiant heat from a nearby fire. 

Finally, an emergency dump tank adjacent to the day tank was available to receive the contents of the 

MIC day tank and cross plant transfer line.

The MIC recirculation system, carbofuran unit transfer line, and the cross plant transfer line were 

equipped with emergency block valves that were operated from the control room. Emergency 

 

16 The day tank at the Methomyl-Larvin unit also supplied MIC to the FMC-owned carbosulfan - carbofuran 

unit through a double wall piping system. Bayer stopped using the day tank, cross-unit transfer piping and 

FMC unit in August 2010 as part of the MIC storage reduction effort.

000044
23 

generators provided power to the refrigeration system in the event of a loss of normal plant electricity. 

MIC system vents were connected to the process and emergency vent systems. 

1.7 Methomyl-Larvin Unit

The Methomyl-Larvin unit is located in the West Carbamoylation Complex (Figure 6). Methomyl 

was produced, packaged, and stored in a unit warehouse for later use in manufacturing Larvin or sold 

directly to commercial customers. Control room and outside operators were trained to work on both 

the methomyl and Larvin units. Although independent, both units were operated from the same 

control room (Figure 7). 

Figure 6. Aerial view of Bayer Institute Manufacturing Park. Methomyl-Larvin unit 

(circled) is in the West Carbamoylation Complex

000045
24 

Figure 7. Overhead view of the Methomyl-Larvin production unit

1.7.1 Methomyl Synthesis

Methomyl production involved a series of complex chemical reactions. The process began by reacting 

aldoxime and chlorine to make chloroacetaldoxime, which was reacted with sodium methyl 

mercaptide in MIBK solvent to produce methylthioacetaldoxime (MSAO). Finally, MSAO was 

reacted with methyl isocyanate in MIBK to produce methomyl (Figure 8). Excess MIC was removed 

from the methomyl-solvent solution and then the solution was pumped to the crystallizers where an 

anti-solvent was added to cause the methomyl to crystallize. Finally, the crystallized methomyl was 

separated from the solvents in the centrifuges and the methomyl cake was removed from the 

centrifuges, dried, cooled, packaged in drums, and moved to the warehouse. The liquid exiting the 

centrifuges, known as mother liquor, contained MIBK and hexane, very small quantities of 

methomyl, and other impurities. 

000046
25 

Figure 8. Methomyl synthesis process flow (dashed lines are unit-to-unit transfer pipes)

Distillation separated the solvents in solvent recovery flashers and recycled the solvents back to the 

beginning of the process (Figure 9). The unvaporized solvents and impurities including up to about 22 

percent methomyl, accumulated in the bottom of the flasher. The flammable liquids could be used as 

fuel in the facility steam boilers. However, before this flammable waste liquid, called “flasher 

bottoms,” could be pumped to an auxiliary fuel tank, the methomyl concentration had to be reduced 

to not more than about 0.5 percent for environmental and processing considerations.17 

 

17 The maximum methomyl concentration limit in the auxiliary fuel was based on environmental effluent 

criteria and the prevention of an uncontrolled methomyl decomposition reaction in the auxiliary fuel storage 

tank.

000047
26 

Figure 9. Methomyl centrifuge and solvent recovery process flow

The residue treater was used to dilute the incoming flasher bottoms in MIBK solvent and was 

designed to operate at a high enough temperature, and with sufficient residence time, to decompose 

the methomyl in the flasher bottoms stream to below 0.5 percent. The solvent and residual waste 

material were transferred to the auxiliary fuel tank for use as a fuel in the facility steam boiler. Vapor 

generated in the methomyl decomposition reaction exited through the vent condenser to the process 

vent system where toxic and flammable vapor were removed.

1.7.2 Control System Upgrade

Operators were qualified to operate the methomyl and the Larvin units, each from a separate work 

station in the control room. In 2007 Bayer upgraded the Larvin unit control system to a Siemens 

000048
27 

distributed control system (DCS)18 and upgraded the methomyl control system during the 2008 

methomyl outage.19

The DCS contains three control system interlock matrices: Safety, Operating, and Control. The safety 

matrix consists of pre-defined process deviations and computer-controlled process actions that 

determine how and when fail-safe automatic control functions are activated. The status of all safety 

matrix interlocks is displayed on a color-coded spreadsheet on the display console. Process mimic 

screens

 Bayer, with assistance from Siemens, conducted formal operator training on the 

Larvin control system upgrade in 2007 and by spring 2008, the operators were proficient in using the 

Larvin DCS.

20 also displayed safety matrix component cause/effect21

Like the Larvin system upgrade, board operators and unit engineers directly participated in 

configuring the design of the methomyl DCS. New display screens designed to mimic the process 

flow incorporated automated icons for critical equipment to show operating status and other 

parameters, included a mouse user interface, and featured improved human-machine interfaces. 

status next to the component icon. A 

password, which board operators did not have access to, was required to bypass (override) or change 

a safety matrix cause/effect fail-safe control. 

 

18 DCS are dedicated systems used to control manufacturing processes that are continuous or batch-oriented. 

The DCS is connected to sensors and actuators and uses setpoint controls to control process variables. 

19 The methomyl process was not run year-round, as demand for methomyl was such that the methomyl unit 

was operated for a few months at a time with extended outages between runs. The optimal time to perform 

major repairs and system upgrades was during these outages.

20 A mimic screen is a simplified graphical representation of a process that uses icons to display piping and 

equipment with color-coded operating status, instrumentation with output values and setpoint data, and other 

key equipment and information maintain situation awareness and to control the process. 

21 A safety matrix cause element is a pre-defined process deviation value that triggers the specified process 

component action or effect. For example, if the tank level exceeds the high-high setpoint (the cause), the fill 

line process valve is commanded to close (the effect).

000049
28 

1.7.3 Residue Treater 

The residue treater was a 4,500-gallon pressure vessel with a maximum allowable operating pressure 

of 50 psig. The relief system on the residue treater was designed to handle a maximum methomyl 

concentration not to exceed 1.0 percent. 

The vessel mechanical integrity program inspection results found that the 25-year-old vessel had 

sustained significant wall thinning due to generalized corrosion. Using the management of change 

(MOC) program, Bayer replaced the vessel during the summer 2008 outage with a new stainless steel 

pressure vessel to improve corrosion resistance. The existing recirculation piping, controls, and 

instruments were not modified. 

The vent condenser piping at the top of the residue treater was prone to blockages during unit 

operation. Gases that evolved from the methomyl decomposition reaction passed through the vent 

condenser to the flare system. The gas flow carried trace amounts of solid material into the vent 

system where they were deposited on the surface of the pipe. Over time, the accumulating deposits 

would choke the flow and cause the residue treater pressure to climb. The board operator directed 

outside operators to attach a temporary steam line to the vent pipe and flush the deposits from the 

vent pipe whenever the deposits blocked the vent and caused the residue treater pressure to approach 

the upper operating limit. 

Because the original design did not consider the need to periodically clear blockages, the valves and 

connection ports were hard to reach, so Bayer repositioned them during the unit outage to improve 

access.

1.7.3.1 Residue Treater Operation

The residue treater (Figure 10) had an automatic level control system to control the liquid level at 

about 50 percent. The residue treater recirculation system was used to heat the solvent at the 

beginning of a new production run, mix the incoming flasher bottoms into the partially filled vessel, 

000050
29 

and remove excess heat generated from the exothermic decomposition of the methomyl inside the 

vessel.

An automatic temperature control system on the residue treater monitored both the bulk liquid 

temperature in the residue treater and the liquid in the recirculation loop. During startup, the control 

system modulated the recirculation and steam flows through the heater. When the liquid temperature 

increased to the setpoint limit, the control system closed the steam flow valve, and changed the 

position of the circulation valves to redirect the recirculation flow from the heater to the cooler. The 

cooler was provided with constantly circulated 80 °C (176 °F) water, which was sufficient to remove 

excess heat from the decomposing methomyl and to maintain the liquid temperature within the 

operating limits, provided that the bulk methomyl average concentration inside the residue treater 

remained below about 0.5 percent. 

Figure 10. Residue treater piping system layout

000051
30 

At normal operating conditions, the temperature of the flasher bottoms liquid was kept at about 80 °C 

(176 °F) to prevent an uncontrolled auto-decomposition of the higher concentration methomyl. The 

contents of the residue treater were maintained at approximately 135 °C (275 °F), the temperature that 

assured the incoming methomyl quickly decomposed so as not to accumulate to an unsafe 

concentration inside the residue treater. As the flasher bottoms liquid entered the hot solution in the 

residue treater, the methomyl began to decompose. The exothermic heat of decomposition was 

controlled by vaporization, and condensing of the solvent in the vent cooler, supplemented as needed 

by the recirculation loop cooler. 

1.7.3.2 Operating Limit Control Interlocks

The residue treater control system was equipped with operating limit controllers integrated into the 

automatic feed control valve operation. A minimum temperature interlock and a maximum pressure 

interlock prevented the feed control valve from opening until the minimum temperature of the residue 

treater contents were at or above the setpoint and the residue treater pressure was below the setpoint, 

respectively. Both were designated as safety interlocks; thus, bypass control was password-protected. 

A third interlock, designated “operating,” also prevented the feed control valve from opening until 

residue treater recirculation flow was established. The standard operating procedure (SOP) 

specifically discussed the importance of these interlocks: 

Mother liquor flasher tails [flasher bottoms] can not be introduced into the 

residue treater until the pressure is not high-high, the tank temperature is not 

high-high or low-low and the circulation flow is not low-low.

The SOP contained an administrative control22

 

22 An administrative control is an action or activity that is described and managed through a specific operating 

or maintenance procedure. 

 that the operator had to perform before putting the 

residue treater methomyl feed in automatic operation: “If the tank is allowed to cool below 130 °C 

[266 °F], for any reason, it must be sampled before being heated up again.” Furthermore, the SOP 

000052
31 

cautioned, “[I]f the methomyl concentration is above 1.3 %, a run away [sic] reaction could result 

upon heating the tank.” Furthermore, the process hazards analysis stated: 

[R]egular samples of residues [flasher bottoms] from the flasher would assure 

proper operation and safety...Take regular samples of residues from the flasher

and residue treatment tank. This will assure proper operation and safety since 

safety relief sizing is based on a certain maximum methomyl concentration in

each item. 

However, the SOP did not require analyzing the flasher bottoms, nor was the system configured such 

that operators could collect a liquid sample for analysis. As discussed in the incident analysis, one key 

factor contributing to the incident was that the operators were unaware the flasher bottoms contained

an excessively high concentration of dissolved methomyl. 

1.7.3.3 Startup and Operation

The SOP contained specific steps for starting the residue treater. During these startup steps, the 

flasher bottoms flow control valve was to be set in the manual, closed position. The safety interlocks 

on the flasher bottoms flow control valve were designed to prevent feeding methomyl into the residue 

treater until the limit conditions were satisfied. The startup sequence also required the operator to 

sample the liquid remaining in the residue treater from the previous run and send it to the lab to 

confirm that it contained less than 0.5 percent methomyl. 

The startup sequence required the board operator, with the assistance from an outside operator, to 

manually pre-fill the residue treater with solvent to the minimum level of about 30 percent and to start 

the pump and achieve steady state recirculation. After reviewing the residue treater sample lab results 

to confirm the methomyl concentration was below 0.5 percent, the board operator started the solvent 

heating cycle, which was typically controlled automatically by the computer system. Finally, the SOP 

required the outside operator to collect another sample of the residue treater contents and send it to 

000053
32 

the lab for analysis to re-verify that the liquid contained not more than 0.5 percent methomyl.23

As long as the flasher and residue treater level controllers and temperature controllers were set to 

automatic, no further operator action was required to control the system. The SOP required the 

outside operator to collect a liquid sample from the residue treater only once every 24 hours and send 

it to the lab to confirm that the methomyl concentration in the liquid being transferred to the alternate 

fuel tank remained below 0.5 percent. 

Once 

confirmed, the board operator set the flasher bottoms flow control valve in the automatic position, and 

flasher bottoms would begin entering the residue treater. These steps ensured that when the flasher 

bottoms began flowing into the residue treater, the flasher bottoms were diluted and heated so that the 

methomyl would decompose rather than accumulate above safe limits.

The residue treater liquid level control was designed to operate in the automatic, continuous flow 

mode. However, in this operating mode, the flow rate was very low; thus, the alternate fuels outgoing 

transfer pipe frequently became plugged with viscous material. Therefore, the board operators kept 

the level controller in the manual operating mode and allowed the residue treater level to increase to 

the upper fill limit, and periodically transferred the liquid at a much higher flow rate to prevent the 

line from becoming plugged. The SOP was not revised to incorporate this change. 

 

23 Since the residue treater was new and not previously operated, this step was not needed for the August restart. 

However, the SOP did not allow this deviation.

000054
33 

2.0 Incident Description

The incident is described in chronological order, beginning with pre-startup activities that contributed 

to the conditions leading up to the explosion. It continues with equipment preparation, then through 

the startup of the principal methomyl unit subsystems. This section next discusses the specific 

conditions that led to the runaway reaction in the residue treater and ends with the emergency 

response discussion.

2.1 Pre-Startup Activities

Unlike the normal methomyl restart after a routine shutdown, the August restart involved operations 

personnel, engineering staff, and contractors working around the clock to complete the control system 

upgrade and residue treater replacement. Work included finalizing the software upgrades, modifying 

the work station, calibrating instruments, and checking critical components. Board operators were 

provided time at the methomyl work station so that they could familiarize themselves with the new 

control functions, equipment and instrument displays, alarms, and other system features. Other 

personnel were completing the residue treater replacement, reinstalling piping and components, and 

reconnecting the control and instrument wiring. These activities progressed in parallel with the 

ongoing Larvin unit operation. 

The methomyl control system upgrade required a revision to the SOP to incorporate the changes 

needed to operate the methomyl unit with the new Siemens system, and to reformat the SOP to a 

computerized document. However, at the time of the incident the SOP revision remained incomplete; 

the operators were using an unapproved SOP 24

 

24 The review and approval record of the working copy in use at the time of the incident was unsigned. A 

watermark on each page read “draft in review 11/13/07.” 

 that did not contain the new control system operating 

details. 

000055
34 

2.1.1 Solvent Flush and Equipment Conditioning

Many of the subsystems in the methomyl unit required a solvent flush and nitrogen gas purge to clean 

and dry the systems before startup. These activities were critical to safely start the residue treater 

system as the feed, recirculation, and vent piping had been disconnected and a new pressure vessel 

had been installed. The solvent-only run was also needed to verify instrument calibrations, proper 

equipment operating sequences, and other operating parameters in the new DCS. 

The staff flushed the process equipment with solvent to remove contaminants and water that might 

have gotten into the system during the outage. However, contrary to the SOP 25 the staff did not 

perform the residue treater solvent run.26 Operators reported that solvent flow restrictions upstream 

impeded completion of instrument calibrations because the proper adjustments could not be made at 

low flow rates. Even had the staff not needed to verify the control system function and operability, the 

solvent run was required to pre-fill the residue treater to the minimum operating level and to heat the 

liquid to the minimum operating temperature before adding the methomyl containing flasher bottoms 

feed.27

1.7.3.2

 This was essential for safe, controlled methomyl decomposition. As discussed in Section 

, the control system design prevented adding methomyl until the solvent was at minimum 

volume and temperature, but the operators bypassed the safety devices during the startup.

2.2 Unit Restart

Although the operations staff acknowledged that management had not prescribed a specific deadline 

for resuming methomyl production, onsite stockpiles of methomyl necessary to make Larvin were 

dwindling. Unit personnel recognized the important role of methomyl in the business performance of 

 

25 Although the SOP had not been reviewed and approved, as with the prior approved SOP, it required the 

solvent run. 

26 The staff acknowledged that the solvent-only run was not performed on the residue treater, but were unable to 

explain who decided to proceed with feeding methomyl to the empty, unheated residue treater.

27 The SOP warned that a runaway reaction would result if methomyl were allowed to accumulate in the residue 

treater before the treater is properly heated.

000056
35 

the facility, and a recent increase in worldwide demand for Larvin created a significant, sustained 

production schedule. Methomyl-Larvin operating staff told CSB investigators that they looked 

forward to resuming methomyl production and a return to the normal daily work routine after the long 

unit shutdown.

Operator logs documented the plan to start the MSAO (a.k.a. Oxime) unit Monday morning, August 

25. Methomyl synthesis needed to begin shortly thereafter. However, critical startup activities were 

not completed, and the staff struggled with many problems as they attempted to bring each subsystem 

on line. To complicate the startup problems, process computer system engineers had not verified the 

functionality of all process controls and instruments in the new control system. 

2.2.1 Equipment Malfunctions

Although the methomyl unit outage and new DCS implementation were incomplete, the staff 

proceeded with the unit restart. Some of the equipment was not yet operational and some equipment 

malfunctioned. For example, a few days before the incident, operators discovered that a valve had not 

been installed on a solvent feed line, which resulted in excessive solvent consumption. During one 

shift, operators discovered that heat tracing on a process line was not operating, which allowed the 

contents in the pipe to cool and solidify. 

Another problem was traced to a broken stem on a water cooling system valve on a vapor condenser. 

The closed valve prevented adequate condenser cooling, which led to an imbalance in the crystallizer 

solvent ratios and excess MSAO in the flasher bottoms. Operators also encountered many problems 

tuning control loops and calibrating instruments for the newly installed computer control system. 

These issues were compounded because the operators had not become familiar with all of the 

methomyl work station functions and changes made to some process variables. 

000057
36 

2.2.2 Methomyl Synthesis and Crystallization

The board operator startup log reported many continuing adjustments and corrections to the computer 

system. By mid-week, methomyl was being synthesized in the methomyl reactor and the crystallizers 

were put in service. The next step was to start the centrifuges to separate the crystallized methomyl 

from the solvents. The SOP was written such that two centrifuges operated in parallel. While one was 

progressing through the crystal-liquid separation cycles, the other was emptied of the crystallized 

methomyl “cake” and then refilled with a new batch of slurry. From there the methomyl cake went to 

the drying and packaging stages. This operating sequence assured that the upstream methomyl 

synthesis processes could run continuously. 

At the beginning of this startup, only one centrifuge was operational; the other had continuing 

problems with electrical connections. Regardless, the operators proceeded with the restart, using only 

one centrifuge to separate the crystallized methomyl from the liquid solvents. An operator told CSB 

investigators that maintaining the proper solvent ratios was much more difficult during the startup, 

and that he needed to closely focus on the operating conditions and frequently adjust control variables 

in the DCS.

After feeding what they presumed to be normal methomyl-solvent slurry into the centrifuge, the 

outside operators opened the centrifuge to remove the methomyl crystal cake but discovered there 

were no methomyl crystals in the centrifuge basket. The absence of methomyl crystals could have 

been due to two causes: either a malfunction prevented methomyl from being synthesized in the 

methomyl reactor, or the crystallizer solvent/anti-solvent ratio was incorrect and the methomyl 

remained in solution rather than being crystallized. If the former was the cause, methomyl would not 

be present in the flasher bottoms feed to the residue treater—there would be no methomyl to 

decompose in the residue treater. If the latter was the cause, the methomyl concentration in the 

residue treater feed would likely be significantly greater than expected—uncrystallized methomyl 

would remain in solution and eventually accumulate in the flasher bottoms. 

000058
37 

2.2.3 Solvent Recovery

As the operators worked through the ongoing myriad problems during the methomyl startup, they 

were depleting the fresh solvent inventory faster than expected. Therefore, they needed to get the 

solvent recovery system on line as quickly as possible to replenish the solvents. The residue treater 

was the last processing step in the solvent recovery system.

The liquid exiting the centrifuge normally contained only about 0.5 percent methomyl, some MSAO, 

trace impurities, and solvents. Routine collection and testing during startup indicated that the 

methomyl concentration was more than double the maximum operating limit value and as high as 4.0 

percent, eight times greater than the specified operating limit for the four collected samples. These 

samples confirmed that methomyl was being synthesized in the reactor and that the solvent ratio was 

off specification in the crystallizer so the methomyl did not crystallize. Again, ongoing equipment 

issues and improperly calibrated and tuned instruments distracted the staff. They did not review the 

lab results so were unaware of the over-concentration problem and continued solvent recovery startup 

activities. 

The solvent flasher separated and extracted the solvents for reuse. Trace impurities and MSAO 

accumulated in the bottom of the flasher along with the non-recoverable solvents and methomyl. 

These so-called flasher bottoms typically contained about 22 percent methomyl when all upstream 

process equipment was operating within the specified parameters. However, unknown to the startup 

team, the gross solvent imbalance in the crystallizer caused the methomyl concentration to climb to as 

high as 40 percent, nearly twice the design basis amount.28

 

28 The process hazards analysis (PHA) discussed the importance of sampling the residue treater feed (flasher 

bottoms) to verify that the methomyl concentration did not exceed the residue treater design limits. However, 

the SOP did not require such a sample, and no sample collection point was available in the system. The 

designers presumed that the flasher feed sample and in-specification flasher column operation would assure 

methomyl concentration in the flasher bottoms would not exceed the design limit. 

 

000059
38 

2.2.4 Residue Treater Startup

The residue treater was the last equipment to be started. The critical startup safety prerequisites, prestartup solvent fill and heat-up were omitted from the restart activities. Furthermore, the board 

operators bypassed the minimum operating temperature interlock that prevented adding methomyl 

into the residue treater, as some operators were accustomed to doing. The minimum recirculation loop 

flow interlock on the feed valve was also left bypassed by the computer programmers. Without 

recirculation flow, the concentrated methomyl feed was not adequately mixed with what should have 

been preheated solvent already in the residue treater. 

Operators told CSB investigators that, based on operating experience, there would be little methomyl 

in the system “this early in the startup.” That is most likely the reason the operators skipped the 

sample collection and analysis steps. 

On August 28, at approximately 4 a.m., the board operator manually opened the residue treater feed 

control valve and began feeding flasher bottoms into the nearly empty vessel. With a low flow rate of 

about 1.5 gallons per minute, more than 24 hours would be required to fill the residue treater to 50 

percent, the normal operating level. The operations staff did not discuss the residue treater operating 

status at the 6 a.m. shift change, as they were preoccupied with other startup issues.

Samples from the second sample point, the residue treater outlet, were not collected and tested as 

required by the startup procedure or at the normally scheduled time, the beginning of the day shift. 

Operators offered two explanations for not sampling the residue treater contents during the restart 

activities. First, since the centrifuges contained no methomyl cake, the staff incorrectly concluded that 

methomyl had not been synthesized. Second, the outside operator on the day shift was unaware that 

the residue treater had been put into operation—the night shift crew did not tell the day shift crew that 

the feed to the residue treater had been started.

The outside operator started the recirculation pump at 6:14 p.m. as directed by the board operator. 

The residue treater liquid level was approximately 30 percent (1,300 gallons) and the temperature 

000060
39 

ranged between 60 and 65 °C (140-149 °F), still significantly below 135 °C (275 °F), the critical 

decomposition temperature. The pressure remained constant at 22 psig. At 6:38 p.m., the temperature 

began steadily rising about 0.6 degrees per minute (Figure 11). At 10:21 p.m., the level was 51 

percent when the recirculation flow suddenly dropped to zero.29 In less than 3 minutes, the 

temperature was at 141 °C (286 °F), rapidly approaching 155 °C (311 °F), the safe operating limit, 

and climbing at the rate of more than two degrees per minute. 

Figure 11. Residue treater process variables before the explosion. Failure occurred at 22:33, as 

shown at vertical dotted line

 

29 A Bayer review after the incident determined that the split-range temperature control was incorrectly 

programmed in the DCS. In the process of changing from heating to cooling, the residue treater recirculation 

flow valves to both the heater and cooler closed, blocking all recirculation flow. However, the CSB 

concluded that this was not causal to the runaway reaction and vessel rupture.

000061
40 

At approximately 10:25 p.m., the residue treater high pressure alarm sounded at the work station. The 

board operator immediately observed that the residue treater pressure was above the maximum 

operating pressure and climbing rapidly. Not understanding what was wrong, but suspecting a 

blockage in the vent line, he contacted the outside operator and directed him to go to the residue 

treater to check the vent system.30

2.3 Explosion and Fire

He also asked a second outside operator to assist. He then manually 

switched the residue treater recirculation system to full cooling, hoping that that might slow or stop 

the climbing pressure. 

At 10:33 p.m., a few minutes after the board operator talked to the outside operators, a violent 

explosion rocked the control room. A huge fireball erupted on the south side of the unit as alarms 

sounded on the methomyl and Larvin work stations. Operators scrambled to shut the systems down. 

The onsite fire station located nearby shook from the explosion as the emergency alarm sounded. 

Outside operators rushed to close valves, de-energize equipment, and activate stationary water 

cannons to begin fire suppression efforts. Water cannons were also directed at the MIC day tank blast 

blanket structure to help keep the day tank cool and prevent the fire from spreading to the tank.

Shortly after the explosion one of the two outside operators who had gone to investigate the residue 

treater problem was seen walking toward the control room. Coworkers quickly came to his aid and 

took him to a safe area until help arrived. He was badly burned. The body of the other outside 

operator was located about 4 hours later. 

The bolts holding the residue treater support legs to the concrete foundation sheared off as the shell 

and top head of the 5,700-pound residue treater careened into the methomyl unit. The bottom head 

separated from the shell (Figure 12 and Figure 13) and came to rest about 20 feet from the residue 

 

30 The CSB was later told that, in hindsight, plugging in the newly installed vent system could not have been the 

cause of the pressure excursion. The residue treater had not operated long enough to cause deposits to 

accumulate inside the vent pipe.

000062
41 

treater foundation. The explosion destroyed nearby pumps, heat exchangers, and electrical 

switchgear. The fire was fueled primarily by the solvent inside the residue treater and other 

flammable liquids that spilled from the ruptured piping systems. 

 

Figure 12. Residue treater bottom head (left); vessel shell and top head (right)

Figure 13. Residue treater shell and top head recovered from inside the 

Methomyl-Larvin unit

000063
42 

The residue treater struck a large support column on the four-story process unit structure and sheared 

it off the baseplate on the concrete foundation (Figure 14). Small debris, including conduit, valves, 

small diameter pipe segments, and insulation, was thrown in all directions, some of which struck, but 

did not penetrate the MIC day tank blast blanket. The blast blanket also functioned as a heat shield to 

protect the tank and attached piping from the intense solvent-fueled fire.

Figure 14. Structural column (arrow) ripped from the steel baseplate (left)

The overpressure produced by the rupturing residue treater damaged properties in the surrounding 

community. Mobile homes, houses, businesses, and vehicles sustained primarily window breakage 

and minor structural damage. The majority of the property damage reports were within 1.5 miles of 

the explosion epicenter; however, some damage was reported as far away as 7 miles (Figure 15). 

Bayer received 57 property damage claims from residences and businesses totaling about $37,000. 

000064
43 

Figure 15. Aerial view of locations of reported offsite property damage

2.4 Emergency Notification and Response

2.4.1 Bayer CropScience Response

The Bayer fire brigade was at the scene within minutes of the explosion and set up a command post 

northeast of the methomyl unit, where the incident commander began coordinating the response as 

fire equipment and personnel arrived. Plant responders established and directed a water stream to the 

fire zone from the north. 

About 5 minutes after the explosion, Metro 9-1-1 contacted the Kanawha County Emergency 

Ambulance Authority (KCEAA) and advised the agency of a large explosion at the Bayer plant. 

Emergency Medical Services (EMS) personnel began staging at the main gate about 2 minutes later. 

Within 6 minutes of the explosion, fire alarms sounded at the Institute and Tyler Mountain volunteer 

fire departments in accordance with the established mutual aid protocol. Institute fire department 

responders staged at the main gate with backup equipment and supplies. Tyler Mountain firefighters 

000065
44 

joined the Bayer fire brigade at the methomyl unit to battle the blaze. A Metro 9-1-1 operator 

contacted the security guard at the Bayer main gate 9 minutes after the explosion.31

2.4.2 Local and State Emergency Response Agencies

Bayer activated 

its Emergency Operations Center (EOC) at 10:45 p.m. Twelve minutes into the incident, the Bayer 

security guard asked the Metro 9-1-1 operator to dispatch an ambulance for a worker burned in the 

fire. The emergency response timeline is shown in Appendix B.

As provided in the Kanawha Putnam Emergency Management Plan, the Kanawha Emergency 

Management Director ordered the Kanawha Putnam Emergency Operations Center (EOC) to be 

activated. County personnel staffed the EOC, which served as the centralized communications hub for 

all emergency response dispatch of police, fire, and EMS for Kanawha and Putnam counties. 

The Kanawha County Sheriff heard a loud explosion at about 10:30 p.m. After hearing state and 

county radio traffic indicating that an explosion had occurred near the Bayer plant, he radioed Metro 

9-1-1 while en route to the facility. He then requested that Metro Communications contact the Nitro 

and Dunbar Police Departments to arrange for roadblocks of Route 25 at the city limits to restrict 

traffic flow into the Institute area. The county EOC also routed information to and from the various 

responding municipal, state, and county agencies. Responding agencies included South Charleston, 

Nitro, and Dunbar Police Departments; the Jefferson and St. Albans Fire Departments; the Kanawha 

County Sheriff’s Department; the State Fire Marshal’s Office; the U.S. Bureau of Alcohol, Tobacco, 

and Firearms and Explosives, (ATF); and the KCEAA. All of these agencies routed their 

communications through the EOC during the emergency (Figure 16). As the night progressed, the 

Metro 9-1-1 call center received more than 2,700 phone calls, which overwhelmed the system. 

 

31 The Bayer security guard told investigators that he tried many times to get through to Metro 9-1-1 but the line 

rang busy. The Metro 9-1-1 operator also had trouble getting through to the Bayer guard shack.

000066
45 

Upon arrival at the main gate about 10 minutes after the incident occurred, the Institute Volunteer 

Fire Department chief set up a command post and assumed the role of resource commander. In this 

role, he coordinated with the Bayer IC to provide outside mutual aid resources of personnel and 

equipment as needed. After the Institute fire department chief made the initial contact, the Bayer IC 

advised him that based on air monitoring information, “everything [was] being consumed in the fire” 

and that a shelter-in-place was not necessary. However, when the Kanawha County Sheriff arrived, he 

noticed an acrid smell in the air and not knowing the source, felt that he and his deputies might be at 

risk; thus, he ordered his deputies and state police to relocate to the Shawnee Park EOC, the location 

so designated in pre-planning exercises.

Immediately after the incident began, the Director of Regional Response Teams (RRT) for West 

Virginia, who works in the State Office of Emergency Services (OES) and was unsatisfied with the 

information being provided by Bayer, called the State Fire Marshal to assess the incident.32 Bayer 

EOC personnel directed the Fire Marshal to the onsite EOC, where he tried, unsuccessfully, to get 

information that would allow an accurate assessment of the conditions and status of the incident 

response. Based on his observations of fire suppression operations, the Fire Marshal ordered the RRT 

unit, a trailer with supplies and other resources stationed in Nitro, be brought to the site for use if 

needed. He then went to the EOC at Shawnee Park. 

 

32 The State Fire Marshal is responsible for hazardous material incidents, incidents involving weapons of mass 

destruction, and mass casualty operations. The State Fire Marshal also provides guidance to 447 departments; 

more than 11,000 firefighters; and is responsible for code enforcement, fire safety, and investigations.

000067
46 

Figure 16. Methomyl unit explosion emergency communications diagram

000068
47 

At about 11:00 p.m., the St. Albans fire chief, after seeing a smoke cloud advancing towards St. 

Albans, requested information from Metro 9-1-1 about the composition of the cloud. As it 

approached, the chief advised Metro 9-1-1 dispatchers that if he did not get clear information 

regarding the make-up of the cloud, he would initiate a shelter-in-place advisory for the St. Albans 

community. 

At 11:19 p.m., Metro 9-1-1 announced a shelter-in-place for the immediate area surrounding the 

Bayer facility, and initiated a reverse ring-down notification33

Figure 17

to the residents in the affected 

community. Five minutes later, Bayer recommended that Metro dispatchers issue a shelter-in-place 

for the St. Albans area. At about 11:34 p.m., the KPEPC activated the County Emergency Alert 

System, which in turn initiated a shelter-in-place for the areas west of Charleston to Putnam County 

line. The shelter-in-place affected about 40,000 residents ( ).

Figure 17. Areas and population affected by the shelter-in-place

 

33 A reverse ring-down notification system is an automatic calling system that automatically calls residents and 

businesses in pre-defined areas. It delivers a pre-recorded message advising action to be taken in response to 

a community emergency. 

000069
48 

At 12:34 a.m., a little more than two hours after the incident occurred, Bayer notified the National 

Response Center. At 2:05 a.m., about 3 hours and 30 minutes after the incident began, Kanawha 

Putnam EOC declared the area west of Charleston, which included St. Albans, Nitro, Jefferson, 

Dunbar and Institute safe to re-enter and canceled the shelter-in-place action. 

2.4.3 Emergency Operations Center Activations

As the response to the emergency progressed, three EOCs were activated, which contributed to 

confusion and communication difficulties. The first, the Bayer EOC, was located along the northern 

boundary of the plant adjacent to Route 25, and was staffed by Bayer personnel including the WCC 

unit manager; Health, Safety, and Environmental Manager; and operations manager. This site was 

less than one-half mile from the incident and was part of the Bayer emergency planning process. One 

function of the Bayer EOC was to coordinate communication with Bayer corporate staff in Raleigh, 

North Carolina, and provide updates to the media. It was also responsible for communicating incident 

status and mutual aid assistance with the outside emergency response agencies.

The Kanawha Putnam EOC was activated at the Metro 9-1-1 call center in South Charleston. The 

center was staffed by county personnel and served as the centralized communications hub for all 

emergency response dispatch of police, fire, and EMS for Kanawha County.

As part of the Bayer emergency notification ring-down system, the plant’s environmental specialist 

was notified of the incident and advised to report to the Kanawha Putnam EOC in response to its 

request for a Bayer representative to relay information directly to the county authorities. The 

environmental specialist arrived at the Kanawha Putnam EOC between 11:40 p.m. and 12:00 a.m. 

Shortly after arriving, he phoned the Bayer EOC to obtain information regarding the location of the 

fire and the substances thought to be involved. He spoke to the Health, Safety, and Environmental 

Manager and his supervisor and was able to provide the dispatchers with information regarding three 

substances thought to be involved in the incident: dimethyl disulfide (DMDS), methyl isobutyl ketone 

(MIBK), and acetonitrile. However, Bayer was slow to provide additional details. 

000070
49 

The Kanawha Emergency Management Director also activated a mobile EOC at Shawnee Park, 

which was located on Route 25 less than a mile to the southeast of Bayer. Two Bayer environmental 

specialists reported there to act as liaisons with non-Bayer responders. Representatives from the 

Department of Highways, State Police, and the Sheriff’s office also reported to the Shawnee Park 

EOC.

2.5 Air Monitoring 

At the time of the incident, the two AreaRae® fence line air monitors34

Continuous air monitors were located in and around the production units to detect fugitive leaks in 

process equipment

 were positioned on the east 

end of the plant and on the west riverbank to detect concentrations of airborne chemical contaminants 

and alert facility occupants if air concentrations exceeded safe levels and had traveled beyond plant 

boundaries. The CSB investigators examined the monitor data and determined that the fence line 

monitors did not detect hazardous concentrations of the chemicals sampled. Another AreaRae system 

monitor recorded atmospheric winds, temperature, and barometric pressure. 

35

However, in May 2008, the analyzer malfunctioned, causing spurious alarms. Although technicians 

investigated, they had not resolved the problem before the August methomyl unit startup. The CSB 

learned that the system had not been repaired and restarted even though the MIC storage tank had 

or leaks resulting from process upsets. The Methomyl-Larvin unit had 16 

localized MIC sample points connected to an analyzer, which Bayer installed in March 2006 to

continuously sample and record MIC concentrations at 2-minute intervals. If concentrations exceeded 

1.0 ppm, the system was designed to activate a visual alarm display in a room on the second floor of 

the Methomyl-Larvin control building. 

 

34 An AreaRae instrument is a direct-reading device that continuously samples for a wide range of chemicals 

including oxygen, carbon monoxide, chlorine, volatile organic compounds (VOC), and methane.

35 A fugitive leak is a small leak in process equipment. Such leaks are commonly called “fugitive emissions,” 

which must be identified and corrected.

000071
50 

remained in service. On the night of the incident, the personnel in the Bayer EOC were unaware that 

the monitoring system was not active, therefore they assumed it would alarm if it detected airborne 

MIC or other detectable chemicals during the incident response. They had no way of knowing if toxic 

vapors from chemicals used in the methomyl unit were escaping into the air. 

The MIC production unit, located about 1,800 feet from the Methomyl-Larvin unit, had a similar MIC

air monitoring system with 16 stationary sample points. The analyzer recorded the results at 2-minute 

intervals. This analyzer was operational on the night of the incident but did not detect any chemicals 

including MIC during or after the incident.

000072
51 

3.0 Incident Analysis

3.1 Residue Treater Replacement 

The Mechanical Integrity program on the original, 25 year old carbon steel residue treater identified

significant service degradation. Bayer, through the MOC program, replaced it with a corrosionresistant stainless steel vessel in anticipation of the planned increase in methomyl production. With 

the exception of substituting stainless steel for the carbon steel and associated material thickness 

changes required by the American Society of Mechanical Engineers Boiler and Pressure Vessel Code 

(ASME Code), Section VIII design rules, the new ASME Code-stamped vessel was identical to the 

original. The CSB concluded that this process modification did not contribute to the incident cause or 

consequences. 

3.2 Internal Compliance Auditing

3.2.1 Corporate Process Safety Management Audits

The Bayer North America corporate assessment team conducted an audit of the Methomyl-Larvin 

unit in July 2005. The team, composed of four auditors from other Bayer facilities and business units, 

specialized in process safety, mechanical integrity, and pressure vessel engineering. The team audited 

against 7 of the 14 elements in the OSHA Process Safety Management standard36

The final report, issued in 2006, identified 17 PSM compliance issues in the audit focus areas. Several 

findings included deficiencies with tracking the status of recommendations and corrective actions 

from PHAs, equipment inspections, and compliance audits. As required by Bayer corporate standards, 

the Institute site developed a list of recommendations and corrective actions to resolve the findings 

and the emergency 

response requirements in the EPA Risk Management Program. 

 

36 The 2005 corporate PSM audit focused on process safety information, process hazards analysis, operating 

procedures, mechanical integrity, management of change, incident investigation, and compliance audits.

000073
52 

and entered them into a new action tracking system with an assigned responsible person for 

completion. 

3.2.2 Audit Action Tracking System Upgrade

In 2006, Bayer implemented a new action tracking system in response to OSHA citations issued in a 

2005 Institute facility inspection, which faulted Bayer for not having a tracking system to assure PHA 

recommendations were resolved, documented, and communicated. In 2006, Bayer program 

developers in Research Triangle Park, North Carolina developed the system for the Bayer facilities. A 

new tracking system feature contained a workflow integration function that automatically sent 

notifications to responsible parties and required electronic approval by managers to close completed 

actions. However, even with this new system, problems with action item tracking and closure 

continued. 

3.2.3 Process Safety Management Self Assessments

Institute site personnel audited the Methomyl-Larvin unit against the PSM standard in 2004 and in 

2007. The PSM “facilitated self assessment” was conducted every three years as required by the PSM 

standard. The 2007 facilitated self assessment found that action tracking deficiencies identified in 

previous corporate PSM audits and facilitated self assessments remained unaddressed. The audit also 

found that even after the OSHA citation 2 years earlier, action items generated in PHAs on the 

Methomyl-Larvin unit still were not being tracked and closed. 

CSB investigators reviewed the corrective action plans identified in the corporate PSM audits and the 

PSM facilitated self assessments and identified similar shortcomings. For the 2005 corporate PSM 

audit, some listed corrective action items were still open. Some of the items listed on the 2007 

facilitated self-assessment action plan were overdue by more than 9 months at the time of the August 

2008 incident including one requiring the revision of Methomyl-Larvin unit SOPs. 

000074
53 

3.3 Process Hazards Analysis 

A Bayer team that included an experienced facilitator, process engineer, and experienced unit 

operations personnel conducted the methomyl system process hazards analysis (PHA) in 2005 using a 

hazard and operability study (HAZOP) technique. The team also used Bayer’s semi-quantitative risk 

matrix to analyze whether additional protections were required for the various scenarios identified in 

the HAZOP. Properly applied, these tools can identify improvements that could have prevented the 

residue treater incident. However, the relatively short duration of the PHA, and the team’s poor 

application of the tools during the process, produced results that failed to identify significant 

unmitigated scenarios that needed recommendations.

3.3.1 PHA Duration and Staffing Deficiencies

Poor execution of the PHA was due in part to the way Bayer had structured it and the total hours the 

PHA team worked. Bayer assigned methomyl unit operators to the PHA team, but most were only 

present for a few hours each. Most revealing is that in just 12 meeting days, for an average of 6 hours 

per day, the team analyzed 37 HAZOP nodes, including analyzing risks to determine if additional 

protections were needed. Considering the complexity of the unit the time spent on the HAZOP was 

insufficient to address all the critical process safety information, draw logical conclusions, and 

determine appropriate recommendations. 

3.3.2 PHA Assumptions Deficiencies 

The 2005 PHA team failed to validate critical assumptions used in their analyses. For example, the 

team accepted defined procedure steps without confirming that the operators rigorously followed the 

procedures. They also incorrectly assumed that the automatic safeguard controls listed in the safety 

matrix remained operational during all operating modes. Through staff interviews, CSB investigators 

learned that some board operators bypassed the two safety interlocks on the residue treater feed 

control valve during startups based on their experience with the residue treater heater not heating the 

000075
54 

solvent to the minimum temperature interlock setpoint. With the interlocks in bypass, they manually 

opened the flasher bottoms feed valve when the residue treater temperature was about five degrees 

below the required operating temperature. The heat generated by the decomposing MSAO and 

methomyl would finally increase the residue treater temperature to the minimum operating value. 

Because the PHA team was apparently unaware of any problem with the residue treater heater, and 

assumed the safeguards were active, it did not recommend that management resolve the residue 

treater startup issues. However, with the interlocks in bypass, the residue treater had insufficient 

protections to prevent accumulating a large quantity of cold, highly concentrated methomyl and 

MSAO in the residue treater.

The CSB investigators noted another significant PHA performance deficiency, namely that the PHA 

team identified an issue with the old control system that persisted in the new system:

The control system for methomyl is antiquated and there is no Safety 

Instrumented System (SIS) for a process with an above average level of hazards 

and risks. The operators have access to the control system that allows them to 

make unauthorized program changes and to alter alarm settings...

ANSI/ISA standard 84.00.01–2004 (Functional Safety: Safety Instrumented Systems for the Process 

Industry Sector) – which is a recognized good engineering practice required for compliance with the 

OSHA Process Safety Management standard – recommends a Safety Instrumented System that is 

separate and independent from the basic process control functions. Among other requirements, the 

standard provides that “Bypass switches shall be protected by key locks or passwords to prevent

unauthorized use.” 

Despite knowing that interlock settings could be accessed and changed by the operating staff without 

proper safety reviews as required by the management of change program, the PHA team did not make 

any recommendations to improve computer access control. In the August 2008 incident, lack of 

000076
55 

password access control to the new DCS allowed the staff to bypass the safety interlocks, which 

directly resulted in the runaway reaction and catastrophic residue treater failure.

3.3.3 Inadequate Process Safety Information Reviews

The PHA did not adequately incorporate the process safety information used as a basis for the 

assumptions and conclusions. The process safety information package from the original construction 

project discussed the importance of controlling the methomyl concentration in the flasher bottoms 

feed to the residue treater to preclude a runaway reaction. The Methomyl Process Description in the 

SOP discussed the importance of controlling methomyl concentration in the residue treater at least 

five times. For example, it cautioned, “Even with normal flow rates, care must be taken to prevent 

over concentrating residues in the mother liquor flasher tails.” Again, it warned, “The interlocks 

should prevent feeding the tank when it is cold, but if the methomyl concentration is above 1.3%, a 

run away [sic] reaction could result upon heating the tank.” In contrast, the PHA team concluded that 

a high residue concentration in the flasher feed was an operations issue having “no consequence.” 

Another PHA item concluded, without substantiation, that the residue treater feed valve lowtemperature safety interlock would “function as intended” and prevent a high methomyl concentration 

runaway reaction. 

A September 1994 PHA considered high methomyl concentration caused by off-specification solvent 

in the crystallizer. However, that PHA team concluded that the solvent recovery system and the 

residue treater system could handle the excess methomyl because they considered the existing safety 

interlocks to be adequate protections. The team did not consider any operational errors or startup and 

shutdown scenarios that could lead to a large quantity of under-temperature methomyl and MSAO in 

the residue treater. 

The 2005 PHA team used the “Bayer CropScience PHA Quick Reference Guide” to qualitatively 

evaluate the unmitigated and mitigated risk for various scenarios and determine whether the system 

needed more protections. It concluded that high methomyl concentration downstream of the 

000077
56 

crystallizer was only a product quality problem, which the operations staff would resolve. In 

analyzing a possible residue treater rupture caused by a runaway reaction scenario, the team assumed 

that the low temperature interlock and the operating sequence described in the SOP provided 

adequate controls to prevent feeding methomyl until the system was at the minimum safe operating 

conditions. Based on these protections, the team determined that the outcome was in a range that the 

guide listed as not requiring additional protections. However, the original design basis concluded that 

a relief system could not be designed to prevent a catastrophic failure of the residue treater if the 

methomyl concentration exceeded the design limit. 

3.3.4 Analysis Deficiencies 

In addition to analyzing the hazards of a process based on the equipment information, the PHA should 

examine the human interactions with the equipment. In particular, for operational tasks that depend 

heavily on task performance and operator decisions, the team should analyze the procedures 

step-by-step to identify potential incident scenarios and their consequences, and to determine if the 

protections in place are sufficient. 

According to “Guidelines for Hazard Evaluation Procedures” (CCPS, 2008), 

Personnel may have less operating experience with procedure-based operations 

that are heavily dependent on task performance and operator decision-making. In 

addition, safeguards may be bypassed or not fully functional during some modes 

of operation such as at start-up of a continuous process. Performing a hazard 

evaluation of procedures can identify steps where the operator is most vulnerable 

and point to means of reducing the risk of an incident, such as by adding 

engineered safeguards and improving administrative controls. 

The publication further recommends that procedures expected to involve major hazards should be 

subjected to a detailed procedure-based HAZOP study using guidewords similar to those used for 

000078
57 

batch chemical processes. CCPS also gives guidance for hazard analyses for processes that include

programmable control systems, chemical reactivity hazards, facility siting, and the combination of 

tools such as Hazard and Operability Studies with Layer of Protection Analysis. The PHA team could 

have addressed all these topics in analyzing the methomyl process. 

3.4 Pre-Startup Safety Review

The CSB concluded that Bayer did not conduct an adequate Pre-Startup Safety Review (PSSR) for 

the control system upgrade and the residue treater replacement. Furthermore, staff interviews 

indicated that the limited PSSR work did not directly involve operators or other subject matter 

specialists. An eight-page checklist recorded the PSSR for the residue treater and required a “yes,” 

“no,” or “not applicable” checkbox mark for a series of questions and key subjects; a field at the 

bottom of the page was available for comments. The PSSR team incorrectly identified some items as 

being completed when they clearly had not been. For example, the team did not identify the SOP 

inadequacies that should have been addressed in the PSSR checklist item, “Do operating procedures 

exist that adequately cover the MOCR (management of change review)?” The existing operating 

procedures were not revised to address information specific to the new control system. However, the 

PSSR question was incorrectly answered “yes.”

The PSSR for the control system change had errors involving equipment checkouts that were marked 

as complete. A thorough PSSR should include verification that all equipment has been installed and 

configured for startup before any chemical is introduced into the system. As discussed in Section 

2.2.1, while starting the unit, staff discovered that a valve had not been installed on a solvent drip line 

and that another valve was broken. The PSSR missed these two equipment installation problems that 

directly contributed to the overconcentration of methomyl in the flasher bottoms and ultimately led to 

the residue treater explosion.

The control system PSSR also had errors involving incomplete items. Although the PSSR marked the 

items as incomplete, the team did not record due dates for follow-up items. For example, the PSSR 

000079
58 

asked whether adequate technical coverage had been specified for the startup, and the PSSR team 

marked the item “no.” They listed two people as responsible for this follow-up, but did not specify a 

due date for completion. Section 0 discusses the lack of sufficient technical coverage during the 

startup. 

3.5 Human Factors Deficiencies

3.5.1 Control System Upgrade 

The introduction of the Siemens PCS7 control system significantly changed the interactions between 

the board operators and the DCS interface. The Siemens control system contained features intended to 

minimize human error such as graphical display screens that simulated process flow and automated 

icons to display process variables. But the increased complexities of the new operating system 

challenged operators as they worked to familiarize themselves with the system and units of 

measurement for process variables differed from those in the previously used Honeywell system.37

Human interactions with computers are physical, visual, and cognitive. New visual displays and 

modified command entry methods, such as changing from a keyboard to a mouse, can influence the 

usability of the human-computer interface and impair human performance when training is 

inadequate. Operators told CSB investigators they were concerned with the slower command 

response times in the Siemens system and they talked about the methomyl process control issues they 

would face during the restart, which was much more difficult to control than the Larvin process. 

Board operators also told CSB investigators that the detailed process equipment displays in the DCS 

were difficult to navigate. Routine activities like starting a reaction or troubleshooting alarms would 

require operators to move between multiple screens to complete a task, which degraded operator 

awareness and response times.

 

 

37 For example, one variable in the old computer system was displayed as “percent full” whereas the new 

system recorded total “pounds” in the vessel.

000080
59 

The old system display and command entry was basically a spreadsheet, or line-item display. The 

new system used a graphical user interface (GUI) that displayed an illustrative likeness of the process 

and its various components (Figure 18). The board operator selected the device that needed to be 

changed. This made data entry clearer, but much slower. In the old system, board operators could 

change multiple process variables simultaneously, but they could select and change only one variable 

at a time in the Siemens system. 

Figure 18. Typical Siemens work station screen display

000081
60 

The new control system also changed how board operators monitored multiple pieces of equipment. 

The methomyl board operators’ station had five display screens available to monitor the methomyl 

processes and one display screen dedicated to process alarms. However, operating some methomyl 

equipment required the operators to use at least three of the five display screens. To simplify the 

operation, they asked the Siemens project engineers to add equipment overview screens to display 

multiple pieces of equipment. The board operators believed that the overview screens would provide 

more effective control of the unit; however, the screens were not available for the August 2008 

startup.

3.5.2 Operator Training

The Siemens system switchover configuration for the Larvin unit began in early 2006, and the Larvin 

unit startup with that new DCS occurred in early 2007. The Larvin board operators attended four 

sessions of formal training during their shifts prior to the actual Larvin start-up. A Bayer process 

engineer and a contractor from the engineering company that configured the DCS conducted 

comprehensive training on the Larvin system before the Larvin unit was restarted. Board operators 

also used a Siemens operating station simulator to learn the Larvin system DCS functions and 

familiarize themselves with controlling different devices such as block valves, control valves, and 

pumps. Informal, on-shift training also took place and resources were available during the Larvin 

startup to assist operators, and support continued to be provided as needed. 

For the Larvin system, board operators received a document labeled the “Siemens training manual” 

that included a system architecture description; glossary of tag names for controllers, alarms, and 

indicators; and an overview of the screen layouts. The manual also included a description of the 

application of operational and safety interlock matrices. Well-designed training manuals typically 

contain precise descriptions of computer control steps, icon definitions, menu hierarchy, and 

equipment-specific control examples. However, the Siemens training manual was not a well-designed 

000082
61 

computer system training tool. The information in the manual did not correspond with the procedural 

steps the operators would take to run the control system. According to the Center for Chemical 

Process Safety (CCPS, 1994) control system providers should develop training tools and procedures 

based on how the user perceives the task. Using those tools in conjunction with classroom sessions 

and simulator training on normal and abnormal conditions fully prepares operators for transitioning to 

a new control system.

Management concluded that comprehensive formal training and practice using the new DCS on the 

methomyl process was unnecessary. They incorrectly assumed the methomyl and oxime board 

operators had become proficient from the many operating hours using the DCS on the Larvin unit. 

Methomyl and oxime board operators had minimal training on a few specific processes, but general 

training took place during the operators’ shift as time allowed, and was self-directed and self-paced. 

Informal, on-the-job training intended to develop the necessary skills to run the system can lead to 

inappropriate or incorrect practices that became the norm in the absence of proper training tools and 

instruction (CCPS, 1994). The CSB concluded the training was inadequate. 

Prior to the methomyl startup, management provided operators time on the console during the DCS 

upgrade to practice using the new system. However, management did not require any methomyl 

operator to use this time to learn and practice operating the methomyl unit, and operators could decide 

for themselves how much time they needed to become familiar with the new DCS. Management also 

assumed that operators directly involved in designing the mimic displays, such as the one in Figure 

18, and other customizable features would have had adequate exposure to the new system.

Although operators had become proficient using the system on the Larvin unit, they acknowledged 

that the new methomyl control system created new challenges with operating the methomyl process 

unit, some of which were driven by the highly complex process chemistries involved in synthesizing 

methomyl. Substituting previous control system experience for training on a new process can be 

000083
62 

problematic. Even minor differences in operation challenge an unfamiliar operator unless the operator 

has had process-specific training on the new equipment (CCPS, 1994).

Operators also told CSB investigators that the mouse interface command entry sequence responded 

slower than the Honeywell keyboard command entry process. They also reported that they were not 

familiar with some of the revised units of measure used to display equipment status and operating 

conditions that had been changed with the new DCS system installation. For example, one operator 

reported that the old control system used “percent full” to indicate the level in a vessel, but the new 

control system listed the level in total gallons inside the vessel. The methomyl operators had to 

improvise solutions to resolve the confusion by attaching paper conversion sheets on the work 

console for quick reference. However, at the time of the incident, some conversion charts had not yet 

been made. One operator told investigators:

There was an issue with the solvent ratio, because when we went to the Siemens 

system the ratio was a different number...We were not sure if we were feeding 

the wrong amounts...When we first started this process we were pretty much 

guessing...No one came in and told us what amounts to put in for the new 

system.

As with any new control system, the Siemens system required process tuning before it was placed in 

service. Specifically, an issue arose in the MIBK-hexane separation column: high MIBK 

concentration prevented the automatic control system from effectively operating the separation 

column. The board operators observed that the column temperature was fluctuating undesirably and 

that the automated valves were operating sluggishly. The unstable MIBK-hexane separation column 

caused excess methomyl to pass downstream as there was too little hexane in the system to achieve 

proper methomyl crystallization. Had the board operators received comprehensive DCS training, they 

might have recognized the problem much sooner. 

000084
63 

3.5.3 Operator Fatigue

Unit startups and shutdowns typically involve significant increases in staff workload, which may 

result in longer work hours and extended back-to-back workdays. Many operators and other key staff 

were working 60 to 70 hours per week prior to the August 2008 methomyl startup, and some reported 

working 18-hour shifts with only 6 hours of downtime. Overtime and shift work demands disrupt 

sleep cycles and cause fatigue, which can adversely affect performance and safety (Stanton, 2010). 

The rigors of shift work, rotating between day and night shifts, and working large amounts of 

overtime can impair decision-making, reaction times, and degrade communications. Performing 

infrequently used startup and shutdown procedures while fatigued increases the chance of errors. 

Fatigue also degrades competencies and alertness necessary to successfully operate an unfamiliar 

control system. Personnel are more likely to make mistakes as fatigue increases. Labor-intensive, 

non-routine activities including integrating utilities such as steam and other ancillary systems into the 

startup sequence complicate operator startup duties. 

The staff was confronted with many startup problems and equipment malfunctions. The startup was 

further complicated because of the new, unfamiliar process control system. However, the CSB was 

unable to determine if fatigue specifically contributed to any of the staff actions during the startup, or 

the decisions to continue the startup in spite of the ongoing problems. 

3.6 Shift Change Communications

Operators maintained an electronic notepad (eLog) on the computer system to summarize daily 

progress and identify ongoing activities for the incoming shift. They also held a verbal turnover 

meeting in the control room when shifts were changing. However, a number of key items were 

inadequately addressed in the shift change during the morning and evening shift changes the day of 

the incident. Had the written and verbal shift turnover activities been properly performed, the incident 

most likely would not have occurred. 

000085
64 

As discussed, the solvent run and residue treater prefill and heatup were not performed on the residue 

treater, yet these deficiencies were never entered in the eLog nor were they discussed in the shift 

change meetings by either the board or the outside operators. Second, the night shift staff did not 

inform the day shift crew that they had started filling the residue treater with flasher bottoms. Third, 

the methomyl unit day shift operator, distracted while assisting another board operator with an 

operational problem at the end of his shift, neglected to inform the incoming night shift operator that 

the lab results from the scheduled flasher bottoms sample identified excessively high methomyl 

concentration. Believing that the operators had not yet started the residue treater system and it 

remained empty, the day shift outside operator did not collect the residue treater liquid sample as the 

residue treater SOP required.

3.7 Procedure Deficiencies

The CSB identified significant problems with the methomyl unit SOP. As noted, the operators were 

using an unreviewed, unapproved draft SOP. Regardless, the draft SOP was essentially the same as 

the previously approved SOP; the deficiencies discussed below existed in the earlier version.

The SOP was so complex that the table of contents spanned more than 12 pages. The SOP contained 

more than 1000 pages organized in 16 major sections that included much more than procedures 

typically used by unit operations staff to operate the process equipment. Subjects unrelated to process 

operations such as Change Procedure, Vendor Information, and History of Major Incidents were in 

the SOP. The methomyl unit SOP was last updated and approved in May 2006. 

Only about 400 pages of the SOP contained detailed startup, normal operation, and emergency 

shutdown procedures for operating the unit with the Honeywell computer operating system. It was 

000086
65 

available only from the computerized document control system. Operators could print specific pages 

for information only purposes.38

Many operators reported that they did not rely on the SOP: they felt that they understood how to run 

the unit correctly without instructions. The SOP complexity may have also discouraged its use. This 

may be acceptable for frequently performed tasks but, to prevent errors, directly using the written 

procedure is critical especially when performing infrequent or uncommon tasks such as start-up after 

a major turnaround. 

3.8 Process Chemistry Problems

Safe and correct operation of the methomyl unit involved closely controlling many complex chemical 

reactions. However, during the August startup the staff was confronted with equipment malfunctions 

and process chemistry problems in key equipment including: 

• The methomyl reactor, 

• The MIC stripping still (MSS) side-draw condenser, 

• The crystallizers, 

• The MIBK-hexane column, and 

• The residue treater. 

During steady-state conditions in the methomyl reactor, MIC and MSAO react to form methomyl. 

Bayer ran the reactor with enough excess MIC to consume as much MSAO as possible, which 

minimized the MSAO content in the methomyl product. On the day of the incident, the MIC to 

MSAO ratio was lower than normal, which left more MSAO unconverted and formed less methomyl. 

Adding hexane to the dissolved methomyl and solvent caused the methomyl to crystallize. The 

crystallized methomyl could then be separated from the liquid solvents in the centrifuges. However, 

 

38 Printed pages contained a note at the bottom of each page that said “Uncontrolled when printed.”

000087
66 

excess MIBK caused the MIBK-hexane ratio to be out of specification so that the methomyl remained 

in solution and passed directly through the centrifuge. Not understanding the chemistry imbalance, 

the staff concluded that methomyl was not being synthesized in the reactor. Had they reviewed the lab 

results from routine flasher feed liquid samples downstream of the crystallizer they would have 

quickly recognized that the reactor was producing methomyl and the problem was related to the 

solvent ratios. Four flasher feed samples that had been collected over 2 days contained methomyl 

significantly above the acceptance criteria. During the solvent recovery step, uncrystallized methomyl 

accumulated in the flasher bottoms significantly above the concentration normally fed to the residue 

treater. 

The residue treater cooler had enough capacity to remove the heat of reaction from the decomposing 

methomyl if the average concentration in the residue treater did not exceed about 0.5 percent. As the 

methomyl concentration in the residue treater climbed, the decomposition reaction rate increased 

exponentially39

The methomyl decomposition reaction had important characteristics: 

 until the heat and evolving gases generated enough pressure to overcome the relief 

system capacity and rupture the residue treater. 

• It was an exothermic, or heat-releasing, reaction;

• It was a self reaction, as methomyl needed no other chemicals to begin decomposing; 

• The reaction rate was faster at a higher temperature and higher methomyl 

concentration; and

• It rapidly produced non-condensable gases and solvent vapors.

 

39 As the temperature increases, the rate of a chemical reaction generally increases exponentially.

000088
67 

The original design of the residue treater included features to control the reaction rate. First, the 

residue treater was intended to operate between 30 and 70 percent full of MIBK to ensure the feed to 

the residue treater flowed into a large volume of hot solvent. The hot solvent provided four functions: 

• It diluted the incoming feed, which reduced the concentration of methomyl; 

• It heated the incoming methomyl so that the methomyl would decompose quickly and not 

accumulate to a high concentration in the residue treater; and 

• It absorbed the heat from the methomyl decomposition. 

The second important safe operating condition involved the startup sequence, which was intended to 

ensure a safe decomposition rate at the beginning of the run. The control system contained interlocks 

to prevent opening the residue treater feed valve if the temperature, level, and pressure were not 

within the specified operating ranges. First, the operators had to fill the residue treater with solvent 

and start the recirculation pumps. Next, the circulation loop had to heat the solvent to the minimum 

operating temperature. Only then would the automatic feed control system open the flasher bottoms 

feed valve to begin feeding the methomyl-solvent into the preheated and circulating MIBK. This 

sequence assured that enough solvent was present to absorb the heat generated from the MSAO and 

methomyl decomposition reactions, and that the solvent was hot enough to ensure rapid 

decomposition to prevent the methomyl from accumulating in the residue treater. 

The purpose of the residue treater was to eliminate the methomyl from the solvent before the solvent 

was used as a fuel in the boiler. The feed also contained unconverted MSAO. Like methomyl, MSAO 

decomposes exothermically, but will begin decomposing at a lower temperature than methomyl. As 

MSAO content in the auxiliary fuel was not a concern, the staff likely was not aware that MSAO 

decomposition played a role in residue treater performance and temperature control.

Although the temperature in the residue treater was lower than normal operation, the MSAO and 

methomyl began decomposing. Because they were both present in abnormally high concentrations, 

000089
68 

the decomposition generated a significant amount of heat. The operators filled the residue treater to 

about 35 percent with flasher bottoms and then pumped hot MIBK into the residue treater to bring the 

level up to 50 percent. After starting the recirculation pump, the board operator set the recirculation 

temperature control to the automatic mode to begin the normal heating cycle. As discussed earlier, the 

closed steam valve prevented the heater from heating the liquid. The board operator was unaware that 

the temperature was climbing because large quantities of MSAO and methomyl were decomposing in 

an uncontrolled fashion. 

The rapidly forming gases overwhelmed the vent system and the residue treater pressure started 

climbing. The rate of reaction continued increasing until the evolving gases caused the relief system 

to activate and then overwhelm the relief system. The pressure rapidly rose until the residue treater 

suddenly ruptured. 

The relief device was sized to handle an external fire around the residue treater, but only if the residue 

treater contained less than 2 weight percent methomyl equivalent (280 pounds). Post-incident analysis 

estimated that the residue treater contained at least 40 weight percent methomyl and 7 weight percent 

MSAO just before the runaway reaction initiated, which could not be safely vented by the existing 

relief system. 

The most important layer of protection against over-concentrating methomyl in the residue treater 

was the minimum temperature and minimum flow interlocks on the flasher bottoms feed valve, which 

were bypassed the night of the incident. The administrative controls requiring laboratory sampling 

were not robust. The most important variable, the chemical composition of the flasher bottoms going 

to the residue treater, was not required to be analyzed before or during residue treater operation. 

Although analysis results for samples would likely have alerted the operators to the high risk situation 

of concentrated methomyl accumulating in the residue treater, these lab results took more than an 

hour to process, too long to be an effective input to the operators to prevent overcharging the residue 

000090
69 

treater with concentrated methomyl. The existing layers of protection were inadequate to prevent a 

runaway reaction. 

3.9 Unit Restart Equipment Problems 

Unit staff encountered many problems with equipment during the restart activities. One involved a 

longstanding issue with the residue treater heater operation. Others were directly related to the new 

control system installation, and some involved equipment malfunctions or misaligned valves. 

3.9.1 Residue Treater Heater Performance

The original design basis specified the minimum residue treater operating temperature to be 85 °C 

(185 °F), but early system runs did not adequately decompose the methomyl at that temperature. 

Subsequent kinetic studies determined that the ideal safe operating temperature to achieve the 

required methomyl decomposition was 135 °C (275 °F). Engineers added a heater in the residue 

treater recirculation system to preheat the MIBK solvent to the higher minimum temperature. 

However, more than one board operator told CSB investigators the heater could increase the 

temperature to only about 130 °C (266 °F). To resolve the issue during start-ups, some board 

operators bypassed the minimum temperature safety interlock and manually opened the flasher 

bottoms feed valve when the residue treater solvent temperature was within about 5-10 degrees of the 

operating temperature. After feeding methomyl and MSAO into the solvent, the exothermic 

decomposition reactions generated enough energy to heat the contents the remaining few degrees 

needed to satisfy the minimum temperature interlock setpoint, but not enough energy to cause an 

explosion. Thus, operators became accustomed to bypassing the interlocks and manually opening the 

feed valve before the residue treater contents were at the minimum operating temperature. 

On the night of the incident, the residue treater was not pre-filled with solvent, and based on 

experience with the heater, the minimum temperature safety interlock was bypassed. The flasher 

bottoms were hot enough for the concentrated MSAO and methomyl to begin decomposing. The 

000091
70 

temperature continued climbing until the reaction reached a runaway condition that led to the 

explosion. 

3.9.2 Broken, Missing, and Misaligned Valves 

Other equipment problems continued to disrupt the operators and cause chemical imbalances in the 

system.

3.9.2.1 Instrument Drip System Valve

The instrument drip system provided MIBK solvent to various components and instruments to 

prevent solids from depositing and accumulating inside pipe and equipment. As “drip system” 

implies, MIBK was intended to be added using a minute, drip-wise flow rate into the process stream. 

During the methomyl unit outage, a valve on the instrument drip system was inadvertently left out of 

a line, so that MIBK flowed continuously into the system. This oversight was not discovered and 

fixed until the day before the incident, which allowed off-specification material to proceed through 

the process. This “hydraulic load” made maintaining balanced operating conditions in the methomyl 

crystallizers more difficult, which contributed to the high methomyl content in the flasher bottoms 

feed to the residue treater.

3.9.2.2 Cooling Water Valve

A broken cooling water valve on an upstream distillation column side-draw condenser further overconcentrated the MIBK. Without the cooling water, MIBK was not condensing out of the vapor 

stream, worsening the solvent ratio imbalance.

3.9.2.3 Residue Treater Recirculation System Block Valves

While examining the damaged unit, CSB investigators discovered, and Bayer later confirmed, that a 

valve on the residue treater recirculation heater steam supply was closed, instead of fully opened as 

intended. This incorrect valve position should have been identified either during a formal valve 

alignment checkout before the unit restart began, or during a residue treater system solvent run. 

000092
71 

However, the staff did not perform either activity before they began the unit restart so the misaligned 

valve was not detected during the startup. 

The board operator told investigators that he believed that the heater was working correctly because 

the residue treater temperature was increasing in a similar way to what he had expected during a 

residue treater startup. The CSB concluded that the residue treater liquid temperature was climbing 

because highly concentrated methomyl and MSAO were already decomposing and the self-sustaining 

decomposition reactions were rapidly increasing and would soon go out of control. 

Post-incident examination of the computer data suggested that steam was flowing into the heater 

(Figure 19). However, the CSB concluded that with the steam supply block valve confirmed to have 

been in the closed position,40

Another equipment malfunction that should have been identified before the restart involved the 

residue treater heating/cooling control configuration in the DCS. About 15 minutes before the residue 

treater explosion, the data indicated that recirculation flow suddenly dropped to zero 

(

 the only possible explanation for indicated steam flow was an 

improperly calibrated instrument, misaligned vent valve, or malfunctioning flow instrument. This was 

yet another example of the inadequate system checkout. 

Figure 11, bottom trace). 

 

40 The valve was removed from the pipe and visually examined. Water placed in the valve body did not leak 

past the seat in any measurable amount.

000093
72 

Figure 19. Indicated steam flow through the residue treater heater. Vertical dashed line 

shows point of vessel failure. Actual flow was zero because valve was closed

Figure 20. Closed steam block valve recovered from residue treater heater steam supply valve

000094
73 

It was determined that the automatic temperature control system closed both the heater and cooler 

flow control valves (see Figure 10) at the same time when the recirculation temperature control 

transitioned from heating to cooling. Bayer examined the temperature controller and its investigation 

team concluded that 

[An] undocumented change in the heating/cooling control scheme was made 

during the control system upgrade that resulted in a flow restriction when 

changing from heating to cooling. 

Regardless of this control system error, both the CSB and Bayer concluded that even if full flow had 

been established, the cooler could not remove enough heat to stop the runaway reaction and prevent 

the explosion. 

3.9.3 Other Process Equipment Problems

At the Institute facility, supervisors commonly left their passwords logged in to allow operators to 

bypass safety systems considered troublesome during startup. Without supervisors’ direct 

involvement, best practices were ignored to get the process underway quickly.

The excessively high concentration of MIBK caused by the equipment malfunctions upstream 

prevented the methomyl from crystallizing in the crystallizers: the methomyl remained dissolved in 

the solvent. Dissolved methomyl remaining in the solution caused the liquid level in the centrifuges to 

trip a high-level alarm and abort the centrifuge cycle. Operators, unaware that the problem involved a 

solvent ratio imbalance in the crystallizers, used the unsecured control system supervisory access41

 

41 Safety matrix and operating matrix function changes were administratively controlled using a secure 

password to prevent inadvertent or unauthorized changes or bypassing without engineering approval. 

However, during startup, a supervisor logon to the operator matrix edit screen was left active so that anyone 

could defeat the control functions. 

screen to bypass the centrifuge high-level trip interlock and operated the centrifuges manually. 

000095
74 

Improper or incomplete checkout and calibration of the Siemens control system caused more 

centrifuge problems. A malfunctioning relay in the new system caused the centrifuges to trip off 

when the operators attempted to run both at the same time, which was the normal condition. That 

problem combined with many recurring high-level alarms in the centrifuges led operators to believe 

that the two issues were linked. They did not recognize the real issue: the malfunctioning equipment 

upstream of the crystallizer prevented proper methomyl crystallization. Uncrystallized methomyl 

increased the liquid level in the centrifuges, which triggered the high level alarms.

3.10 Air Monitoring Systems Deficiencies 

3.10.1 Fenceline Air Monitors

Fenceline air monitors are often relied on to determine if chemicals released from a plant enter the 

community. The locations of the monitors, as well as their limited chemical sensitivity, often make 

release determinations difficult. On the night of the incident, two property fenceline monitoring 

devices were operating, one on the east side and one on the west side of the facility. The closest 

monitor was more than 800 feet from the methomyl unit and would be effective only if it were 

downwind of a release. The monitors were configured to detect chlorine, carbon monoxide, methane, 

and oxygen. Each monitor contained a 10.6 eV (electron volt) lamp and a VOC sensor capable of 

picking up chemical compounds only within a certain range of ionization energies. Because the VOC 

sensor can detect several different chemical compounds, it is useful only in estimating a concentration 

if the released material is suspected and possesses an ionization energy in the detectable range. The 

AreaRae monitor, which was used the night of the incident, could not detect specific compounds such 

as methomyl or some of its intermediates. Laboratory analyses of air or swipe samples were the only 

sampling methods available to determine if methomyl was released, but those tests were performed 

days later.

The fence line monitors were also unreliable because they could not detect buoyant gas releases 

unless strong wind currents drove the gas back down to the detector locations. Weather conditions the 

000096
75 

night of the explosion, including wind direction and velocity, were unfavorable for proper detection 

of any toxic or flammable gas by either fence line monitor.42

3.10.2 Unit Air Monitors

The air sample analyzer collected and analyzed samples at 16 locations in the Methomyl-Larvin unit 

and near the MIC day tank at 2-minute intervals. The analytical results were recorded in a data 

historian and any concentrations exceeding 1.0 ppm triggered a visual alarm notification on a display 

panel on the second floor of the Methomyl/Larvin control building and at the board operator’s 

console. The analyzer used a fixed filter photometer consisting of an infrared radiation (IR) source to 

absorb and detect the concentration of MIC within a range of 0 to 10 ppm. 

In May 2008, the analyzer malfunctioned and reported erroneous concentrations in excess of 1 ppm 

and failed to activate control building alarms. Two weeks before the August incident, the monitor 

data logging system stopped recording for an unknown reason. The analyzer manufacturer worked 

with Bayer to resolve the problem, but the analyzer was not repaired and returned to service before 

the incident. 

Unknown to EOC personnel the monitor was not operating the night of the incident. Assuming it was 

working, they concluded that the explosion did not cause an MIC release, or if MIC had been 

released, it was being consumed in the fires. The PSSR for the residue treater, completed prior to the 

methomyl restart, did not specifically list MIC analyzer operation as a requirement for startup or 

operation. 

 

42 Weather conditions the night of the incident were 66° F (19° C) and calm wind conditions.

000097
76 

3.11 Organizational Deficiencies 

One experienced methomyl unit operator described how the organizational structure changes 

degraded the technical support available during unit operations: 

When we started getting rid of people--not getting rid of people--“thinning”--less 

technical assistance, if you will. There were some guys, they were in charge--we 

had a guy in charge of methomyl, a guy in charge of oxime, and a guy in charge 

of the warehouse. And that was their baby. And now we have like one guy doing 

it all. No shift supervisor.

This and other interviews led the CSB investigation team to conclude that the multiple shortcomings 

in the technical support available to the operators made recognizing and addressing problems with the 

system more difficult. 

The reorganization resulted in only one Technical Advisor assigned to the entire Methomyl-Larvin 

unit who worked the day shift. The Shift Leader was also available to assist but did not work with the 

operators on a daily basis, operators relied primarily on the Technical Advisor. However, the night 

shift did not have a Technical Advisor on duty. If the board operators had a process question during 

their shift, they could call the Shift Leader or Technical Advisor who was on-call on nights and 

weekends. The Technical Advisor also served as a liaison to the capital project team.

For the system upgrade capital project, Bayer assigned a second Technical Advisor to assist with the 

increased workload. The first Technical Advisor focused on Larvin production, and the new 

Technical Advisor, who had no methomyl unit operating experience, focused on methomyl 

production. The second Technical Advisor had experience as a technical advisor and had DCS control 

system training. That experience, however, was in a different unit and the training was on a different 

brand of control system. A highly experienced methomyl unit operator helped the Technical Advisor 

000098
77 

with limited project work such as the functional acceptance testing, but the Technical Advisor was the 

primary contact. 

In the days leading up to the incident, the only assigned Technical Advisor had worked as many as 15 

to 17 hours a day, and 10 hours on the day shift preceding the incident. Throughout the evening 

preceding the incident, operators struggled with stabilizing the operating conditions in the methomyl 

unit, and yet the Technical Advisor had already left for the day. During this critical first startup using 

a new control system, management should have ensured that a highly experienced Technical Advisor 

was assigned to the control room staff during both shifts. 

A Run Plant Engineer was another person operators could consult for technical assistance. The role of 

the Run Plant Engineer varied depending on the needs in the particular unit and mainly involved 

working on improvement and repair projects, and turnarounds. The Run Plant Engineer had little 

involvement on day-to-day operational support. The Methomyl-Larvin unit Run Plant Engineer had 

less than one year of experience before the incident. In his previous assignment, he had primarily 

defined and installed improvement and repair projects and did not typically deal with unit startup and 

operating issues. This engineer told CSB investigators that he knew very little about the details of the 

DCS upgrade project and was not even sure who had been designated as the project manager. More 

importantly, he said he lacked knowledge of the methomyl unit equipment and chemistry. He had 

hoped to learn more about the process by having greater involvement in the unit startup, but was 

unable because operational difficulties on the Larvin unit demanded his attention. 

The Production Leader was another resource available to the operators. However, the reorganization 

also changed the relationship between the operators and the Production Leader. In the traditional 

structure, only one team of board operators reported to a supervisor, but in the self-directed work 

structure, the Production Leader was responsible for four self-directed work teams. The methomyl 

Production Leader worked the day shift and was responsible primarily for administrative activities

and had little interaction with the operators related to unit startup and operation. 

000099
78 

The organizational changes directly contributed to the incident causes. With the self-directed team 

organization in place, management did not directly advise or control the unit restart schedule. The 

self-directed work team ultimately decided to start the methomyl unit even though the control system 

and some equipment were not ready and the SOP was not up-to-date. Furthermore, management was 

so far removed from the process operation that they were unaware that the operators seldom used the 

SOP and some bypassed the critical safety interlocks, which directly led to the residue treater 

explosion. 

3.12 Previous Methomyl-Larvin Unit Incident 

On August 18, 1993, at approximately 10:15 a.m., an explosion occurred in the chloracetaldoxime 

(CAO) reactor loop of the methomyl unit. At the time of the incident the facility was owned and 

operated by Rhone-Poulenc. The explosion caused one death and injuries to two workers who were in 

the unit at the time of the incident. Investigators concluded that a flow indicator malfunction led to 

over-chlorination of acetaldoxime, which led to a violent decomposition. They further concluded that 

the workers’ activities were not causally related to the incident. The explosion ignited a massive fire,

which was fueled by flammable liquids being released by ruptured pipes. 

The investigation team made the following recommendations: 

• Identify, and treat as critical, all ESD interlock alarms. Examine and rigorously apply the 

Institute Plant Alarm Management procedure with regard to nuisance alarms; and 

• Review and revise the unit procedures for “Disabling Alarms” and “By-passing 

Interlocks” to address a temporary bypass of a safeguard for operational purposes, such

as during a unit startup. 

Contrary to the 1993 recommendation to improve administrative controls involving critical process 

interlocks, the residue treater incident more than 15 years later directly involved similar improper 

control system interlock changes.

000100
79 

3.13 Emergency Planning and Response

3.13.1 National Incident Management System

The National Incident Management System (NIMS) is an organized system of roles, responsibilities, 

and procedures for the command and control of emergency operations. OSHA 1910.120(q) requires 

that both public safety and industrial emergency response organizations use a nationally recognized 

Incident Command System (ICS) for emergencies involving hazardous materials. ICS is an organized 

system of roles, responsibilities, and standard operating procedures used to manage and direct 

emergency operations (Figure 21). 

Another important component of this network is the Unified Command System (UCS). UCS is a 

process of determining overall incident strategies and tactical objectives by having all agencies, 

organizations or individuals who have jurisdictional responsibility participate in the decision-making 

process. 

As part of a comprehensive national incident management system, most state, local, and volunteer 

organizations are familiar with the NIMS process and use it for even routine incidents. Interviews 

with the St. Albans fire chief, the Kanawha County Sheriff, and Metro 9-1-1 staff revealed knowledge 

of the NIMS system and their use of the process in routine incidents such as traffic accidents and 

residential emergencies. 

On the night of the incident, all of the responding outside agencies communicated via the Kanawha 

Putnam EOC. However, the Bayer EOC did not use a shared network to communicate with all 

responding agencies; thus, the responding agencies did not receive timely status updates. Important 

information updates about the continually changing conditions at the fire scene were not 

communicated to the other responding agencies (Knoll, 2005).

000101
80 

Figure 21. NIMS incident command structure

INCIDENT COMMAND STRUCTURE 

~ 

'""" --1 ~ 

.I _ 

- ~-~ 

-- r ........ - - -- ~--- -1 I -1 ,- &- I rl - 1 rl "-

,- 1 

- - rl- I - H~I H - 1 rl - -1 -- I -- -1 ~~ I H - 1 H ,- ..... , ----1 Ht,I S:l!1lf\' I H- - Y rl 1 "'" 1 H - 1 ~, 

~, 

Ili>isroB ----1- - I .-,

- -

-I ~ 1 "'" 

-j - I 

----1 I*'IMa2 I 

- 1 

000102
81 

3.13.2 Kanawha Putnam Emergency Planning Committee

The Kanawha Putnam Emergency Planning Committee (KPEPC) history dates back to the 1950s 

when it began as the Kanawha Valley Industrial Emergency Planning Council to serve as a mutual aid 

group doing business in Kanawha County. In 1995, the KPEPC began functioning as the Local 

Emergency Planning Committees (LEPC)43

KPEPC activities include conducting emergency drills (e.g., fire or hazardous materials spills) with 

member companies; holding monthly meetings; and interfacing with other LEPCs in West Virginia. 

The committee also serves as a resource and supports training of various emergency response 

agencies. 

in Kanawha and Putnam counties. The federally 

mandated committee includes volunteers from the community, industrial businesses, and 

representatives from the emergency response organizations in the area. KPEPC has 12 board 

members, 10 annex committees, and about 125 members that oversee emergency response planning. 

It is funded by its membership, the U.S. Department of Transportation, and West Virginia state 

grants. 

3.13.3 Kanawha Putnam Emergency Management Plan

The Kanawha Putnam Emergency Management Plan provides “general guidelines for planning, 

managing and coordinating the response and recovery activities of local government” in the event of a 

major emergency or disaster.44

 

43 An LEPC is a committee appointed by the state emergency response commission, as required by SARA Title 

III, to formulate a comprehensive emergency plan for its jurisdiction.

The president of the County Commission is responsible for executing 

the plan when the emergency involves the county. The plan is divided into a “basic plan” and two 

annexes. The “Functional” annex contains guidelines for participating agencies to use in developing 

agency-specific operating documents. The “Hazards” annex contains non-routine emergency 

44 West Virginia Emergency Act Chapter 15, Article 5, “Emergency Services.”

000103
82 

scenarios. The Emergency Management Director is responsible for the operational aspects of the plan 

and plan revisions. 

The Basic Plan addresses only governmental organizations—it fails to address roles and 

responsibilities of facility personnel in the event of a chemical incident at a facility. The Basic Plan 

requires that only one EOC be in place for an emergency and all staffing functions be provided by 

emergency response agencies. Furthermore, the plan states, correctly, that an Incident Commander 

(IC) is responsible for tactical operations in the field and assigns “absolute control over all on-scene 

operations” and requires all emergency activities to conform to the ICS and NIMS. 

However, the Basic Plan does not address the facility owner’s roles and responsibilities to establish 

an internal incident command structure in accordance with the NIMS process. It does not provide any 

information or direction when the facility owner assigns the IC and establishes an EOC, as was the 

case during the August 2008 Bayer incident. 

The CSB also found that at least two functional annexes contradict the Basic Plan. Chemical HazMat 

Response, Annex A16, states that “the manufacturing facility (plant) Incident Commander will be 

part of the Unified Command structure.” Additionally, Mining Accidents, Annex 26, states that 

“Initially, the coal company is in charge of the incident.” The annex defines the criteria for official 

transfer of the incident command to state and federal government agencies when they arrive on-scene. 

The omissions and contradictions in the Basic Plan are likely to confuse critical emergency response 

activities in the event of a fire or chemical release at a facility.

3.13.4 Chemical Release Notification Law

In 2009, the State of West Virginia revised the Mine and Industrial Accident Rapid Response System 

regulation (West Virginia Code Chapter 15 Article 5B), to require prompt reporting of chemical 

releases. The new law applies to all facilities regulated by the EPA Risk Management Program 

regulation (40 CFR 68). It does not apply to facilities regulated only by the Occupational Safety and 

000104
83 

Health Administration (OSHA) Process Safety Management standard (29 CFR 1910.119). The law 

requires the facility to notify the Mine and Industrial Accident Emergency Operations Center by 

telephone within 15 minutes of the industrial facility ascertaining the occurrence of an emergency 

event. The regulation also requires the reporting facility to:

• Implement a communications system designed to provide timely information to 

appropriate state and local officials;

• Upon request, provide appropriate state and local officials with timely authorized access 

to the person or persons charged with managing the event on behalf of the facility and the 

area(s) where the emergency event is being managed or the industrial facility's response 

to the emergency event is being coordinated; and

• Provide appropriate state and local officials with timely authorized access to any areas 

affected by the emergency event. 

The law also requires that within 30 minutes of obtaining information that affects the public health, 

safety and welfare, state and local officials shall notify the public of any hazardous materials or 

events which may affect the area.

3.14 Incident Response and Communication Deficiencies

3.14.1 Bayer CropScience Facility

The Bayer IC led the plant’s internal emergency response team but did not have direct contact with 

the Kanawha Putnam EOC. Because the information to and from the Bayer EOC was not part of a 

UCS, responding municipal, county, and state agencies were not provided updated and reliable 

information regarding the status of the incident throughout the response. 

Concerns expressed post-incident cited a number of troubling issues, including police and fire 

responders’ potential exposure to toxic substances while performing their duties. Responding 

agencies also cited the threat to the surrounding communities due to the lack of timely information 

that would have made for better coordination of the shelter-in-place decision-making process. The 

CSB could find no evidence of an effort by Bayer to align operations with other responders in a UCS. 

000105
84 

The Bayer IC established radio communication with the Institute VFD fire chief, who was also a 

Bayer employee; Bayer fire brigade members; and the Bayer EOC. Information relayed to municipal, 

county, and state agencies that responded to the incident was not first-hand in most cases and so was 

prone to errors as information was relayed from one source to another. 

3.14.2 Facility and Emergency Responders’ Communications

Timely and accurate information updates from the Bayer EOC to the outside emergency responders 

were an issue throughout the incident. The quality and lack of timely information regarding the status 

of the incident and information necessary to make decisions advising shelter-in-place emerged as 

recurring concerns post-incident from participating agencies. The agencies also felt that communities 

were placed at greater risk and that better information would have helped in providing useful 

advisories to police and fire units. 

More than 10 minutes elapsed before Bayer was able to alert Metro 9-1-1 and even then, the 

information was inadequate. The guard at Bayer’s main guard shack told investigators that he tried 

several times to call them but was unable to get through.45 Finally, at 10:42 p.m. contact was made 

when the guard was calling for an ambulance to transport a burn victim to the hospital. When the 

Metro 9-1-1 operator questioned him about the explosion, the caller indicated that he could not 

provide any information.46

Another control and communication deficiency involved possible toxic exposure to on-scene 

emergency responders. The decontamination area located outside the fire zone was shut down shortly 

after the all-clear was sounded, but before all the emergency responders involved in the fire 

Similar exchanges continued throughout the night until the all-clear was 

sounded at about 5:50 a.m. the following morning. 

 

45 The Metro 9-1-1 operator made a similar observation as he attempted to call the Bayer site.

46 Bayer management instructed the guard, who was the official point of contact with Metro 9-1-1 for such 

communications, not to provide any information other than what the IC directed.

000106
85 

suppression activities had decontaminated their clothing and equipment. The responders from the 

Tyler Mountain Fire Department returned to their fire station with contaminated gear. The CSB 

learned that the next day they complained of symptoms indicative of toxic exposure. 

3.14.3 Kanawha Valley Emergency Communications Process Improvement 

Initiatives

The Kanawha Putnam Emergency Plan requires that police, fire, and EMS dispatch be coordinated 

and directed from the Metro 9-1-1 call center. Located in Charleston, West Virginia, the facility 

employs about 100 dispatchers, administrative support, and supervisors. All calls for emergency 

assistance requiring municipal or county resources are consolidated through the call center. Metro 9-

1-1 is also a member of the KPEPC and participates in the committee meetings. 

To address the communication issues that occurred during the Bayer incident response, Metro 9-1-1 

and KPEPC developed new tools and processes for use by the agencies charged with emergency 

response in the Kanawha Valley. Post-incident, Metro 9-1-1 participated in a drill with the Institute 

site and local emergency response organizations and implemented the following emergency response 

improvements: 

• Developed a list of questions to use when any fixed facility calls the center and trained all 

telecommunications personnel; 

• To improve response times when receiving calls for assistance, Metro 9-1-1 no longer 

serves as the conduit for KPEPC reporting requirements.47

• Established one-mile zones around fixed facilities for rapid, automatic reverse ringdown 

phone calls in the event of a release; 

Plants complete and submit 

chemical release information forms to the KPEPC within 14 days of an incident;

 

47 Releases of Extremely Hazardous Substances as listed in 40 CFR 355, Appendix A, or chemicals that require 

release reporting as defined in section 103(a) of the Comprehensive Environmental Response, Compensation 

and Liability Act (CERCLA), Must be reported to LEPCs within 14 days of a chemical release.

000107
86 

Table 2. New Metro 9-1-1 questionnaire for fixed chemical facilities 

(Courtesy Metro 9-1-1) 

Fixed Facility Chemical Questions

1 What is your name?

2 What is your title?

3 What is the address/Location of the actual alarm?

4 What phone number do we use to call back about the alarm?

5 Is any outside assistance requested?

On initial call only: 

If the nature of the alarm or chemical is not known at this point, cease questions 

until plant personnel call back

6 

What is the Chemical involved?

 - How is it spelled? and/or

 - What is the CAS number?

7 Is the chemical involved on the "extremely hazardous" list?

8 Has the chemical been released into the air, water, or ground?

If there has been a release, is it a "reportable quantity"?

9 Are there any recommended protective actions for the public?

• Established a 15-minute rule (starting when the call is first received) for the Metro 9-1-1 

Emergency Management Director to call for an advisory shelter-in-place if the call center 

has knowledge of an event, but the company has not provided timely or quality 

information about the material involved in the release. (Section 3.13.4 discusses the new 

state law that requires facility owners to report certain chemical releases to the Mine and 

Industrial Accident Emergency Operations Center);

• Developed a process for emailing residents in the affected zone when a release occurs;

• Developed a protocol for notification when a release is reported to Metro 9-1-1 that uses 

email, reverse ringdown phone calls, and emergency sirens; 

• Increased call center phone capacity by 50 percent to address increased telephone traffic 

during emergencies;

000108
87 

• Identified mid-level personnel contact information for Bayer, DuPont, and Dow who are 

authorized to talk directly with Metro 9-1-1 staff during an emergency; and

• Developed a matrix that identifies the information that should be provided to the public 

as soon as it becomes available.

To address the communication problem between the Bayer EOC and METRO 9-1-1, Bayer installed a 

dedicated telephone line that directly connects the Bayer EOC to Metro 9-1-1. This is intended to 

ensure that overloaded phone lines do not block calls between the two parties, which typically occur 

in such incidents. 

3.15 Environmental Impact

More than 2,000 gallons of toxic and flammable liquid was expelled from the residue treater, ruptured 

piping, and other equipment, most of which burned in the ensuing fire. Although the residue treater 

feed contained significant quantities of methomyl and MSAO, those chemicals were rapidly 

decomposing in the residue treater. Post-incident, trace amounts of methomyl were found in swipe 

samples from equipment in the vicinity of the explosion; however, the specific quantities of undecomposed or unburned methomyl or other toxic chemicals that might have escaped into the 

atmosphere were indeterminate.

The MIC day tank and cross-unit transfer piping were not damaged in the incident. However, the 

liquid in the residue treater contained significant quantities of methomyl and MSAO products of 

decomposition and possibly some quantity of methyl isocyanate.48

 

48 The flasher bottoms likely contained small amounts of MIC, and MIC could have been one of the products of 

the methomyl decomposition reaction.

MIC might have also been 

released from ruptured process piping and vent piping. MIC is flammable and highly reactive with 

water; at least some of any released MIC likely burned in the fire or reacted with the water used to 

000109
88 

fight the fires. There were no reports of river water contamination or other offsite ground 

contamination. 

3.16 MIC Day Tank Blast Shield Analysis

The MIC day tank was adjacent to the methomyl-Larvin unit. A steel rope mesh ballistic shield (blast 

blanket), mounted on the sides of and on top of a structural frame, protected the tank in the event of 

an explosion in the unit or nearby equipment (see Figure 2). Flying debris from the residue treater 

explosion struck the blast blanket. The fires radiated intense heat on the blast blankets. 

After the incident, Bayer removed the blast blanket and the MIC day tank insulation and associated 

piping. They visually examined the day tank for impact or heat damage. They also pressure tested the 

day tank. The day tank showed no evidence of heat damage— the blast mat provided highly effective 

protection against radiant heat from the external fires. The examination and testing confirmed the day 

tank and associated piping were not damaged by the explosion. 

As reported by the blast mat manufacturer and confirmed by independent studies, the blast mat 

provided effective protection against penetration by small projectiles traveling at near sonic velocity, 

as well as penetration by a large fragment travelling more than 100 miles per hour.49

To fully protect the day tank, the blast blanket and frame assembly had to absorb the dynamic energy 

from any debris strike. The original structural frame design only considered the blast mat weight and 

wind loading, it did not examine dynamic loading. The CSB analyzed the structural frame to 

determine if it provided adequate protection against overpressure blast energy and a large projectile 

An analysis 

commissioned by Bayer after the August 2008 incident also concluded the blast mat provided 

effective protection against small, high-velocity projectiles.

 

49 The manufacturer worked with the Israeli Defense Force and the Southwest Research Institute to evaluate the 

ballistic shield design. Testing demonstrated that it is capable of withstanding detonation pressures resulting 

from thousands of pounds of TNT more than 30 feet from the source of the detonation. 

000110
89 

impact into the blast mat (Appendix C). The analysis examined both maximum theoretical deflection 

and structural component failure. It concluded that the structural frame was adequate to prevent 

damage to the MIC day tank and attached vent pipe from the overpressure energy. The analysis 

concluded that the structure provided only marginal impact energy absorption protection from a large 

fragment strike at velocities predicted to result from the residue treater explosion.

Therefore, had the residue treater traveled unimpeded in the direction of the day tank, and struck the 

shield structure just above the top of the MIC day tank, the shield structure might have impacted the 

relief valve vent pipe. A puncture or tear in the vent pipe or MIC day tank head would have released 

MIC vapor into the atmosphere above the day tank. 

000111
90 

4.0 Methyl Isocyanate Risk Reduction at the Institute 

Facility 

4.1 Congressional Action

In May 2009, the U.S. House of Representatives Committee on Energy and Commerce sent a letter to 

the U.S. Chemical Safety Board Chairman requesting that the Board: 

1. “Conduct an investigation to determine options for Bayer to reduce or eliminate the use 

or storage of MIC by switching to alternative chemicals or processes.”

2. “Determine whether Bayer has adequately examined the feasibility of switching to 

alternative chemicals or processes.” 

3. “Provide specific recommendations for Bayer and its state and federal regulators on how 

to reduce the dangers posed by on-site storage of MIC.”

4. “Brief our staff on the Board’s findings and recommendations at the end of its 

investigation.”

In the fall 2009, the Congress appropriated $600,000 to the CSB fiscal 2010 budget and directed that 

the funds

[S]hall be for a study by the National Academy of Sciences [NAS] to examine the 

use and storage of methyl isocyanate including the feasibility of implementing 

alternative chemicals or process and an examination of the cost of alternatives at 

Bayer CropScience facility in Institute, WV.

The NAS study was designed to address item 1 in the May 2009 committee request. Historical studies 

addressing MIC alternatives conducted by Bayer and the prior owners of the Institute facility are 

discussed in Section 4.2. 

000112
91 

The CSB published a draft scope of work for the NAS study in The Federal Register50

4.2 Alternative MIC Technology Analysis History

on April 23, 

2010, to solicit public comment. The CSB reviewed all submitted comments and revised the NAS 

scope of work. The CSB awarded the contract to the NAS in September 2010. The CSB is currently 

considering the impact of Bayer’s announcement concerning the planned total elimination of MIC on 

the NAS study. 

4.2.1 Union Carbide Corporation Studies

UCC began alternative MIC technology research in November 1976. The initial research focused in 

the area of “adducts,” which are chemical structures that can be easily added and removed from the 

desired chemical. The intention of an adduct is to change undesired characteristics of the chemical to 

which the adduct is attached. In the case of MIC, the adduct made it water soluble and ultimately less 

hazardous should it escape containment. However, the MIC adduct was not easily removed, so it 

contaminated the insecticide products. 

In July 1984, UCC researched a palladium catalyzed reaction that had the potential to completely 

eliminate both MIC and phosgene use. However, the cost of the catalyst greatly outweighed any 

potential feasibility for this process. At the time, it would have cost more than $14 per pound of 

insecticide, merely to cover the cost of the palladium catalyst, which was cost prohibitive.

During its ownership, UCC reviewed 97 patents dealing with alternative technologies to MIC 

production but concluded that none could perform as well as the existing process. In the last year of 

the facility ownership, UCC found three different pyrolysis51

 

50 The Federal Register. Chemical Safety and Hazard Investigation Board, National Academy of Sciences 

Study, Vol. 75, No. 78 / Friday, April 23, 2010, pg. 21223.

 techniques that showed promise to 

51 Pyrolysis is a term for chemically decomposing organic materials through heating--a form of thermal 

decomposition.

000113
92 

eliminate phosgene and/or reduce the MIC stockpile, but sold the facility before completing the 

studies.

4.2.2 Rhone-Poulenc Studies

Rhone-Poulenc continued research into pyrolysis through March 1989, but determined that the 

pyrolysis approach to manufacturing pesticide products was not cost-effective. Rhone-Poulenc also 

researched different approaches to operating the processes that use MIC and phosgene, intending to 

reduce the stockpiles of both. In all five new techniques studied, Rhone-Poulenc concluded that either 

the stress placed on the process equipment was too great or the new process would be unacceptably 

difficult to control.

Following the deadly MIC release from the Union Carbide facility in Bhopal, India, in 1984, DuPont 

implemented a new technology for producing the carbamate pesticide methomyl at its plant in La 

Porte, Texas, which did not require a large inventory of MIC. The technology also eliminated 

phosgene from the production process. In DuPont’s technology, the less acutely toxic chemical 

methylformamide is converted into MIC on an as-needed basis and immediately consumed in a 

subsequent reaction, avoiding the need to store MIC. In the 1980s, Bayer itself used a similar 

approach to producing the carbamate pesticide propoxur in Europe; according to a published account, 

Bayer used an alternative chemistry where MIC was produced and consumed in tandem 

(Worthy, 1985). 

Rhone-Poulenc also researched various in-situ processes for MIC, which would allow MIC to be 

synthesized and almost instantly consumed in the process line. This form of production eliminates the 

MIC stockpile and often removes the need for phosgene. In February 1989, Rhone-Poulenc analyzed 

the in-situ process DuPont used but did not adopt the technology, possibly due to patent restrictions. 

In December 1989, Rhone-Poulenc reviewed what was thought to be a promising in-situ process 

proposed by Enichem. The Enichem process was going to be used at a facility in Brazil, and the 

000114
93 

suggestion was that it could also be used at the Institute facility. The available historical records did 

not explain why Rhone-Poulenc did not implement the Enichem technology. 

4.2.3 Bayer CropScience Studies

Bayer CropScience continued to research the Enichem in-situ process that would eliminate phosgene 

and the MIC stockpile. However, the company reported that a byproduct of this reaction degrades the 

effectiveness of pesticide products by nearly 50 percent. As of August 2010, Bayer claimed that it has 

had not found an alternative to MIC suitable for its products manufactured in Institute, West Virginia. 

Bayer however committed to cooperate with the NAS and consider the recommendations that result 

from the NAS study. 

4.3 Bayer CropScience MIC Storage Reduction

Concern expressed by many in the community, local regulators, and Congress ultimately prompted 

Bayer CropScience to reevaluate MIC use at the Institute facility. In August 2009, the company 

reported that the use of MIC would not be eliminated at the facility and that in-situ production of MIC 

at the operating units where MIC is used was not a viable alternative. However, Bayer committed to 

significantly reduce the on-site inventory of MIC, make process unit upgrades, and continue to study 

alternate chemistries that could eliminate the need for MIC for pesticide production. The full text of 

the Bayer CropScience announcement is contained in Appendix D. 

Bayer management announced the following planned changes at the Institute facility:

1. Reduce the MIC storage at the Institute facility by 80 percent;

2. Eliminate all aboveground MIC storage; 

3. Eliminate all transfer, storage, and use of MIC in the West Carbamoylation Center; and

4. Eliminate manufacturing methomyl and carbofuran. 

Bayer did not repair the damaged Methomyl unit and abandoned methomyl production at the Institute 

facility. Bayer negotiated a carbofuran unit shutdown schedule with FMC, the owner of the unit, 

000115
94 

which ended carbofuran production in August 2010.52

Bayer also committed to replacing the MIC production unit underground storage system with new, 

smaller storage vessels and a new underground containment vault. Bayer further committed to 

decommissioning the remaining aboveground storage vessels at the facility. Bayer CropScience 

management also stated to the CSB it would revise the MIC system Process Hazard Analysis and 

commission an independent review of the PHA. The facility upgrade work is scheduled to be 

complete by February 2011. 

 Bayer then stopped storing MIC in the 

Methomyl-Larvin unit day tank. 

Subsequent to Bayer’s announcement of its MIC inventory reduction plans, in August 2010 the 

Environmental Protection Agency and Bayer reached an agreement to phase out the production of 

aldicarb, one of two remaining MIC-derived pesticides made in Institute, by the end of 2014. On 

January 11, 2011, Bayer announced plans to end the production of both aldicarb and carbaryl by mid2012 and thereby eliminate the production, storage, and use of all MIC and phosgene. Bayer stated it 

would continue to produce Larvin at the plant by the conversion of methomyl purchased from 

commercial sources; however, this process does not require MIC or phosgene to operate.

 

52 On May 15, 2009, the Environmental Protection Agency revoked all food tolerances for carbofuran and 

effectively prohibited the use of the pesticide. The EPA stated that “dietary, worker, and ecological risks are 

unacceptable for all uses of carbofuran.” See 

http://www.epa.gov/opp00001/reregistration/carbofuran/carbofuran_noic.htm, January 9, 2011.

000116
95 

5.0 Regulatory Analysis 

5.1 Occupational Safety and Health Administration

5.1.1 Process Safety Management Program

The PSM standard requires employers to prevent or minimize the consequences of catastrophic 

releases of highly hazardous chemicals. PSM applies to processes that involve any of 137 listed toxic 

chemicals at, or above, threshold quantities and processes with flammable liquids or gases onsite in 

one location in quantities of 10,000 pounds or more. The Methomyl-Larvin unit was covered by the 

PSM standard because it contained listed toxic chemicals including methyl isocyanate (threshold 

quantity [TQ] = 250 pounds); methyl mercaptan (TQ = 5,000 pounds); and various flammable liquids 

including hexane and methyl isobutyl ketone, each in quantities significantly above the 10,000 pound 

flammable liquid/gas TQ. Chlorine (TQ = 1,500 pounds) is also used in the methomyl unit. 

The PSM standard requires the owner to perform an initial PHA [1910.119(e)], and to revalidate the 

PHA at least every five years thereafter. Furthermore, the standard requires the employer to

[A]ssure that recommendations are resolved in a timely manner and that the 

resolution is documented; document what actions are to be taken; complete 

actions as soon as possible; develop a written schedule of when these actions 

are to be completed. 

5.1.2 PSM Inspections at the Bayer Facility

OSHA conducted a planned inspection of the Bayer Institute facility in 2005. The inspection 

identified deficiencies in PSM program elements including conduct of PHAs and compliance audits. 

After the August 2008 incident, OSHA conducted a compliance audit that focused on the MethomylLarvin unit.

In addition to the PHA deficiencies discussed in Section 3.3, both the CSB and OSHA investigations 

found that many PHA recommendations had not been resolved, including operating procedure 

000117
96 

deficiencies and deficient hazard analyses. Delays in addressing these issues persisted even after the 

methomyl system PHA conducted in 2005 identified the problem.53

The CSB investigation team also identified other significant PSM program deficiencies associated 

with Operating Procedures [1910.119(f)]; Training [1910.119(g)]; and Pre-startup Review

[1910.119(i)], which are discussed in Section 

The Bayer PSM-facilitated selfassessment, dated Oct 30-Nov 9, 2007, again identified that many action items, called “risk sheets,” 

from the 2005 PHA remained incomplete and unassigned. An internal Bayer memo dated August 7, 

2008, three weeks before the incident, noted 48 open risk sheets. 

3.0. The OSHA inspection conducted after the incident 

identified 12 items that violated the PSM program requirements, two of which OSHA classified as 

“repeat” violations.

5.1.3 PSM Program Deficiency Findings in Other CSB Investigations 

The PSM program deficiencies identified in the Bayer incident investigation parallel findings in many 

other CSB investigations (Table 3). Notably, the BP Texas City refinery investigation identified PSM 

deficiencies in MOC, PHA, PSSR, and operating procedures practices. 

At the BP Texas City refinery CSB investigators found that, “deviations from the procedure were 

made without performing MOC hazard analyses.” The same situation occurred during the methomyl 

unit startup at Bayer. The CSB identified organizational change control deficiencies existed at both 

BP and Bayer. In the case of the BP incident, the company did not apply the PSM MOC process to 

evaluate the organization changes in the Isom unit operation. Although Bayer applied the MOC 

process to the organization redesign implemented in 2007, the MOC failed to adequately address the 

impact the changes had on technical support during special operating situations, such as the methomyl 

unit startup with a completely new control system. 

 

53 The recommendations and corrective action listed in the 2005 PHA report to Bayer management contain the 

finding that “some areas of concern were identified...Many of the risk sheets identified in previous PHAs 

have not been mitigated.”

000118
97 

Table 3. Common PSM program deficiencies identified in CSB investigations

 PHA MOC PSSR

Standard 

Operating 

Procedures 

Bayer (2008) X X X X

BP (2005) X X X X

Formosa (2004) X X X 

DPC (2002) X X 

Honeywell (2003) X X

INDSPEC (2008) X X

Motiva (2001) X X X

Sierra (1998) X X X

Tosco (1999) X

Valero (2007) X X 

The CSB determined that PHAs and PSSRs performed at both BP Texas City and Bayer were not 

sufficient. In both cases, the PHAs failed to address operating conditions involving bypassed or 

inoperative safety devices. At BP Texas City, the CSB determined that, “none of the PSSR procedural 

steps were undertaken for the ISOM startup.” This is echoed in the Bayer case, as personnel 

improperly identified the PSSR as complete, and thus they proceeded with the methomyl unit startup 

even though equipment was not properly installed or calibrated. 

At Bayer, longstanding operating procedure deficiencies played a significant role in the accident. As 

was the case in the BP incident, the CSB found that, “management did not effectively review the 

available computer records of [SOP] deviations and intervene to prevent future deviations.” The staff 

should have corrected the operational problems before they proceeded with the unit restart. 

Furthermore, management did not enforce procedural compliance or proper application of MOC to 

ensure SOP errors were corrected. In all six CSB investigations that identified SOP problems, each 

000119
98 

incident involved SOP deviations that became “necessary violations” to get the job done 

(Hopkins, 2000). 

5.1.4 OSHA PSM Chemical National Emphasis Program

Since the Process Safety Management of Highly Hazardous Chemicals standard was promulgated in 

1992, OSHA has found that even employers with extensive written PSM programs may not 

effectively implement the programs on their covered processes. On July 27, 2009, OSHA issued a 

directive to implement a pilot national emphasis program (NEP) for chemical facilities covered by the 

PSM standard. The NEP directs certain OSHA regional offices to verify that the activities actually 

performed by employers are consistent with the employer’s written program and with the 

requirements of the standard. This NEP requires auditors to use investigative questions focused on a 

limited number of specific PSM program activities, rather than the traditional PSM program 

inspections that involved comprehensive, but broad, open-ended, and resource-intensive compliance 

evaluations. The NEP is intended to “allow for a greater number of inspections by better allocation of 

OSHA resources” [OSHA Directive 09-06 (CPL 02)]. It applies to planned inspections in the pilot 

regions, and unplanned inspections OSHA-wide. On July 8, 2010, OSHA superseded Directive 09-06 

with Directive 10-05. The revision extended the NEP through September 2010 and encouraged State 

Plan adoption of the program. In October 2010, OSHA extended the directive in Regions 1, 7, and 10. 

OSHA continues evaluating the results of the pilot chemical industry NEP, and plans to make 

appropriate modifications to improve its effectiveness, and extend the NEP to all ten regional offices. 

5.1.5 OSHA PSM Citations Follow-up Deficiencies

OSHA has issued many citations to companies for failure to comply with the PSM standard. 

Generally, the companies are required to submit written certifications to OSHA that assert the 

corrective actions have been implemented, as Bayer submitted in response to the citations that 

resulted from the 2005 planned inspection. Furthermore, OSHA can levy significant penalties when 

000120
99 

they determine that a company has a repeat violation, or has failed to abate workplace hazards cited in 

a previous inspection. 

The CSB found, as did OSHA, that contrary to the certifications made by Bayer, some corrective 

actions were not implemented adequately. The CSB further found that OSHA does not always 

conduct follow-up field inspections to verify that companies have, in fact fully implemented agreedupon corrective actions. OSHA field inspections that occur through planned inspections, complaints, 

referrals, or accident investigations do not necessarily examine the adequacy of corrective actions 

from previous inspections that a company has certified to be complete. Follow-up inspections 

specifically intended to confirm corrective action status are utilized only occasionally.

5.2 Environmental Protection Agency

Risk Management Program

The EPA Risk Management Program (RMP) regulation (40 CFR 68), mandated by Section 112(r) of 

the Clean Air Act Amendments of 1990, regulates the use of highly hazardous chemicals at facilities 

(stationary sources). The purpose of the RMP is to prevent accidental offsite releases of these 

substances and ensure that the company and community are able to respond effectively in case of a 

release. The regulation applies to facilities that use or store regulated substances that exceed threshold 

quantities specified in the EPA regulations. 

5.2.1 Application of the Bayer CropScience Risk Management Program 

The Methomyl-Larvin unit and other units in the facility are subject to the RMP rule. The unit 

contained two listed toxic chemicals, methyl isocyanate (TQ = 10,000 pounds) and methyl mercaptan 

(TQ = 5,000 pounds). Bayer also reports six additional RMP regulated chemicals are used at the 

facility (Table 4). 

000121
100 

Table 4. RMP covered chemicals in Bayer process units

Chemical Threshold Quantity

(pounds)

ammonia 10,000 

chlorine 2,500 

trichloromethane 20,000 

methylamine 10,000 

methyl mercaptan 5,000 

phosgene 500 

trimethylamine 10,000 

The EPA requires the facility owner to assign to each covered process one of three “prevention 

program” levels based on offsite consequence analyses, incident history, and PSM program 

applicability. Program 1 is the lowest, simplest management program. Program 2 is an intermediate 

management level program with added program elements and basic documentation requirements. 

PSM-covered processes cannot be designated Program 2. Program 3 is the highest level management 

program. All PSM program activities and records are directly applicable to the Program 3 regulatory 

activities. Most PSM-covered processes fall into Program 3, as do the Bayer Institute facility 

processes that involve the seven RMP listed chemicals.

Each covered process must undergo a hazard assessment (40 CFR 68, Subpart B) in which the owner 

is required to prepare a “worst case release scenario” and an “alternative release scenario” for each 

covered process. Different analysis criteria apply based on whether the covered chemical is a toxic or 

000122
101 

flammable material. The hazard assessment also requires inclusion of the “five year accident history.” 

The results of the hazard assessment, along with other pertinent information for each covered process, 

must be submitted to the EPA. This Risk Management Plan (40 CFR 68, Subpart G) is prepared and 

submitted electronically and must be periodically updated by the facility owner. 

The most recent Bayer CropScience Institute facility Risk Management Plan submittal preceding the 

August 2008 incident was dated July 2007. It states: 

The phosgene and MIC units [sic] on-site inventories have been minimized as far 

as practicable in order to minimize the potential impact in the event of a release. 

In 1992 and 1993, the phosgene process was rebuilt and the MIC process was 

modified to achieve these improvements following a thorough study of potential 

release scenarios.

The Risk Management Plan also discusses air emissions controls: “All of the processes covered by 

RMP utilize scrubbers and flares to destroy emissions from the process to minimize releases to the 

atmosphere.” 

The five-year accident history for the RMP-regulated chemicals reports an accident that released 

approximately 15 pounds of phosgene (October 1999), another that released less than 1 pound of 

chlorine (May 2000), and a third that released approximately 3,000 pounds of liquid chloroform 

(August 2001). Each resulted in one or more worker exposures, and the phosgene release prompted a 

shelter-in place-alert. However, the company reports none of the releases involved offsite 

consequences. 

5.2.2 EPA Inspections at the Bayer Institute Facility

The CSB searched the EPA Enforcement and Compliance History Online database for a record of 

EPA program audits or inspections at the Bayer facility. The database identified three evaluations of 

the Clean Air Act, Section 112(r), the first in 2005 and the second in 2006, which involved the MIC 

000123
102 

production unit. A third evaluation occurred in 2007.54

5.2.3 EPA Office of Inspector General Risk Management Program Review

None of the evaluations resulted in any 

enforcement action by the EPA. 

In 2008, the Office of Inspector General (OIG) of the U.S. Environmental Protection Agency 

conducted a review of the EPA implementation and oversight of the Risk Management Program 

(40 CFR 68). The OIG issued the final report, EPA Can Improve Implementation of the Risk 

Management Program for Airborne Chemical Releases, Report No. 09-P-0092 on February 10, 2009. 

The OIG review found that EPA had not inspected or audited more than half (296 of 493) of the highrisk facilities. EPA Region 3, which includes West Virginia, had the highest RMP inspection rate 

of high-risk facilities (96 percent). 

The report contained two significant recommendations to the EPA: 

• Strengthen its inspection process to provide greater assurance that facilities comply with 

Risk Management Program requirements, and 

• Develop inspection requirements to target higher-priority facilities for inspection and 

track its progress in completing inspections of these facilities.

The CSB also found during other incident investigations involving RMP covered processes that the 

EPA has seldom performed comprehensive audits or inspections of RMP programs at the facilities 

where the incident occurred. 

In a May 2009 memorandum to the Office of Inspector General, EPA Office of Enforcement and 

Compliance Assurance agreed with the OIG recommendations. It revised the definition of a high-risk 

facility and reported that it would “work with the regions to develop an approach for targeting high 

risk facilities to make the best use of our limited inspection resources.” EPA also revised the fiscal 

 

54 The EPA Enforcement and Compliance History Online database lists Bayer as the owner for the 2006 

evaluation and Union Carbide Corporation as the owner for the 2005 and 2007 evaluation.

000124
103 

year 2010 National Program Managers Guidance to require the regions to ”require at least 10 percent 

of the total number of 112(r) inspections at defined high risk facilities.” Finally, EPA agreed to 

improve compliance inspection tracking of high-risk facilities. 

5.3 State and Local Government Programs

5.3.1 Contra Costa County California Hazardous Materials Safety Ordinance

In 1999, the Contra Costa County, California Board of Supervisors approved an industrial safety 

ordinance55

• The owner shall prepare a Facility Safety Plan and submit it to the department. The Plan shall 

include: 

that established broad authority to the county health services department to oversee 

stationary sources in the refining and chemical industries in unincorporated areas in the county. The 

ordinance contains the following key elements: 

- Human factors and safety culture assessments

- Consideration of inherently safer technologies in the PHA. 

• The county health services department shall: 

- Conduct tri-annual audits of all submitted Safety Plans, 

- Hold public meetings on the facility safety plan, 

- Collect and maintain certain documents in a public information bank, and 

- Conduct an annual program performance review and issue a written report. 

• The facility owner shall:

- Allow the department to investigate an accident site and directly related facilities and 

submit an annual report of all accidents,

- Document the decision made to implement or not implement all process hazard analysis 

recommended action items and the results of recommendations for additional studies, and 

- Periodically conduct a safety culture assessment. 

 

55 Contra Costa County, California, Ordinance Code Title 4 – Health and Safety, Division 450 – Hazardous 

Materials and Wastes, Chapter 450-8 – Risk Management.

000125
104 

The State also authorized the county to collect fees from each covered facility to fund the program. 

The department maintains a full-time staff of technical specialists who administer the program, 

perform the required audits, and conduct incident investigations. The City of Richmond adopted a 

similar ordinance in 2002 that mirrors the Contra Costa County ordinance. 

The ordinance requires the Health Services department to conduct annual program reviews to 

evaluate the effectiveness of the program, discuss the results of audits completed by the department, 

and present various program metrics. The November 2009 annual audit56

The number and severity of the Major Chemical Accidents or Releases have been 

decreasing since the implementation of Industrial Safety Ordinance. The 

implementation of the Industrial Safety Ordinance has improved and, in most 

cases, is being done as required by the ordinance. It is believed that by continuing 

implementation of the Industrial Safety Ordinance and strengthening the 

requirements of the Ordinance that the possibility of accidents that could impact 

the community has decreased. 

 concluded: 

The ordinance applies to three refineries and four chemical facilities in the county as 

reported in the audit. The audit report also includes the results of the City of Richmond 

ordinance, which includes one refinery and one chemical facility. The total fees assessed 

to the covered facilities in 2008 were less than $440,000. For the same period, the county 

reported that 4400 hours were charged in support of the ordinance. The report notes a 

significant decrease in the number of “major chemical accidents and releases” at covered 

facilities, from 11 incidents in 2001 to zero incidents in 2009. 

As the CSB previously noted in its BP Texas City refinery investigation, the Contra 

Costa program has the benefit that covered facilities are regularly inspected for process 

 

56 http://cchealth.org/groups/hazmat/industrial_safety_ordinance.php, October 2010.

000126
105 

safety compliance every three years by a team of trained engineers employed by the 

county and funded through fee collection. By contrast, as the CSB and others noted, 

comprehensive OSHA and EPA safety inspections of high-hazard chemical facilities 

have historically been infrequent. OSHA and EPA process safety inspections do not 

occur on a regular schedule and often result only from a serious accident or complaint.57

5.3.2 New Jersey Toxic Catastrophe Prevention Act 

The New Jersey state legislature enacted the Toxic Catastrophe Prevention Act (TCPA) in 1985 in 

response to the release of MIC in 1984 from the Union Carbide India Limited plant in Bhopal. The 

TCPA was one of the first regulatory programs in the nation to impose more stringent requirements 

on chemical facilities to reduce the risk of accidental releases. The TCPA is part of the New Jersey 

Department of Environmental Protection (DEP) Bureau of Release Prevention and has been accepted 

by the U.S. EPA for implementing the Risk Management Program regulation (40 CFR 68). 

The TCPA is intended to protect the public from catastrophes caused by the release of Extraordinary 

Hazardous Substances (EHS) 58 and Reactive Hazard Substances (RHS).59

 

57 In 2007, the CSB recommended in its BP Texas City investigation that OSHA “strengthen the planned 

comprehensive enforcement of the OSHA Process Safety Management (PSM) standard” and “establish 

the capacity to conduct more comprehensive PSM inspections by hiring or developing a sufficient cadre 

of highly trained and experienced inspectors.”

Facilities covered under 

58 An EHS is any substance or chemical compound used, manufactured, stored, or capable of being produced 

from on-site components in this State in sufficient quantities at a single site such that its release into the 

environment would produce a significant likelihood that persons exposed will suffer acute health effects 

resulting in death or permanent disability.

59 An RHS is an EHS that is a substance, or combination of substances, which is capable of producing toxic or 

flammable EHSs or undergoing unintentional chemical transformations producing energy and causing an 

extraordinarily hazardous accident risk.

000127
106 

the act must submit a Risk Management Plan for all covered processes. Additionally, the DEP may 

require owners or operators to do the following under the TCPA: 

• Immediately submit a risk management program for the DEP to review, 

• Perform a safety review, hazard analysis, or risk assessment, 

• Immediately take risk reduction actions or implement a risk reduction plan, and 

• Cease operating until the identified risks have been abated. 

The TCPA incorporates the EPA RMP list of toxic chemicals and threshold quantities; however, the 

TCPA EHS list contains several chemicals with lower thresholds than the RMP. The TCPA list also 

contains some chemicals for which the RMP does not apply. Facilities in New Jersey that process 

listed EHSs or RHSs in excess of the threshold quantities must submit a TCPA-specific Risk 

Management Plan to the DEP. The facility must also submit an EPA-specific Risk Management Plan 

as required by 40 CFR 68 Subpart G if the chemical is listed in the EPA RMP and the quantity 

exceeds the EPA threshold quantity.

Facilities with substances or mixtures containing substances on the RHS list must conduct a hazard 

assessment under the TCPA. The RHS list contains 30 specific reactive chemicals and 43 functional 

groups that exhibit reactive hazards such as water reactivity and pyrophoric or self-reacting 

properties. Operators must determine applicability of substances and mixtures to the RHS 

requirements by conducting calorimetry tests, literature reviews, or engineering calculations to 

determine the heat of reaction. The RHS threshold quantity ranges from 13,100 pounds for the lowest 

heat of reaction value (100 calories per gram) to 2400 pounds for a heat of reaction at, or above 1000 

calories per gram.

In June 2008, the state amended the act to require facilities to conduct inherently safer technology 

(IST) reviews, to provide improved risk reduction. A team of qualified experts are required to conduct 

the IST reviews, as well as operations and union representatives. Each covered facility must 

000128
107 

determine whether IST is feasible and take into account environmental, health and safety, legal, 

technological, and economic factors into the analysis. The IST review must be submitted to the TCPA 

and updated on a 5-year basis, or with major process modifications. 

As of March 2010, the TCPA has eliminated the less rigorous RMP Program 1and Program 2 criteria 

[40 CFR 68.10(b) and (c)]; it now requires all covered processes to be classified and managed in 

accordance with Program 3. It is the most rigorous toxic chemical environmental regulatory program 

in the United States.

5.3.3 Hazardous Materials Regulatory Oversight in West Virginia

Like Contra Costa County, the Kanawha valley has many facilities that handle large quantities of 

hazardous materials, some of which are acutely toxic. The EPA RMP database contains 15 facilities 

that report EPA Risk Management Program covered chemicals assigned as Program level 3 in 

Kanawha County. Statewide, the RMP database contains 54 facilities with Program level 3 plans. The 

region contains environmentally sensitive areas such as the Kanawha River, which is also an 

important transportation corridor. In addition to the serious incident at Bayer’s Institute plant in 

2008, the CSB is currently investigating a series of incidents that occurred in 2010 at the DuPont 

chemical plant in nearby Belle, West Virginia, including a fatal release of phosgene gas on January 

23. Although the CSBs final report on the DuPont incidents remains to be completed, the incidents at 

DuPont also reveal process safety deficiencies that were not detected or corrected through existing 

regulatory enforcement mechanisms. In the Kanawha valley where both Bayer and DuPont are 

located, neither the state nor the local government has a program or regulation in place that requires 

or authorizes direct participation with facility safety planning and oversight even though many 

community stakeholders have long campaigned for such involvement. 

The West Virginia Code Chapter 16, Public Health, charges the state public health agency with 

providing “Essential public health services” i.e., activities necessary to promote health and prevent

disease, injury and disability for the citizens of the state.” The code authorizes the commissioner of 

000129
108 

the bureau for public health “To make inspections, conduct hearings, and to enforce the legislative

rules concerning occupational and industrial health hazards.” The Secretary of the state department 

of health and human resources may also propose “Fees for services provided by the Bureau for Public 

Health.” 

If the West Virginia Department of Health and Human Services were to implement a program similar 

to the California safety ordinance, it would likely improve stakeholder participation and awareness, 

and improve emergency planning and accident prevention. 

000130
109 

6.0 Key Findings

6.1 Process Hazard Analysis

1. The PHA team did not validate the assumptions in the PHA including accuracy of the 

SOP, conformance to the SOP, and control of process safeguards. 

2. The residue treater layers of protection to prevent a runaway reaction were inadequate.

3. Previous PHA action items were not closed in a timely manner, including operator 

training and control of process safeguards. 

4. The methomyl unit SOP was overly complex and not reviewed and approved prior to the 

methomyl unit startup. 

5. The SOP did not include flasher tails methomyl concentration testing as required by the 

original construction process safety information package. 

6.2 Pre-Startup Safety Review

1. The PSSR did not include a formal process involving multiple disciplines. 

2. The PSSR did not verify the completion of modifications in the field, including: 

a. Methomyl-Larvin unit toxic gas monitoring system was not in service.

b. Project engineers did not verify the functionality of critical DCS control and 

indication circuits. 

c. Operating equipment and instruments were not installed before the restart, some of 

which were discovered to be missing after the startup began.

3. Equipment checkouts as required by the pre-startup safety review were incomplete:

a. Methomyl-Larvin unit toxic gas monitoring system was not in service.

b. Project engineers did not verify the functionality of critical DCS control and 

indication circuits.

c. Valve lineups were incomplete or incorrect.

4. Control system training was inadequate. The operators were not formally trained on the 

methomyl DCS and were not familiar with some of the changed units of measure used on 

the DCS displays.

000131
110 

6.3 Methomyl Unit Startup 

1. Methomyl unit board operators were not provided with computer screen displays to 

effectively operate all assigned process and utility systems. 

2. Multiple operational problems diverted the staff’s attention:

a. Only one of the two centrifuges was operating properly. 

b. The new Siemens operating system was not calibrated; consequently, the staff 

struggled with balancing the MIBK- hexane ratio in the crystallizers.

c. Operators were pressured to start the MIBK solvent recovery system because the 

MIBK stockpile levels were getting low.

3. Operations personnel incorrectly assumed that methomyl was not being produced in the 

reactor even though the flasher feed sample lab results were available, which reported 

excessively high methomyl content in the process downstream from the reactor.

4. Operators and technical staff did not troubleshoot why the centrifuges did not contain 

methomyl cake. 

5. Several required SOP steps were not completed during the methomyl unit startup: 

a. The residue treater was not pre-filled with solvent. 

b. The solvent was not circulated and heated to the minimum operating temperature. 

c. The 7 a.m. daily residue treater liquid sample was not collected and analyzed for 

methomyl concentration. 

6. Management did not strictly enforce the safety matrix control policies. Bypassing the 

safety interlocks on the residue treater flasher bottoms feed valve allowed the empty 

residue treater to be filled with concentrated methomyl. 

7. Oxime system startup problems diverted operators’ attention, resulting in poor 

communication between methomyl board operators at shift change. 

000132
111 

8. The residue treater relief system design basis was invalidated during the methomyl unit 

startup:

a. The design basis assumed that the safety interlocks were active, but the interlocks 

were bypassed.

b. The resident treater relief system design basis relied on administrative controls such 

as sample collection and analysis to prevent overcharging methomyl, but these 

controls were either incomplete or not implemented before startup. 

9. A runaway methomyl decomposition reaction inside the residue treater overwhelmed the 

vent system and caused the vessel to violently explode. 

6.4 MIC Day Tank Shield Structure Design

1. The blast blanket design basis did not consider an impact of a large object moving at high 

velocity. Had the residue treater traveled in the direction of the day tank and struck the 

shield structure near the top of the frame it might have resulted in an MIC release into the 

atmosphere (see Appendix C) 

6.5 Emergency Planning, Response, and Communication 

6.5.1 Bayer CropScience

1. The Bayer onsite emergency response did not conform to the unified command structure 

contained in the National Incident Management System (NIMS) protocols. 

2. Bayer did not assign a Public Information Officer (PIO) to directly communicate with the 

Kanawha Putnam EOC and Metro 9-1-1. 

3. Unknown to Bayer emergency personnel, the Methomyl-Larvin unit air monitor system 

that they relied on to determine and report airborne concentrations of possible toxic 

chemicals was not in service the night of the incident.

4. Bayer had only two distant fenceline air monitors to determine the extent of chemical 

contaminants traveling off site.

5. Although the Bayer IC recommended a shelter-in-place, the Bayer EOC did not notify 

Metro 9-1-1. 

6. Bayer discontinued hot zone decontamination activities before all emergency responders 

were able to clean their safety gear. 

000133
112 

6.5.2 Outside Responding Agencies

1. The overloaded telephone system prevented Bayer from promptly notifying the Metro 9-

1-1 center of the incident.

2. County emergency responders established three separate EOCs in response to the 

incident, which resulted in duplication of effort, poor communication, and conflicting 

control. 

3. First-responders working near the explosion and fire did not wear adequate respiratory 

protection and were not decontaminated. 

6.5.3 Kanawha County Commission

1. The Kanawha Putnam Emergency Management Plan does not adequately address 

emergency response personnel responsibilities and communications between the facility 

IC and outside emergency response organizations when a facility owner is responsible for 

incident command during an on-site emergency involving hazardous chemicals.

6.6 Environmental Impact

1. MIC air monitoring devices in the Methomyl-Larvin unit were not functioning at the time 

of the incident, preventing the accurate measurement of any MIC release from piping or 

equipment that might have resulted from the explosion and fires. 

2. Two fenceline monitors located hundreds of feet from the incident location were 

ineffective for detecting toxic chemicals that might be released into the atmosphere either 

from process equipment leaks or spills, or combustion products from a major fire. 

6.7 Regulatory Oversight

1. Both the Occupational Safety and Health Administration (OSHA) and the Environmental 

Protection Agency (EPA) had conducted process safety related audits and inspections at 

the Bayer facility prior to the incident in August 2008. However, the inspections did not 

detect or correct all the serious, longstanding process safety problems that were revealed 

by investigations conducted after the incident.

2. OSHA cited Bayer for deficient process hazard analyses in 2005; however OSHA did not 

subsequently verify that corrective actions were fully implemented by Bayer. Deficient 

PHAs were a causal factor in the August 2008 incident. 

000134
113 

7.0 Incident Causes

1. Bayer did not apply standard PSSR and turnover practices to the methomyl control 

system redesign project. Bayer restarted the unit before the equipment was properly 

tested and calibrated.

2. Operations personnel were inadequately trained to operate the methomyl unit with the 

new DCS control system.

3. Malfunctioning equipment and the inadequate DCS checkout prevented the operators 

from achieving correct operating conditions in the crystallizers and solvent recovery 

equipment. 

4. The methomyl-solvent mixture was fed to the residue treater before the residue treater 

was pre-filled with solvent and heated to the minimum safe operating temperature.

5. The incoming process stream normally generated an exothermic decomposition reaction, 

but methomyl that had not crystallized due to equipment problems greatly increased the 

methomyl concentration in the residue treater, which led to a runaway reaction that

overwhelmed the relief system and over-pressurized the residue treater. 

000135
114 

8.0 Recommendations

The CSB makes recommendations based on the findings and conclusions of its investigations. 

Recommendations are made to parties that can effect change to prevent future incidents, which may 

include the companies involved; industry organizations responsible for developing good practice 

guidelines; regulatory bodies; and/or organizations that have the ability to broadly communicate 

lessons learned from the incident, such as trade associations and labor unions. 

8.1 Bayer CropScience – Research Triangle Park, NC

2008-08-I-WV-R1 Revise the corporate PHA policies and procedures to require:

a. Validation of all PHA assumptions to ensure that risk analysis of each 

PHA scenario specifically examines the risk(s) of intentional bypassing 

or other nullifications of safeguards, 

b. Addressing all phases of operation and special topics including those 

cited in chapter 9 of “Guidelines for Hazard Evaluation Procedures” 

(CCPS, 2008), and 

c. Training all PHA facilitators on the revised policies and procedures prior 

to assigning the facilitator to a PHA team.

Ensure all PHAs are updated to conform to the revised procedures. 

8.2 Bayer CropScience - Institute, West Virginia

2008-08-I-WV-R2 Review and revise, as necessary, all Bayer production unit standard operating 

procedures to ensure they address all operating modes (startup, normal 

operation, temporary operations, emergency shutdown, emergency 

operations, normal shutdown, and startup following a turnaround or 

emergency shutdown), are accurate, and approved.

000136
115 

2008-08-I-WV-R3 Ensure that all facility fire brigade members are trained in the National 

Incident Management System, consistent with municipal and state 

emergency response agencies.

2008-08-I-WV-R4 Evaluate the fenceline air monitor program against federal, state, and local 

regulations, and Bayer corporate policies, and upgrade and install air

monitoring devices as necessary to ensure effective monitoring of potential 

releases of high-hazard chemicals at the perimeter of the facility. 

2008-08-I-WV-R5 Commission an independent human factors and ergonomics study of all 

Institute site PSM/RMP covered process control rooms to evaluate the 

human-control system interface, operator fatigue, and control system 

familiarity and training. Develop and implement a plan to resolve all 

recommendations identified in the study that includes assigned 

responsibilities, required corrective actions, and completion dates. 

000137
116 

8.3 Director of the Kanawha-Charleston Health Department

2008-08-I-WV-R6 Establish a Hazardous Chemical Release Prevention Program to enhance the 

prevention of accidental releases of highly hazardous chemicals, and 

optimize responses in the event of their occurrence. In establishing the 

program, study and evaluate the possible applicability of the experience of 

similar programs in the country, such as those summarized in Section 5.3 of 

this report. As a minimum: 

a. Ensure that the new program: 

1. Implements an effective system of independent oversight and other 

services to enhance the prevention of accidental releases of highly 

hazardous chemicals 

2. Facilitates the collaboration of multiple stakeholders in achieving 

common goals of chemical safety; and, 

3. Increases the confidence of the community, the workforce, and the 

local authorities in the ability of the facility owners to prevent and 

respond to accidental releases of highly hazardous chemicals

b. Define the characteristics of chemical facilities that would be covered by 

the new Program, such as the hazards and potential risks of their 

chemicals and processes, their quantities, and similar relevant factors;

000138
117 

c. Ensure that covered facilities develop, implement, and submit for review 

and approval: 

1. Applicable hazard and process information and evaluations.

2. Written safety plans with appropriate descriptions of hazard controls, 

safety culture and human factors programs with employee 

participation, and consideration of the adoption of inherently safer 

systems to reduce risks

3. Emergency response plans; and,

4. Performance indicators addressing the prevention of chemical 

incidents.

d. Ensure that the program has the right to evaluate the documents 

submitted by the covered facilities, and to require modifications, as 

necessary 

e. Ensure that the program has right-of-entry to covered facilities, and 

access to requisite information to conduct periodic audits of safety 

systems and investigations of chemical releases;

f. Establish a system of fees assessed on covered facilities sufficient to 

cover the oversight and related services to be provided to the facilities 

including necessary technical and administrative personnel; and,

g. Consistent with applicable law, ensure that the program provides 

reasonable public participation with the program staff in review of 

facility programs and access to:

1. The materials submitted by covered facilities (e.g., hazard 

evaluations, safety plans, emergency response plans);

2. The reviews conducted by program staff and the modifications 

triggered by those reviews;

000139
118 

3. Records of audits and incident investigations conducted by the 

program; 

4. Performance indicator reports and data submitted by the facilities, 

and; 

5. Other relevant information concerning the hazards and the control 

methods overseen by the program. 

h. Ensure that the program will require a periodic review of the designated 

agency activities and issue a periodic public report of its activities and 

recommended action items.

8.4 Secretary of West Virginia Department of Health and Human 

Services and the West Virginia Department of Environmental 

Protection

2008-08-I-WV-R7 Work with the Director of the Kanawha-Charleston Health Department to 

ensure the successful planning, fee collection, and implementation of the 

Hazardous Chemical Release Prevention Program as described in 

Recommendation 2008-08-WV-R6, above, including the provision of 

services to all eligible facilities in the State.

8.5 Kanawha-Putnam Emergency Planning Committee 

2008-08-I-WV-R8 Work with the Kanawha and Putnam counties Emergency Response 

Directors to prepare and issue a revision to the Kanawha Putnam County 

Emergency Response Plan and Annexes to address facility emergency 

response and Incident Command when such functions are provided by the 

facility owner.

000140
119 

8.6 West Virginia State Fire Commission

2008-08-I-WV-R9 Revise the Fire Department Evaluation Administrative Section Matrix 

addressing the periodic inspection of local fire departments to include a 

requirement for inspectors to examine and identify the status of National 

Incident Management System fire department personnel training. 

8.7 Occupational Safety and Health Administration

2008-08-I-WV-R10 In light of the findings of this report and the serious potential hazards to 

workers and the public from chemicals used and stored at the Bayer Institute 

site (such as phosgene, MIC, and methomyl), conduct a comprehensive 

Process Safety Management (PSM) inspection of the complex. Coordinate 

with the Environmental Protection Agency, as appropriate. 

2008-08-I-WV-R11 Revise the Chemical National Emphasis Program and the targeting criteria 

to: 

a. Expand the coverage to all 10 OSHA regions,

b. Include in the targeting criteria from which potential inspections are

selected all establishments that have submitted certifications of

completions of actions in response to previous PSM citations;

c. Require NEP inspections to examine the status of compliance of all

previously cited PSM program items for which the company has

submitted certifications of completion to OSHA.

000141
120 

8.8 Environmental Protection Agency

2008-08-I-WV-R12 In light of the findings of this report and the serious potential hazards to 

workers and the public from chemicals used and stored at the Bayer Institute 

site (such as phosgene, MIC, and methomyl), conduct a comprehensive Risk 

Management Program (RMP) inspection of the complex. Coordinate with 

the Occupational Safety and Health Administration, as appropriate. 

000142
121 

9.0 REFERENCES 

Baum, M.R., “Disruptive Failure of Pressure Vessels: Preliminary Design Guidelines for Fragment 

Velocity and the Extent of the Hazard Zone,” ASME Journal of Pressure Vessel Technology, vol. 110 

pp168, May 1988. 

Cain, Maurice R., Pressure Vessel Assessment Workbook, General Physics Corporation, Titusville, 

Florida, 1995.

Center for Chemical Process Safety (CCPS). Guidelines For Hazard Evaluation Procedures, 

American Institute of Chemical Engineers, Center for Chemical Process Safety, New York, 2008.

CCPS. Guidelines for Preventing Human Error in Process Safety, American Institute of Chemical 

Engineers, Center for Chemical Process Safety, New York, 1994. 

CCPS. “Human Factors Methods for Improving Performance in the Process Industries,” American 

Institute of Chemical Engineers, Center for Chemical Process Safety, 2007. 

CCPS. Layer of Protection Analysis; Simplified Process Risk Assessment, American Institute of 

Chemical Engineers, Center for Chemical Process Safety, New York, 2001. 

Contra Costa County, California, Ordinance Code Title 4 – Health and Safety, Division 450 – 

Hazardous Materials and Wastes, Chapter 450-8 – Risk Management. 

Faupel, J.H., “Yield and Bursting Characteristics of Heavy-Wall Cylinders,” Transactions of the 

ASME, vol. 78 pp 1031-1064, July 1956. 

Hopkins, A., Lessons from Longford, the Esso Gas Plant Explosion. Sydney, New South Wales: CCH 

Australia Limited, 2000. 

Health and Safety Executive (HSE), Reducing Error and Influencing Behavior, 2nd ed. U.K.: HSE 

Books, 1999. 

HSE, Safety Culture: A Review of the Literature. HSL/2002/25, 2002. 

Knoll, G. G., Hildebrand, M.S., Yvorra, J. Eds. Hazardous Materials - Managing the Incident, 3rd 

edition, Red Hat Publishing: Chester, Maryland, 2005. 

New Jersey Department of Environmental Protection, Toxic Catastrophe Protection Act, New Jersey 

Administrative Code Title 7, Chapter 31. 

Sittig, M., Handbook of Toxic and Hazardous Chemicals and Carcinogens, 5th edition, William 

Andrew Norwich, New York, 2008. 

000143
122 

Stanton, N., Salmon, S., Jenkins D., Walker, G., Human Factors in the Design and Evaluation of 

Central Control Room Operations, CRC Press, Boca Raton, Florida, 2010. 

U.S. Chemical Safety and Hazard Investigation Board (CSB). Investigation Report, Explosive 

Manufacturing Incident, Sierra Chemical Company, January 7, 1998, No. 98-001-I-NV, 1998. 

CSB. Investigation Report, Refinery Fire Incident, Tosco Avon Refinery, February 23, 1999, No. 99-

014-I-CA, 2001. 

CSB. Investigation Report, Refinery Incident, Motiva Enterprises LLC, July 17 2001, No. 2001-05-IDE, 2002. 

CSB. Investigation Report, Chlorine Release, DPC Enterprises, L.P., August 14, 2002, No. 2002-04-

I-MO, 2003. 

CSB. Investigation Report, Chlorine Release, July 20, 2003, Contaminated Antimony Pentachloride 

Exposure, July 29, 2003, Hydrogen Fluoride Release, August 13, 2003, Honeywell International, Inc., 

No. 2003-13-I-LA, 2005. 

CSB. Investigation Report, Vinyl Chloride Monomer Explosion, Formosa Plastics Corp., April 23, 

2004, No. 2004-10-I-IL, 2007. 

CSB. Investigation Report, Refinery Explosion and Fire, BP, March 23, 2005, No. 2005-04-I-TX, 

2007. 

CSB. Investigation Report, LPG Fire at Valero – McKee Refinery, Valero Energy Corporation, 

February 16, 2007,, No. 2007-05-I-TX, 2008. 

CSB. Investigation Report,Uncontrolled Oleum Release Petrolia Pennsylvania, INDSPEC, No. 2009-

01-I-PA, 2009. 

U.S. Environmental Protection Agency (EPA), EPA Can Improve Implementation of the Risk 

Management Program for Airborne Chemical Releases, Office of Inspector General Report 

No. 09-P-0092, February 10, 2009. 

Worthy, W., “Methyl Isocyanate: The Chemistry of a Hazard,” Chemical & Engineering News, pp 

27-33, February 11, 1985. 

World Health Organization, International Program on Chemical Safety, Health and Safety Guide No. 

106, Phosgene Health and Safety Guide, Geneva, SZ, 1998. 

000144
Appendix A.

123 

Appendix A – Causal Analysis Charts

Appendix A is a "Why Tree" diagram showing the events that led to the incident and its

consequences. Each box in the Why Tree is from information discovered in the investigation, and is a 

statement of something that happened in the chain of events. To construct a Why Tree, the 

investigation team starts with a concise description of the on-site and off-site human health, 

environmental, and business impacts, and asks why each impact occurred. The team continues asking 

why each preceding event occurred until they determine that they have reached a root cause. The 

arrows show the direction of flow from the root causes to the final impacts. When the evidence shows 

that a particular hypothetical event did not happen, the box in the Why Tree has a diagonal line 

crossed through it and a statement next to the box describing the evidence that the event did not 

happen. 

000145
Appendix A.

124 

SIX FIREFIGHTERS AND 

TWO RAILWAY 

WORKERS REPORTED 

SYMPTOMS OF 

CHEMICAL EXPOSURE 

RELEASED CHEMICALS FROM 

THE RESIDUE TREATER TO 

THE ENVIRONMENT

ONE BAYER EMPLOYEE 

DIED FROM SEVERE 

THERMAL BURNS

SECOND BAYER 

EMPLOYEE DIED FROM 

BLUNT FORCE TRAUMA 

AND SEVERE THERMAL 

BURNS

DAMAGED 

PROPERTY ON SITE 

AND OFFSITE

RESIDUE TREATER LOSS 

OF CONTAINMENT AND 

EXPLOSION EXPOSED 

PEOPLE AND 

ENVIRONMENT TO 

RESIDUE TREATER 

CONTENTS AND FIRE

EMPLOYEES WERE IN 

THE VICINITY OF THE 

EXPLOSION

SEE SHEET 4

METHOMYL UNIT 

CONTROL PANEL 

OPERATOR ASKED TWO 

FIELD OPERATORS TO 

CHECK THE RESIDUE 

TREATER VENT LINE FOR 

PLUGGAGE

SEE SHEET 3 

SHEET 1

B

C

A SEE SHEET 2

000146
Appendix A.

125 

SEE SHEET 1

BAYER REPORTED THAT 

THEY HAD DETECTORS 

THAT WERE NOT 

DETECTING ANY 

CHEMICALS LEAVING THE 

SITE

EMERGENCY 

RESPONDERS REPORTED 

CHEMICAL ODORS 

THROUGH THE NIGHT

EMERGENCY 

RESPONDERS DID NOT 

WEAR RESPIRATORY 

PROTECTION

FIREFIGHTERS 

RESPONDED TO THE 

EXPLOSION AND FIRE

RAILWAY WORKERS 

WERE TRANSPORTING 

RAILCARS IN AND OUT 

FROM THE PLANT

RAILWAY WORKERS DID 

NOT WEAR RESPIRATORY 

PROTECTION AND WERE 

TOLD TO SHELTER IN 

PLACE RATHER THAN 

EVACUATE

CHEMICAL MONITORS IN 

THE METHOMYL AREA 

WERE NOT FUNCTIONING, 

AND THE TWO WORKING 

FENCELINE MONITORS 

WERE NOT CAPABLE OF 

DETECTING CHEMICALS 

SUCH AS METHOMYL AND 

MIBK

ALL CHEMICALS WERE 

NOT BEING CONSUMED IN 

THE FIRE

TYLER MOUNTAIN 

VOLUNTEER FIRE 

DEPARTMENT HEARD 

THE INFORMATION THAT 

ALL THE CHEMICALS 

WERE BEING CONSUMED 

BY THE FIRE. 

RAILWAY WORKERS 

WERE NOT IN A ROLE 

THAT WOULD HAVE 

BEEN TRAINED TO 

WEAR RESPIRATORY 

PROTECTION

RAILWAY WORKERS 

CALLED METRO 9-1-1 AND 

RECEIVED 

COMMUNICATIONS TO 

STOP OPERATIONS AND 

SHELTER IN PLACE, BUT 

DID NOT RECEIVE ANY 

COMMUNICATIONS ABOUT 

POTENTIAL CHEMICAL 

EXPOSURE

THE BAYER INCIDENT 

COMMANDER 

COMMUNICATED TO THE 

BAYER EMERGENCY 

OPERATIONS CENTER 

AND THE INSTITUTE FIRE 

DEPARTMENT THAT THE 

CHEMICALS WERE BEING 

CONSUMED IN THE FIRE

BAYER DID NOT SHARE 

RELEVANT INFORMATION 

WITH METRO 9-1-1

SHEET 2

A

000147
Appendix A.

126 

SEE SHEET 1 

METHOMYL UNIT 

CONTROL PANEL 

OPERATOR 

INCORRECTLY ASSUMED 

RESIDUE TREATER VENT 

LINE WAS PLUGGED

UNPLUGGING THE VENT 

LINE WAS A MANUAL 

TASK

METHOMYL UNIT 

CONTROL PANEL 

OPERATOR ATTENTION 

WAS PARTIALLY 

DIVERTED TO THE LARVIN 

UNIT

SHIFT CHANGE AT 6:00 

AM DID NOT DISCUSS 

THE STATUS OF THE 

RESIDUE TREATER AND 

THAT THEY HAD 

STARTED FEEDING THE 

RESIDUE TREATER AT 

4:24 AM WITH FLASHER 

BOTTOMS (RATHER 

THAN SOLVENT).

SHIFT CHANGE AT 6:00 

PM DID NOT DISCUSS 

THE STATUS OF THE 

RESIDUE TREATER. 

METHOMYL UNIT 

CONTROL PANEL 

OPERATOR WAS LIKELY 

FATIGUED 

(OPERATOR HAD A ONE 

DAY BREAK AND 

WORKED 84 HOURS 

THAT WEEK.) 

PLUGGING IN THE 

RESIDUE TREATER VENT 

LINE WAS A KNOWN 

COMMON ISSUE

METHOMYL UNIT 

CONTROL PANEL 

OPERATOR RECEIVED 

RESIDUE TREATER HIGH 

PRESSURE ALARM AT 

22:19

METHOMYL UNIT 

CONTROL PANEL 

OPERATOR WAS ASKED 

TO HELP TROUBLESHOOT 

THE LARVIN UNIT

THIS WAS THE FIRST 

TIME THAT OPERATIONS 

TRIED TO RUN LARVIN 

AND METHOMYL AT THE 

SAME TIME (SINCE 

INSTALLING THE NEW 

DCS IN METHOMYL)

THE RESIDUE TREATER 

PROCESS CREATED 

ENTRAINED LIQUID OR 

CONDENSIBLE VAPORS

VENT DESIGN ALLOWED 

PLUGGING

METHOMYL AND MSAO 

DECOMPOSITION 

FORMED GASES AND 

INCREASED THE 

PRESSURE IN THE 

RESIDUE TREATER 

OPERATIONS AND 

TECHNICAL DID NOT 

RESOLVE THE ISSUE

VAPOR STREAM 

CONDENSED IN VENT 

LINE

FAILED TO MANAGE THE 

HAZARD; TREATED AS A 

MINOR OPERATING 

ISSUE RATHER THAN A 

SAFETY ISSUE SEE SHEET 5

SHEET 3

B

D

000148
Appendix A.

127 

SEE SHEET 1 

RATE OF PRESSURE 

INCREASE EXCEEDED 

THE DESIGN BASIS FOR 

THE PRESSURE RELIEF 

SYSTEM

UNCONTROLLED 

DECOMPOSITION 

REACTION ACCELERATED

PRESSURE SAFETY 

VALVE DESIGN BASIS 

CONSIDERED A 

RUNAWAY CASE WITH A 

MAXIMUM OF 280 LBS 

METHOMYL VERSUS 

THOUSANDS OF POUNDS 

DURING THE INCIDENT

2005 PHA ASSUMED THAT 

THE AUTOMATED 

CONTROLS WOULD 

PREVENT THE EVENT, 

BUT OPERATIONS 

FREQUENTLY BYPASSED 

THE INTERLOCKS

MOC PROCESS FOR 

THE 2008 DCS PROJECT 

DID NOT PERFORM A 

PHA THAT CONSIDERED 

THE POTENTIAL TO 

BYPASS INTERLOCKS

DECOMPOSITION 

REACTION BECAME SELFSUSTAINING (RUNAWAY)

BAYER CONCLUDED 

THAT THERE WERE 

OTHER PROTECTIONS 

TO PREVENT 

OVERLOADING THE 

RESIDUE TREATER

1994 PHA TEAM 

IDENTIFIED THE LOSS OF 

CONTAINMENT EVENT 

BUT DID NOT 

RECOMMEND CHANGES 

TO PREVENT THE EVENT

THE 2005 PHA 

DEPENDED TOO 

HEAVILY ON THE 

EXISTING PHA RATHER 

THAN PROVIDING IN 

DEPTH ANALYSIS

THE PHA TEAM GAVE 

TOO MUCH CREDIT TO 

THE AUTOMATIC 

CONTROLS 

(INTERLOCKS) BEING IN 

PLACE

HIGHER TEMPERATURE 

INCREASED THE RATE OF 

REACTION AND THE 

RATE OF SOLVENT 

EVAPORATION

DCS PROGRAMMING 

ERROR INACTIVATED THE 

COOLING SYSTEM. 

COOLING SYSTEM WAS 

NOT DESIGNED TO 

PREVENT RUNAWAY 

CONDITIONS

PHA TRAINING AND 

EXECUTION WERE 

INADEQUATE

HEAT GENERATION 

INCREASED THE 

TEMPERATURE IN THE 

RESIDUE TREATER 

COOLING SYSTEM WAS 

ADAPTED FROM OLD 

HEATING SYSTEM TO 

COOL FOR CONTROL TO 

SETPOINT

SEE SHEET 5 

 SHEET 4

C

E

000149
Appendix A.

128 

SEE SHEET 3 SEE SHEET 4

DECOMPOSITION 

REACTIONS 

GENERATED HEAT

RESIDUE TREATER 

LIQUID BEGAN 

DECOMPOSING

PUMPING HOT MIBK INTO 

THE RESIDUE TREATER 

HEATED THE LIQUID AT 

HIGH CONCENTRATION. 

DECOMPOSITION IS A 

FUNCTION OF BOTH 

TEMPERATURE AND 

CONCENTRATION

MSAO DECOMPOSES 

AT A LOWER 

TEMPERATURE THAN 

METHOMYL

SEE SHEET 6

METHOMYL 

CONCENTRATION IN 

RESIDUE TREATER 

LIQUID WAS MANY TIMES 

MORE THAN THE SOP 

LIMIT.

RESIDUE TREATER 

LIQUID WAS MOSTLY 

MOTHER LIQUOR 

FLASHER TAILS INSTEAD 

OF HOT MIBK

SEE SHEET 7 

SHEET 5

D E

G

F

000150
Appendix A.

129 

 SEE SHEET 5

THERE WERE 

SOURCES OF HEAT IN 

THE SYSTEM

MOTHER LIQUOR 

FLASHER TAILS 

TEMPERATURE WAS 

80 °C WHILE 

RESIDUE TREATER 

WAS BEING FILLED

HEAT EXCHANGER 

E-2575 

(TEMPERED WATER 

COOLER) 

HEATED THE LIQUID

OPERATOR SWITCHED 

THE TEMPERATURE 

CONTROLLER TO 

AUTOMATIC AT 18:15 

TO HEAT THE 

RESIDUE TREATER 

CONTENTS

CIRCULATION PUMP 

HEATED THE LIQUID 

(NEGLIGIBLE 

CONTRIBUTION)

OPERATOR ADDED 

80 °C MIBK TO THE 

RESIDUE TREATER 

SYSTEM AT 6:30 PM

THE MOTHER 

LIQUOR FLASHER 

SYSTEM WAS 

OPERATING

HEAT EXCHANGER 

E-2576R 

(STEAM HEATER) 

HEATED THE LIQUID

OPERATOR TURNED 

ON CIRCULATION 

PUMP (MANUAL)

SHEET 6

THE MANUAL BLOCK VALVE 

ON THE STEAM SUPPLY LINE 

WAS CLOSED

THE AUTOMATIC VALVE TO 

HEAT EXCHANGER E-2575 

WAS CLOSED.

F

000151
Appendix A.

130 

SEE SHEET 8

SEE SHEET 5

WITHOUT COMPLETING THE 

SOLVENT RUN, THE OPERATOR 

SET RESIDUE TREATER FEED 

VALVE TO MANUAL AND OPEN 

TO INCREASE LEVEL IN RESIDUE 

TREATER 

SEE SHEET 8

OPERATIONS TRAINING ON 

PROCESS HAZARDS DID NOT 

TRAIN THE OPERATORS THAT 

UNREACTED MSAO ALSO 

DECOMPOSED AND COULD LEAD 

TO A RUNAWAY REACTION

OPERATORS ASSUMED THAT 

THERE WAS ONLY SOLVENT IN 

THE MOTHER LIQUOR FLASHER 

(NO METHOMYL)

OPERATORS WERE 

ACCUSTOMED TO NORMAL 

START-UP (WITH MATERIAL LEFT 

IN THE RESIDUE TREATER FROM 

THE END OF THE PREVIOUS 

RUN)

OPERATORS 

SOMETIMES 

DEVIATED FROM SOP 

DURING RESIDUE 

TREATER START-UP

OPERATOR PERCEPTION THAT 

THE SAMPLING WAS TO VERIFY 

QUALITY OF MATERIAL GOING 

TO FUEL USE RATHER THAN 

FOR SAFE OPERATING LIMITS

UPSTREAM PROCESS NEEDED 

TO MOVE MATERIAL OUT OF THE 

MOTHER LIQUOR FLASHER

OPERATORS WERE USED TO 

RUNNING THE RESIDUE 

TREATER IN BATCH MODE 

RATHER THAN CONTINUOUS 

(PROCEDURES ARE WRITTEN 

TO RUN IN CONTINUOUS MODE)

MANAGEMENT DID NOT 

ENFORCE COMPLIANCE WITH 

SOP

MOTHER LIQUOR FLASHER 

OVERHEAD STREAM FED THE 

MIBK / HEXANE COLUMN, AND 

THEY NEEDED TO PRODUCE 

HEXANE

HEATER WAS NOT ABLE TO 

REACH MINIMUM TEMPERATURE 

(ACCORDING TO OPERATIONS 

PERSONNEL) 

MANAGEMENT DID 

NOT ENFORCE 

COMPLIANCE WITH 

SOP

SEE SHEET 8

RUNNING LOW ON HEXANE FOR 

CENTRIFUGES

HEAT EXCHANGER 

PERFORMANCE DEGRADED 

ALREADY CONSUMED THE 

FRESH HEXANE WHILE TRYING 

TO GET THE METHOMYL TO 

PRECIPITATE AT THE 

CRYSTALLIZERS

OPERATIONS, TECHNICAL, AND 

MAINTENANCE DID NOT 

RESOLVE THE PROBLEM

MECHANICAL 

INTEGRITY 

PROGRAM DID NOT 

IDENTIFY THE 

PROBLEM

 SHEET 7

J

I

H

G

000152
Appendix A.

131 

 SEE SHEET 9 SEE SHEET 7

METHOMYL UNIT CONTROL 

PANELOPERATOR THOUGHT THERE 

WAS NO METHOMYL IN THE MOTHER 

LIQUOR FLASHER TAILS (FEED TO THE 

RESIDUE TREATER)

METHOMYL UNIT CONTROL PANEL 

OPERATOR ATTENTION WAS 

PARTIALLY DIVERTED TO THE OXIME 

PROCESS

OPERATIONS DID NOT FOLLOW SOP TO 

SAMPLE RESIDUE TREATER BEFORE 

STARTING FEED (FROM MOTHER 

LIQUOR FLASHER) IF RESIDUE 

TREATER TEMPERATURE WAS BELOW 

130 DEGC

OPERATIONS DID NOT 

FOLLOW SOP TO SAMPLE 

RESIDUE TREATER AT 7AM

SEE SHEET 7

THIS WAS THE FIRST TIME THAT 

OPERATIONS TRIED TO RUN LARVIN 

AND METHOMYL AT THE SAME TIME 

(SINCE INSTALLING THE NEW DCS IN 

METHOMYL)

OUTSIDE OPERATOR THOUGHT THAT 

THE RESIDUE TREATER WAS NOT IN 

SERVICE 

OPERATIONS THOUGHT THAT 

THE REACTOR WAS NOT 

PRODUCING METHOMYL

CONTROL ROOM OPERATOR DID NOT 

HAVE A NEED TO COMMUNICATE TO 

THE OUTSIDE OPERATOR YET, AND THE 

COMMUNICATION DID NOT OCCUR AT 

SHIFT CHANGE

CENTRIFUGES WERE NOT 

PRODUCING 

WET CAKE 

(RAN ONE AT A TIME) 

INADEQUATE ENFORCEMENT OF SHIFT 

CHANGE POLICY OR INADEQUATE 

SHIFT CHANGE POLICY 

CRYSTALLIZERS WERE NOT 

CRYSTALLIZING METHOMYL

 SEE SHEET 10

SOLVENT / ANTISOLVENT 

RATIO WAS WRONG SEE SHEET 7

SHEET 8

J

I

H

L

K

000153
Appendix A.

132 

OPERATIONS BYPASSED 

INTERLOCKS THAT SHOULD 

HAVE KEPT THE RESIDUE 

TREATER FEED VALVE 

CLOSED UNTIL REACHING 

MINIMUM TEMPERATURE

SEE SHEET 8 

OPERATORS SOMETIMES 

BY-PASSED RESIDUE 

TREATER LOW 

TEMPERATURE 

INTERLOCK ON START-UP

OPERATORS SOMETIMES BYPASSED RESIDUE TREATER 

HIGH PRESSURE INTERLOCK 

ON START-UP

THE DCS CHANGEOVER 

PROJECT LEFT 

RESIDUE TREATER 

LOW CIRCULATION 

FLOW INTERLOCK BYPASSED 

SOME OPERATORS WERE 

USED TO STARTING THE 

FEED TO THE RESIDUE 

TREATER BEFORE IT 

REACHED 135 °C 

(DEVIATION FROM SOP)

OPERATIONS SOMETIMES 

BYPASSED THESE 

INTERLOCKS (USED TO 

DEVIATING FROM SOP)

OPERATOR DID NOT 

NOTICE OR DID NOT 

REMOVE THE BYPASS 

BEFORE START-UP

CONTRACTOR 

BYPASSED THE RESIDUE 

TREATER MINIMUM 

CIRCULATION FLOW 

INTERLOCK DURING THE 

DCS CHANGEOVER

PSSR DID NOT 

ENSURE THAT THE 

SAFETY SYSTEMS 

WERE READY FOR 

OPERATION

NO COMMUNICATION 

FROM THE PHA OR 

OTHER SOURCES 

THAT OPERATIONS 

SHOULD NOT START 

THIS WAY. 

MORE THAN ONE BOARD 

OPERATOR TOLD CSB 

INVESTIGATORS THE 

HEATER COULD INCREASE 

THE TEMPERATURE TO 

ONLY ABOUT 130 °C (266 °F). 

MANAGEMENT DID NOT 

ENFORCE POLICY FOR 

CONTROL OF 

BYPASSING SAFETY 

INTERLOCKS 

PROJECT PROCESS DID 

NOT CHECK ALL 

CRITICAL INSTRUMENT 

SETTINGS BEFORE 

HANDOVER

1994 PHA TEAM IDENTIFIED 

THE LOSS OF 

CONTAINMENT EVENT BUT 

DID NOT ACCOUNT ACTUAL 

PRACTICE OF BYPASING 

INTERLOCKS

THE 2005 PHA 

DEPENDED ON THE 

EXISTING PHA 

RATHER THAN 

PROVIDING 

IN-DEPTH ANALYSIS

THE 2005 PHA TEAM GAVE 

TOO MUCH CREDIT TO 

THE CONTROLS BEING IN 

PLACE

MANAGEMENT DID NOT 

RESOLVE THE DIFFERENCE 

BETWEEN OPERATING 

PRACTICE AND THE 

STANDARD OPERATING 

PROCEDURES

PHA TRAINING AND 

EXECUTION LED TO 

THESE DEFICIENCIES

 SHEET 9

K

000154
Appendix A.

133 

SEE SHEET 8

DATA ENTRY, 

RESPONSE, AND 

FEEDBACK WERE 

ALL DIFFERENT 

FROM PREVIOUS 

CONTROL SYSTEM. 

INADEQUATE TRAINING 

TECHNIQUES ON THE 

NEW CONTROL SYSTEM, 

AND INADEQUATE 

TRAINING TIME ON THE 

NEW CONTROL SYSTEM. 

ABILITY TO FOCUS ON 

SPECIFIC PIECES OF 

EQUIPMENT WAS LOST 

IN THE CONVERSION

UNITS OF MEASURE 

WERE DIFFERENT 

FROM PREVIOUS 

CONTROL SYSTEM, 

AND NO CONVERSION 

TABLE WAS SUPPLIED 

TO OPERATIONS. 

THERE WAS MIBK IN 

THE RECYCLE 

HEXANE

PSSR DID NOT IDENTIFY 

THESE DEFICIENCIES

CAPITAL PROJECT DID 

NOT PERFORM HUMAN 

FACTORS ANALYSIS 

MIBK / HEXANE 

COLUMN WAS NOT 

OPERATING 

PROPERLY

HIGH FLOW AT MIBK 

DRIP TO INSTRUMENT 

TAP

WRONG SIZE VALVE 

FOR DRIP CONTROL

MANAGEMENT DID NOT 

ENFORCE 

MANAGEMENT OF 

CHANGE PROCESS

PSSR DID NOT VERIFY 

EQUIPMENT IN FIELD 

WAS READY FOR 

START-UP

SHEET 10

L

000155
Appendix B

134 

Appendix B – Emergency Response Timeline

The following is a key for the abbreviations used to denote the 

organizations agencies in the table below:

CAD Computer Aided Dispatch 

EOC Emergency Operations Center

KCEAA Kanawha County Ambulance Authority 

KCSD Kanawha County Sheriff’s Department

000156
Appendix B

135 

Date Time Information Source

8/28 22:34 Explosion and Fire on Methomyl Unit 

8/28 22:34 Metro to Jefferson fire department (FD): unknown source of explosion, 

receiving numerous calls KCSD-1 

8/28 22:35 EMS to Metro 911: wants address for explosion; Metro states it might be at 

Bayer CropScience, not sure KCEAA

8/28 22:36 First report of explosion--caller to Metro CAD Operations 

Report

8/28 22:36 Alarm--Tyler Mountain FD Tyler Mountain 

FD

8/28 22:37 Metro to Dunbar and Institute FD--Explosion at Bayer plant, fireball 100 ft in 

air, numerous calls; no telephone or radio contact with plant at this time KCSD-1 

8/28 22:38 Dispatch to 1600 1st Ave South (Bayer); scene of incident confirmed to be at 

the center of the plant. KCSD-1 

8/28 22:38 Emergency alarm at Larvin unit EOC Log

8/28 22:39 Metro calls Main Gate: gate guard says he has been instructed not to give out 

information; emergency alarm in progress

911 call 

Transcript

8/28 22:41 Haze coming towards Cross Lanes KCEAA

8/28 22:41 EMS to Metro 911: ambulance staging outside Bayer KCEAA

8/28 22:42 Metro contacts Bayer: gate guard requests ambulance immediately for a burn 

patient; will not provide additional information

911 call 

Transcript

8/28 22:42

Call from Metro to Dunbar FD to stand by for Institute Station 24. Large 

explosion reported at the Bayer plant. No contact with plant at this time; 

multiple calls to plant have been made

Dunbar Fire

8/28 22:43 Metro to EMS: a burn patient is at main gate KCEAA

8/28 22:44 Need medics at gate for burn patient CAD Operations 

Report

8/28 22:44 Bayer has not called Metro KCEAA

8/28 22:44 Metro advises that burn patient is at the main gate KCSD-1 

8/28 22:44 "They’re not giving us anything, I don’t know if they’ve even called in from 

Bayer." KCSD-1 

8/28 22:45 Unit 245 on-scene command established KCSD-1 

8/28 22:45 EOC activated, Shift A and B ring-down EOC Log

000157
Appendix B

136 

Date Time Information Source

8/28 22:46 Metro calls Bayer, no answer; gate guard not giving information. KCEAA

8/28 22:47 EMS enters plant KCEAA

8/28 22:48 Talks to someone at the gate, he doesn't know what is going on but they need 

an ambulance at the front gate KCEAA

8/28 22:49 Tyler FD arrives on scene Tyler Mountain 

FD

8/28 22:51 ATF on way to scene CAD Operations 

Report

8/28 22:51 Route 25 closed Dunbar Police

8/28 22:53 Station 31, power line down at1014 Ellis Street. Pole and line in front of 

residence still smoking and leaning against a tree. Power still on to residence

St. Albans FD 

and Nitro FD

8/28 22:53 "Spoke to a gentleman in the plant and informed that the event is located in 

the Larvin unit. Told that the material involved is poisonous." KCSD-1 

8/28 22:54

Metro to Dunbar: No contact from plant, getting info from many different 

sources. Keep roads closed unless you hear otherwise from Metro 9-1-1 

EOC only.

Dunbar Police

8/28 22:57 Cloud observed moving towards metro; seeks guidance on what cloud 

consists of.

St. Albans FD 

and Nitro FD

8/28 23:00 Notification to shut down river traffic CAD Operations 

Report

8/28 23:00 St. Albans FD orders SIP unless hears otherwise about the cloud over 

explosion

CAD Operations 

Report

8/28 23:04 Still no contact from plant to Metro 911; Dunbar FD gathers a copy of 

evacuation plan just in case

Dunbar FD

8/28 22:52 "The explosion is in the Larvin unit; someone talked to a mechanic they know 

in the plant [and] it’s poisonous." KCEAA

8/28 23:04 Metro advises command that the unit involved is the Larvin KCSD-1 

8/28 23:06 No SIP per Chief 24 (Institute) Dunbar Police

8/28 23:06 Burn victim in ambulance EOC Log

8/28 23:13 KC-1 directed to Shawnee Park (designated as EOC) KCSD-1 

8/28 23:15

Bayer contacts Metro: a Bayer representative informs Metro that they "might 

want to alert the community that there is an emergency at the plant right now." 

The rep. does not confirm Larvin unit as source 

911 call 

transcript

8/28 23:18 Secondary explosion noted St. Albans FD 

and Nitro FD

8/28 23:24 SIP recommended for St. Albans and Nitro EOC Log

000158
Appendix B

137 

Date Time Information Source

8/28 23:33 NWAS issues SIP; informs media CAD Operations 

Report

8/28 23:34 Bayer contacts Metro with update; Bayer representative tells Metro that Bayer 

CropScience still having emergency and is responding to it.

911 call 

transcript

8/28 23:34 Bayer informed that Metro Emergency Service director putting community SIP 

order for South Charleston, Dunbar, Nitro, St. Albans

911 call 

transcript

8/28 23:34 SIP declared for western portion of the county St. Albans FD 

and Nitro FD

8/28 23:43

By order of the Kanawha County Office of Emergency Services, SIP ordered 

for all cities west of the City of Charleston (South Charleston, Dunbar, Nitro & 

St. Albans, specifically.)

KCSD-1 

8/28 23:48 Individual transported to hospital EOC Log

8/28 23:58

Status update: I-64 shut from Nitro to Dunbar; Rt. 25 from Dunbar to Putnam 

County line; Rt. 60 from South Charleston to Putnam County line; SIP for all 

areas west of South Charleston

KCSD-1 

8/28 TV/radio announcement acknowledges SIP SCPD

8/29 0:01 Praxair is SIP location EOC Log

8/29 0:06 Bayer contacts Metro with update: still having emergency and is responding to 

it. Bayer rep. on way to Metro 911 center

911 call 

transcript

8/29 0:13 West of Larvin unit under toxic cloud; SIP in west end of plant EOC Log

8/29 0:15 Norfolk Southern railroad personnel onsite with rash and itching goes to 

medical EOC Log

8/29 0:21 One employee in medical with heat-related problems EOC Log

8/29 0:25 Shawnee Park requests MSDS EOC Log

8/29 0:35 Chemical in the explosion is highly toxic and flammable methomyl Dunbar Police

8/29 0:37 MIC tank warming EOC Log

8/29 0:40 Bayer contacts Metro with update: still having emergency and is responding 

to it 

911 call 

transcript

8/29 0:55 EE sent to hospital is not decontaminated (HCN, Sulfide, Hexane, MIBK, 

methomyl residue) EOC Log

8/29 1:10 Another emergency responder being transferred to medical (firefighter) EOC Log

8/29 1:12 Bayer contacts Metro with update: still having an emergency and is 

responding to it 

911 call 

transcript

8/29 1:12 Another emergency responder sent to medical for heat stress (firefighter) EOC Log

000159
Appendix B

138 

Date Time Information Source

8/29 1:20 SIP lifted in St. Albans EOC Log

8/29 1:25 Another BCS employee to medical department with heat fatigue EOC Log

8/29 1:27 Third BCS emergency responder sent to medical (heat stress) EOC Log

8/29 1:32 Bayer makes official statement to media EOC Log

8/29 1:40 SIP all clear accept Larvin unit EOC Log

8/29 1:42 All community SIPs lifted; Metro notified EOC Log

8/29 1:43 Bayer contacts Metro with update: still having emergency and is responding 

to it. 

911 call 

transcript

8/29 1:47 Two heat stress and one injured knee in medical EOC Log

8/29 1:55 Metro wants written request from BCS to lift SIP EOC Log

8/29 2:04 Roadways re-opened, SIP lifted Dunbar PD

8/29 2:08 Metro 911 to all units: be advised SIP has been lifted. Dunbar Fire

8/29 2:08 SIP lifted; roadways being re-opened St. Albans FD 

and Nitro FD

8/29 2:08 Department of Environmental Protection notified incident over EOC Log

8/29 2:14 Firefighting operations to be released, and begin to return to quarters. The fire 

is out KCEAA

8/29 3:01 Bayer contacts Metro with update: response team has situation under control, 

plant still in alarm state 

911 call 

transcript

8/29 3:33 Bayer contacts Metro with update: response team has situation under control, 

plant still in alarm state 

911 call 

transcript

8/29 4:07 Tyler FD leaves scene Tyler Mountain 

FD

8/29 5:31 "Governor is now on scene" EOC Log

8/29 5:50 Bayer contacts Metro with update: all clear except Larvin unit 911 call 

transcript

000160
Appendix C

139 

Appendix C – Methyl Isocyanate Day Tank 

Blast Shield Analysis

000161
Appendix C

140 

APPENDIX C CONTENTS

1.0 INTRODUCTION ........................................................................................................................ 141

2.0 METHOMYL AND CARBOFURAN MIC SUPPLY SYSTEM ................................................ 142

2.1 MIC Manufacturing .........................................................................................................142

2.2 Production Storage ..........................................................................................................142

2.3 Impact From the Explosion and Fire ...............................................................................144

2.4 Day Tank Inspection and Return to Service ....................................................................145

3.0 MIC DAY TANK BLAST SHIELD ANALYSIS ....................................................................... 146

3.1 Postulated Worst-Case Event Analysis ...........................................................................147

3.2 Residue Treater Rupture Pressure and TNT Energy .......................................................148

3.3 Fragment Kinetic Energy Estimates ................................................................................151

3.3.1 Fragment Velocity Estimates .............................................................................151

3.3.2 Fragment Range and Strike Velocities ...............................................................153

3.3.3 Shield Structure Dynamic Analysis ...................................................................154

3.3.4 Blast Mat Design ................................................................................................155

3.3.5 Structural Frame Assembly Design ....................................................................155

3.3.6 Limitations of the Model ....................................................................................157

3.4 Blast Shield Analysis Conclusions ..................................................................................158

000162
Appendix C

141 

1.0 Introduction

Methyl isocyanate (MIC) has been manufactured and used at the Institute site since at least the 1970s. 

Union Carbide Corporation (UCC) owned the facility when the equipment was designed and 

installed. Recognizing the acute toxic hazard associated with MIC, UCC specified a more rigorous 

design than what is often applied in chemical processes: redundant and backup instrument systems, 

augmented fire suppression systems, and an ammonia-steam emergency vapor suppression system. In 

addition, the bulk storage systems were more robust than a typical aboveground storage vessel. In 

particular, Union Carbide installed specialized blast-resistant structures around the aboveground MIC 

storage vessels to protect the vessels from projectiles in the event of an explosion in nearby 

equipment. The blast blankets also provided a thermal heat shield in the event of a nearby fire. 

In 1994, the owner of the Institute facility, Rhone-Poulenc, increased the height of the blast shield on 

the MIC day tank in the Methomyl-Larvin unit. The added height protected the relief valve piping and 

the vent line that is attached to the top head of the vessel. 

The August 2008 incident and Bayer’s subsequent effort to restrict public information about the 

proximity of the MIC day tank to the explosion resulted in renewed concern about MIC use and 

storage at the plant. This appendix presents a CSB analysis that evaluates whether the exploded 

residue treater could have damaged the MIC day tank and piping, if it had followed a hypothetical 

trajectory in that direction.

000163
Appendix C

142 

2.0 Methomyl and Carbofuran MIC Supply System

2.1 MIC Manufacturing

Bayer, the only user of large quantities of MIC in the U.S., manufactures MIC and at the time of the 

incident stored up to 200,000 pounds in large underground pressure vessels and smaller aboveground 

vessels. Liquid MIC was transferred from the MIC production unit about 2500 feet through an 

insulated piping system to an aboveground pressure vessel called a “day tank” located adjacent to the 

Methomyl-Larvin production unit. After refilling the day tank, operators removed all MIC from the 

transfer pipe and purged the pipe with nitrogen gas. 

The transfer piping and storage vessel incorporated multiple layers of protection, both active and 

passive: 

• The MIC recirculation system, carbofuran unit transfer line, and the cross-plant transfer 

line were equipped with emergency block valves that were operated from the control 

room; 

• An emergency dump tank adjacent to the day tank was available to receive the contents 

of the MIC day tank and cross-plant transfer line; and 

• The day tank and dump tank were installed on a concrete foundation and surrounded by a 

concrete dike wall with the capacity to contain the maximum MIC inventory in the day 

tank and transfer piping. 

2.2 Production Storage

The MIC day tank was a 6,700-gallon-capacity stainless steel pressure vessel. Maximum inventory 

was approximately 37,000 pounds (4,400 gallons). The tank was designed, fabricated, and tested in 

accordance with the American Society of Mechanical Engineers Boiler and Pressure Vessel Code 

000164
Appendix C

143 

Section VIII and was rated for lethal60

The day tank was equipped with additional layers of protection. The refrigeration system chilled the 

MIC to about 0 °C (32 °F). A multiple stage chiller system first used ethylene glycol to cool methyl 

isobutyl ketone (MIBK). The MIBK was then used to cool MIC in a separate heat exchanger. This 

two-step cooling process prevented a possible MIC-water reaction should the ethylene glycol chiller 

system leak.

service. Union Carbide specified the vessel to be designed with 

a maximum allowable working pressure of 100 psig, even though the MIC system would operate at 

only 1-2 psig; the rupture disk and relief valve were set at 20 psig. UCC also installed a dedicated 

nitrogen supply system to maintain an inert atmosphere in the tank and piping system. 

61

The day tank control system contained redundant pressure, temperature, and flow instruments 

including high-pressure, high-temperature, and refrigeration system failure alarms. The MIC system 

vents discharged into the process and emergency vent scrubber system.

The MIBK system pressure was also maintained greater than the MIC system pressure, 

and the MIBK pressure in the MIBK-ethylene glycol heat exchanger was greater than the ethylene 

glycol pressure. This ensured that water could not enter the MIC system. Finally, emergency 

generators provided power to the refrigeration system in the case of normal plant electricity loss.

The area around the tank was equipped with air monitors to detect MIC. Firewater monitors were 

located nearby to mitigate an MIC leak and suppress a fire that could threaten the tank. Surveillance 

cameras provided full-time visual display on video display panels inside the Methomyl-Larvin control 

room. A blast shield structure fully enclosed the day tank to protect it from flying debris and thermal 

radiation in the event of an explosion and fire.

 

60 ASME defines lethal substance as a poisonous gas or liquid of such a nature that a very small amount of the 

gas or of the vapor of the liquid mixed or unmixed with air is dangerous to life when inhaled (ASME 2001). 

Lethal service rated vessels are designed and fabricated to a higher quality standard than non-lethal rated 

vessels.

61 The coolant is a mixture of ethylene glycol and water. 

000165
Appendix C

144 

2.3 Impact From the Explosion and Fire

The day tank contained approximately 13,700 pounds of MIC on the night of the residue treater 

explosion and fire. Neither the empty cross-plant transfer line nor the carbofuran unit transfer system, 

which was operating at the time of the incident, was damaged. Debris from the explosion struck the 

blast blanket surrounding the day tank (Figure C-1), and the blast blanket was exposed to radiant heat 

from the fires. However, the MIC day tank was not damaged. 

Figure C-1. MIC tank blast shield post-incident

Power to the MIC refrigeration system was interrupted, so an emergency generator was put in service. 

The MIC temperature rose to 8.9 °C (48 °F) and the pressure rose to 12.7 psig, which were both less 

than the maximum allowed values of 30 °C (86 °F) and 20 psig, respectively. The day tank 

temperature was below 2 °C late the next day. The day tank was then depressurized and drained. 

000166
Appendix C

145 

2.4 Day Tank Inspection and Return to Service

Bayer removed the blast blankets and removed the tank insulation, then inspected the tank, piping, 

and refrigeration system to verify that the explosion and fire did not damage the equipment. Bayer 

reinsulated the tank and piping systems and purchased and installed new blast blankets to replace 

those that were exposed to the fire. The blankets not directly exposed to the fire were reused. Finally, 

the MIC tank was returned to service to provide MIC to the carbofuran unit until the unit was shut 

down in August, 2010. 

000167
Appendix C

146 

3.0 MIC Day Tank Blast Shield Analysis 

When the day tank was installed in 1983, a wire rope blast blanket system was installed to protect it 

from flying debris. The blast blankets also provide a radiant heat shield from nearby fires. In 1994, 

the structure was extended up to completely surround the entire tank and top piping connections 

(Figure C-2). The original frame design considered static (blast blanket weight) and wind loads only, 

and did not analyze the structure for dynamic side loading, one of the functional purposes of the 

assembly.

Figure C-2. MIC day tank shield structure

000168
Appendix C

147 

3.1 Postulated Worst-Case Event Analysis 

The shell and one head careened into the methomyl unit when the residue treater violently exploded. 

The other 800-pound head (Figure C-3) sheared off and came to rest near the installed location of the

residue treater. A small piece of the vessel cylindrical shell separated and lodged between a catwalk 

and the shell of a distillation column (Figure C-4) some 15 to 20 feet from the residue treater installed 

location. 

Figure C-3. 800-pound residue treater bottom head

Figure C-4. Residue treater shell fragment lodged in catwalk of 

adjacent distillation column

000169
Appendix C

148 

The blast shield showed no evidence of an impact by any significant projectile. However, because of 

the proximity of the residue treater to the structure, the CSB conducted a dynamic analysis of the 

shield structure and compared the results to a postulated residue treater impact with the structure. The 

analysis consisted of the following steps:

• Calculate the residue treater theoretical rupture pressure,62

• Calculate the TNT equivalent energy at the rupture pressure and temperature,

• Calculate the initial velocity of various size residue treater fragments, 

• Calculate impact forces from residue treater fragment impacts with the shield structure,

• Calculate the forces required to deflect the shield structure into the MIC day tank or 

attached piping, and 

• Compare the results of the fragment energies to the shield structure frame analysis.

3.2 Residue Treater Rupture Pressure and TNT Energy

The newly installed 4,500-gallon residue treater was an ASME Code-stamped, SA-240 316L stainless 

steel pressure vessel manufactured in 2008. It had a maximum allowable working pressure (MAWP) 

of 50 psi at 400 °F and the vessel hydrostatic test pressure was 68 psig. The following calculations 

estimate the burst pressure and TNT equivalency of the energy released in the August 2008 

explosion. 

The Faupel method (Faupel, 1956) is a theoretical method used to predict vessel burst pressures 

+/- 15 percent based on vessel geometry and yield and ultimate tensile strengths of the stainless steel. 

The formulas were developed from nearly 100 static cylinder tests. According to Faupel, if a cylinder 

 

62 The maximum pressure range of the control system residue treater pressure instruments was 0-50 psig. 

Therefore, the actual vessel pressure near the failure point was not recorded.

000170
Appendix C

149 

wall yields at a constant stress, it will burst at a pressure required to overstrain the wall63





 



 = −

u

y y Pb R

σ

σ σ

ln 2

3

2

. The residue 

treater burst pressure, Pb, is estimated using the following equation. 

where 

σu, ultimate tensile strength = 70,000 psi 

σy = yield strength = 25,000 psi 

Cylinder wall ratio, R = b/a

a = inner radius (47.6875 in)

b = outer radius (48 in)

R = 1.0066 

Pb = 310 psig 

When the residue treater ruptured, the stored energy was released nearly instantaneously, creating a 

blast wave that spread over a distance from the vessel. The energy of the blast wave can be compared 

to a high explosive detonation through a TNT equivalency calculation using the conversion factor of 

1.545 x 106 ft lbs/lb of TNT.

 

63 Though the Faupel method is intended for thick-walled vessels, it can be applied to thin-walled vessels as 

well. All thin- and thick- walled equations derived in the Faupel method yield the same result as the cylinder 

wall ratio, R, approaches the value 1.0 (Faupel, 1034).

000171
Appendix C

150 

Using the calculated burst pressure, the blast energy and TNT equivalence (Cain, 1995) are: 



































 − − =

−

γ

γ

γ

1

1

11 2 1

1 P

PVP W 

where

W = total explosion energy 

P1 = 310 psia = 46,760 psfa 

P2 = 14.7 psia = 2117 psfa 

V1 = 295 ft3

 (volume above liquid level: 4500-gallon vessel @ 51% full)

γ = specific heat ratio of CO2 = 1.23 (because CO2 is a principal byproduct of methomyl 

decomposition) 

W = 26.3 e 6

 ft-lbs 

Using the TNT equivalency factor of 1.545 e 6

 ft-lbs/lb, the mass of TNT required to generate the 

calculated explosion energy is: 

TNT = 26.3 ft - lbs

1.545 ft - lbs/lb

TNT = 17 lbs

The American Institute of Chemical Engineers, Center for Chemical Process Safety (CCPS) 

Guidelines for Chemical Process Quantitative Risk Analysis (AIChE, 2000) contains other methods 

for estimating the TNT equivalent energy from a pressure vessel explosion. The CSB compared the 

result from the Cain method with the methods contained in the CCPS publication. Table C-1 contains 

the summary of the results. 

000172
Appendix C

151 

Table C-1. TNT equivalency values

Method TNT (lbs) Energy (ft-lbs)

Baum 13 20,690,000 

Brode 36 57,000,000 

Brown 44 69,900,000 

Crowl 19 29,500,000 

Cain 17 26,300,000 

3.3 Fragment Kinetic Energy Estimates

The explosion caused the vessel to separate into three pieces: the bottom head, a small segment that 

embedded in the catwalk, and the main vessel shell with the top head attached. Initial velocities were 

calculated and applied to various trajectory departure angles in the direction of the MIC day tank. 

Aerodynamic drag coefficients were then applied to predict the velocity and kinetic energy of each 

fragment at impact with the day tank shield structure at the same elevation as the top of the day tank. 

The analyses ignored the pipe rack and other large structures between the residue treater and the day 

tank that would likely deflect the object, or absorb some of the kinetic energy.

3.3.1 Fragment Velocity Estimates

The energy released in an exploding pressure vessel is distributed among the energy consumed to 

fracture the steel vessel, shock wave, kinetic energy of the fragments, and heat energy. The energy 

distribution depends on the vessel failure characteristics (e.g., ductile vs. brittle fracture)64

 

64 Post-explosion visual examination of the new residue treater confirmed ductile failure of the shell and heads, 

as expected for stainless steel.

 and can 

change throughout the explosion.

000173
Appendix C

152 

Assuming a complex expansion process (e.g., gas/liquid mixtures are contained in the pressure 

vessel), a simple kinetic energy calculation can be used to estimate the fragment upper limit velocity:

2

2

1 KE = mv

so 

m

KE

v

2 =

where 

KE = kinetic energy lbs (ft-lbs) 

v = initial velocity (ft/s)

m = mass (lbs)

However, according to Baum (1988), less than 20 percent of the vessel expansion energy is 

transferred to projectiles. To improve the understanding of pressure vessel failure energies, the U.S. 

Air Force and U.S. Naval Surface Warfare Center commissioned the General Physics Corporation to 

develop a computer model to calculate fragment velocity and energy, called LIMIT-V, as part of the 

Pressure Vessel Burst Test Study (Cain, 1995). The study compared the Baum predicted values to 

actual fragment velocities measured from high-pressure, gas-filled pressure vessel burst tests. 

Assuming a vessel axial split, which was similar to the residue treater failure, and assuming a burst 

pressure of 310 psig, the LIMIT-V program predicts that the fragment projectile energy and velocity 

for the main residue treater shell and top head are: 

Fragment energy = 14.3 e 6

 ft-lbs 

Initial velocity = 81 ft/sec

The LIMIT-V method likely over-predicts the residue treater fragment velocity because the residue 

treater was approximately half-full of liquid rather than vapor filled, and the method does not 

000174
Appendix C

153 

consider a foamy gas-liquid mixture inside the pressure vessel. However, the results are reasonable to 

use for evaluating the MIC blast shield structure. 

3.3.2 Fragment Range and Strike Velocities

TRAJ is a two-dimensional fragment trajectory model developed for the U.S. Naval Surface Warfare 

safety program to estimate fragment velocity and range at various angles. The program uses velocity 

and shape characteristics to plot fragment flight path height and range and accounts for aerodynamic 

drag and fragment ricochets off barriers or interferences in the fragment path. The program calculates 

the velocity and energy at the point of contact with a specified barrier or interference.

The residue treater vessel shell and top head scenario generated the greatest fragment kinetic energy 

that could impact the MIC day tank blast mat frame. Barriers representing the MIC day tank structure 

were input into TRAJ at a range of 70 feet and a height of 22 feet from the residue treater. Figure C-5 

shows the path traveled by the vessel shell and top head having an initial velocity of 81 feet per 

second.

If a large, high velocity fragment strikes the shield structure at the elevation where the MIC tank 

piping passes through the grating with enough energy to deflect the structure more than about 4 

inches horizontally, the piping could be damaged. The model predicts that the residue treater main 

fragment will strike the structure at this elevation (circled area on Figure C-5) when the departure 

trajectory angle from the explosion epicenter is about 30 degrees above horizontal. The fragment 

energy at impact is 137,000 foot-pounds. 

000175
Appendix C

154 

Figure C-5. TRAJ plot with fragment impact with the blast shield structure (vertical line at 75 feet 

range). The curves represent fragment departure angles of 0, 15, 30, and 45 degrees.

3.3.3 Shield Structure Dynamic Analysis

Union Carbide installed the blast shield structure in 1983. A 1994 modification added additional 

shielding above the MIC day tank. The assembly consisted of a structural frame bolted to the concrete 

foundation. Steel wire rope ballistic shield mats were suspended on all sides. The shield mats served 

multiple functions: prevent small projectile penetration or significantly reduce the projectile exit 

velocity, attenuate energy from an explosion generated pressure wave, and absorb heat from an 

explosion or fire. The structural frame supported the heavy steel mats. 

A steel grating floor deck was installed a few inches above the top of the MIC day tank. The vessel 

relief valve piping passed through a circular opening in the floor deck. The clearance between the 

floor opening and the pipe was approximately 4 inches. Therefore, contact between the steel grating 

and the pipe will occur if the frame is deflected 4 inches horizontally. An MIC release was assumed 

to occur if the grating contacts the pipe—the analysis ignored the strength of the pipe and vessel 

000176
Appendix C

155 

nozzle. The analysis did not evaluate the additional fragment energy (greater impact velocity) that 

would be necessary to puncture or break the pipe and release MIC. 

3.3.4 Blast Mat Design 

The blast mat is a commercially available ballistic shield product that was originally intended to 

protect personnel from high-energy explosive detonations. The manufacturer worked with the Israeli 

Defense Force and the Southwest Research Institute to determine the ability of the blast mat to absorb 

potential debris or pressure waves from an explosion. Testing conducted using explosive devices 

showed that the shield is capable of containing very high energy explosions. The testing also 

demonstrated that the shield is capable of withstanding detonation pressures resulting from thousands 

of pounds of TNT more than 30 feet from the source of the detonation. 

The CSB estimated that the residue treater exploded with the force of about 17 pounds of TNT 

equivalent, many orders of magnitude lower that the energy absorbing capacity of the ballistic shield. 

Therefore, the CSB concluded the shield mat would withstand any postulated explosion pressure 

wave from the residue treater. 

3.3.5 Structural Frame Assembly Design

Frame assembly design records address only the capacity of the frame to support the deadweight of 

the installed mats, plus wind loads. The records do not include a frame dynamic analysis to 

demonstrate that the frame assembly was strong enough to protect the day tank from a large object 

strike at high velocity.

The CSB commissioned a structural analysis of the frame assembly to evaluate it for resistance to two 

load cases:

1. Blast wave overpressure from approximately 40 pound TNT equivalent explosion at 75 feet. 

2. Impact force from the residue treater vessel. 

000177
Appendix C

156 

The structural and civil drawings were used to analyze the assembly using GTStrudul,® a 

comprehensive structural analysis tool. Failure was assumed if the maximum calculated stresses 

exceeded the material strength of any primary component in the frame assembly, or if the frame 

structure deflected 4 inches horizontally at the elevation of the top floor grating, the space between 

the hole in the grating and the pipe. The results are shown in Table C-2. 

Table C-2. Frame loading analysis results

Load condition Frame component stress 

limit Maximum Deflection

Blast overpressure Baseplate overstressed ~ 1.8 inches

(no contact with pipe) 

Residue treater vessel 

impact

Baseplate, structural 

beams and braces 

overstressed

~ 4 inches 

(possible contact with MIC 

pipe) 

The analyses are based on worst case conditions for the following reasons: 

• They ignore any objects in the path between the residue treater and the MIC day tank 

including the pipe rack that might deflect or even stop the fragment before it strikes the 

shield structure (See Figure C-2); 

• The blast mat is assumed to act as a rigid plate, which transmitted all forces directly into 

the frame (i.e., the calculation ignored attenuation of blast or impact energy by the blast 

mat); 

• The frame is assumed to be oriented such that the east face was perpendicular to the path 

of the overpressure and vessel fragment trajectory; and

• The fragment analysis uses the absolute value of the velocity applied in the horizontal 

direction rather than the horizontal vector component of the calculated velocity at the 

incident angle.

000178
Appendix C

157 

The blast overpressure analysis indicates that the calculated frame deflection was less than half the 

available space between the grating and the relief valve pipe. Although the overpressure analysis 

suggested that the frame baseplates would have shown evidence of permanent structural deformation, 

post-incident visual examination did not identify any structural damage, confirming that the analysis 

results were very conservative. 

The fragment impact analysis predicts that the frame might have sustained permanent and observable 

structural damage if the residue treater vessel had impacted the structure at maximum theoretical 

velocity near the top of the structure. Furthermore, the results show that the frame could contact a 

pipe connected to the MIC day tank. However, the same highly conservative assumptions used in the 

analysis likely results in the model over-predicting the maximum frame deflection. 

3.3.6 Limitations of the Model

The CSB did not evaluate the likelihood that the residue treater would travel along any particular 

trajectory when it ruptured The direction the vessel traveled was the result of the physical 

characteristics of the vessel and attached piping and other factors that are difficult to model. Factors 

that influenced the direction of the fragments included:

• Piping connected to the residue treater, including the relief pipe attached to the top head; 

• Orientation of the support legs and concrete anchor bolts; and

• The orientation of the head and shell welds, manway, and other significant attachments 

that strongly influenced where the vessel shell first was breeched.

Specific conditions would have been necessary for the largest residue treater fragment to strike the 

blast shield frame at the most vulnerable location. First, the trajectory angle would have had to 

approach 30 degrees above horizontal. A steep trajectory angle would also be necessary for the 

residue treater to pass over the elevated pipe rack that was directly in front of the day tank. The CSB 

000179
Appendix C

158 

did not attempt to quantify the likelihood of these conditions occurring; in the actual incident, the 

residue treater followed an essentially horizontal trajectory.

3.4 Blast Shield Analysis Conclusions

The blast mat provided highly effective protection to the MIC day tank against radiant heat from an 

external fire and penetration from very small projectiles traveling at near sonic velocity. The blast mat 

would also prevent penetration of a large fragment, such as the residue treater shell or head travelling 

nearly 55 miles per hour. 

The original design of the structural frame used to support the blast mat considered only the weight of 

the blast mats and wind loading. The calculations did not consider dynamic loading from a high 

velocity large projectile impact. The CSB frame analysis concluded that the structure provided only 

marginal impact energy absorption protection from such a large fragment strike at velocities predicted 

to result from the residue treater rupture. 

Had the residue treater traveled unimpeded in the direction of the day tank, and struck the shield 

structure just above the top of the MIC day tank, the shield structure might have moved enough to 

come in contact with the relief valve vent pipe. A puncture, or tear in the vent pipe or MIC day tank 

head would have released MIC vapor into the atmosphere above the day tank. 

The CSB notes that the scenario did not occur and remains hypothetical. The vessel might have 

traveled in one of many trajectories; even under conservative assumptions, only a specific narrow set 

of trajectories could have potentially led to an MIC release. However, the analysis does emphasize 

the risks of locating large vessels containing extremely toxic substances within hazardous process 

areas that have the potential for explosions. As noted previously, following the August 2008 incident 

Bayer committed to eliminating all aboveground storage tanks of MIC. 

000180
Appendix D

159 

Appendix D – Bayer CropScience Press Release 

Announcing Institute Facility MIC Storage Reduction 

000181
Appendix D

160 

000182
Appendix D

161 

000183
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

REPORT NO. 2011-06-I-HI

JANUARY 2013

 DONALDSON ENTERPRISES, INC.

FIREWORKS DISPOSAL EXPLOSION AND FIRE

(5 Fatalities, 1 Injury) 

WAIKELE SELF STORAGE

WAIPAHU, HAWAII

APRIL 8, 2011

KEY ISSUES: 

• HAZARDS OF FIREWORKS DISPOSAL AND THE ACCUMULATION OF

EXPLOSIVE FIREWORKS COMPONENTS

• LACK OF REGULATIONS AND INDUSTRY STANDARDS ADDRESSING

FIREWORKS DISPOSAL

• INSUFFICIENT CONTRACTOR SELECTION AND OVERSIGHT

REQUIREMENTS FOR HAZARDOUS ACTIVITIES

000184
DEI Final Investigation Report January 2013

2 

Table of Contents 

Table of Contents .......................................................................................................................................... 2

Acronyms and Abbreviations ....................................................................................................................... 6

Executive Summary ...................................................................................................................................... 8

Technical Findings ...................................................................................................................................... 10

Contractor Selection and Oversight Findings ............................................................................................. 10

Regulatory and Industry Safety Standard Findings .................................................................................... 11

1.0 The Incident .................................................................................................................................... 13

2.0 Fireworks ........................................................................................................................................ 15

2.1 Explosive Classification of Fireworks ............................................................................................ 15

2.2 Importing Fireworks ....................................................................................................................... 17

2.3 Seized Fireworks Disposal .............................................................................................................. 18

2.3.1 History ..................................................................................................................................... 18

2.3.2 Present Fireworks Disposal Framework ................................................................................. 19

2.4 Federal Government Seizure Programs .......................................................................................... 19

3.0 Pre-Incident ..................................................................................................................................... 21

3.1 Federal Seized Property Management Contract .............................................................................. 21

3.2 Federal Fireworks Disposal Subcontract ........................................................................................ 21

3.3 Donaldson Enterprises, Inc. ............................................................................................................ 23

3.4 Waikele Self Storage ....................................................................................................................... 24

3.5 DEI Initial Fireworks Disposal Activities ....................................................................................... 25

3.6 Modifications to the Fireworks Disposal Process ........................................................................... 26

3.6.1 Initial Modification ................................................................................................................. 26

3.6.2 Second Modification ............................................................................................................... 30

3.7 Morning of the Incident .................................................................................................................. 30

000185
DEI Final Investigation Report January 2013

3 

4.0 Technical Analysis .......................................................................................................................... 34

4.1 Site Inspection and Evaluation ........................................................................................................ 34

4.2 Disassembly Activities .................................................................................................................... 39

4.3 Testing............................................................................................................................................. 40

4.3.1 ATF Testing of Firework Samples .......................................................................................... 40

4.3.2 CSB Testing of Firework Samples .......................................................................................... 40

4.3.3 HIOSH Testing of Tools ......................................................................................................... 40

4.4 Conclusions on Ignition .................................................................................................................. 41

5.0 Incident Analysis ............................................................................................................................ 43

5.1 Process Safety Management Standard ............................................................................................ 43

5.1.1 Process Hazard Analysis ......................................................................................................... 44

5.1.1.1 Process Safety Information ................................................................................................. 44

5.1.1.2 Identifying, Evaluating, and Controlling Hazards .............................................................. 45

5.1.2 Management of Change (MOC) Review ................................................................................ 46

5.2 Principles of Inherent Safety ........................................................................................................... 46

5.3 Relevant Training and Experience .................................................................................................. 47

5.3.1 DEI Management .................................................................................................................... 47

5.3.2 Experience ............................................................................................................................... 47

5.3.3 Training ................................................................................................................................... 47

5.4 Relevant Incidents ........................................................................................................................... 48

5.4.1 Enschede Fireworks Incident .................................................................................................. 48

5.4.2 Lansing, Kansas Incident ........................................................................................................ 49

6.0 Contractor Selection and Oversight ................................................................................................ 51

6.1 Federal Acquisition Regulation ...................................................................................................... 51

6.1.1 Determining Responsibility .................................................................................................... 51

6.2 Supplements to the FAR ................................................................................................................. 52

000186
DEI Final Investigation Report January 2013

4 

6.2.1 Department of the Treasury .................................................................................................... 53

6.2.2 Department of Defense ........................................................................................................... 53

6.3 Subcontractor Selection .................................................................................................................. 55

6.3.1 VSE Procurement Selection Methodology for Subcontractors ............................................... 55

6.3.1.1 Initial Solicitation ................................................................................................................ 55

6.3.1.2 Subcontractor Selection – Determining Responsibility ...................................................... 56

6.4 Fireworks Disposal Subcontract Provisions.................................................................................... 57

6.5 Subcontractor Oversight ................................................................................................................. 57

6.5.1 Initial DEI Fireworks Disposal Plan ....................................................................................... 57

6.5.2 Property Destruction Plan Review and Approval ................................................................... 58

6.5.3 VSE Regional Office .............................................................................................................. 59

6.5.4 BAI .......................................................................................................................................... 59

6.6 Conclusion ...................................................................................................................................... 59

7.0 Regulatory and Industry Standards Analysis .................................................................................. 61

7.1 Hawaii Occupational Safety and Health Division .......................................................................... 61

7.1.1 Jurisdiction .............................................................................................................................. 61

7.1.2 HIOSH Investigation of the Incident ...................................................................................... 62

7.2 ATF ................................................................................................................................................. 62

7.3 Regulation of Hazardous Waste ...................................................................................................... 63

7.3.1 Resource Conservation and Recovery Act .............................................................................. 63

7.3.2 State of Hawaii Department of Health (DOH) ........................................................................ 65

7.4 Industry Standards .......................................................................................................................... 67

7.4.1 National Fire Protection Association ...................................................................................... 67

7.4.1.1 NFPA 495 ........................................................................................................................... 67

7.4.1.2 NFPA 1123 ......................................................................................................................... 67

7.4.1.3 NFPA 1124 ......................................................................................................................... 68

000187
DEI Final Investigation Report January 2013

5 

7.4.2 Review of Current Fireworks Disposal Practices ................................................................... 68

7.4.2.1 Fireworks Operators ............................................................................................................ 68

7.4.2.2 Local Law Enforcement Agencies ...................................................................................... 69

7.5 Conclusion ...................................................................................................................................... 69

8.0 Causal Analysis ............................................................................................................................... 70

8.1 Physical Events, Conditions, and Outcomes ................................................................................... 70

8.2 DEI .................................................................................................................................................. 70

8.3 VSE ................................................................................................................................................. 71

8.4 Industry Codes and Standards ......................................................................................................... 71

8.5 Government ..................................................................................................................................... 71

9.0 Recommendations ........................................................................................................................... 73

Federal Acquisition Regulatory (FAR) Council ......................................................................................... 73

Department of the Treasury Office of the Procurement Executive (OPE) ................................................. 73

Treasury Executive Office for Asset Forfeiture (TEOAF) ......................................................................... 74

VSE Corporation ......................................................................................................................................... 74

National Fire Protection Association (NFPA) ............................................................................................ 75

U.S. Environmental Protection Agency (EPA) ........................................................................................... 75

Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) ................................................................. 76

References ................................................................................................................................................... 78

Appendix A: Hawaii Firework Seizures .................................................................................................... 80

Appendix B. Department of Defense Contractor’s Safety Manual ........................................................... 85

000188
DEI Final Investigation Report January 2013

6 

Acronyms and Abbreviations

AE Ammunition and Explosives

AIHA American Industrial Hygiene Association

ANSI American National Standards Institute

APA American Pyrotechnics Association

ATF Bureau of Alcohol, Tobacco, Firearms and Explosives

BAI Thomas E. Blanchard & Associates, Inc.

CBP U.S. Customs and Border Protection 

CCR Central Contractor Registration

CLIN Contract Line Item Number

CO Contracting Officer 

CSB U.S. Chemical Safety and Hazard Investigation Board

CURT Construction Users Roundtable

DAR Daily Activity Report

DDESB Department of Defense Explosives Safety Board

DEI Donaldson Enterprises, Inc.

DFARS Department of Defense Acquisition Regulation Supplement

DHS U.S. Department of Homeland Security

DLIR Department of Labor and Industry Relations

DoD Department of Defense

DOH State of Hawaii Department of Health

DOT U.S. Department of Transportation

DTAP Department of Treasury Acquisition Procedures

DTAR Department of Treasury Acquisition Regulation System

EOD Explosive Ordnance Disposal

EPA U.S. Environmental Protection Agency

ESD Electrostatic Discharge

FAR Federal Acquisition Regulation

HAR Hawaii Administrative Rules

HAZWOPER Hazardous Waste Operations and Emergency Response

HFD Honolulu Fire Department

HIOSH Hawaii Occupational Safety and Health Division 

000189
DEI Final Investigation Report January 2013

7 

HPD Honolulu Police Department

HSPM Health and Safety Program Manager

ICC International Code Council

ICE U.S. Immigration and Customs Enforcement

ICE/HSI U.S. Immigration and Customs Enforcement Homeland 

Security Investigations 

MOC Management of Change

NFPA National Fire Protection Association

OPE Department of the Treasury Office of the Procurement 

Executive

OSHA Occupational Safety and Health Administration

PHA Process Hazard Analysis

PPE Personal Protective Equipment 

PSM Process Safety Management

RCRA Resource Conservation and Recovery Act

QCM Quality Control Manager

SBA Small Business Association

SOP Standard Operating Procedure

SPE Senior Procurement Executive

SSHO Site Safety and Health Officer

SOW Statement of Work

TEOAF Treasury Executive Office for Asset Forfeiture

TEP Temporary Emergency Permit

TFU Thermal Flash Unit

TFF Treasury Forfeiture Fund

TSDF Treatment, Storage, and Disposal Facility

VSE VSE Corporation

UXO Unexploded Ordnance 

000190
DEI Final Investigation Report January 2013

8 

Executive Summary

On April 8, 2011, at approximately 8:50 am, an explosion and fire occurred at a magazine1

DEI is an unexploded ordnance

located at 

Waikele Self Storage in Waipahu, Hawaii, that was leased and used by Donaldson Enterprises, Inc. (DEI) 

for seized fireworks storage and disposal-related activities. Five DEI personnel in the magazine at the 

time of the incident were fatally injured. 

2 (UXO) remediation company based on Oahu that employs fewer than 20

full-time workers. Pursuant to a federal seized property management contract with the Treasury 

Executive Office for Asset Forfeiture (TEOAF), federal government contractor VSE Corporation (VSE) 

awarded DEI a subcontract in early 2010 to dispose of imported fireworks seized in Honolulu, Hawaii, by 

federal law enforcement personnel. Three fireworks shipments were seized as contraband3 because they 

were labeled as consumer grade fireworks but, upon inspection, appeared physically consistent with more 

hazardous commercial display grade fireworks. 

Federal contractor selection regulations did not require VSE procurement personnel to conduct a safetyrelated review of DEI prior to awarding the company the subcontract, nor did VSE procurement personnel 

involved in awarding this subcontract have training and experience related to fireworks disposal. VSE’s 

procurement office selected DEI as the fireworks disposal subcontractor because DEI was already storing 

the seized fireworks at the time under a separate subcontract with VSE, and because DEI submitted the 

lowest-cost and most time-efficient bid, which VSE determined to be the best overall value for the 

government. VSE procurement personnel were unaware that DEI had no prior fireworks disposal 

experience when it awarded the subcontract. 

Because seized fireworks requiring disposal are considered hazardous waste in the United States, DEI 

was required to obtain an environmental permit from the State of Hawaii Department of Health (DOH). 

In June 2010, DOH issued DEI a 90-day emergency hazardous waste permit authorizing “thermal 

treatment”4 of the fireworks at a local shooting range, and DEI began its disposal work soon after. The 

permit did not evaluate or address fireworks disassembly or diesel soaking. To dispose of the first seizure

of fireworks, DEI personnel separated individual firework tubes from their original configuration and 

soaked the firework tubes whole in 55-gallon diesel-filled steel drums inside the magazine. DEI then 

transported the soaked fireworks to a local shooting range to burn them in either drums or a portable 

incinerator. 

The U.S. Chemical Safety Board (CSB) learned that because DEI was experiencing minor explosions 

with some types of fireworks while burning the initial shipment of seized fireworks, the company altered 

 

1 A “magazine” is “any building or structure, other than an explosives manufacturing building, used for storage of 

explosive materials.” Commerce in Explosives, 27 CFR §555.11 (2003). 2 “Unexploded ordnance” is an explosive weapon such as a grenade, bomb, or land mine that has not exploded and 

poses a risk of detonation. It can be located on the ground, partially buried in the ground, under bushes or other 

vegetation, and in water. 

3 Goods that have been imported illegally.

4 Burning. 

000191
DEI Final Investigation Report January 2013

9 

its fireworks disposal methodology in summer 2010. As a result of the altered methodology, DEI 

personnel began cutting open, or disassembling, individual firework tubes by hand on a loading dock just 

outside the magazine entrance and separating out the individual explosive fireworks components, the 

black powder5 and aerial shells,

6

 which are both susceptible to ignition from sparks, friction, and static

electricity. The accumulated explosive powder from the fireworks, referred to as “black powder,” was 

stored in a plastic container lined with a plastic garbage bag. To improve diesel permeation of the shells 

and minimize explosions, DEI personnel cut one-inch slits in the aerial shells. They then soaked the 

shells in diesel and burned them at the shooting range. VSE personnel were aware of this procedure 

change, but did not question or express concern about it. DEI completed disposal of the initial seizure in

late fall 2010 without incident. 

DEI began work on the next fireworks seizure in December 2010. In early 2011, DEI again altered the

fireworks disposal process to increase the fireworks destruction rate by maximizing the amount of aerial 

shells that could be burned at once. Expanding upon the modification DEI developed when disposing of 

the initial seizure, DEI personnel disassembled the firework tubes outside the magazine by hand and 

separated the individual explosive components, the black powder and aerial shells, into cardboard boxes. 

The cardboard boxes containing the black powder were lined with plastic garbage bags to minimize 

leakage. DEI personnel stacked and stored boxes containing aerial shells and black powder within the 

magazine and simultaneously soaked aerial shells in diesel. DEI notified VSE of this change in 

methodology via email in March 2011, but VSE again did not question the change.

Although DEI wrote a brief document presenting a hazard review of its fireworks disposal activities when 

it was awarded the subcontract, this analysis did not consider the safety implications of cutting into the 

fireworks and accumulating their explosive components. Because the Occupational Safety and Health 

Administration (OSHA) Process Safety Management (PSM) standard does not apply to activities 

conducted under the umbrella of fireworks disposal,

7

 DEI was not required to conduct a formal Process 

Hazard Analysis (PHA) of its fireworks disposal activities or a formal Management of Change (MOC) 

analysis when it modified its disposal process. 

At the time of the incident, DEI personnel had abruptly halted their disassembly work due to rain and had 

taken the materials involved in the process to just inside the magazine entrance. Boxes containing aerial 

shells, black powder, and partially disassembled firework tubes were stacked inside the magazine near the

entrance along with tools, a metal hand truck, and chairs. Once the materials were moved into the 

 

5 Black powder is a mixture of charcoal, sulfur, and potassium nitrate. The standard composition typically contains 

75% potassium nitrate, 10% sulfur, and 15% charcoal. Turcotte, R., Turcotte, A.M., Fouchard, R., and Jones, 

D.E.G. Thermal Analysis of Black Powder. Journal of Thermal Analysis and Calorimetry. Canadian Explosives 

Research Laboratory, Natural Resources Canada, Ottawa, Ontario, Canada. 2003; Vol. 73, p 105. 6 An “aerial shell” is “a cartridge containing pyrotechnic composition, a burst charge, and an internal time fuse or 

module, that is propelled into the air from a mortar and that is intended to burst at or near apogee [highest point].” 

National Fire Protection Association (NFPA) 1124. Code for the Manufacture, Transportation, Storage, and Retail 

Sales of Fireworks and Pyrotechnic Articles, Section 3.3.1, 2006. 7 PSM only applies to activities associated with fireworks manufacturing; it does not apply to fireworks disposal. 

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=22524 (accessed 

December 29, 2012)

000192
DEI Final Investigation Report January 2013

10

magazine, the DEI project supervisor stepped outside to make a phone call. While he was on the phone, a 

large explosion occurred inside the magazine near its entrance. 

The CSB determined that changes in DEI’s fireworks disposal process resulted in the accumulation of a 

large quantity of explosive components just inside the magazine entrance, creating the essential elements 

for a mass explosion.8

 Insufficient federal contractor selection and safety oversight requirements for 

hazardous activities, a significant gap in regulatory and industry standards pertaining to fireworks

disposal, and a lack of hazard management by DEI personnel, enabled DEI to introduce significant 

hazards to its fireworks disposal process without those hazards being adequately identified or effectively 

controlled. 

The CSB investigation into this incident identified the following key findings: 

Technical Findings

1. DEI’s hazard analysis of its fireworks disposal process was insufficient. The company

failed to identify key hazards of handling, disassembling, and storing contraband 

commercial display fireworks, and did not adequately control the identified and evaluated 

hazards.

2. DEI personnel disposing of the fireworks lacked the training, experience, and knowledge 

of procedural safeguards for the safe conduct of the fireworks disposal. 

3. DEI’s modifications to the fireworks disposal process accumulated substantially large

quantities of explosive material in boxes, greatly increasing the potential explosion 

hazard. This change to the disposal process was not adequately reviewed for safety 

implications.

4. The CSB, along with the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) 

and the Hawaii Occupational Safety and Health Division (HIOSH), identified a number 

of possible ignition sources in the magazine at the time of the incident, including 

sparking tools, a metal hand truck, a rolling office chair, and plastic bags capable of 

producing static discharge. 

Contractor Selection and Oversight Findings

5. The Federal Acquisition Regulation (FAR), which governs federal agencies’ acquisition 

of goods and services, does not specifically require a federal contracting officer to 

consider safety performance measures and qualifications when determining the 

“responsibility” of a potential government contractor or subcontractor to handle, store, 

and dispose of hazardous materials such as fireworks. 

 

8 A mass explosion is “one which affects almost the entire load instantaneously.” 49 CFR §173.50 (b)(1) (2003). 

000193
DEI Final Investigation Report January 2013

11

6. The Department of the Treasury Acquisition Regulation (DTAR), the Department of the 

Treasury’s supplement to the FAR, does not impose sufficient requirements for safe 

practices and subcontractor selection and oversight with respect to the unique hazards 

associated with handling, storing, and disposing of hazardous materials.

7. VSE’s procurement office conducted a non-technical review of DEI and the competing 

offeror for the fireworks disposal subcontract that did not address health and safety. 

8. VSE did not use personnel with the technical background or expertise to properly select 

and oversee subcontractors performing work with hazardous materials such as fireworks, 

nor did it consult with or hire anyone with that expertise. 

Regulatory and Industry Safety Standard Findings

9. The CSB found a lack of regulations or industry standards that adequately address safe

fireworks disposal. Federal or local codes, regulations, or industry standards do not 

establish safety requirements, provide guidance on proper ways to dispose of fireworks, 

or address the hazards associated with the disassembly of fireworks and the accumulation 

of explosive fireworks components. 

10. While OSHA’s PSM standard applies to fireworks manufacturing, OSHA has determined 

that the regulation does not apply to work activities related to fireworks disposal. 

Therefore, DEI was not required to implement a more robust PSM system for its 

fireworks disposal process. For example, DEI’s change to its disposal process led to the 

accumulation of material that created a mass explosion hazard. PSM elements such as 

Management of Change (MOC) would have required a safety review of this change. 

11. Emergency hazardous waste disposal permits are granted in Hawaii and throughout the 

country to entities seeking to dispose of seized contraband fireworks because they are 

considered an imminent threat to human health and the environment. However, the 

Resource Conservation and Recovery Act (RCRA) does not incorporate PSM-type 

elements in its hazardous waste permitting process, despite the extremely hazardous 

nature of the materials covered by these permits. 

000194
DEI Final Investigation Report January 2013

12

As a result of this investigation, the CSB makes recommendations to 

• The Federal Acquisition Regulatory Council 

• The Department of the Treasury Office of the Procurement Executive (OPE)

• Treasury Executive Office for Asset Forfeiture (TEOAF)

• VSE Corporation 

• The National Fire Protection Association (NFPA)

• The U.S. Environmental Protection Agency (EPA) 

• The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) 

Section 9.0 of this report details the recommendations. 

000195
DEI Final Investigation Report January 2013

13

1.0 The Incident

On April 8, 2011, at approximately 8:50 am, an explosion and fire occurred at a magazine known as “A21” located at Waikele Self Storage in Waipahu, Hawaii. Five Donaldson Enterprises, Inc. (DEI) 

employees were fatally injured and a sixth sustained minor injuries. 

DEI, a small unexploded ordnance (UXO) clearance company based on the island of Oahu, was using the 

magazine to store seized contraband fireworks and prepare them for disposal. On the morning of the

incident, five DEI personnel were disassembling one-inch contraband firework tubes on a cement loading 

dock located directly in front of the magazine entrance, while a sixth remained inside the magazine 

cleaning and organizing (Figure 1). To accomplish the disassembly work, DEI personnel cut into the 

individual firework tubes by hand using a PVC pipe cutter or knife and separated the individual explosive 

components contained within each tube, the aerial shells and the black powder (which functions as a lift 

charge9

) into cardboard boxes. 

According to witness statements, around 8:30 am it began to rain heavily, and the DEI workers quickly 

moved materials involved in the disassembly process – including tools, chairs, and boxes containing 

aerial shells, black powder, and partially disassembled firework tubes – to just inside the magazine 

entrance. While five of the workers remained inside, the project supervisor went outside to the front left

corner of the loading dock to make a phone call. While he was on the phone, an explosion occurred 

inside the magazine, and a fire ensued. 

The five individuals located inside the magazine at the time of the incident did not survive. Three DEI 

employees sustained fatal burn injuries while two succumbed to carbon monoxide poisoning. The project 

supervisor sustained minor injuries.

 

9 A lift charge is a “pyrotechnic composition used to propel a component of a mine or shell device into the air. Lift 

charge is limited to black powder (potassium nitrate, sulfur, and charcoal) or similar pyrotechnic composition 

without metallic fuel.” APA Standard 87-1. Standard for Construction and Approval for Transportation of 

Fireworks, Novelties, and Theatrical Pyrotechnics, Section 2.10, 2001. 

000196
DEI Final Investigation Report January 2013

14

Figure 1. DEI work area outside of the A-21 magazine at Waikele Self Storage

000197
DEI Final Investigation Report January 2013

15

2.0 Fireworks 

2.1 Explosive Classification of Fireworks

The American Pyrotechnics Association10 (APA) defines fireworks as “[a]ny device, other than a novelty 

or theatrical pyrotechnic article, intended to produce visible and/or audible effects by combustion, 

deflagration,11 or detonation.”12,13 Fireworks require a source of combustible material for energy such as 

black powder, which acts as a lift charge to propel the device into the air. A chemical substance known as 

a burst charge14 contained within the aerial shell emits brightly colored light once the firework is 

propelled into the air. According to industry literature, black powder is extremely sensitive to ignition 

from small sparks, which can be emitted from static electricity, friction, and electrical contacts, and may 

explode violently when ignited.15 

The U.S. Department of Transportation (DOT) hazard classification system regulations classify fireworks 

as Class 1 explosives due to the hazardous nature of the chemical compositions they contain.16 Under 

DOT regulations, all explosives must be formally approved for transportation and assigned an EX 

Number before they can be transported within the U.S.17

The DOT system classifies explosives into divisions 1.1 through 1.6, of which fireworks typically fall 

into two: 1.3 and 1.4.18 Division 1.1 has the largest potential hazard, with each subsequent division 

representing a lower hazard category. Division 1.3 (1.3G19

 

10 The American Pyrotechnics Association (APA), founded in 1948, is a fireworks industry trade association whose 

goal is to promote safe design and use of all types of fireworks and responsible regulation of the fireworks industry. 

Display Fireworks – UN0335) “consists of 

explosives that have a fire hazard and either a minor blast hazard or a minor projection hazard or both, but 

www.americanpyro.com (accessed July 14, 2012). 11 Deflagration is a reaction in which the speed of the reaction front propagates through the unreacted mass at a 

speed less than the speed of sound in the unreacted medium. Crowl, Daniel A. Understanding Explosions, A CCPS 

Concept Book, 2003; p. 204. 12 A detonation is a reaction in which the speed of the reaction front propagates through the unreacted mass at a 

speed greater than the speed of sound in the unreacted medium. Ibid. 13 APA Standard 87-1, Section 2.7, 2001. 14 According to APA Standard 87-1 Section 2.5, a burst charge is a “chemical composition used to break open a 

fireworks device after it has been propelled into the air, producing a secondary effect such as a shower of stars. 

Burst charge is also sometimes referred to as expelling charge or break charge...[b]urst charge for use in 1.3G 

fireworks is limited to black powder (potassium nitrate, sulfur, and charcoal) or similar pyrotechnic composition 

without metallic fuel for approval under provisions of this standard.” 15 Malitz, I. “Black Powder Manufacturing, Testing & Optimizing.” American Fireworks News (AFN), Dingmans 

Ferry, PA, 2003; p. 16. 

16 49 CFR §173.50(a) (2003). 17 49 CFR §173.56 (2003). 18 49 CFR §172.101 provides a Hazardous Materials Table that includes Identification Numbers for fireworks under 

each appropriate hazard classification/Division. 1.3 fireworks have the Identification Number of UN0335, and 1.4 

fireworks have the identification number UN0336. Identification Numbers that start with the prefix “UN” are 

appropriate for both domestic and international transportation. 

19 The “G” following the explosive classification number pertains to the compatibility group of the substance. 49 

CFR §173.52(a) (2011). Compatibility group “G” indicates pyrotechnic substances. 49 CFR §173.52(b) (2011). 

000198
DEI Final Investigation Report January 2013

16

not a mass explosion hazard.”20,21 The Bureau of Alcohol, Tobacco, Firearms and Explosives22 (ATF) 

regulates 1.3G fireworks under 27 CFR Part 555, Commerce in Explosives, which subjects the fireworks 

to significant controls regarding storage, permitting, and marking requirements.

To be considered a 1.3G UN0335 device, an aerial shell contained within the firework cannot exceed 10 

inches in diameter.23 Otherwise, the firework would be considered a division 1.1 explosive with the 

ability to mass explode.24 In addition, black powder, an explosive mixture of charcoal, sulfur, and 

potassium nitrate that is often a component of aerial shells and the primary explosive for the lift charge 

inside each firework tube, is considered to be a 1.1 explosive on its own under the DOT classification 

system. 25

Division 1.4 (1.4G Consumer Fireworks – UN0336) “consists of explosives that present a minor 

explosion hazard.”26 The DOT rates the transportation hazard of these materials as “minimum.” Because 

of the limited amount of pyrotechnic composition permitted in each individual piece, their explosive 

effects are expected to be largely confined to the package, and they are consequently exempt from

regulations under 27 CFR Part 555.27 Consumer fireworks intended for use by the general public are 

typically Division 1.4G UN0336 explosives.28

APA Standard 87-1, Standard for Construction and Approval for Transportation of Fireworks, Novelties, 

and Theatrical Pyrotechnics, provides manufacturers, importers, and distributors of fireworks and 

novelties with relevant information to manufacture, test, ship, and label their products in accordance with 

federal law and good manufacturing practices. This standard requires that aerial mine and shell devices 

that are classified as Division 1.4 (i.e., consist of a single heavy cardboard or paper tube attached to a base 

and filled with pyrotechnic composition) should not contain more than 60 grams of total chemical 

composition, including the lift charge, burst charge, and the visible/audible composition, and the 

components that create a noise should be limited to 130 mg.29 When a device comprises multiple tubes, 

the total weight of all explosive or pyrotechnic components within the device cannot exceed 200 grams. 

Fireworks containing greater amounts of explosives are classified as either Division 1.3G UN0335 or 

Division 1.1G UN0333.

30

 

20 49 CFR §173.50(b)(3) (2003). 21 A mass explosion is “one which affects almost the entire load instantaneously.” 49 CFR §173.50 (b)(1) (2003). 22 ATF works to protect communities from violent criminals and criminal organizations by investigating and 

preventing the illegal use and trafficking of firearms, the illegal use and improper storage of explosives, acts of 

arson and bombings, and the illegal diversion of alcohol and tobacco products. www.atf.gov (accessed November 

26, 2012). ATF regulates the importation, manufacturing, dealing in, receiving, and storage of display fireworks 

under 27 CFR Part 555. 

23 APA Standard 87-1, Section 4.1.1, 2001 24 Ibid. 25 49 CFR §172.101 Table (1990). 26 49 CFR §173.50(b)(4) (2003). 27 27 CFR §555.141(a)(7) (2006). 28 Division 1.4 can be further broken down into 1.4G and 1.4S subcategories.

29 APA Standard 87-1, Section 3.1.2.5, 2001. 30 49 CFR §172.101 Table (1990). 

000199
DEI Final Investigation Report January 2013

17

2.2 Importing Fireworks

Since the 1970s, the U.S. has greatly increased its importation of fireworks, due in part to lower labor 

costs overseas and increased federal regulation of fireworks manufacturing.31 Fiscal year 2011 U.S. 

International Trade Commission statistics obtained and published by the APA show that 98 percent of all 

consumer fireworks and 75 to 80 percent of commercial display fireworks used in the U.S. are 

manufactured in and imported from China. Of the 440 million pounds of consumer and display fireworks 

consumed in the U.S. in 2010 and 2011, only approximately 1.5 percent (6.7 million pounds) was

produced domestically.32 

The importation of illegal fireworks33 has also been rising throughout the country.34 This increase has 

resulted in efforts by a network of government agencies, not-for profit organizations, and other entities to 

improve the quality and safety of imported fireworks through screening, inspecting, testing, seizing, and 

when necessary, disposal. Federal law enforcement agencies, including ATF, U.S. Customs and Border 

Protection35 (CBP), and U.S. Immigration and Customs Enforcement36 (ICE), work to prevent the illegal 

importation of fireworks by inspecting, seizing, and testing firework shipments at major cities and ports 

of entry throughout the country. To illustrate the extent of the illegal fireworks importation issue in the 

U.S., between October 1, 2008, and November 30, 2012, the CBP Office of Field Operations37 conducted 

a total of 69 firework seizures at cities considered to be major ports of entry including Boston, Chicago, 

Houston, Los Angeles, Miami, New York, and San Francisco. The largest individual commercial seizure

conducted by CBP during the first half of 2012 contained nearly 18 tons of fireworks.38

 

31 Yang, Xiyun. China’s Fireworks: A Trusted Import. Washington Post, [Online] 2007, 

 In Honolulu, 

http://www.washingtonpost.com/wp-dyn/content/article/2007/07/03/AR2007070302188.html (accessed July 12, 

2012).

32 American Pyrotechnics Association (APA). APA U.S. Fireworks Consumption Figures 2000-2011. 

http://www.americanpyro.com/pdf/Fireworks-Consump-Figures-2000-11.pdf (accessed July 14, 2012). 33 Imported fireworks may be deemed “illegal” or “contraband” under federal law if they have been imported 

without the requisite license or permit; if they have been mislabeled; if they have been smuggled or attempted to be 

smuggled into the U.S.; or if they exceed the maximum allowable explosive filler weight or charge weight, or 

maximum grams of explosives permitted.

34 Yang, Xiyun. China’s Fireworks: A Trusted Import. Washington Post, [Online] 2007, 

http://www.washingtonpost.com/wp-dyn/content/article/2007/07/03/AR2007070302188.html (accessed July 12, 

2012).

35 CBP exists within the U.S. Department of Homeland Security and works to secure U.S. borders and facilitate 

trade to and from the U.S. www.cbp.gov (accessed November 27, 2012). 36 ICE is the principal investigative arm of the U.S. Department of Homeland Security. Its primary mission is to 

“promote homeland security and public safety through the criminal and civil enforcement of federal laws governing 

border control, customs, trade, and immigration.” www.ice.gov (accessed November 27, 2012). 37 The CBP Office of Field Operations is “the largest component of CBP and is responsible for securing the U.S. 

border at ports of entry while expediting lawful trade and travel.” 

http://www.cbp.gov/xp/cgov/about/organization/assist_comm_off/field_operations.xml (accessed December 7, 

2012). 

38 “Watch Out for Illegally Imported Fireworks: CBP seizes dozens of illegal fireworks shipments on behalf of 

partner agencies.” July 3, 2012. http://www.cbp.gov/xp/cgov/newsroom/news_releases/national/07032012.xml 

(accessed December 4, 2012).

000200
DEI Final Investigation Report January 2013

18

Hawaii, CBP and ICE Homeland Security Investigations39 (ICE/HSI) together have conducted nine 

separate fireworks seizures between 2006 and 2012, including the seizure involved in the incident. 

These quantities are significant, as these fireworks pose substantial safety challenges once they are seized. 

Due to the unknown composition of seized fireworks and the hazards that may be involved, illegally 

imported and seized fireworks are typically destroyed; a major issue for all entities involved becomes 

how to properly and safely destroy them. 

2.3 Seized Fireworks Disposal

2.3.1 History 

Through the early 1980s, the standard practice in the U.S. was to use U.S. Military Explosive Ordnance 

Disposal40 (EOD) technicians to dispose of fireworks confiscated by local and federal law enforcement, 

reflecting the military’s mission to support those agencies and their work. However, the CSB learned that

a July 29, 1980, explosion and fire at Fort Rosecrans in San Diego, California, that killed three EOD 

technicians and injured another caused the military to eliminate seized firework disposal activities. 

The incident involved disposing of homemade firework “poppers” illegally imported from Mexico. EOD 

technicians were loading fireworks, which federal law enforcement personnel had seized and stored in 

plastic bags, from a holding unit onto a military truck for destruction at Fort Irwin, California, when one 

of the bags on the truck began to pop and fizz. As an EOD technician grabbed the bag to throw it off the 

truck, it exploded. Three EOD technicians moved to the back of the storage unit and shut the door to 

isolate themselves from the explosion and resulting fire. However, they became trapped in the unit as the 

rest of the fireworks within the unit were set off, and all three were killed. 

The military’s decision not to handle seized fireworks highlights the risk involved in storing, transporting, 

and disposing of contraband fireworks, because they are unpredictable and hazardous. Typically, no 

quality assurance controls are used in contraband fireworks manufacture. Mislabeled fireworks are by 

definition uncharacterized. Their unknown composition makes them dangerous to an EOD technician 

tasked with their disposal. Ultimately, this change shifted seized firework, storage, transportation and 

disposal responsibilities from EOD technicians within the military to permitted commercial entities and 

federal, state, and local law enforcement agencies. 

 

39 ICE/HSI exists within ICE and is responsible for investigating immigration crime, human rights’ violations and 

smuggling of humans, narcotics, weapons, and other types of contraband. 

http://www.ice.gov/about/offices/homeland-security-investigations/ (accessed December 4, 2012). 40 Explosive Ordnance Disposal involves the rendering safe and disposal of all hazardous items containing 

explosives, including bombs, grenades, and mines.

000201
DEI Final Investigation Report January 2013

19

2.3.2 Present Fireworks Disposal Framework

A small number of commercial41 treatment, storage, and disposal facilities (TSDFs) across the country 

have the requisite environmental permitting to accept and dispose of explosives, including commercial 

and consumer fireworks. These facilities utilize various methods of disposal, including incineration,42

open burning,43 and microbiological destruction.

44

While these commercial facilities are available for disposal work, the CSB learned from local law 

enforcement agencies throughout the country that many local agencies have undertaken the task of 

disposing of seized fireworks themselves because contracting the work out to these facilities is too timeconsuming and costly. And some state and local law enforcement agencies have had difficulty disposing 

of seized fireworks due in part to stringent state environmental regulations and policies that prevent them 

from burning the fireworks. The CSB has learned the extensive time and cost necessary to ship the 

fireworks elsewhere has, unfortunately, resulted in the growing accumulation of illegal consumer and 

display fireworks in magazines in states across the country. 

2.4 Federal Government Seizure Programs

The approach federal agencies use for storing, transporting, and disposing of illegally imported and seized 

fireworks involves subcontracting to commercial vendors under an overarching, multi-million dollar 

federal seized property management contract. The U.S. has two separate and distinct federal forfeiture 

programs, one within the U.S. Department of Justice and one within the U.S. Department of the Treasury

(Treasury). 

 

41 Permitted to receive third party waste. 42 For example, General Dynamics operates a facility located in Joplin, Missouri, that contains two Resource 

Conservation and Recovery Act (RCRA) permitted incinerators specifically designed to incinerate explosive 

materials and devices. www.ebveec.com (accessed November 26, 2012). Heritage-WTI, Inc, located in East 

Liverpool, Ohio, is another incineration system capable of receiving 60,000 tons per year of hazardous waste. 

www.heritage-wti.com (accessed November 28, 2012). 43 For example, Clean Harbors operates a RCRA permitted facility that accepts and treats over 300 kinds of 

explosive and reactive wastes, including consumer and commercial display fireworks. Clean Harbors practices the 

method of open burning, usually soaking the fireworks in diesel and burning them on concrete slabs in a large open 

space the size of a football field. www.cleanharbors.com (accessed November 27, 2012). 44 Heritage Disposal and Storage (HDS) operates a 24,000 square foot recycling facility for energetic materials, 

including fireworks. The HDS energetic materials recycling process is a proprietary process utilizing 

microbiological technology to recycle propellants, energetic materials, and ammunition into agricultural use 

products. HDS has treated approximately 2 million pounds of explosives for U.S. Government agencies. HDS 

documents indicate that in 2004, the Nebraska Department of Environmental Quality (NDEQ) evaluated the HDS 

processes and studied the final products and determined that the HDS process meets the definition of true recycling 

as outlined in NDEQ Title 128, Nebraska Hazardous Waste Regulations. HDS possesses an ATF Explosive 

Manufacturing License and is able to modify explosive materials for either safe disposal or resale. HDS considers 

the energetic materials it recycles to be “Highly Hazardous Materials” and has implemented management systems 

for all technical operations involving ammunition and explosives in accordance with PSM goals identified in 29 

CFR §1910.119 Appendix C, Compliance Guidelines and Recommendations for Process Safety Management 

(Nonmandatory). HDS documents indicate that no separating or disassembling of explosive components is done at 

this facility. www.heritagedisposalandstorage.com (accessed November 26, 2012). 

000202
DEI Final Investigation Report January 2013

20

The program relevant to this investigation is the Treasury Executive Office for Asset Forfeiture (TEOAF)

seizure and forfeiture program. TEOAF administers the Treasury Forfeiture Fund45 (TFF), which is the 

receipt account for the deposit of non-tax forfeitures made pursuant to laws enforced or administered by 

participating law enforcement agencies. Under this federal program, TEOAF procures general seized 

property management services, including storage and disposal, to support the seizure, forfeiture, and 

blocking programs of the Treasury and U.S. Department of Homeland Security (DHS) participating 

agencies.

46 Participating agencies seize a broad range of items, such as cars, horses and other livestock, 

handbags and jeans, perfume, and explosives (including fireworks), as well as other hazardous materials.

 

45 The Treasury Forfeiture Fund was established in 1992 as the successor to the Customs Forfeiture Fund. The 

mission of the Treasury Forfeiture Fund is to “affirmatively influence the consistent and strategic use of asset 

forfeiture by participating agencies to disrupt and dismantle criminal enterprises.” 

http://www.treasury.gov/about/organizational-structure/offices/Pages/The-Executive-Office-for-AssetForfeiture.aspx (accessed June 6, 2012). 46 TFF participating agencies include the Internal Revenue Service, Criminal Investigation (IRS-CI); ICE; CBP; 

U.S. Secret Service (USSS); and the U.S. Coast Guard (USCG). http://www.treasury.gov/about/organizationalstructure/offices/Pages/The-Executive-Office-for-Asset-Forfeiture.aspx (accessed June 6, 2012). 

000203
DEI Final Investigation Report January 2013

21

3.0 Pre-Incident 

3.1 Federal Seized Property Management Contract

On August 1, 2006, TEOAF awarded a ten-year contract (federal prime contract) to VSE Corporation 

(VSE) to support its Seized and Forfeited Property Program. VSE employs roughly 2,500 individuals and 

provides diverse services to the government and military, including reverse engineering, supply chain 

management, management consulting, and process improvement.

47 VSE’s responsibility under the 

federal prime contract was to secure services for the receipt, storage, handling, transportation, 

consignment, or disposal of all seized, blocked, or forfeited general property48 through the subcontracting 

of vendors. Among other things, the federal prime contract required VSE, as the contractor, to ensure the 

safety of the public, workers, and property of others. 

The ten-year federal prime contract was protested49 and terminated by an agreement between Treasury 

and VSE. On September 28, 2010, TEOAF awarded VSE a seven-month interim contract50 for the 

continuation of services being provided under the earlier awarded federal prime contract. This interim 

contract was in place at the time of the incident. 

According to VSE officials, it was instrumental to the company in obtaining the federal prime and interim 

contracts that it had a separate subcontract with the management company Thomas E. Blanchard & 

Associates, Inc. (BAI). BAI utilizes a team of retired federal law enforcement personnel located 

throughout the U.S. who provide VSE with field services such as acceptance, transportation, and 

inspection of seized property, on an as-needed basis.51

3.2 Federal Fireworks Disposal Subcontract

 According to VSE, subcontracting with BAI 

enabled VSE to submit a lower-cost proposal to TEOAF that provided for national coverage without VSE 

incurring day-to-day expenses such as travel and per diem. Review of the subcontract shows there was no 

requirement that BAI make available field representatives with relevant safety experience, as their 

primary responsibility was tracking of inventory. 

Between 2007 and 2010, federal law enforcement agents conducted three separate firework seizures in 

Honolulu, Hawaii, intercepting the fireworks during importation from China.52

 

47

 These shipments were 

www.vsecorp.com (accessed June 20, 2012). 48 The federal prime contract defined seized, blocked, or forfeited property as “seized, blocked, or forfeited tangible 

property that is not real property, money or investments, including aircraft; vehicles; vessels; machinery and 

equipment; antiques and collectables; and livestock.” 49 Pursuant to 4 CFR Part 21 (1996). 50 The contract was later extended to one year. 51 BAI provides field services solutions to companies and government agencies throughout the United States. 

http://blanchardai.com (accessed June 21, 2012). 52 CBP seized one fireworks shipment on December 10, 2007. ICE/HSI seized one fireworks shipment on February 

4, 2009, and one on January 13, 2010. 

000204
DEI Final Investigation Report January 2013

22

labeled as 1.4G UN0336 consumer fireworks, but the fireworks contained within the shipments had 

physical characteristics of more hazardous 1.3G UN0335 display fireworks (See Appendix A). The 

fireworks involved in the incident53 (referred to as “primary seizure”) were seized in 2010 and consisted 

of multi-tube devices known as cake fireworks, which are made up of individual firework tubes linked by 

pyrotechnic fuse. Each firework tube contains a lift charge and aerial shell (Figure 2). 

Figure 2. Cake firework tube, lift charge, and aerial shell configuration (photo courtesy of ATF)

Because CBP and ICE/HSI both participate in the Treasury Forfeiture Fund, VSE was responsible, as the 

prime federal contractor, for locating vendors to transport, store, and ultimately destroy the shipments 

when instructed to do so by the seizing agency. In March 2010 VSE awarded a subcontract to Donaldson 

Enterprises, Inc. (DEI) to dispose of the seized fireworks. Figure 3 shows the chain of contractual 

relationships relevant to this incident (Section 6.0 discusses VSE’s selection and oversight of DEI).

 

53 The third fireworks seizure (number 2010-3205-000-012-01) was seized on January 13, 2010. This seizure is 

referred to as the “primary seizure” as it contained the fireworks that resulted in the explosion on the day of the 

incident.

000205
DEI Final Investigation Report January 2013

23

TREASURY EXECUTIVE OFFICE FOR 

ASSET FORFEITURE

(TEOAF)

VSE CORPORATION

Federal Prime Contractor for Seized 

Property Management

DONALDSON 

ENTERPRISES, INC.

(DEI)

Awarded Federal 

Subcontract for Seized 

Fireworks Disposal

THOMAS E. 

BLANCHARD & 

ASSOCIATES, INC.

(BAI)

Had field representative 

on Oahu

Figure 3. Contractual Relationships

3.3 Donaldson Enterprises, Inc.

DEI is a small company that was founded in 1988 and provides environmental and UXO mitigation 

services throughout the Pacific basin. DEI employs a staff with experience in both military and civilian 

UXO clearance operations. During World War II and the Vietnam War, the military used areas 

throughout Hawaii for live munitions training. Many of these areas have been returned to civilian use, 

but may still have UXO present. Individuals and companies hire DEI to determine the presence and 

extent of UXO in an area or at a site and provide UXO escort services.

54

 

54 “The UXO Escort is responsible for the safe escort of non-UXO qualified personnel who are not directly involved 

in specific UXO clearance site work, but have activities to perform within restricted/exclusion areas...the escort 

function involves hazard recognition and avoidance only, not the execution of UXO search or clearance actions...”

 When UXO is located, DEI 

personnel typically clear the UXO by installing explosives and remotely initiating an explosion to safely 

destroy the UXO. DEI also assists in the development of UXO clearance plans and provides training to 

http://www.dol.gov/whd/regs/compliance/wage/p29494.htm#.UN-QFm_BGSo (accessed December 29, 2012).

000206
DEI Final Investigation Report January 2013

24

others in UXO identification and avoidance. Prior to being awarded the subcontract by VSE, DEI’s work 

did not include the disposal of fireworks. 

3.4 Waikele Self Storage

DEI leased magazine A-21 at Waikele Self Storage, Ltd. in Waipahu, Hawaii, to store unexploded 

ordnance.55 Waikele Self Storage consists of 120 storage units cut into a solid rock hillside that were 

built during World War II and used by the Navy as ammunition storage bunkers. These magazines are 

tunnel-like structures, each approximately 250 feet long, with concrete floors, walls, and domed ceilings. 

Each magazine has a loading dock and ramp leading to one entrance with steel doors. 

The A-21 magazine is 250 feet long, 16 feet wide, and 12 to 14 feet high. Its entrance is secured with a 

steel door that is 6.1 feet wide by 9.4 feet high, and split into two segments (Figure 4). 

Figure 4. Magazine A-21 (and loading dock), Waipahu, Hawaii

DEI told the CSB that its personnel stored the three fireworks shipments, which consisted of boxes 

wrapped in plastic stacked on wood pallets, towards the rear of the magazine. DEI personnel pulled out 

boxes individually when they were ready to prepare the fireworks for disposal. 

 

55 According to the lease for the A-21 magazine, it appeared that the storage of fireworks was also permitted. While 

the lease contained boilerplate language prohibiting the storage of explosives and fireworks, this language had been 

struck through on the executed contract. 

000207
DEI Final Investigation Report January 2013

25

3.5 DEI Initial Fireworks Disposal Activities

DEI began its fireworks disposal work on the initial seized fireworks shipment56 (initial seizure) in 

summer 2010. According to DEI’s Standard Operating Procedure (SOP), its disposal process involved 

soaking individual whole firework tubes that had been separated from the cake in diesel-filled 55-gallon 

steel drums located within the magazine for a minimum of 24 to 48 hours, removing the fireworks from 

the diesel soaking drum, and transporting the diesel soaked fireworks to the Koko Head firing range 

(Koko Head) to burn the fireworks in a drum or in DEI’s portable incinerator (a Thermal Flash Unit 

(TFU)). Diesel is sometimes used to soak and burn fireworks because it desensitizes the material to 

spark, friction, impact, and temperature and should result in a slow burn rather than an explosion. 

As Section 7.0 discusses, seized fireworks are considered hazardous waste under the Resource 

Conservation and Recovery Act (RCRA) and, as such, require a RCRA permit for treatment and disposal. 

DEI notified the State of Hawaii Department of Health (DOH), Hawaii’s state environmental agency 

responsible for implementing and enforcing federal environmental regulations, of its intended burn 

operations at Koko Head via letter in May 2010. On June 8, 2010, DOH issued DEI a 90-day Emergency 

Hazardous Waste Permit57 authorizing DEI personnel to “conduct specific hazardous waste management 

activities at a designated site at Koko Head Range and proper storage of the waste fireworks.” 

According to DOH, the actions authorized in the permit were based on information DEI provided when it 

requested the permit, and DEI’s activities were limited to those the permit authorized. The permit stated 

that DEI would dispose of approximately 5,000 pounds of confiscated class “C” type58 illegal fireworks 

by thermal treatment, using empty 55-gallon containers or a mobile incinerator, at Koko Head. The 

permit expired 90 days after it was issued. Upon conclusion of the permitted activities, DEI was required 

to provide a closure report to the DOH Solid and Hazardous Waste Branch and the RCRA Facilities 

Management Office at EPA Region IX in San Francisco, California. The permit did not discuss diesel 

soaking or fireworks disassembly. 

 

56 The initial seizure (number 2008-3201-000-013-01) was seized on December 10, 2007, and consisted of 11 pallets 

of fireworks and included “Maylar Tubes,” “Assortment Shells,” and “Singing Oriole/Dancing Swallows.” 

57 DOH has the authority under 40 CFR §270.61 and Hawaii Administrative Rules (HAR) §11-270-61 to issue 

temporary emergency permits to non-RCRA permitted, and RCRA permitted, persons or facilities seeking to engage 

in hazardous waste treatment, storage, or disposal activities where there is an “imminent and substantial 

endangerment to human health or the environment.” The burden is on the applicant to prove that such an imminent 

threat exists. 

58 1.4G fireworks were classified as “Type C” fireworks prior to 1991. 1.3G fireworks were previously classified as 

“Type B.” 49 CFR §173.53 (2001). 

000208
DEI Final Investigation Report January 2013

26

3.6 Modifications to the Fireworks Disposal Process

3.6.1 Initial Modification

DEI management later told the CSB that during the disposal of the initial seizure, some of the fireworks 

were exploding during burning operations, even after the diesel soaking time had been increased to one 

week. DEI believed this was due to inadequate diesel permeation of the aerial shells contained in these 

fireworks. To resolve this issue, DEI personnel used blades to disassemble the fireworks by cutting open 

the individual firework tubes by hand and taking apart their explosive components (the aerial shells and 

black powder lift charge) (Figures 5 and 6). They then cut a one-inch slit into each aerial shell (Figure 7), 

soaked the aerial shells in diesel-filled drums (Figures 8 and 9), and burned them at Koko Head (Figures 

10 and 11). The black powder lift charge from the tubes was collected in plastic containers lined with 

plastic garbage bags. 

DEI completed its disposal of the initial seizure in December 2010. However, it did not dispose of the 

black powder lift charge collected from the disassembly work. The powder was being stored in 

containers in the back of the magazine at the time of the incident.59

Figure 5. Photo of DEI personnel disassembling initial fireworks seizure in 2010

 

59 DEI completed its disposal work on the initial seizure in December 2010. The DOH 90-day Emergency 

Hazardous Waste Permit expired on September 5, 2010, and was not renewed. As discussed in Section 7.3.2, the 

CSB determined that DEI’s failure to renew the Emergency Hazardous Waste Permit for its fireworks disposal 

activities was not causal to the incident. 

000209
DEI Final Investigation Report January 2013

27

Figure 6. Fireworks cake being disassembled

Figure 7. Slit aerial shell from DEI's first destruction

000210
DEI Final Investigation Report January 2013

28

Figure 8. 55 gallon steel drum and inner liner used for diesel soaking

Figure 9. Aerial shells removed from the firework tubes and placed in an inner liner for diesel soaking

000211
DEI Final Investigation Report January 2013

29

Figure 10. Fireworks burning in incinerator (TFU) 

Figure 11. Fireworks burning in drums 

000212
DEI Final Investigation Report January 2013

30

3.6.2 Second Modification

DEI began work on its second disposal job under the subcontract in December 2010 and in early 2011 

again altered its fireworks disposal process. According to an email from DEI management to VSE, this 

modification was designed to increase the destruction rate of the third shipment of seized fireworks (later 

referred to as the “primary seizure,” as this was the seizure involved in the incident). To maximize the 

quantity of explosives that could be burned at one time, DEI personnel again disassembled the fireworks 

by cutting open individual firework tubes by hand and separating the individual explosive firework 

components, black powder lift charge and aerial shells, into cardboard boxes. The boxes containing black 

powder were lined with plastic garbage bags to minimize leakage. 

More precisely, DEI took three boxes of fireworks at a time out of the magazine and broke them down 

into three boxes of firework components: one box, lined with a plastic garbage bag, contained the black 

powder lift charge; one box contained the accumulated aerial shells; and one box contained the cardboard 

tubes and packaging material. Periodically, the plastic bags containing black powder were relocated from 

the cardboard boxes into plastic containers and were stored towards the middle of the magazine. 

DEI’s plan was to soak the aerial shells in diesel in the steel drums and burn them; however, the company 

had no plan to dispose of the accumulated black powder. 

3.7 Morning of the Incident

On April 8, 2011, at approximately 7:15 am, a team of six DEI personnel (a project supervisor, four UXO

Level I Technicians,

60 and one general laborer) arrived at the magazine to begin their disassembly work 

for the day. They prepared their outside work area by setting up a pop-up tent, table, and chairs on the

magazine loading dock located directly in front of the magazine entrance. 

According to witness testimony, DEI personnel previously stacked fifteen remaining boxes of whole oneinch firework tubes from the primary seizure in the front left corner of the magazine (Figure 14). Each

box contained 152 one-inch Sky Festival tubes that had been separated from a cake (Figure 12).61

 

60 A UXO Level I Technician (UXO Tech I) has successfully completed 200 hours of training on Munitions and 

Explosives of Concern (MEC) and Material Potentially Presenting an Explosive Hazard (MPPEH), and 40 hours of 

Hazardous Waste Operations and Emergency Response (HAZWOPER). A UXO Technician is qualified for and 

fills a Department of Labor, Service Contract Act, Directory of Occupations contractor position of UXO Technician 

I, II, and III. See the Department of Defense Explosives Safety Board (DDESB). Minimum Qualifications for 

Unexploded Ordnance (UXO) Technicians and Personnel; Technical Paper (TP) 18, Section 3.1.1, 2004; this paper 

provides the minimum qualification standards for personnel conducting UXO-related operations in support of the 

Department of Defense. According to the DDESB, a UXO Tech I may not handle or transport UXO or discarded 

military munitions, including military pyrotechnic items, without the direction and supervision of UXO-qualified 

personnel, which include UXO Tech IIs, UXO Tech IIIs, UXO Safety Officers, UXO Quality Control Specialists, 

and Senior UXO Supervisors. Ibid at Section C2.1.2, 2004. 

 DEI 

61 ATF evaluated the Sky Festival fireworks as part of the seizure enforcement process. Each of the 96 seized boxes 

of contraband Sky Festival fireworks contained 4 individual cakes containing 156 firework tubes, or shots. An 

individual cake contained 150 small tubes, and 6 large tubes. ATF kept one box to sample and test for evidence 

purposes, leaving 95 boxes. DEI removed all of the tubes from the cakes and boxed the 2,280 large tubes and

000213
DEI Final Investigation Report January 2013

31

personnel initially transferred three boxes of whole firework tubes to the outside working area. They then 

began their normal disassembly process: two UXO technicians cut the tubes using a PVC cutter or knife, 

while the project supervisor and the two additional technicians broke the tubes apart and separated the 

internal explosive components into one of the three cardboard boxes. 

The general laborer remained inside the magazine during this work, performing cleaning and organizing

tasks. When the DEI personnel were finished disassembling and separating this first round of firework 

tubes, they then pulled out three more boxes of whole firework tubes and took them to the outside work 

area to disassemble. 

Figure 12. Sky Festival cake firework (from the primary seizure) contains 150 small tubes and 6 large tubes; large 

tubes located on the right side of the box were being disassembled on the day of the incident. 

The team was able to disassemble six to seven boxes of fireworks before 8:30 am when according to the 

project supervisor, it began to rain heavily. The team stopped work and used a metal hand truck to move

the boxes containing black powder, aerial shells, and partially disassembled tubes, and stack them just 

 

57,000 small tubes separately. DEI determined that individual disassembly of the small tubes to remove the 

explosive components did not offer a sufficient advantage during the diesel soaking and burning process, so these 

tubes were not disassembled, and remained intact. According to witness statements, this resulted in 15 boxes of 

large tubes. According to CSB calculations, each box contained 152 large Sky Festival tubes. 

000214
DEI Final Investigation Report January 2013

32

inside the magazine entrance. They also brought in the table, camp chairs, and a rolling office chair, 

leaving the pop-up tent outside on the dock. Figures 13 and 14 show the approximate location of 

materials within the magazine just prior to the incident. This information is based on witness statements

to the CSB. 

While the team of personnel remained inside the magazine, the project supervisor left and got his phone 

from his truck, which was parked in front of the magazine dock. He then walked to the front left corner 

of the magazine dock to make a phone call. While he was on the phone, a large explosion occurred inside 

the magazine and a fire ensued, fatally injuring all five DEI personnel who were located inside the 

magazine at the time of the incident. Only one of those five was able to escape the magazine during the 

event, and he succumbed to his burn injuries later that day.

000215
DEI Final Investigation Report January 2013

33

Figure 13. Magazine layout at the time of the incident

Figure 14. Side aerial view of magazine at the time of the incident

000216
DEI Final Investigation Report January 2013

34

4.0 Technical Analysis

The CSB investigation team arrived at the incident scene the morning of April 11, 2011. The team 

interviewed DEI personnel, examined the incident scene and physical evidence, and collected and 

reviewed relevant documentation. 

Investigation activity was coordinated with a number of other organizations: 

• ATF

• Hawaii Occupational Safety and Health Division (HIOSH)

• U.S. Occupational Safety and Health Administration (OSHA)

• Honolulu Police Department (HPD) 

• Honolulu Fire Department (HFD) 

4.1 Site Inspection and Evaluation

Following an examination of the incident scene, the CSB determined the explosion was a deflagration that

originated inside the magazine near the entrance. Damage indicators included chipping and scorching of 

the magazine walls, burned 55-gallon drums, and scorching on the lower portions of the ventilation duct 

within the magazine near the entrance. The other side of the concrete partition located in the middle 

portion of the magazine sustained little to no damage and the ventilation duct toward the rear had minimal 

marking. The very rear of the magazine still contained fully intact fireworks, with slight melting of the 

plastic wrapping (Figures 15 through 18). 

000217
DEI Final Investigation Report January 2013

35

Figure 15. Damage to the magazine wall

Figure 16. Interior of the magazine post-incident

Ventilation Duct 

Damage to wall 

000218
DEI Final Investigation Report January 2013

36

Figure 17. Rear interior of magazine, behind concrete partition, post-incident

Figure 18. 2009 Seizure (second seizure) at rear of magazine, relatively undamaged with some melting of the 

plastic wrapping following the explosion and fire near the front of the magazine. 

000219
DEI Final Investigation Report January 2013

37

The steel hand truck (Figure 19) used to move the boxes in and out of the magazine was propelled more 

than 100 feet from the magazine door into vegetation located across a road in front of the magazine. The

rolling office chair was found in the same area near a stream (Figure 20). The GMC Sierra truck, parked 

approximately 30 feet in front of the magazine entryway, was forced away from the magazine, its rear cab 

rotated approximately 10 feet away from its original position (Figure 21). The CSB was told that the 

truck was not running at the time of the incident. 

Figure 19. Steel hand truck found in vegetation (courtesy of Honolulu Fire Department)

 

000220
DEI Final Investigation Report January 2013

38

Figure 20. Rolling office chair found blown out of the magazine 

Figure 21. Prior to incident, this GMC truck was parked just in front of the silver car. The force of the explosion

moved the rear of the truck to the right as indicated by the arrow. 

000221
DEI Final Investigation Report January 2013

39

4.2 Disassembly Activities

CSB analysis of DEI’s activities on the day of the incident indicates that the act of disassembling the Sky 

Festival firework tubes from the primary seizure and separating out the explosive components into boxes 

increased the mass of explosive materials within a single container by a factor of 456.62 

Type of 

Firework

Mass of lift 

charge per 

individual 

firework 

tube 

(grams) 

Mass of 

aerial shell 

explosives 

per

individual 

firework 

tube 

(grams) 

Mass of lift 

charge DEI 

accumulated 

in a single 

container

(grams) 

Mass of aerial 

shell 

explosives DEI 

accumulated 

in a single 

container

(grams) 

Scale-Up 

Factor

Sky Festival 

Fireworks 

disassembled 

by DEI on the 

Day of the 

Incident

3.3 4.7 1,505 2,143 456

Table 1. DEI disassembly process on the day of the incident increased the mass of explosives within a 

container by a factor of 456. 

DEI decided to disassemble these larger tubes in order to remove the black powder lift charges and aerial 

shells. As Table 1 shows, DEI’s disassembly activities, which accumulated large quantities of black 

powder (a 1.1 explosive on its own)63

 

62 Factor/Scale-up Factor calculation is based on starting with the amount of explosives in a single large tube from 

the Sky Festival cake fireworks after DEI workers separated the large tubes from the original cake. ATF determined 

that each large tube contained approximately 3.3 grams of black powder lift charge and 4.7 grams of a perchlorate 

explosive pyrotechnic mixture in the aerial shell. The disassembly process had evolved over time, and on the day of 

the incident was such that 3 boxes of fireworks were removed from the magazine and taken out to the loading dock. 

The three boxes contained a calculated total of 456 large firework tubes. When DEI personnel disassembled these 

fireworks, they accumulated all of the black powder lift charge in one box; all of the aerial shells in a second box; 

and the remaining non-explosive materials in a third box. The CSB calculated that the box of accumulated black 

powder lift charges contained 1,505 grams of black powder and the box of accumulated aerial shells contained 2,143 

grams of explosive pyrotechnics, which was 456 times more than a single large tube from the 1.3(G) contraband Sky 

Festival fireworks contained. 

and aerial shells into boxes, greatly increased the risk to DEI 

personnel working that day by creating the potential for a mass explosion. 

63 The table located in 49 CFR §172.101 states that 1.1 explosives have the ability to mass explode.

000222
DEI Final Investigation Report January 2013

40

4.3 Testing

4.3.1 ATF Testing of Firework Samples

On January 16, 2010, ATF officials conducted a detailed examination of four samples64

4.3.2 CSB Testing of Firework Samples

collected from 

the primary seizure (Appendix A). ATF concluded from its analysis that the amount of pyrotechnic 

material contained within all four samples exceeded the allowable quantities for a 1.4G UN0336 

consumer firework. Laboratory analysis of the explosive components from the larger Sky Festival tubes 

being disassembled on the day of the incident identified the lift charge as black powder and the burst 

charge (contained within the aerial shells) as a perchlorate explosive mixture. 

Physical testing of samples from the four types of fireworks contained in the primary seizure, including 

the Sky Festivals, is being performed to identify the likely means of accidental ignition of the fireworks.

The results of this testing were not completed at the time this report was issued; the results will be 

published on www.csb.gov when available. 

Composition testing, conducted to determine which chemical components most likely contributed to the 

energetic properties of the fireworks and whether any chemicals were added to the fireworks to make 

them particularly energetic, had not yet been performed at the time of this report’s release. The results 

will be published on www.csb.gov when available. 

4.3.3 HIOSH Testing of Tools

National Fire Protection Association (NFPA) good practice industry standards and ATF explosive 

regulations recognize the importance of minimizing ignition sources near explosives. For example, 

NFPA 1124, Code for the Manufacture, Transportation, Storage, and Retail Sales of Fireworks and 

Pyrotechnics Articles states that “[m]etal tools other than nonferrous conveyors shall not be stored in 

magazines.”65

Post-incident, HIOSH collected 12 separate tools found inside the magazine near the entrance: three 

cutting tools, pruning shears, a shovel/dust pan, loppers,66 a push broom, a pair of miter saws, scissors, tin 

snips, and a battery-powered diesel pump. Metallurgical testing was conducted to determine if the tools 

were sparking and thus likely capable of initiating an explosion within the magazine. 

 

64 The four sampled fireworks were taken from the following: a. O Triple C 8/1; b. HALAWA 8/1; c. Sky Festival 

4/1; and d. Krazy Kids 8/1. 

65 National Fire Protection (NFPA) 1124. Code for the Manufacture, Transportation, Storage, and Retail Sales of 

Fireworks and Pyrotechnic Articles, Section 5.4.8.1, 2006. 66 A “lopper” is a pruning shear with long handles. 

000223
DEI Final Investigation Report January 2013

41

Two tests were performed on each of the 12 tools. The first test identified what metal components were 

made of steel and the type of steel in each component. The second test demonstrated whether the tools’ 

steel components were “spark resistant.” A spark-resistant wrench was used as the control. Each tool

was applied to a grinding wheel to produce particles of the material being tested; these particles were then 

directed towards a flammable material to determine if they could be an ignition source. In every case 

except one (the non-ferrous dust pan), when the metal tested on these tools emitted visible sparks, the 

flammable material caught fire. The conclusion was that each of the tools, other than the non-ferrous 

dustpan, was capable of producing a spark, and therefore being an ignition source within the magazine.67 

4.4 Conclusions on Ignition

ATF concluded in its investigative report on the incident that the explosion was likely triggered when 

loose explosive pyrotechnic powder, initially generated as the fireworks were disassembled outside, 

spilled or leaked from the boxes onto the storage magazine floor and was ignited due to friction or a 

metal-to-metal spark as DEI employees moved materials around inside the magazine. ATF concluded 

that the ignition likely propagated to one or more of the boxes of the accumulated explosives located near 

the magazine entrance, resulting in a large explosion. 

CSB explosion analysis concurred with ATF’s conclusion. The CSB adds that the ignition of the 

explosive powder could have resulted from any of the following uncontrolled ignition sources: sparks 

generated by the movement of the metal hand truck (either by knocking it over or dragging the metal lip 

on the floor); dropping or knocking over a removable steel drum lid onto the floor; or friction from the 

office chair rolling over explosive pyrotechnic powder. 

While less likely, static electricity from the plastic garbage bags used as liners for the cardboard boxes 

could have also caused the ignition. Ordinary plastic garbage bags are sometimes charged with static 

electricity as part of the manufacturing process in order for the bags to be tightly folded; as such, they are 

not appropriate for storing explosives.68 At the site, ATF investigators used special anti-static plastic bags 

to contain explosive components they collected as evidence (Figure 22). 

 

67 OSHA. Report on Donaldson Enterprises, Inc.; April 9, 2012. 68 National Aeronautics and Space Administration (NASA). Safety Standard for Explosives, Propellants, and 

Pyrotechnics; NSS 1740.12, Section 525(b)(2)(b), 1993. 

000224
DEI Final Investigation Report January 2013

42

Figure 22. Left photo (courtesy of ATF) shows anti-static bag used by ATF post-incident; right photo shows a roll 

of plastic garbage bags found following the incident. 

While the CSB cannot definitively identify the source of ignition that led to the explosion, the physical 

evidence shows that the explosion initiated a rapid reaction, consuming significant quantities of explosive 

firework components, cardboard tubes, and boxes that had been accumulated within the magazine near its 

only entrance and exit, and prevented escape by a majority of the DEI workers who were inside the 

magazine at the time of the incident. 

000225
DEI Final Investigation Report January 2013

43

5.0 Incident Analysis

The CSB analyzed DEI’s firework disposal activities and its Standard Operating Procedure (SOP), an 

“evergreen”69 document which contained an “Activity Hazard Analysis” created by DEI management, 

and determined that DEI would have greatly benefitted from Process Safety Management (PSM) 

principles and concepts of inherent safety.

70

5.1 Process Safety Management Standard

 For instance, rather than minimizing and controlling the 

amount of hazardous materials present, the DEI fireworks disassembly process increased and 

concentrated the hazard by removing explosive components from within individual firework cardboard 

containers and accumulating large quantities of these explosives in boxes. This process greatly 

compounded the total amount of explosive energy within each box, creating the conditions that allowed 

for the mass explosion. 

OSHA provides at 29 CFR §1910.109(k)(3) that the manufacture of pyrotechnics must meet the 

requirements of 29 CFR §1910.119, also known as OSHA’s PSM standard. The preamble states that 

“OSHA remains convinced that the hazards associated with the manufacture of explosives and 

pyrotechnics have the potential of resulting in a catastrophic incident, and pose a significant risk to 

employees and that the manufacture of explosives and pyrotechnics should be covered by the provisions 

of the final process safety management rule.”71

Despite the recognized hazardous nature of fireworks and explosives, a February 4, 1998, OSHA “Letter 

of Interpretation” narrows OSHA’s jurisdiction over those materials and defines the manufacture of 

explosives to mean the “mixing, blending, extruding, synthesizing, assembling, disassembling and other 

activities involved in the making of a chemical compound, mixture or device which is intended to 

explode,”

 Appendix A of the PSM standard lists toxic and reactive 

highly hazardous chemicals that present a potential for a catastrophic event at or above the threshold 

quantity. However, OSHA considers explosives and blasting agents to be so hazardous that they have no 

minimum threshold quantity to trigger the requirements of the PSM standard.

72

Had PSM been applicable to DEI’s fireworks disposal process, DEI would have been required to conduct 

a formal Process Hazard Analysis (PHA) on its disassembly procedure that explicitly identified a) the 

 an interpretation further promulgated by the Hawaii Occupational Safety and Health Division

(HIOSH), part of the Department of Labor and Industrial Relations (DLIR). Following the DEI incident, 

HIOSH evaluated DEI’s disposal process and determined it would not fall under the standard because 

DEI’s disassembly work was done under the umbrella of fireworks disposal rather than manufacturing. 

 

69 An evergreen document is a document that is updated on an ongoing basis to reflect changes to a system or 

procedure.

70 Inherent Safety is a “concept, an approach to safety that focuses on eliminating or reducing the hazards associated 

with a set of conditions.” Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life 

Cycle Approach; 2nd ed., 2009; p.11. 71 Preamble to 29 CFR Part 1910. Section 3 – III. Summary and Explanation of the Final Rule (1992). 72 OSHA Letter of Interpretation. Applicability of PSM Standard to Explosive and Pyrotechnic Manufacturing,

February 4, 1998.

000226
DEI Final Investigation Report January 2013

44

hazards of the disassembly process; b) any previous incidents involving DEI that had a likely potential for 

a catastrophic consequence in the workplace; c) engineering and administrative controls applicable to the 

hazards; d) consequences of the failure of these controls; e) justification and risk assessment associated 

with facility siting; and f) a human factors analysis of the proposed process.73 DEI would have also been 

required to conduct a formal management of change (MOC) analysis of its proposed disposal 

methodology before changes were made, to identify and control hazards introduced by the change.74 

5.1.1 Process Hazard Analysis

According to the PSM standard, a PHA is conducted to “identify, evaluate, and control the hazards 

involved” in a process associated with highly hazardous chemicals.75 DEI’s Corporate Health and Safety 

Plan required DEI’s Quality Control Manager (QCM) and Corporate Health and Safety Program Manager 

(HSPM) to analyze and control risks associated with DEI activities by identifying explicit risks associated 

with specific and implied tasks, determining the hazards causing these risks and the magnitude of risks, 

making risk acceptance decisions by balancing risk benefits against risk assessments, eliminating 

unnecessary risks, integrating specific controls into plans, and training and enforcing controls and 

standards. As such, upon developing its original fireworks disposal plan pursuant to the fireworks

disposal subcontract, DEI management personnel produced an SOP that contained a two-page “Activity 

Hazard Analysis” to evaluate its fireworks disposal activities. The Activity Hazard Analysis, however, 

did not robustly identify hazards associated with the disassembly process and was not evaluated by 

outside entities such as VSE, or DOH during the permitting process. Furthermore, safeguards DEI 

management listed to mitigate identified hazards, such as flame-retardant clothing and non-sparking tools, 

were not implemented, as evidenced by the HIOSH testing of the tools found within the magazine and 

physical evidence indicating workers were not wearing personal protective equipment (PPE) at the time 

of the incident. 

5.1.1.1 Process Safety Information

To conduct a thorough PHA, DEI personnel would have had to compile certain process safety information 

to help identify and understand the hazards of their disposal process. Safety information critical to the 

DEI process would include thermal and chemical stability as well as physical, toxicity, and reactivity 

data. None of these data were available to DEI workers, however, because these fireworks were brought 

into the country as contraband, and there were no company, contractual, or regulatory requirements to 

obtain the data prior to initiating disposal operations. Because contraband fireworks are generally 

uncharacterized, a better safety approach would have been to assume that they were extremely energetic 

and highly sensitive to potential ignition and to develop procedures and protocols to dispose of them as if

they were at the highest level of potential hazard. This is consistent with the approach OSHA requires for 

 

73 29 CFR §1910.119(e) (2002). 74 29 CFR §1910.119(l) (2002). 75 29 CFR §1910.119(e) (2002). 

000227
DEI Final Investigation Report January 2013

45

Hazardous Waste and Emergency Response, where workers who may need to enter an insufficiently 

characterized environment must prepare as though it presented the highest level of potential hazard, such 

as wearing a very high level of personal protective equipment (PPE).76

5.1.1.2 Identifying, Evaluating, and Controlling Hazards

The Activity Hazard Analysis in place at the time of the incident77 identified five operations being 

performed by DEI personnel while conducting fireworks disposal activities:

1. Separating and cutting fireworks

2. Establishing SOPs to desensitize fireworks to prepare for their destruction by burning

3. Destroying fireworks by burning 

4. Standing in front of the TFU, and 

5. Standing near the TFU 

The Activity Hazard Analysis identified heat, shock, and friction as possible hazards of separating and 

cutting fireworks that could lead to fire, severe burns, detonation, or death. The recommended controls 

for these activities were to use non-sparking tools, refrain from dragging boxes of fireworks across 

cement, and prepare fireworks outside the magazine; however, wearing the proper PPE such as flame 

resistant clothing was not listed. DEI personnel allowed sparking tools, steel drums, a steel hand truck, 

and a rolling office chair inside the magazine, hazards that could have been eliminated if tools and other 

items manufactured with non-spark-producing materials had been used. 

The Activity Hazard Analysis also did not identify hazards of separating explosive firework components 

that are sensitive to shock, friction, and static, such as black powder, and accumulating them in large 

quantities, creating a mass explosion hazard. No safety analysis was done that focused on minimizing the 

amount of hazardous material that was being accumulated during the disposal process, nor did the 

analysis identify or evaluate hazards stemming from the use of regular plastic garbage bags to store black 

powder rather than utilizing anti-static bags. 

To prevent possible injury or exposure to fumes from the TFU during burn operations, the Activity 

Hazard Analysis instructed DEI personnel not to stand downwind of the TFU and to wear proper PPE, but 

specific PPE requirements were not given. DEI’s Corporate Health and Safety Plan states that PPE must 

be worn when work activities involve known or suspected atmospheric contamination; when vapors, 

gases, or airborne particulate matter may be generated; or when direct contact with skin-affecting 

substances may occur. Records show that DEI purchased rubber gloves, face shields, eye protection, and 

fire-retardant clothing for its personnel conducting the disposal work. But on the day of the incident, 

 

76 29 CFR §1910.120 (C)(5)(iii) (2012). 77 DEI developed an initial hazard analysis in 2010 prior to disposal of the initial seizure; it was updated on an 

unknown date prior to the incident to include separating and cutting the fireworks as operations being conducted, 

and heat, shock, and friction as hazards of this operation, that could result in death. 

000228
DEI Final Investigation Report January 2013

46

workers wore only ordinary street clothes, including cotton shorts and t-shirts, which are not flame 

resistant. 

The magazine had only one means of ingress and egress. Yet DEI work practices allowed for explosive 

and combustible materials to effectively block this exit. The only life-saving provision afforded DEI 

workers who might be trapped inside the magazine were three small portable fire extinguishers attached 

to the magazine wall: one near the entrance, one towards the middle of the magazine, and one in the rear. 

No provision for emergency breathing air or fire protection clothing was provided. The only worker able 

to escape from the magazine after the explosion exited with his clothing in flames, and he sustained fatal 

burn injuries. Two workers succumbed to carbon monoxide poisoning inside the magazine. Had the 

proper PPE and emergency provisions such as breathing air been available and used, the severity of the 

injuries might have been reduced and lives could have been saved.

5.1.2 Management of Change (MOC) Review 

Under PSM, proposed changes to a process must be analyzed to determine their technical basis, required 

authorizations, and impact on health and safety.

78 As DEI activities were not covered under PSM, DEI 

altered its original fireworks disposal process twice without conducting an MOC-type review. The CSB 

has found no evidence suggesting that DEI conducted a detailed analysis of the risks associated with 

disassembling the fireworks and creating the potential for a mass explosion by accumulating explosive 

fireworks components. 

5.2 Principles of Inherent Safety

Inherent safety focuses on eliminating or reducing hazards associated with a process. That is, a process 

can be made inherently safer by eliminating or reducing the hazards associated with materials and 

operations.79 The four principles of inherent safety are to minimize, substitute, moderate, and simplify.80

To minimize is to reduce the quantity of material or energy contained in a process.81 However, rather 

than minimize hazards, DEI’s fireworks disposal process increased the quantity of hazardous energy and 

created the potential for a mass explosion when explosive components were removed from individual 

firework tubes, concentrated in a box, and allowed to accumulate. 

One approach to minimizing hazards that DEI could have used would have been to immediately soak the 

aerial shells in diesel as each firework tube was disassembled. If a process to effectively destroy the 

black powder lift charge as each tube was disassembled was not feasible, DEI should have developed an 

alternative disposal process that did not require the disassembly of the individual firework tubes. 

 

78 29 CFR §1910.119(l) (2012). 79 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life Cycle Approach; 2nd 

ed., 2009; p.11. 

80 Ibid at 29. 81 Ibid at 30. 

000229
DEI Final Investigation Report January 2013

47 

5.3 Relevant Training and Experience

DEI’s main practice as a company was to conduct UXO identification and clearance activities 

through remote ignition (Section 3.3). While the company did employ individuals with military 

explosives backgrounds, many of whom held management-type positions, this experience was 

not sufficient to safely handle or disassemble contraband commercial display fireworks. 

5.3.1 DEI Management

DEI’s firework disposal team included a project manager, a senior supervisor, a site safety and health 

officer (SSHO), and a project supervisor. This team collaborated to develop DEI’s fireworks disposal 

methodology and the SOP, which included the two-page Activity Hazard Analysis (Section 5.1.1.2). The 

DEI project manager was responsible for communicating with VSE, executing all instructions, managing 

all aspects of the project, overseeing the overall performance of those on the project team, coordinating all 

contract and subcontract work, and resolving any problems. The senior supervisor planned, coordinated, 

and supervised all operations, and communicated on a regular basis with VSE personnel. The SSHO 

implemented the overall safety program during the project and was responsible for implementing all

Accident Prevention Plan and onsite training requirements, and changes to the level of PPE as site 

conditions warranted. The project supervisor oversaw the lower-level UXO technicians employed by 

DEI, performed on-site activities (such as fireworks disassembly), and maintained control of team and 

daily activities. DEI personnel involved in the fireworks disposal activities under the fireworks disposal 

subcontract lacked the requisite training and experience needed to safely identify and control the hazards 

of this type of hazardous work. 

5.3.2 Experience

DEI management told the CSB that DEI personnel had significant experience dealing with explosives

from their time served in the military as EOD technicians; however, there is no evidence that this 

experience pertained to disposing of commercial fireworks. As discussed in Section 2.0, military EOD 

policy does not support military EODs handling contraband commercial fireworks. 

5.3.3 Training

The DEI Corporate Health and Safety Plan required that all DEI field personnel undergo the initial 40-

hour “Hazardous Waste Operations and Emergency Response” (HAZWOPER) course prior to 

participating in field activities. This training covers medical surveillance requirements; safety, health, and 

other hazards present on the site; selection and use of appropriate PPE; work practices to minimize risks 

000230
DEI Final Investigation Report January 2013

48

from potential hazards; and the safe use of test equipment and engineering controls.82 In addition, all DEI 

managers and supervisors were required to have at least eight extra hours of specialized OSHA supervisor 

training prior to job assignment. 

Four of the six DEI personnel involved in the incident were certified UXO Level I Technicians and 

received their UXO training83 and credentials from commercial schools in Hawaii and Texas; however, 

this training does not provide information on commercial fireworks or disassembly activities. In 

addition, according to the Department of Defense Explosives Safety Board (DDESB), a UXO Level I 

Technician may not handle or transport UXO or discarded military munitions, including pyrotechnics, 

without the direction and supervision of UXO-qualified personnel.84 UXO-qualified personnel include 

UXO Level II Technicians, UXO Level III Technicians, UXO Safety Officers, UXO Quality Control 

Specialists or Senior UXO Supervisors.85 The four UXO Level I Technicians involved in the incident had 

not been adequately trained to handle and dispose of commercial contraband fireworks, and required 

direction and supervision at the magazine from the project supervisor to conduct the disposal work. 

The CSB’s interviews with DEI management, and analysis of DEI’s disposal process and hazard analysis 

show that despite their military EOD experience, these individuals were not experienced or adequately 

trained to comprehend the hazards associated with this kind of work. In addition, the CSB could not 

identify the existence of training available to civilians covering fireworks disposal. 

5.4 Relevant Incidents

The following incidents provide valuable lessons regarding the hazards of handling and disposing of 

fireworks and the importance of identifying and properly managing those hazards. 

5.4.1 Enschede Fireworks Incident 

On May 13, 2000, a fireworks explosion and fire at the SE Fireworks86

 

82 29 CFR §1910.120(e)(2) (2006). 

Depot in Enschede, Netherlands, 

killed 23 and injured 947. This incident involved stored fireworks labeled as 1.4G consumer fireworks. 

As with DEI, an investigation into the incident concluded that although the fireworks were labeled as 

1.4G consumer fireworks, these fireworks were consistent with 1.3G display fireworks and the mass 

explosion was consistent with 1.1G explosives. The report on this incident highlights that aerial shells, 

when taken from their packaging, must be treated as a 1.1G explosive with the potential to mass 

83 UXO Technician Level I training consists of a four-week course that provides students with training in the safe 

detection, location, identification, and disposal of unexploded ordnance. 

http://teex.org/teex.cfm?pageid=training&area=teex&templateid=14&Division=publicsafety&Course=UXO200&na

vdiv=publicsafety (accessed September 17, 2012). 84 DDESB. Technical Paper (TP)18, Minimum Qualifications for Unexploded Ordnance (UXO) Technicians and 

Personnel, Section C2.1.2, 2004. 85 Ibid. 86 SE Fireworks was a major importer of fireworks from China and a supplier for concerts and events in the 

Netherlands. 

000231
DEI Final Investigation Report January 2013

49

explode.87 This conclusion is critical for anyone conducting firework disposal activities, as separating 

and accumulating explosive firework components can introduce the possibility of a mass explosion. 

5.4.2 Lansing, Kansas Incident

On July 4, 2012, a volunteer was killed when he and other local volunteers, some of whom worked with 

the local fire department, were disposing of fireworks that had not discharged during a fireworks display 

show for the City of Lansing, Kansas. The state-licensed fireworks display operator had been conducting 

this show annually for more than ten years. He told the CSB that each year during his shows as many as 

ten percent of the fireworks do not properly discharge and must be disposed of. In this incident, 

volunteers were disposing of undischarged three-inch diameter aerial shells by digging a pit several feet 

deep, starting a fire to burn the cardboard containers from cake fireworks, and throwing the defective 

firework aerial shells into the pit one at a time (Figures 23 and 24). This had been the common disposal 

method for this display operator for the last several years and was specifically developed to avoid past 

incidents when unexploded fireworks discharged on the back of a pickup truck during transportation, as 

well as in a garbage dumpster hours after the show was completed. The display operator had developed 

this disposal technique based on experience working for a fireworks manufacturing company. 

Just prior to this incident, following a verbal instruction for everyone to take cover, a chain of three-inch 

spherical aerial shells was thrown into the fire pit. At least one of the shells was ejected from the pit and 

exploded, fatally injuring a volunteer who had taken cover 40 to 50 feet away behind sand troughs 

constructed to stabilize the mortar tubes during the show. 

As Section 7.0 discusses, a significant regulatory and industry standards gap exists surrounding fireworks 

disposal in the U.S. This incident is yet another reflection of that gap, and illustrates the lack of guidance 

for disposing of fireworks, both contraband and non-contraband. 

 

87 National Fire Service of the Netherlands. Final Consideration. National Fire Service Documentation Center, p. 8.

http://www.nbdc.nl/cms/servlet/nl.gx.nibra.client.http.GetFile?id=498631&file=Final_consideration_(Slotbeschouw

ing_Engels).pdf (accessed Nov 16, 2012). 

000232
DEI Final Investigation Report January 2013

50

Figure 23. Burn pit used for fireworks disposal (courtesy of the Office of the Kansas State Fire Marshal)

Figure 24. Sand troughs built to stabilize mortar tubes for the display show, behind which volunteers took cover 

during disposal activities as aerial shells were thrown into the burn pit (yellow rectangle) (courtesy of the Office 

of the Kansas State Fire Marshal)

000233
DEI Final Investigation Report January 2013

51

6.0 Contractor Selection and Oversight

The procurement process TEOAF and VSE utilized, which is governed by the Federal Acquisition 

Regulation (FAR), the Department of the Treasury Acquisition Regulation System (DTAR), the 

Department of the Treasury Acquisition Procedures (DTAP), and bureau-level procurement policies and 

procedures, does not explicitly address safety, and lacks sufficient selection and oversight requirements 

for the prime contractor VSE and its subcontractors for the unique hazards associated with fireworks

disposal. 

6.1 Federal Acquisition Regulation

The FAR,

88 a broad set of regulations governing the federal agencies’ acquisition of goods and services, 

covers both the selection of contractors and in many cases the selection of subcontractors under federal 

contracts. These regulations deal with the types of contracts available to procure and the factors to 

consider when determining the qualifications of a prospective contractor or subcontractor. As such, the 

FAR governed the TEOAF federal prime seized property management contract and the process for 

awarding subcontracts under the prime contract. 

6.1.1 Determining Responsibility

FAR Subpart 9.104-489 requires prime contractors to determine the “responsibility” of their 

subcontractors before awarding a subcontract.90 To be deemed “responsible” under the FAR, a 

prospective contractor or subcontractor must “a) [h]ave adequate financial resources to perform the 

contract...[;] b) [b]e able to comply with the required or proposed delivery or performance schedule...[;]

c) [h]ave a satisfactory performance record91

 

88 48 CFR Chap. 1 (2012). 

...[;] d) [h]ave a satisfactory record of integrity and business 

ethics...[;] e) [h]ave the necessary organization, experience, accounting and operational controls, and 

technical skills, or the ability to obtain them (including...quality assurance measures and safety 

programs...)[;] f) [h]ave the necessary production, construction, and technical equipment and 

89 48 CFR §9.104-4 (2005). 90 48 CFR §9.104-1 discusses requirements for determining the responsibility of a prospective contractor. 48 CFR 

§9.104-4 extends those requirements to determining the responsibility of prospective subcontractors. 

91 According to the FAR, “[a] prospective contractor that is or recently has been seriously deficient in contract 

performance shall be presumed to be nonresponsible...[p]ast failure to apply sufficient tenacity and perseverance to 

perform acceptably is strong evidence of nonresponsibility. Failure to meet the quality requirements of the contract 

is a significant factor to consider in determining satisfactory performance.” 48 CFR §9-104-3(b). (2005). See also 

48 CFR §42.15, Contractor Performance Information: “Past performance information is relevant information, for 

future source selection purposes, regarding a contractor’s actions under previously awarded contracts. It includes, 

for example, the contractor’s record of conforming to contract requirements and to standards of good workmanship; 

the contractor’s record of forecasting and controlling costs; the contractor’s adherence to contract schedules, 

including the administrative aspects of performance; the contractor’s history of reasonable and cooperative behavior 

and commitment to customer satisfaction; the contractor’s reporting into databases...the contractor’s record of 

integrity and business ethics, and generally, the contractor’s business-like concern for the interest of the customer 

(2002). 

000234
DEI Final Investigation Report January 2013

52

facilities...[;] and g) [b]e otherwise qualified and eligible to receive an award under applicable laws and 

regulations.”92 FAR Subpart 9.104-2 states that, when necessary, a contracting officer (CO) may develop 

special standards of responsibility, especially when unusual expertise is needed for adequate contract 

performance.93 Pursuant to these sections, VSE contract procurement personnel are required to determine 

a potential subcontractor’s “responsibility” before awarding any subcontract; as such, they would have to 

have the ability to assess any prospective subcontractor’s technical qualifications relevant to the work 

involved. 

FAR Subparts 9.104-1 and 9.104-4, however, do not specifically require prime contractors to include any 

safety performance metrics and qualifications criteria in their review of a prospective subcontractor’s 

responsibility, despite the fact that the work of federal agencies can be hazardous. As discussed in the 

CSB’s Xcel Investigation Report, issued in August 2010, several organizations and industry associations, 

including the Construction Users Roundtable94 (CURT), the American National Standards Institute95

(ANSI), and the American Industrial Hygiene Association (AIHA), have developed guidelines and 

recommended practices addressing the use of safety criteria for selecting and prequalifying contractors. 

CURT has stated that demonstrated safety performance is a “critical criterion used in the [contractor] 

prequalification process.”96 CURT guidance lists staff qualifications, accident history, a contractor’s

safety program, and an owner’s previous experience as potential criteria for safety prequalification of a 

contractor. ANSI Standard Z-10, “Occupational Health and Safety Management Systems,” also 

recommends that the contractor prequalification process include consideration of safety criteria for 

successful contractor safety performance management.97 

6.2 Supplements to the FAR

Over the years, federal agencies have developed supplements to the FAR containing regulations and 

policies that are more specific to an agency’s activities and needs. The courts have ruled that agency 

supplements, like the FAR itself, have “the force and effect of law.”98

 

92 48 CFR §9.104-1 (2005). 

 The U.S. Department of Defense 

93 48 CFR §9.104-2 (2005).

94 CURT is an industry organization that promotes advocacy by users of construction services on national issues that 

includes “developing industry standards and owner expectations with respect to safety, training and worker 

qualifications” http://www.curt.org/2_0_about_curt.html (accessed September 27, 2012). CURT is composed of 66 

member companies, organizations, and government entities that represent some of the largest industrial corporations 

and users of construction services in the U.S. including ExxonMobil, Dow Chemical, Intel, Duke Energy, Shell, the 

U.S. Army Corp. of Engineers, U.S. Department of State, U.S. Federal Bureau of Prisons, and the U.S. General 

Services Administration.

95 ANSI is as private, non-profit organization that “oversees the creation, promulgation and use of thousands of 

norms and guidelines that directly impact businesses in nearly every sector...[and] is also actively engaged in 

accrediting programs that assess conformance to standards...” 

http://www.ansi.org/about_ansi/overview/overview.aspx?menuid=1 (accessed December 20, 2012). ANSI is 

comprised of nearly 1,000 businesses, professional societies and trade associations, standards developers, 

government agencies, and consumer and labor organizations. 96 CURT, Construction Safety: The Owner’s Role, UP-802, 2004, p.6. 97 ANSI/AIHA. ANSI/AIHA Z-10, American National Standard for Occupational Health and Safety Management 

Systems, 2012; p.18. 98 Davies Precision Machining, Inc. v. U.S., 35 Fed Cl. 651 (1995). 

000235
DEI Final Investigation Report January 2013

53

(DoD), for example, developed the Defense Federal Acquisition Regulation Supplement (DFARS),

99

6.2.1 Department of the Treasury

which, among other things, reflects the nature of the DoD’s hazardous work and its commitment to 

protecting the public and workers by requiring more rigorous contractor and subcontractor selection and 

oversight practices to ensure safety is effectively managed. However, the Treasury supplement (the 

DTAR) does not explicitly require the consideration of health or safety in its selection and oversight 

provisions, despite the fact that subcontractors are engaging in hazardous work pursuant to the TEOAF 

federal prime contract. 

The DTAR establishes uniform policies for all acquisition activities throughout Treasury, including the 

TEOAF. 100 The Treasury Office of the Procurement Executive (OPE), which is responsible for 

evaluating, reviewing, and issuing all departmental acquisition regulations and guidance, directly oversees 

and controls the DTAR.101 The Senior Procurement Executive (SPE) is the director of OPE and may 

approve all individual and class contract FAR and DTAR deviations.102 The SPE has also published a 

companion policy guide to the DTAR, the DTAP, which must be used in conjunction with the DTAR and 

FAR to ensure adherence to all Treasury policy and federal procurement regulations.103 

Although the TEOAF is responsible for managing participating agencies’ seized and forfeited property, 

which may include explosive and hazardous materials, provisions contained within the DTAR do not 

reflect the importance of occupational health and safety when conducting hazardous activities. The 

DTAR and DTAP lack explicit safety provisions, and do not provide for additional contractor and 

subcontractor selection and oversight procedures when contracting for the handling, storage, or disposal 

of hazardous materials such as fireworks.

6.2.2 Department of Defense 

The DoD’s DFARS Section 223, “Environment, Energy and Water Efficiency, Renewable Energy 

Technologies, Occupational Safety, and Drug-Free Workplace,”104 considers additional safety and 

contractor oversight for all DoD acquisitions involving the use of ammunition and explosives105 (AE),

including handling or loading, assembling, transportation, storage, and disposal.106

 

99 48 CFR Chapter 2 (Sections 200 to 299) (last updated May 29, 2012). 

 Section 223 requires

100 48 CFR Chapter 10 (Sections 1000 to 1052) (2011). 101 48 CFR §1001.304 (2011). 102 48 CFR §1001.403 and 1001.404 (August 2011). 103 See Department of the Treasury Acquisition Procedures (DTAP) (June 1, 2011) 

http://www.treasury.gov/about/organizational-structure/offices/Mgt/Documents/DTAP%2006-01-2011.pdf

(accessed September 18, 2012). 104 48 CFR §223 (May 29, 2012) 105 “Ammunition and Explosives” is defined as “liquid and solid propellants and explosives, pyrotechnics, 

incendiaries and smokes in the following forms: (i) Bulk; (ii) Ammunition; (iii) Rockets; (iv) Missiles; (v) 

Warheads; (vi) Devices; and (vii) Components of (i) through (vi), except for wholly inert items.” 48 CFR §252.223-

7002, Safety Precautions for Ammunition and Explosives (May 1994). 

106 48 CFR §223.370-1(a) (May 29, 2012). 

000236
DEI Final Investigation Report January 2013

54

contracting officers to incorporate DoD Manual 4145.26M, DoD Contractor’s Safety Manual For

Ammunition and Explosives (DoD Safety Manual),107 into all contracts under which AE are handled (AE 

procurement actions).108

The DoD Safety Manual provides safety requirements, guidance, and information to minimize potential 

accidents that “could interrupt DoD operations, delay DoD contract production, damage DoD property, 

cause injury to DoD personnel, or endanger the public during DoD contract work or services involving 

AE.”

 

109

For example, Section C1.5 requires that DoD safety personnel conduct pre-award safety surveys to 

evaluate each potential contractor’s ability to comply with contract safety requirements. A potential 

contractor must provide the CO with any site plans; its safety and fire prevention programs; descriptions 

of proposed facilities; its safety history; proposed operations and equipment (including a process flow 

narrative/diagram, proposed hazard analysis and proposed procedures for all phases of AE operations); 

and information on any subcontractor the contractor plans to utilize to perform AE work.

 These requirements apply to DoD contractors and subcontractors handling AE and provide 

additional contractor selection and safety oversight information. 

110

Under Section C1.6, DoD has the authority to conduct an additional “pre-operational survey” under 

certain circumstances, such as when a contract has been awarded to a contractor with “limited 

experience,” or following a “major modification,” both of which were significant factors in the DEI 

incident.

 The policy 

states that DoD safety personnel will then assess whether the prospective contractor has sufficient 

programs in place before awarding an AE contract. 

111

Section C1.7 states that, post-award, a contractor must comply with all requirements of the DoD Safety 

Manual in addition to following all applicable local, state, and federal codes, standards, and regulations. 

The contractor also must implement a demonstrable safety program to prevent AE-related accidents, 

designate qualified individuals to administer the safety program, and prepare and keep available for 

review all hazard analyses.112

Chapter 3 provides general safety requirements for all AE operations addressed within the manual. They 

reflect the “cardinal principle of AE safety,” which is to “limit exposure to a minimum number of 

personnel, for a minimum amount of time, to the minimum amount of the hazardous material consistent 

with safe and efficient operations.”113 It includes minimum requirements for 1) SOPs; 2) training and 

housekeeping; 3) controlling and monitoring subcontractors, including the method the contractor uses to 

determine whether subcontractors are qualified to perform work safely; 114

 

107 DoD Contractor’s Safety Manual for Ammunition and Explosives. DoD 4145.26-M. (March 13, 2008). 

 and 4) handling and storing 

108 48 CFR §223.370-3(b) (2012). 

109 DoD 4145.26-M Section C1.1. Purpose. (March 13, 2008). 110 DoD 4145.26-M Section C1.5. Pre-Award Safety Survey. (March 13, 2008). 111 DoD 4145.26-M Section C1.6. Pre-Operational Safety Survey. (March 13, 2008). 112 DoD 4145.26-M Section C1.7. Post-Award Contractor Responsibilities. (March 13, 2008). 113 DoD 4145.26-M Section C3.2.1. Personnel and Material Limits. (March 13, 2008). 114 DoD 4145.25-M Section C3.3.5. Control and Monitoring. (March 13, 2008). 

000237
DEI Final Investigation Report January 2013

55

explosives waste in operating areas (including a requirement that black powder must be stored in 

containers with water).115

Chapter 11, which includes a sample matrix used for guidance,

 

116 requires that all contractors have a risk 

identification and management system and perform a hazard analysis that evaluates processes, materials, 

equipment, and personnel hazards.117 (Appendix B includes excerpts from the DoD Safety Manual). 

As discussed in Section 6.3, VSE’s selection and oversight of DEI as a subcontractor as well as DEI’s 

fireworks disposal process reflect a lack of safety focus throughout the entire contracting process. All 

parties involved would have greatly benefited from contract safety provisions similar to those found in the 

DoD Safety Manual, including those that required pre- and post-award safety surveys of subcontractors, 

the creation and review of risk assessments and hazard analyses, the implementation of a safety program, 

and provisions that emphasize the importance of minimizing hazards. 

6.3 Subcontractor Selection

6.3.1 VSE Procurement Selection Methodology for Subcontractors 

VSE procurement personnel assigned to work under the TEOAF prime and interim contracts have varied

training and technical backgrounds and are responsible for subcontracting to vendors to manage a wide 

array of projects. While explosives and hazardous materials are periodically seized and must be 

managed, VSE procurement personnel responsible for selecting and overseeing vendors to conduct these 

activities, including storage and disposal, lacked the requisite backgrounds or expertise necessary to 

understand the risks of managing this type of property – nor does VSE employ or consult with experts to 

assist in selecting vendors capable of properly managing hazardous and explosive materials. 

6.3.1.1 Initial Solicitation

In early 2010, VSE procurement personnel assigned to work under the TEOAF federal prime contract 

began the task of securing a vendor to dispose of the contraband fireworks that CBP and ICE/HSI had 

seized in Honolulu. Based on initial market research, on February 16, 2010, VSE sent a request for a 

firm-fixed-price118 quotation119

 

115 DoD 4145.25-M Section 3.6. Explosives Waste in Operating Areas. (March 13, 2008). 

 to five vendors, including DEI. VSE requested a quote from DEI for one 

116 DoD 4145.25-M Section C11.2.2.2 and Table C11.T1. (March 13, 2008). 117 DoD 4145.25-M Chapter 11. Risk Identification and Management. (March 13, 2008). 118 According to FAR Subpart 16.202-1, “[a] firm-fixed-price contract provides for a price that is not subject to any 

adjustment on the basis of the contractor’s cost experience in performing the contract. This contract type places 

upon the contractor maximum risk and full responsibility for all costs and resulting profit or loss. It provides 

maximum incentive for the contractor to control costs and perform effectively and imposes a minimum 

administrative burden upon the contracting parties...” 

119 VSE required a firm-fixed-price bid to dispose of the contraband fireworks because VSE procurement personnel 

understood that the terms of the federal prime contract required a firm-fixed-price for all purchase orders. The CSB 

learned that VSE understood that firm fixed price contracts are best suited for situations where the subcontractors’ 

000238
DEI Final Investigation Report January 2013

56

main reason: DEI was already storing the fireworks through a separate subcontract with VSE, and VSE 

had a stated preference for a “one-stop shopping” subcontractor. Two solicited suppliers, DEI and 

Liberty Disposal (Liberty), a fireworks disposal company in Michigan,

120 responded with firm fixed-price 

quotations. DEI’s quotation estimated a total of 400 hours of labor and projected a cost of $157,579.73 

for disposal of 40 pallets of fireworks. According to DEI management, the price was based on 

assumptions that certain facilities, such as Koko Head, could be used for burning and that the timelines 

they provided were accurate. The quotation did not detail how DEI would dispose of the fireworks or 

include possible permitting requirements. The CSB has found no evidence that VSE procurement 

personnel discussed these matters with DEI when analyzing the quotation. 

Liberty, which provided a more detailed quotation to VSE that explained how the company would 

dispose of the fireworks (via incineration in Ohio) and what permitting would be necessary, estimated its 

total to be $268,372.56. 

6.3.1.2 Subcontractor Selection – Determining Responsibility

Once VSE procurement specialists received the two price quotations from DEI and Liberty they began 

their analysis by researching both companies on the Central Contractor Registration121 (CCR) website to 

ensure that neither was on the excluded parties list, and then compared each company’s Small Business 

Administration122

VSE procurement analysis found DEI’s proposal to be the lowest-cost and most time-efficient, and 

therefore determined it to be the best overall value for the government. According to VSE, this, along 

with the fact that DEI was a local company already storing the fireworks, led VSE procurement to select 

DEI as the subcontractor. VSE procurement’s lack of health and safety focus during the procurement 

process resulted in a flawed responsibility determination and the award of the subcontract to DEI on 

March 17, 2010. 

(SBA) profile. VSE procurement specialists also perused company websites to get an 

idea of the type of work each vendor did. No additional analysis was done to determine prior work 

history, proposed disposal methodology, or the vendor’s technical skills to safely and responsibly dispose 

of explosives. VSE procurement personnel also failed to discover if DEI had prior fireworks disposal 

experience; instead, VSE procurement personnel told the CSB that because they were not the subject 

matter experts, they deferred to DEI as the expert based on the company’s website and what DEI said its 

capabilities were. 

 

scope of work is fully understood. The protocols associated with seized property do not allow a subcontractor 

bidding on the seized fireworks disposal subcontract to open boxes containing the fireworks and verify their 

contents to help in their cost estimation process. 

120 http://libertydisposalinc.com (accessed July 6, 2012). 121 The Central Contractor Registration (CCR) is the primary vendor database for the U.S. Federal Government. It 

collects, validates, stores and disseminates data in support of agency acquisition mission. Government vendors are 

required to register in CCR in order to be awarded contracts by the government. 

http://www.osdbu.dot.gov/related/ccr.cfm (accessed September 27, 2012) 122 The Small Business Administration (SBA) provides financing, contracts, counseling sessions and other forms of 

assistance to small businesses, http://www.sba.gov/about (accessed September 27, 2012). Both DEI and Liberty are 

SBA certified. 

000239
DEI Final Investigation Report January 2013

57

6.4 Fireworks Disposal Subcontract Provisions

The lack of safety focus is also apparent when reviewing the context of the fireworks disposal subcontract 

itself. The subcontract awarded to DEI contained a Statement of Work (SOW) and a Subcontractor 

Property Management Handbook (Property Management Handbook); both were generic, related to the 

management of general property, and did not address hazards associated with handling or disposing of 

explosive hazardous materials, including fireworks. 

The SOW’s stated intent was to “facilitate the transportation, storage, and destruction of seized general 

property as well as hazardous waste materials in Hawaii.” Its objectives were “General Property 

Management Services in accordance with the Property Management Handbook” and “destruction of 

property via the use of a hazardous waste landfill or landfill.” Under “description of work” the SOW 

stated that the vendor must “have the capacity to transport, store, and destroy general property as well as 

hazardous waste materials...must locate a facility that is a fully-regulated hazardous waste land fill or a 

land fill...dispose of property in accordance with all federal, state, and local laws, codes, ordinances, and 

regulations...[and that] a waste-to-energy facility [was] preferable...” Nothing within this SOW provided 

any technical detail of DEI’s proposed fireworks disposal methodology or the risks involved. When 

asked about the general language contained within the SOW, VSE procurement personnel told the CSB 

that this was a standard language SOW except for specifics that had been inserted such as the state where 

the work was being conducted. These individuals told the CSB this was because the person writing the 

SOW was unfamiliar in terms of what to include specific to fireworks disposal, as that person did not 

understand the process. 

The Property Management Handbook included guidance on a seizure’s life cycle, property collection, 

chain of custody, property manipulation, property transportation, property storage, and property removal 

from storage. However, the language and instructions related to seized general property; explosives, 

fireworks, or other hazardous materials, or the risks of working with such items, were not discussed. 

6.5 Subcontractor Oversight

6.5.1 Initial DEI Fireworks Disposal Plan

After DEI was awarded the fireworks disposal subcontract, DEI submitted a fireworks disposal plan to 

VSE for review and approval. DEI management personnel developed the fireworks disposal plan and told 

the CSB that, as they could find no guidance regarding fireworks disposal, they relied solely on military 

manuals and on-the-job military EOD training and experience to develop the initial disposal 

methodology. The CSB has been unable to verify the use of those military manuals. 

Post-award, the VSE Regional Office in California (Regional Office) became the main VSE day-to-day 

contact for DEI. While this office received DEI’s daily activity reports (DARs) and maintained contact 

with DEI management, CBP, and the BAI representative in Hawaii, its personnel lacked necessary 

expertise or training to understand the risks associated with handling and disposing of explosives, 

000240
DEI Final Investigation Report January 2013

58

including fireworks. Regional Office Personnel also indicated to the CSB that they did not understand the 

kind of permitting DEI required to conduct its disposal work and why such permitting was needed. 

The initial DEI fireworks disposal plan, “DEI Disposal of Commercial Grade Fireworks Plan,” (disposal 

plan) detailed DEI’s intended disposal methodology and was written for the “VSE Regional Office and 

those who will need to oversee the destruction of the commercial grade fireworks via services provide[d] 

by DEI.” The disposal plan provided for DEI to carry out a series of burn operations using a DEI portable 

incinerator (TFU) that was capable of holding 40 to 50 pounds of fireworks. DEI noted the following 

steps in its plan: 

1. DEI would ask the VSE Regional Office to reserve the Koko Head range at least two weeks 

before the actual burn operation, 

2. DEI would pre-soak fireworks in diesel fuel for a minimum of 48 hours to ensure “complete 

desensitization,” 

3. Desensitized fireworks would be loaded into 55-gallon steel drums and transported to Koko 

Head, 

4. The TFU would be ignited and preheated for 15 to 20 minutes, 

5. The pre-soaked fireworks would be fed down a chute one at a time, 

6. Photos would be taken and provided to the VSE Regional Office upon request, and 

7. DEI personnel would sign and date CBP Form 7605 block 8123 and submit to the VSE 

Regional Office.

The Regional Office used the information to create a VSE Property Destruction Plan for submission to 

VSE Risk Management for review and approval. The Property Destruction Plan mischaracterized DEI’s 

initial disposal plan by stating that the diesel fuel would “neutralize” rather than “desensitize” the 

fireworks.

124 As noted, diesel is used to desensitize explosives to spark, friction, impact, and temperature, 

and should result in a slow burn. The explosives are not “neutralized,” and no chemical changes occur 

when diesel is added. The plan also indicated that a BAI field representative would be present to 

“oversee destruction.” However, the CSB later learned that the BAI field representative lacked the 

expertise to oversee DEI’s practices, and VSE had ultimately approved DEI’s conduct of the work 

without BAI’s daily oversight. In short, this plan overstated the safeguards in place to ensure that

disposal was being done safely. VSE Risk Management approved the Property Destruction Plan on April 

28, 2010. 

6.5.2 Property Destruction Plan Review and Approval 

The VSE Risk Management analyst who reviewed the Property Destruction Plan lacked the expertise or 

relevant training to adequately assess a plan for fireworks disposal. After receiving the plan, this analyst 

told the CSB that he first reviewed the very brief disposal methodology consisting of a few lines, which 

 

123 Certification of Destruction. 124 As noted, diesel is used to desensitize explosives to spark, friction, impact, and temperature and should result in a 

slow burn. 

000241
DEI Final Investigation Report January 2013

59

described soaking the fireworks in diesel fuel to “neutralize” them and then destroying them by 

incineration. The analyst told the CSB that he deferred to DEI’s expertise when reviewing this section 

because of his lack of knowledge about fireworks, and he conducted no further research on DEI’s 

proposed methodology. Section IV of the Property Destruction Plan required the analyst to check either 

“Yes” or “No” for whether DEI was qualified to destroy the fireworks. Because VSE’s Procurement 

Office had already assessed DEI’s qualifications and selected DEI as the subcontractor, the Risk 

Management analyst checked “Yes” without researching DEI’s qualifications, experience, or proposed 

methodology. The analyst did search for adverse events involving DEI in VSE’s adverse incidents 

database and, finding no such history, approved and returned the Plan to the Regional Office. 

6.5.3 VSE Regional Office

The approach taken by the VSE Regional Office echoed the stated position adopted throughout VSE: 

company personnel lacked expertise in handling fireworks or other explosives and hazardous materials 

and therefore deferred to DEI as the “expert” on fireworks disposal. The decisions on which VSE 

deferred to DEI included DEI’s two deviations from the original fireworks disposal plan to begin 

disassembling the fireworks by hand. Regional Office staff confirmed to the CSB that when DEI 

significantly altered its disposal methodology in March 2011, VSE was simply informed in a notification 

email. However, VSE Regional Office personnel would not have recognized the hazards associated with 

disassembling fireworks and accumulating boxes of explosive components. Because VSE trusted that 

DEI was an expert that would recognize and address any risks involved, VSE did not question any 

changes or express concern. 

6.5.4 BAI 

As discussed, VSE relied on BAI field representatives to provide field services such as property 

inspections and storage on an as-needed basis. A BAI representative in Hawaii came to the magazine

occasionally and served as VSE’s observer during DEI’s disposal process. He also took photos of the 

disassembly process (Figures 5 and 6). The subcontract between VSE and BAI did not require the BAI 

representative to oversee safety, which the representative could not have done effectively because he had 

no experience with fireworks and explosives and therefore would be unable to offer any valuable insight. 

The CSB concurs with ATF’s conclusion that the BAI field representative did witness some disposal 

work where unsafe practices would have been apparent to observers with expertise in explosive disposal 

operations. 

6.6 Conclusion

Neither VSE nor BAI used personnel with the necessary backgrounds and expertise to recognize the 

hazards associated with DEI’s fireworks disposal work. All deferred to DEI as the “expert” regarding 

fireworks disposal and were unaware of the hazards of disassembling the fireworks by hand, 

accumulating explosive materials in cardboard boxes, and storing them in a magazine along with potential 

spark- and static-producing items. 

000242
DEI Final Investigation Report January 2013

60

To improve the subcontractor selection and oversight process under the TEOAF seized property 

management contract, government acquisition regulations must emphasize safety system management. 

The FAR should be strengthened to require the analysis of safety performance measures and 

qualifications when determining the “responsibility” of prospective contractors and subcontractors 

handling explosive and hazardous materials. Federal agencies such as Treasury, that require contractors 

and subcontractors to deal with explosives and other hazardous materials, should adopt and implement 

stringent safety-related contractor and subcontractor selection and oversight provisions similar to those 

found within the DFARS. In addition, entities tasked with implementing safety-related contracting 

requirements must have the personnel or consultants in place with the necessary technical expertise to 

sufficiently evaluate and oversee contractors and subcontractors to ensure the work is being conducted 

safely. 

000243
DEI Final Investigation Report January 2013

61

7.0 Regulatory and Industry Standards Analysis

Within Hawaii, ATF, HIOSH, and the State of Hawaii Department of Health (DOH) all have regulatory 

oversight over various aspects of fireworks manufacturing, storage, handling, and disposal. National Fire 

Protection Association (NFPA) industry standards also include good practices pertaining to fireworks 

manufacturing and storage. However, the CSB found a significant gap with regulatory and industry 

standards pertaining to the safe disposal of fireworks in the U.S.

7.1 Hawaii Occupational Safety and Health Division

7.1.1 Jurisdiction

Hawaii is one of 26 jurisdictions OSHA approved to operate its own state safety and health program 

under the Occupational Safety and Health Act (OSH Act) Section 18(b).125 HIOSH administers Hawaii’s 

OSHA State Plan Program and has adopted Federal OSHA standards in their entirety, contained within 

the Hawaii Administrative Rules (HAR). 

OSHA’s Explosives Standard, 29 CFR §1910.109,126 and HAR Title 12, Subtitle 8, Part 2 (General 

Industry Standards) cover the storage and handling requirements of explosives and pyrotechnics. 

However, Section 4(b)(1) of the OSH Act precludes OSHA from any enforcement activity over a working 

condition if another federal agency exercises its statutory authority.

127 In this case, HIOSH’s authority to 

regulate most manufacturing, distribution, handling, and storage of fireworks in Hawaii, including DEI’s 

activities, would be preempted should ATF have chosen to exercise its statutory authority under ATF’s 

Federal Explosives Law and Regulations, found at 18 U.S.C. Chapter 40 and 27 CFR Part 555.128 

OSHA Directive Number CPL 02-01-053, Compliance Policy for Manufacture, Storage, Sale, Handling, 

Use and Display of Pyrotechnics,

129 clarifies situations in which OSHA may issue citations for hazards 

related to fireworks and conditions during which the OSH Act General Duty Clause can be applied to 

address hazards not specifically covered by OSHA standards.130

 

125 29 U.S.C. §667 (1970). 

 Because ATF’s regulations in 27 CFR 

Part 555 specifically address working conditions associated with storing explosives, including 

commercial 1.3G UN0335 display fireworks, they preempt OSHA’s storage requirements for explosives 

in §1910.109(c). However, storing 1.4G UN0336 consumer fireworks in their finished state falls under 

126 29 CFR §1910.109, Explosives and Blasting Agents (1998). 127 29 U.S.C. §653 (1970). 128 Organized Crime Control Act of 1970, Title XI, Chapter 40. Importation, Manufacture, Distribution and Storage 

of Explosive Materials. (October 22, 1986). 27 CFR Part 555, Commerce in Explosives (2007). 

129 CPL 02-01-053, Policy for Manufacture, Storage, Sale, Handling, Use and Display of Pyrotechnics (October 27, 

2011).

130 CPL 02-01-053, Executive Summary (Oct. 27, 2011). 

000244
DEI Final Investigation Report January 2013

62

OSHA’s and HIOSH’s authority.131 Hazards such as ignition sources, including static electricity hazards 

associated with storage and handling of explosive materials not covered by ATF, may also be cited under 

§1910.109(b)(1) and correlating HAR standards.132

7.1.2 HIOSH Investigation of the Incident

On September 30, 2011, HIOSH announced that it had completed its investigation of the DEI incident. 

HIOSH identified 11 potential causes for the explosion, each of which carries a separate penalty. HIOSH 

issued four serious, seven willful, and one other citation against DEI, alleging DEI’s serious violation of 

29 CFR §1910.36(b)(2)133 and HAR §12-71.1 by blocking the magazine’s only exit; willful violation of 

HAR §12-61-2(a)(3) that exposed employees to explosion hazards (the presence of sources of static 

electricity as potential ignition sources) while they worked with explosive materials; willful violation of 

29 CFR §1910.109(b)(1) and HAR §12-74.1 by separating pyrotechnic materials in close proximity to 

other explosives, storing ferrous134 tools inside the magazine, and permitting spark-producing devices 

near the magazine; and willful violation of 29 CFR §1910.132(d)(1)(i)135 and HAR §12-64.1 for the lack 

of appropriate PPE. 

As discussed in Section 5.1, because DEI’s disassembly activities were under the umbrella of disposal 

rather than manufacturing, HIOSH was unable to cite DEI for PSM-related violations. In addition, while 

HIOSH did cite DEI for various alleged health and safety violations, no OSHA or HIOSH guidance 

specifically relates to fireworks disposal.

7.2 ATF

As discussed above, 27 CFR Part 555, Commerce in Explosives, regulates the importation, 

manufacturing, distribution, and storage of explosive materials, including commercial display 1.3G 

UN0335 fireworks. Under Subpart D, anyone intending to import, manufacture, or deal in explosive 

materials must obtain an ATF license.136 However, a separate license is not required for storage facilities 

operated by the licensee as an integral part of one business premises.137

 

131 CPL 02-01-053 Section B(2), Enforcement of 29 CFR §1910.109 (Oct. 27, 2011). 

 Because DEI had a 

132 CPL 02-01-053 Section B(3), Enforcement of 29 CFR §1910.109 (Oct. 27, 2011). 13329 CFR §1910.36(b)(2) states “[m]ore than two exit routes must be available in a workplace if the number of 

employees, the size of the building, its occupancy, or the arrangement of the workplace is such that all employees 

would not be able to evacuate safely during an emergency.” 29 CFR §1910.36(b)(2). The number of exit routes 

must be adequate (Nov. 7, 2002). 

134 Of or containing iron. 135 29 CFR §1910.132(d)(1) states that an employer must “assess the workplace to determine if hazards are present, 

or are likely to be present, which necessitate the use of personal protective equipment (PPE). If such hazards are 

present, or likely to be present, the employer shall... (i) Select, and have each affected employee use, the types of 

PPE that will protect the affected employee from the hazards identified in the hazard assessment...” 29 CFR 

§1910.132(d)(1)(i) (June 8, 2011). 136 27 CFR §555.41(a)(1) (2005). 137 27 CFR §555.41(a)(2)(i) (2005). 

000245
DEI Final Investigation Report January 2013

63

manufacturing license from ATF as a result of its UXO activities, its personnel were approved to store the 

three fireworks seizures in the A-21 magazine without ATF inspection. At the time of the incident, no 

ATF staff had inspected the magazine although, according to DEI management, a day and time were 

being set up for this; the goal was to have it classified under ATF regulations as a Type 1 magazine,

138

which is authorized under ATF regulations to store high explosives.139

ATF storage regulations include requirements for storage within Types 1, 2, 3, and 4 magazines. These 

regulations state that explosive materials cannot be placed directly against interior walls and, except for 

fiberboard or other nonmetal containers, containers of explosive materials cannot be unpacked or 

repacked inside a magazine or within 50 feet of a magazine.140 Tools used to open containers of 

explosives must be of non-sparking materials, except that metal slitters can be used to open fiberboard 

containers.141 Magazines are required to be kept clean and dry; free of grit, paper, empty packages, trash, 

and containers; and floors are to be regularly swept with brooms or other items with non-sparking parts. 

Volatile materials are required to be kept at least 50 feet from outdoor magazines.142 ATF regulations do 

not provide guidance on fireworks disposal or disassembly activities. 

7.3 Regulation of Hazardous Waste

7.3.1 Resource Conservation and Recovery Act

The Resource Conservation and Recovery Act (RCRA) is a federal law that regulates non-hazardous and 

hazardous solid waste. RCRA Subtitle C implements the Hazardous Waste Permit Program, which 

regulates the generation, handling, transportation, storage, and disposal of hazardous waste from cradle to 

grave. RCRA requires a permit143 for the treatment,144 storage,145 and disposal146 of any hazardous waste 

as identified or listed in 40 CFR Part 261.147

 

138 27 CFR §555.203(a). (1981). 

139 “High Explosives” are explosive materials which can be caused to detonate by means of a blasting cap when 

unconfined.” 27 CFR §555.2-2(a) (1998). 140 27 CFR §555.214 (a) and (c) (1981). 141 27 CFR §555.214 (d) (1981). 142 27 CFR §555. 215 (1981). 143 A permit includes a permit by rule (270.60), emergency permit (270.61), and standardized permit (subpart J of 

this part). 40 CFR §270.2 (2006). 144 Treatment means “any method, technique, or process, including neutralization, designed to change the physical, 

chemical, or biological character or composition of any hazardous waste so as to neutralize such wastes, or so as to 

recover energy or material resources from the waste, or so as to render such waste non-hazardous, or less hazardous; 

safer to transport, store, or dispose of; or amenable for recovery, amenable for storage, or reduced in volume.” 

40 CFR §270.2 (2006). 145 Storage means “the holding of hazardous waste for a temporary period, at the end of which the hazardous waste 

is treated, disposed, or stored elsewhere.” 40 CFR §270.2 (2006). 146 Disposal means “the discharge, deposit, injection, dumping, spilling, leaking, or placing of any hazardous waste 

into or on any land or water so that such hazardous waste or any constituent thereof may enter the environment or be 

emitted into the air or discharged into any waters, including ground water.” 40 CFR §270.2 (2006). 147 40 CFR §270.1(c) (2006). 

000246
DEI Final Investigation Report January 2013

64

Under RCRA, no material is a hazardous waste unless it is first deemed a solid waste.148 RCRA places 

hazardous waste into two categories: 1) listed wastes, which appear on one of the four hazardous waste 

lists established by regulations;149 or 2) characteristic wastes, which exhibit one or more of four features: 

ignitability;150 corrosivity;151 reactivity;152 and/or toxicity.153 Confiscated, seized, or forfeited fireworks 

(when a solid waste) are considered regulated hazardous waste under RCRA because they are ignitable,154

reactive,

155 and potentially toxic solid wastes.156 

Standard RCRA operating permit applications include two parts (A and B)157 and are comprehensive. 

Permit application requirements include a description of the facility and procedures, structures, or 

equipment used at the facility to prevent hazards in unloading operations, and to prevent undue exposure 

to hazardous waste (for example, protective clothing);158 a description of precautions to prevent accidental 

ignition or reaction of ignitable, reactive, or incompatible wastes as required to demonstrate compliance 

with 40 CFR §264.17;159 and an outline of training programs by owners or operators to prepare workers 

to operate in a safe manner.160 RCRA permit applicants must also comply with the facility standards in 

40 CFR Part 264, including personnel training requirements161

 

148 “Solid waste” is defined under 40 CFR §261.2 as a “discarded material which is A) Abandoned...or; B) 

Recycled...; or C) Considered inherently waste-like...; or D) A military munition...” 40 CFR §261.2 (2010). 

“Hazardous waste” is defined under 40 CFR §261.3 as a solid waste that exhibits any of the characteristics of 

hazardous waste identified in subpart C or that is listed in subpart D of this part. 40 CFR §261.3 (2006). 

 and requirements for handling ignitable, 

149 40 CFR §261.31-33 (2011). 150 40 CFR §261.21 (2011). 151 40 CFR §261.22 (2011). 152 40 CFR §261.23 (2011). 153 40 CFR §261.24 (2011). 154 Characteristic of ignitability: “(a) A solid waste exhibits the characteristic of ignitability if a representative 

sample of the waste has any of the following properties: (2) It is not a liquid and is capable, under standard 

temperature and pressure, of causing fire through friction, absorption of moisture or spontaneous chemical changes 

and, when ignited, burns so vigorously and persistently that it creates a hazard...” 40 CFR §261.21(a)(2) (2011). 

155 Characteristic of reactivity: “(a) A solid waste exhibits the characteristic of reactivity if a representative sample 

of the waste has any of the following properties: (1) It is normally unstable and readily undergoes violent change 

without detonating. (2) It reacts violently with water. (3) It forms potentially explosive mixtures with water. (6) It is 

capable of detonation or explosive reaction if it is subjected to a strong initiating source or if heated under 

confinement. (7) It is readily capable of detonation or explosive decomposition or reaction at standard temperature 

and pressure. (8) It is...a Division 1.1, 1.2, or 1.3 explosive as defined in 49 CFR §§ 173.50 and 173.53.” 40 CFR 

§261.23(a) (2011). 

156 Toxicity characteristic: “(a) A solid waste...exhibits the characteristic of toxicity if, using the Toxicity 

Characteristic Leaching Procedure, test Method 1311 in ‘Test Methods for Evaluating Solid Waste, 

Physical/Chemical Methods’...the extract from a representative sample of the waste contains any of the 

contaminants listed in table 1 at the concentration equal to or greater than the respective value given in that table.” 

40 CFR §261.24(a) (2011). 157 RCRA application Part A and Part B requirements are contained within 40 CFR §§270.13 and 270.14, 

respectively.

158 40 CFR §270.14(b)(8)(v) (1983).

159 40 CFR 270.14(b)(9) (1983). 160 40 CFR §270.14(b)(12) (1983). 161 40 CFR §264.16 (2006).

000247
DEI Final Investigation Report January 2013

65

reactive, or incompatible wastes.162 RCRA permits are effective for a fixed term not to exceed 10 

years.163 

Under 40 CFR §270.61,164 persons or facilities seeking to engage in hazardous waste treatment, storage, 

or disposal activities may obtain an emergency hazardous waste permit if the waste is determined to be an 

“imminent and substantial endangerment to human health or the environment.”165 Emergency permits 

may be oral or written and are effective for 90 days once issued.166 They are significantly less detailed 

and robust than traditional RCRA permits and require substantially less work on the part of the applicant 

and the permit writer. Throughout the U.S., seized fireworks are sometimes disposed of pursuant to 

these emergency permits due to the hazardous characteristics of firework components.

Although not applicable to this incident, RCRA regulations also have a complete exemption from all 

permits, including emergency permits, for all qualified responders to “an immediate threat to human 

health, public safety, property, or the environment, from the known or suspected presence of military 

munitions, other explosive material, or an explosive device, as determined by an explosive or munitions 

emergency response specialist as defined in 40 CFR §260.10.”167

7.3.2 State of Hawaii Department of Health (DOH)

DOH is Hawaii’s state environmental agency, and implements federal environmental regulations that 

have been adopted under the HAR, including RCRA regulations. As such, DOH has the authority under 

40 CFR §270.61 and HAR §11-270-61(a) to issue emergency hazardous waste permits to RCRA and nonRCRA permitted persons or facilities. According to DOH policy, DOH views “illegal fireworks as 

hazardous wastes that exhibit an unusual risk to the public and the environment”168 and therefore issues 

emergency permits to those who wish to treat or dispose of contraband fireworks.

As discussed in Section 3.4, DOH issued DEI an emergency hazardous waste disposal permit on June 8, 

2010, for fireworks disposal activities. 40 CFR §270.61(b)(3) requires that the emergency permit “clearly 

specify the hazardous wastes to be received, and the manner and location of their treatment, storage, or 

disposal.” According to DOH policy, the specific conditions authorized in an emergency permit depend 

on analysis of facts provided by the applicant. However, the policy also provides that DOH‘s “basic 

 

162 40 CFR §264.17 states that an owner or operator must take precautions to prevent accidental ignition or reaction 

of ignitable or reactive waste. This waste must be separated and protected from sources of ignition or reaction, 

including but not limited to open flames, smoking, cutting and welding, hot surfaces, frictional heat, sparks (static, 

electrical, or mechanical), spontaneous ignition (e.g., from heat-producing chemical reactions), and radiant heat. 

(2006). 163 40 CFR §270.50 (1985). 164 40 CFR §270.61 (1996). 165 40 CFR §270.61 (1996). 166 40 CFR §270.61 (b)(1) and (2) (1996). 167 40 CFR §§264.1(g)(8)(i)(D) (2006) and 40 CFR 270.1(c)(3)(i)(D) (1997). 168 State of Hawaii Department of Health, Environmental Management Division, Solid and Hazardous Waste 

Branch. Temporary Emergency Permits to Treat, Store or Dispose of Hazardous Waste, November 29, 2010. 

http://hawaii.gov/health/environmental/waste/hw/pdf/tempemergpermit.pdf (accessed July 10, 2012).

000248
DEI Final Investigation Report January 2013

66

template for TEP [temporary emergency permit] conditions is designed with the temporary, emergency 

nature of the situation in mind and under no circumstances should it be overly burdensome on the 

permittee.”169 

The emergency hazardous waste disposal permit that DOH issued to DEI required that DEI complete the 

disposal within 90 days of the date issued. DOH instructed DEI via email that no extensions would be 

provided. This time limit proved to play a significant role in the incident, as DEI’s first disposal job 

exceeded the 90-day time limit, and emails written by DEI management in fall 2010 indicated that for all 

future fireworks disposal jobs, DEI would disassemble the firework tubes prior to obtaining a permit in 

order to maximize the available time for burning. These efficiency improvements resulted in the 

accumulation of large quantities of explosive firework components, which created a mass explosion 

hazard. 

In its permit application letter, DEI stated it intended to destroy approximately 5,000 pounds of illegal 

“Class 1.3 and 1.4 fireworks” including “firecrackers, poppers, sparklers, and aerials,” through burning 

activities at Koko Head. Emails show that DOH requested DEI’s fireworks disposal plan, which detailed 

diesel soaking and burning activities, prior to awarding the permit. However, DOH wrote the permit to 

include only the burn activities. The CSB has found no evidence that DOH personnel conducted 

additional analysis to better understand DEI’s disposal plan. In fact, evidence suggests that safety was not 

a factor in DOH’s review process, and DOH personnel told the CSB that their focus was on 

environmental protection, not safety. In addition, DOH personnel lacked the requisite background to 

analyze DEI’s proposed disposal methodology, experience, and qualifications when issuing this permit. 

Safety is an important aspect of hazardous waste disposal; the legislative history supports the argument 

that RCRA is intended to address environmental implications of hazardous waste treatment and disposal

and also those of health and safety. In fact, RCRA was created in part to provide “for the safe disposal of 

discarded materials...”170 (Emphasis added). Congress also noted in enacting RCRA that “disposal of 

solid waste and hazardous waste in or on the land without careful planning and management can present a 

danger to human health and the environment...”171 

RCRA regulations also support the consideration of safety. For example, 40 CFR §264.17 requires that 

an owner or operator take precautions to prevent accidental ignition or reaction of ignitable or reactive 

waste. In addition, 40 CFR §264.16 requires that facility personnel complete classroom or on-the-job 

hazardous waste training that at a minimum ensures they are able to respond effectively to 

emergencies.172

 

169 State of Hawaii Department of Health, Environmental Management Division, Solid and Hazardous Waste 

Branch. Temporary Emergency Permits to Treat, Store or Dispose of Hazardous Waste, November 29, 2010. 

 These regulations illustrate that RCRA and comparable state regulations, such as the 

HAR, can and should address environmental protection as well as the safety and health of workers and the 

public. This is especially important for the emergency permitting process, which requires a much less 

http://hawaii.gov/health/environmental/waste/hw/pdf/tempemergpermit.pdf (accessed July 10, 2012). 170 A Legislative History of the Solid Waste Disposal Act. Pub. L. no. 94-580, 90 Stat 2795 (1976). 171 A Legislative History of the Solid Waste Disposal Act. Pub. L. no. 94-580, 90 Stat 2797 (1976). 172 40 CFR §264.16 (2006). 

000249
DEI Final Investigation Report January 2013

67

substantial review of permit applicants even though the materials involved are extremely hazardous and 

pose an imminent safety, health, and environmental threat. 

To reflect the importance of public and worker safety, an emergency permit applicant seeking to dispose 

of explosive hazardous materials such as fireworks should be reviewed extensively. RCRA should 

incorporate PSM-type elements such as PHA and MOC into its regulations to provide for a more robust 

safety program for entities conducting activities that are not covered by OSHA’s PSM standard, such as 

fireworks disposal. Increasing the focus on safety will help ensure that activities being performed 

pursuant to a RCRA emergency hazardous waste permit are done so safely and responsibly. 

7.4 Industry Standards

7.4.1 National Fire Protection Association

The NFPA works to prevent fire-related hazards and advocates for public safety by developing, 

publishing, and disseminating good practice standards intended to minimize risks. This includes 

fireworks and explosives-related standards, which are developed by NFPA’s Pyrotechnics Committee. 

However, NFPA has no standard or guidance for the safe disposal of fireworks. NFPA standards are 

voluntary unless adopted by federal, state, or local agencies as part of regulations.

7.4.1.1 NFPA 495

NFPA 495, Explosive Materials Code, covers the manufacture, transportation, storage, sale, and use of 

explosive materials and emphasizes the importance of training for persons handling explosive materials 

and developing a hazards analysis for processes involving manufacturing, movement, storage, testing, or 

developing energetic materials.173 However, this standard does not apply to any type of fireworks.174

7.4.1.2 NFPA 1123

NFPA 1123, Code for Fireworks Display, applies to constructing, handling, and using fireworks and 

equipment intended for outdoor fireworks display and operation of the display.175 This standard provides 

for the flooding of a fireworks mortar shell with water within 15 minutes if the firework fails to fire.176

 

173 NFPA 495. Explosive Materials Code. 2010 ed. 

 

The standard also states that any storage, handling, assembly, testing, or transportation of fireworks 

materials and devices intended for outdoor display – prior to their delivery to the display site – must 

comply with NFPA 1124, 18 U.S.C. Chapter 40; and 27 CFR Part 55. For fireworks disposal, Section 

8.2.10.2 states that suppliers will provide disposal instructions and those instructions will be followed. 

174 NFPA 495, Section 1.3.4. 175 NFPA 1123. Code for Fireworks Display. 2010 ed.; Section 1.1.1. 176 NFPA 1123, Section 8.2.10.1.1. 

000250
DEI Final Investigation Report January 2013

68

This would not be applicable to seized contraband fireworks, and it does not appear that NFPA 1123 

provides any other guidance on fireworks disposal.

7.4.1.3 NFPA 1124

NFPA 1124, Code for the Manufacture, Transportation, Storage, and Retail Sales of Fireworks and 

Pyrotechnic Articles, applies to manufacturing facilities and to the storage of display fireworks and black 

powder at facilities other than display sites – but the standard does not apply to disposal.177 This standard 

requires that all tools used to open containers of explosive materials be non-sparking,178 and that 

magazines must be used exclusively for storage of explosive and pyrotechnic materials.179 As noted, DEI 

did not utilize the magazine exclusively for storage: DEI also soaked fireworks in diesel-filled steel 

drums, which the CSB would consider to be part of a process. In addition, a number of sparking items 

were found within the magazine or blown out of the magazine post-incident, including steel drums, a 

metal hand truck, metal chair, and metal tools.

While some sections within NFPA 1124 provide relevant safety guidance for fireworks storage activities, 

this standard does not provide any guidance on fireworks disposal. In addition, nowhere are the hazards 

of fireworks disassembly and the accumulation of explosive fireworks components discussed. 

7.4.2 Review of Current Fireworks Disposal Practices

The CSB had informal discussions with a number of fireworks manufacturers and state and local law 

enforcement agencies to better understand their firework disposal methodologies. The responses varied, 

illustrating that manufacturers have developed their own disposal procedures in the absence of industry 

guidance. 

7.4.2.1 Fireworks Operators

Disposal methods were inconsistent across these operators and ranged from procedures that incorporate 

stringent PSM guidelines to those that simply burn the fireworks in a pit, sometimes after soaking them in 

diesel. Several operators indicated that the best method to dispose of undamaged fireworks is to shoot 

them off as intended and strongly stated their opposition to disassembling or soaking fireworks in diesel 

prior to burning. Some operators said that they contract the disposal of 1.3G UN0335 fireworks to thirdparty companies (in Louisiana, Pennsylvania or Ohio) or turn them over to the local fire marshal or law

enforcement.

 

177 NFPA 1124. Code for the Manufacture, Transportation, Storage, and Retail Sales of Fireworks and Pyrotechnic 

Articles, 2006 ed.; Section 1.1. 178 NFPA 1124, Section 5.4.7. 

179 NFPA 1124, Section 5.4.8.

000251
DEI Final Investigation Report January 2013

69

7.4.2.2 Local Law Enforcement Agencies

Fire departments and local law enforcement agencies are also inconsistent in their handling, storage, and 

disposal of fireworks. For example, the State of California Office of the State Fire Marshal seizes and 

takes possession of all contraband fireworks in the state. Its personnel told the CSB that they do not 

disassemble seized fireworks or soak them in diesel prior to burning them. The Office sometimes 

provides 1.3G UN0335 display fireworks to bomb technicians for training, and disposes of 1.4G UNO336 

consumer fireworks in approved burn pits or ships them to an authorized disposal contractor in Louisiana. 

However, its personnel concede that cost and budget constraints have resulted in a large inventory of 

hundreds of thousands of pounds of seized fireworks being stored in magazines within California.

The San Francisco Fire Department confiscates mostly type 1.4G UNO336 fireworks, wets them down, 

grinds them, and then discards them. They do not have a procedure for 1.3G UN0335 fireworks.

Finally, the Houston Fire Department confiscates primarily type 1.4 G UNO336 fireworks, stores them in

magazines, and then either sends them to the bomb squad for disposal, turns them over to the local police 

department for training, or burns them without first soaking them in diesel.

7.5 Conclusion

The wide array of disposal techniques across the country; incidents such as the one in Lansing, Kansas; 

and the lack of existing regulations and standards that provide safety requirements and guidance to those 

disposing of fireworks, all support the conclusion that a regulatory gap exists in this country pertaining to 

fireworks disposal. Closing this gap to prevent fatal incidents requires a combined effort by ATF, EPA, 

NFPA, state and local agencies, and the fireworks industry to create standards and guidance that clearly 

indicate the dangers of handling and disposing of fireworks, and discuss how to properly and effectively 

manage the hazards and safely conduct this work. 

000252
DEI Final Investigation Report January 2013

70

8.0 Causal Analysis

For the DEI Investigation, the CSB team developed an accident map (AcciMap) (Figure 24), a multilayered causal diagram that allows for the evaluation of higher level causes at the governmental, 

regulatory, and societal levels. This diagram is especially useful for developing broadly applicable 

recommendations for accident prevention,

180 and includes five levels:

1. Physical Events, Conditions, and Outcomes: the immediate causes of the incident as displayed in a 

traditional logic tree;

2. DEI: company rules and policies; and conduct of fireworks disposal work;

3. VSE: primary government contractor responsible for subcontractor selection and oversight; 

4. Industry Codes and Standards: good practice guidelines provide safety standards; and

5. Government: laws and legislation are developed to regulate federal contracting and the handling, 

storage, and disposal of explosive hazardous materials. 

8.1 Physical Events, Conditions, and Outcomes

Five workers were fatally injured due to a fire and explosion inside a magazine. The fire and explosion 

were a result of the accumulation of explosive black powder and aerial shells inside the magazine near its 

only entrance, and multiple ignition sources were present. The fire developed near the only entrance and 

exit, and prevented workers’ escape from the magazine. All of these physical outcomes and conditions 

were the result of DEI’s high-risk fireworks disposal activities. 

8.2 DEI

DEI developed a fireworks disposal methodology that evolved into disassembling seized fireworks and 

separating and accumulating their explosive components – black powder and aerial shells – into 

cardboard boxes. By accumulating these explosive components, the DEI process created a much larger 

explosive hazard than the original fireworks represented. In addition, DEI’s Activity Hazard Analysis

and procedures failed to identify and control the key explosive hazards involved in this process. DEI 

personnel also had a lack of fireworks training and experience. 

 

180 The AcciMap tool was developed by Jens Rasmussen and popularized by Andrew Hopkins. Rasmussen, J., &.

A. Hopkins. “Risk Management in a Dynamic Society: A Modeling Problem.” Safety Science, 27 (2.3), 1997; pp 

183-213. 

000253
DEI Final Investigation Report January 2013

71

8.3 VSE

The main federal seized-property management contractor, VSE, did not use individuals with the requisite 

technical and explosives expertise in its subcontractor selection and oversight process. VSE procurement 

personnel lacked explosives and fireworks experience and were not qualified to assess the technical 

differences between the two proposals they received to dispose of the fireworks. Even though DEI had 

never conducted a firework disposal operation, VSE procurement staff selected DEI as the subcontractor 

to dispose of contraband fireworks because DEI was already storing the fireworks, and its proposal was 

determined to be the lowest-cost and most time-efficient bid for the government, resulting in attractive 

“one-stop shopping.” In addition, no VSE personnel or representatives aware of DEI’s disposal process

had the expertise to identify or evaluate any hazards associated with the activities being conducted. 

8.4 Industry Codes and Standards

No Industry Codes or Standards exist that provide safety guidance on fireworks disposal. 

8.5 Government

There is a regulatory gap that exists pertaining to fireworks disposal in the United States. 

RCRA emergency permits lack safety management provisions. The State of Hawaii DOH awarded DEI 

an emergency hazardous waste permit to dispose of the contraband fireworks without reviewing its 

qualifications or proposed disposal methodology. As the DEI firework disposal operation evolved and 

major hazards were introduced from disassembling and accumulating firework components, the 

emergency hazardous waste permit included no requirements to review the safety aspects of these critical 

changes.

Neither the FAR, the DTAR, nor the DTAP explicitly address safety, and lack sufficient selection and 

oversight requirements for the prime contractor and its subcontractors with respect to the unique hazards 

associated with the disposal of hazardous materials, including fireworks. 

000254
DEI Final Investigation Report January 2013

72

Industry 

Codes and 

Standards

VSE DEI Physical Events, Conditions, and Outcomes Government

Single Entrance/

Exit from 

Magazine

Fire Blocked 

Escape from 

Magazine

Multiple Ignition 

Sources Present

People Present

Explosion and Fire 

Inside Magazine

Accumulation of Explosive 

Components and 

Combustibles Inside 

Magazine Near Entry/Exit

High-Risk Fireworks 

Disposal Process

No VSE Personnel with 

Explosives or Firework 

Experience

Lack of VSE 

Subcontractor 

Oversight

VSE Procurement did not 

Evaluate Experience or 

Qualifications of Offerors

VSE Procurement Personnel were not Qualified 

to Award Firework Disposal Subcontract

DEI was Low-Priced 

Bidder

DEI Was Local 

Company, Already 

Storing Fireworks

VSE Preference 

for One-Stop 

Shopping

No Involved Government Personnel had 

Firework or Explosives Experience

Lack of Government 

Contractor Oversight

No Industry 

Standard on Safe 

Firework Disposal

Insufficient Safety 

Oversight Provisions in 

Seized Property Contract

VSE Awards Firework Disposal 

Subcontract to DEI, a UXO Company 

Lacking Firework Disposal Experience

Work 

Activities

Insufficient Contractor and 

Subcontractor Selection Criteria

No Regulatory Safety 

Oversight of 

Fireworks Disposal

Lack of Safety 

Management in RCRA 

Emergency Permitting

5 Worker Fatalities

Figure 24. DEI Investigation AcciMap 

000255
DEI Final Investigation Report January 2013

73

9.0 Recommendations 

The CSB makes recommendations based on the findings and conclusions of the investigation. 

Recommendations are made to parties that can affect change to prevent future incidents, which may 

include the company, contractors, industry organizations responsible for developing good practice 

guidelines, regulatory bodies, and/or organizations that have the ability to broadly communicate lessons 

learned from the incident, such as trade associations. 

Federal Acquisition Regulatory (FAR) Council

2011-06-I-HI-R1

Establish an additional contractor responsibility determination requirement under Subpart 9.104-1 of the 

Federal Acquisition Regulation (FAR) addressing contractor safety performance. The analysis under this 

requirement should focus on incident prevention, and environmental and system safety. At a minimum, 

the language should specifically require the review of a prospective contractor’s:

• Environmental and safety programs; 

• Safety record and incident history;

• Ability to use safe methods for any work involving hazardous materials (including explosives); 

and 

• Suitable training and qualifications for the personnel involved in the work including prior 

relevant safety experience. 

Department of the Treasury Office of the Procurement Executive 

(OPE)

2011-06-I-HI-R2

Establish formal policy requiring that:

• Solicitations for contracts dealing with the storage, handling, and disposal of explosive hazardous 

materials, including fireworks, incorporate rigorous safety-related contractor selection provisions 

such as those provided in the DoD’s Contractor’s Safety Manual for Ammunition and 

Explosives, Section C1.5, “Pre-Award Safety Survey”; and

• Contracts dealing with the storage, handling, and disposal of explosive hazardous materials, 

including fireworks, include a provision requiring that any subcontract (regardless of tier) for the 

storage, handling, and disposal of explosives (including fireworks) be selected based on rigorous 

000256
DEI Final Investigation Report January 2013

74

safety-related contractor selection provisions such as those provided in the DoD’s Contractor’s 

Safety Manual for Ammunition and Explosives, Section C1.5, “Pre-Award Safety Survey.” 

2011-06-I-HI-R3

Establish a formal policy requiring that contracts and subcontracts dealing with the storage, handling, and 

disposal of explosive hazardous materials, including fireworks, incorporate rigorous safety-related 

contractor oversight provisions such as those provided in the DoD’s Contractor’s Safety Manual for 

Ammunition and Explosives, Section C1.6, “Pre-Operational Safety Survey” and C1.7, “Post-Award 

Contractor Responsibilities” to provide effective oversight of subcontractors handling and disposing of 

explosives and hazardous materials. 

2011-06-I-HI-R4

When the NFPA guidance developed by the National Fire Protection Association for the safe disposal of 

fireworks as recommended under recommendation 2011-06-I-HI-R7 is completed, incorporate this 

document by reference into the formal policies established by 2011-06-I-HI-R2 and 2011-06-IHI-R3. 

Treasury Executive Office for Asset Forfeiture (TEOAF)

2011-06-I-HI-R5

Require additional provisions within the TEOAF seized property management contract, such as a contract 

line item number (CLIN), that provide for the prime contractor to use expert(s) to assist the prime 

contractor’s personnel in the selection and oversight of subcontractors who handle, store, or dispose of 

explosive hazardous materials, including fireworks, pursuant to the main contract. 

VSE Corporation

2011-06-I-HI-R6

Use experts to:

• Assist VSE procurement in selecting vendors to properly handle, store, and dispose of explosive 

hazardous materials, including fireworks, pursuant to prime contract requirements; and, 

• Assist VSE personnel in overseeing the work to ensure it is being conducted safely.

000257
DEI Final Investigation Report January 2013

75

National Fire Protection Association (NFPA)

2011-06-I-HI-R7

Develop a new standard, or incorporate within an existing standard, best practices for the safe disposal of 

waste fireworks that are consistent with environmental requirements. At a minimum this guidance or 

standard should:

• Discourage the disassembly of waste fireworks as a step in the disposal process;

• Minimize the accumulation of waste explosive materials, and encourage practices that reduce, 

recycle, reuse, or repurpose fireworks; and

• Incorporate input from ATF, EPA, and other agencies, experts, and available resources on 

fireworks disposal methodologies.

2011-06-I-HI-R8

Once fireworks disposal best practices under recommendation 2011-06-I-HI-R7 is completed, develop 

and implement an outreach plan to promptly communicate the new NFPA practices to relevant 

government agencies and private entities that dispose of waste fireworks. 

U.S. Environmental Protection Agency (EPA)

2011-06-I-HI-R9

Revise the Resource Conservation and Recovery Act (RCRA) Subtitle C regulations to require a 

permitting process with rigorous safety reviews to replace the use of emergency permits under 40 CFR 

§270.61 for the disposal of explosive hazardous materials, including fireworks. At a minimum, the new 

process should require the use of best available technology, safe disposal methodologies, as well as safety 

management practices, such as those required by OSHA’s Process Safety Management Standard (PSM), 

29 CFR §1910.119 (e.g., hazard analysis and control, management of change). 

2011-06-I-HI-R10 

Until recommendation 2011-06-I-HI-R9 can be implemented, develop and issue a policy guidance 

document to provide a regulatory process with rigorous safety reviews to replace the use of emergency 

permits under 40 CFR §270.61 for the disposal of explosive hazardous materials, including fireworks. At 

a minimum, the new process should require the use of best available technology, safe disposal 

methodologies, as well as safety management practices, such as those required by OSHA’s Process Safety 

Management Standard (PSM), 29 CFR §1910.119 (e.g., hazard analysis and control, management of 

change). Ensure its effective communication to all EPA regional administrators, state environmental 

agencies, and organizations within the fireworks industry. 

000258
DEI Final Investigation Report January 2013

76

2011-06-I-HI-R11 

Effectively participate in the National Fire Protection Association’s standard development process to 

develop guidance on the safe and environmentally sound disposal of fireworks, as recommended under 

recommendation 2011-06-I-HI-R7. 

Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF)

2011-06-I-HI-R12 

Effectively participate in the National Fire Protection Association’s standard development process to 

develop guidance on the safe disposal of fireworks, as recommended under recommendation 2011-06-IHI-R7. 

000259
DEI Final Investigation Report January 2013

77

BY THE

U.S. Chemical Safety and Hazard Investigation Board

 Rafael Moure-Eraso

 Chair

 Mark Griffon

 Member

 Beth Rosenberg 

 Member

Date of Approval January ___, 2013. 

000260
DEI Final Investigation Report January 2013

78

References 

American Pyrotechnics Association (APA). APA U.S. Fireworks Consumption Figures 2000-2011. 

http://www.americanpyro.com/pdf/Fireworks-Consump-Figures-2000-11.pdf (accessed July 14, 2012). 

American Pyrotechnics Association (APA). Standard 87-1, Standard for Construction and Approval for 

Transportation of Fireworks, Novelties, and Theatrical Pyrotechnics, 2001. 

ANSI/AIHA. ANSI/AIHA Z-10, American National Standard for Occupational Health and Safety 

Management Systems, 2012. 

Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes: A Life Cycle 

Approach; 2nd ed., 2009; p.11. 

Crowl, Daniel A. Understanding Explosions, A CCPS Concept Book, 2003; p 204. 

CURT. Construction Safety: The Owner’s Role, UP-802, 2004. 

Department of Defense Explosives Safety Board (DDESB). Minimum Qualifications for UXO 

Technicians and Personnel; Technical Paper (TP) 18, Section C2.1.2, 2004. 

Malitz, I. “Black Powder Manufacturing, Testing & Optimizing”. American Fireworks News (AFN), 

Dingmans Ferry, PA, 2003. 

NASA. NSS 1740.12, Safety Standard for Explosives, Propellants, and Pyrotechnics; NNS 1740.12, 

Section 525(b)(2)(b),1993. 

National Fire Protection Association (NFPA) 495. Explosive Materials Code, 2010. 

National Fire Protection Association (NFPA) 1123. Code for Fireworks Display, 2010. 

National Fire Protection Association (NFPA) 1124. Code for the Manufacture, Transportation, Storage, 

and Retail Sales of Fireworks and Pyrotechnic Articles, 2006. 

National Fire Service of the Netherlands. Final Consideration. National Fire Service Documentation 

Center. 

http://www.nbdc.nl/cms/servlet/nl.gx.nibra.client.http.GetFile?id=498631&file=Final_consideration_(Slo

tbeschouwing_Engels).pdf (accessed Nov 16, 2012). 

OSHA. Report on Donaldson Enterprises, Inc., April 9, 2012. 

000261
DEI Final Investigation Report January 2013

79

Rasmussen, J., & Hopkins, A. “Risk Management in a Dynamic society: A Modeling Problem.” Safety 

Science, 27 (2.3), 1997; pp 183-213. 

Turcotte, R., Turcotte, A.M., Fouchard, R., and Jones, D.E.G. “Thermal Analysis of Black Powder.” 

Journal of Thermal Analysis and Calorimetry. Canadian Explosives Research Laboratory, Natural 

Resources, Canada, Ottawa, Canada. 2003; Vol 73. 

U.S. Customs and Border Protection (CBP). “Watch Out for Illegally Imported Fireworks: CBP Seizes 

Dozens of Illegal Fireworks Shipments on Behalf of Partner Agencies.” 

http://www.cbp.gov/xp/cgov/newsroom/news_releases/national/07032012.xml (accessed Oct 14, 2012). 

Yang, Xiyun. “China’s Fireworks: A Trusted Import.” Washington Post, [Online] 2007,

http://www.washingtonpost.com/wp-dyn/content/article/2007/07/03/AR2007070302188.html (accessed 

July 12, 2012). 

000262
DEI Final Investigation Report January 2013

80

Appendix A: Hawaii Firework Seizures

Between 2007 and 2010, CBP and ICE/HSI agents in Hawaii conducted three separate seizures of 

fireworks that were being imported from China into Honolulu, due to suspicion that they were illegally 

labeled for consumer use. 

Seizures

Initial Seizure

On December 10, 2007, CBP seized a shipment of fireworks (initial seizure) in Honolulu181 and declared 

these fireworks forfeited on February 12, 2008.182 This shipment consisted of 11 pallets of fireworks and 

included “Maylar Tubes,” “Assortment Shells,” and “Singing Oriole/Dancing Swallows.” 

Second Seizure

On February 4, 2009, ICE/HSI seized a second shipment of fireworks in Honolulu183 (second seizure) 

illegally imported from China. The property, consisting of 5,480 pieces contained in 1,370 cartons/39 

pallets, was forfeited on July 6, 2009, for knowingly smuggling goods into the United States.184 This 

seizure was being stored in the rear of the magazine at the time of the incident.

Primary Seizure

On January 13, 2010, ICE/HSI seized a third shipment of fireworks in Honolulu185 (primary seizure) 

during its importation from China. The property was forfeited on March 22, 2010, for introducing 

merchandise contrary to law186 and knowingly smuggling goods into the U.S.187 DEI was in the process 

of disassembling the primary seizure on the day of the incident. 

This shipment consisted of eight cardboard containers holding 296 boxes or 17 pallets of fireworks 

marked “Fireworks 1.4G” with the Identification Number UN0336 and DOT approval number 

EX2008060273. The four different products contained within this shipment were 65 boxes/519 pieces of 

“O Triple C”; 65 boxes/519 pieces of “Halawa”; 96 boxes/383 pieces of “Sky Festival”; and 70 boxes/559 

pieces of “Krazy Kids.” The total value of this shipment was over $30,000.00. Table 2 below details 

specific fireworks in the seizure and samples requested by CBP.

 

181 Seizure Number 2008-3201-000-013-01. 182 For introducing merchandise contrary to law under 19 U.S.C. §1595A(c) and knowingly receiving explosive 

materials without a license or permit under 18 U.S.C. §842(a)(3)(A).

183 Seizure Number 2009-3201-000-052-01. 184 Under 18 U.S.C. §545 (1996). 185 Seizure Number 2010-3205-000-012-01. 186 19 U.S.C. §1595a(c) (2008). 187 18 U.S.C. §545 (1996). 

000263
DEI Final Investigation Report January 2013

81

U.S. Dept. of Homeland Security (Disposition Order) VSE (Chain of Custody)

Line Item# Description Unit of Quantity Count was: Count Sample 

 Measure now: pulled

_____________________________________________________________________________________ 

001-A001 CC Halawa CTNS 64 65 (519 pieces) 64 1 

002-A001 KK Krazy Kids CTNS 69 70 (559 pieces) 69 1 

003-A001 RR O Triple C CTNS 64 65 (519 pieces) 64 1 

004-A001 SF Sky Festival CTNS 95 96 (383 pieces) 95 1 

Table 2. Seizures and Samples188

All four of these fireworks are multi-shot devices, often referred to as “cakes” in the industry, 189 and are 

designed to produce a succession of effects. According to the APA, each tube in a multi-shot device is 

typically 0.6” – 1.38” in diameter. A single igniter is generally used to initiate the first effect; a timed 

fuse, the spacing of the tubes, and the total number of tubes determine subsequent ignition of the tubes 

and the overall duration of the device. The tubes typically incorporated in these devices can include 

comets, mines, small aerial devices, audible effects, and any combination thereof.190 In the instantaneous 

version of these devices, all tubes ignite simultaneously. 

ATF testing and analysis of Primary Seizure

ATF conducted a detailed analysis of the primary seizure and concluded that 

1. The CC Halawa fireworks consisted of a multi-tube device (shot cake) comprising 25 tubes. The 

shot cakes were packaged eight per carton and the tubes within each device were spaced less than 0.5 

inches apart. Each shot cake contained two types of tubes, half of which contained shells with stars. For 

laboratory analysis, one of each type of tube was randomly selected, weighed, and disassembled. The lift 

charge for the tubes (with and without stars) consisted of 5.15 grams of black powder. The shells 

contained a 1-gram lift charge; 10.83 grams of pyrotechnic stars; and a burst charge, identified as 

perchlorate explosive mixture, of either 2.47 or 5.79 grams. The cake contained a total of 374.32 grams 

of explosives and pyrotechnics material. The ATF observed that, while the carton displayed a marking 

 

188 CTNS = Cartons (boxes).

189 http://www.fireworks.us/Fireworks-Multi-Shots-Cakes-s/7.htm (accessed April 22, 2012). 

190 American Pyrotechnics Association (APA). Generic Close Proximity Product Types: Pyrotechnics Used Before 

a Proximate Audience, March 1, 2009; p 12. 

http://www.americanpyro.com/pdf/APACloseProxDescriptionsFinal.pdf (accessed November 1, 2012). 

000264
DEI Final Investigation Report January 2013

82

indicating that it contained 1.4G UN0336 fireworks, the individual shot cakes were unmarked; the ATF 

therefore concluded that the product violated APA 87-1, paragraph 3.5.2. The DOT hazard classification 

for multiple tube devices with less than 0.5-inch tube separation is limited to 200 grams. This product 

also exceeded the maximum allowable explosive filler weight of 130 milligrams permitted in consumer 

fireworks by 27 CFR §555.151 (a)(7) and the maximum permitted charge weight of 130 milligrams for 

devices that are intended for sale to the public and produce an audible charge effect (APA 87-1, paragraph 

3.373). The ATF therefore opined that the CC Halawa fireworks were classified as explosives (Class 1.3 

or higher) and subject to regulations under 27 CFR Part 555, Commerce in Explosives. 

2. The KK Krazy Kids fireworks also consisted of a 25-tube shot cake packaged eight per carton, 

with the tubes spaced less than 0.5 inches apart. Each tube contained 3.75 grams of a black powder lift 

charge. The shell contained 1-gram black powder lift charge; 9.01 grams of pyrotechnic stars; and 2.28 

grams perchlorate explosive lift charge. The entire multi-tube assembly contained a total of 400.25 grams 

of explosives and pyrotechnics material. The ATF observed that, while the carton displayed a marking 

indicating that it contained 1.4G UN0336 fireworks, the individual shot cakes were unmarked and 

therefore concluded that the product violated APA 87-1, paragraph 3.5.2. The DOT hazard classification 

for multiple tube devices with less than 0.5-inch tube separation is limited to 200 grams. This product also 

exceeded the maximum allowable explosive filler weight of 130 milligrams permitted in consumer 

fireworks by 27 CFR §555.141(a)(7) and the maximum permitted charge weight of 130 milligrams for 

devices that are intended for sale to the public and produce an audible charge effect (APA 87-1, paragraph 

3.7.3). The ATF therefore opined that the KK Krazy Kids fireworks were classified as explosives (Class 

1.3 or higher) and subject to regulations under 27 CFR Part 555, Commerce in Explosives. 

3. The RR O Triple C fireworks also consisted of a multi-tube device (shot cake) comprising 25 

tubes packaged eight per carton. The tubes were spaced less than 0.5-inch apart. A tube was selected 

randomly from a single multi-tube device, weighed, disassembled, and submitted to the laboratory for 

analysis. Each tube contained 5.15 grams of a black powder lift charge; 10.5 grams of pyrotechnic stars;

and 6.18 grams of a perchlorate explosive burst charge. Each shot cake contained a total of 570.25 grams 

of explosives and pyrotechnics material. The ATF observed that, while the carton displayed a marking 

indicating that it contained 1.4G UN0336 fireworks, the individual shot cakes were unmarked; thus, ATF 

concluded that the product violated APA 87-1, paragraph 3.5.2. The DOT hazard classification for 

multiple tube devices with less than 0.5-inch tube separation is limited to 200 grams. This product also 

exceeded the maximum allowable explosive filler weight of 130 milligrams permitted in consumer 

fireworks by 27 CFR §555.141 (a)(7) and the maximum permitted charge weight of 130 milligrams for 

devices that are intended for sale to the public and produce an audible charge effect (APA 87-1, paragraph 

3.7.3). The ATF therefore opined that the RR O Triple C fireworks were classified as explosives (Class 

1.3 or higher) and subject to regulations under 27 CFR Part 555, Commerce in Explosives.

4. The SF Sky Festival fireworks consisted of a 156-tube shot cake packaged four per carton. The 

cake contained six large tubes, and 150 smaller tubes spaced less than 0.5 inches apart. One of each type 

of tube was randomly selected, weighed, disassembled, and submitted for analysis. The large tubes 

contained 3.3 grams of a black powder lift charge and 4.7 grams of a perchlorate explosive burst charge, 

while the small tubes contained 0.96 gram of black powder lift charge and 1.22 grams of pyrotechnic 

000265
DEI Final Investigation Report January 2013

83

stars. Each shot cake contained a total of 375 grams of explosives and pyrotechnic material. The ATF 

observed that, while the carton displayed a marking indicating that it contained 1.4G UN0336 fireworks, 

the individual shot cakes were unmarked; thus, ATF concluded that the product violated APA 87-1, 

paragraph 3.5.2. The DOT hazard classification for multiple tube devices with less than 0.5-inch tube 

separation is limited to 200 grams. This product also exceeded the maximum allowable explosive filler 

weight of 130 milligrams permitted in consumer fireworks by 27 CFR §555.141 (a)(7) and the maximum 

permitted charge weight of 130 milligrams for devices that are intended for sale to the public and produce 

an audible charge effect (APA 87-1, paragraph 3.7.3). The ATF therefore opined that the RR O Triple C 

fireworks were classified as explosives (Class 1.3 or higher) and subject to regulations under 27 CFR Part 

555, Commerce in Explosives. 

ATF analysis of samples from the subject seizure, collected from undamaged cartons found near the rear 

of the magazine after the subject explosion, provides photographic documentation of individual tubes for 

each type of these fireworks. The analysis concluded that a) the aerial component within the Halawa 

cakes were consistent with star shells and contained approximately 13.4 grams of powder; b) the aerial 

shells within the Krazy Kids cakes contained between 5.7 and 12.1 grams of material that appeared to be 

consistent with a flash powder; c) the aerial component within the O Triple C cakes contained 

approximately 5.9 grams of material consistent with flash powder; and d) the aerial shells within the Sky 

Festival cakes contained comets and approximately 4.3 grams of material that appeared to be consistent

with flash powder.

Case Processing and Management

Post-seizure, a CBP Fines, Penalties and Forfeitures Officer (FP&F) at Port of Honolulu oversaw the 

seized property program and aspects of case processing. CBP issued disposition orders (CBP Form 7605) 

to VSE as TEOAF’s primary federal contractor to secure storage for the seizures, coordinate their 

destruction, monitor and control storage costs, and inspect the storage facilities. 

Storage

Initial Seizure 

On December 11, 2007, CBP issued a disposition order to VSE to store the initial seizure. VSE 

subcontracted to Timberline Environmental Services191 (Timberline) to locally store the fireworks at 

Waikele Storage. At some point, Timberline entered into a separate agreement with DEI to store the 

seizures. For unknown reasons, VSE did not renew their storage contract with Timberline and instead, in 

late 2008, directly subcontracted with DEI to store the firework seizures. On December 12, 2008, CBP 

issued a new disposition order to VSE to transfer the initial seizure from Timberline to DEI as the “new 

vendor for storage.” DEI began storing the seizure at Waikele Storage on February 17, 2009. 

 

191 Timberline provides unexploded ordinance (UXO) services, including vegetation clearance, target removal, scrap 

management and large scale soil sifting operation on live ranges http://www.uxoservices.com (accessed November 

29, 2012). 

000266
DEI Final Investigation Report January 2013

84

Second Seizure

On February 19, 2009, CBP issued a disposition order to VSE to store the second seizure. DEI had stored 

this seizure in the back of the magazine, where it was at the time of the incident.

Primary Seizure

On January 13, 2010, CBP issued a disposition order to VSE to store the primary seizure. On or around 

March 29, 2010, these fireworks were transferred to the A-21 magazine for storage. 

Destruction

Initial Seizure

On February 10, 2010, CBP issued a disposition order to VSE to destroy the initial seizure. CBP issued a 

second disposition order on April 16, 2010. DEI obtained the requisite permitting to begin the disposal 

process on June 8, 2010. 

 

CBP Form 7605 states that DEI completed its destruction of the initial seizure on December 1, 2010. 

Second Seizure

Post-incident, on July 20, 2011, CBP issued a disposition order to VSE to destroy the second seizure. 

However, these 39 pallets of cake fireworks have not yet been destroyed and are being stored in the 

magazine where the incident occurred. 

Primary Seizure

On April 16, 2010, CBP issued a disposition order to VSE, set to expire June 16, 2010, for destruction of 

the primary seizure. 

The incident occurred while DEI was completing its disassembly of these fireworks; it had destroyed 

approximately 35 percent of this seizure at the time of the incident. 

000267
DEI Final Investigation Report January 2013

85

Appendix B. Department of Defense Contractor’s Safety Manual

Pertinent Sections. 

DoD 4145.26-M, March 13, 2008 

C1.1. PURPOSE

C1.1.1. This Manual provides safety requirements, guidance and information to minimize 

potential accidents that could interrupt Department of Defense (DoD) operations, delay DoD 

contract production, damage DoD property, cause injury to DoD personnel, or endanger the 

public during DoD contract work or services involving ammunition and explosives (AE). The 

Manual contains the minimum contractual safety requirements to support DoD objectives. These 

requirements are not a complete safety program, and this Manual does not relieve a contractor 

from complying with Federal, State, interstate, and local laws and regulations.

C1.2. APPLICABILITY. When included in or properly incorporated into their contracts, 

subcontracts, purchase orders, or other procurement methods and made applicable to the 

contractor (or to their subcontractors), these safety requirements apply to contractors and 

subcontractors handling ammunition or explosives. Nothing in this Manual should be construed 

as making the Department of Defense a controlling employer under Occupational Safety and

Health Administration (OSHA) regulations and standards. 

C1.5. PRE-AWARD SAFETY SURVEY

 C1.5.1. The PCO will request a DoD pre-award safety survey to help determine contractor

capability. DoD safety personnel conduct pre-award surveys to evaluate each prospective 

contractor's ability to comply with contract safety requirements. While the pre-award safety

survey is an opportunity for the contractor to request clarification of any safety requirement or 

other AE issue that may affect the contractor's ability to comply, any such clarification must be

issued by the contracting officer. During pre-award surveys, the contractor shall provide: 

C1.5.1.1. Site plans conforming to subparagraphs C1.8.5.1. through C1.8.5.5. for 

proposed facilities to be used in contract performance. 

C1.5.1.2. Evidence of implementation of a safety program containing at least the 

mandatory requirements described in Chapter 3 of this Manual. 

C1.5.1.3. General description of proposed contract facilities, including size, building 

layouts, construction details, and fire resistive capabilities.

C1.5.1.4. Fire prevention program and available firefighting resources, including local 

agreements or other documentation demonstrating coordination. 

C1.5.1.5. Copies of required licenses and permits or demonstration of the ability to obtain 

approvals necessary to support the proposed contract. 

000268
DEI Final Investigation Report January 2013

86

C1.5.1.6. A safety history including accident experience; safety survey or audit reports by 

insurance carriers or Federal, State, and local authorities; and any variances, exemptions, or

waivers of safety or fire protection requirements issued by Federal, State, or local authorities.

C1.5.1.7. Proposed operations and equipment to include process flow narrative/diagram, 

proposed facility or equipment changes, proposed hazard analysis, and proposed procedures for 

all phases of AE operations.

C1.5.1.8. Subcontractor information. 

C1.5.8.1. Identification of all subcontractors proposed for the AE work. 

C1.5.8.2. Proposed methods used to evaluate the capability of the subcontractor to 

comply with the requirements of this Manual. 

C1.5.8.3. Proposed methods used to ensure subcontractor compliance.

C1.6. PRE-OPERATIONAL SAFETY SURVEY

 C1.6.1. The Department of Defense reserves the right to conduct a pre-operational survey 

after contract award in these situations:

C1.6.1.1. Contractor has limited experience with the item.

C1.6.1.2. After major new construction. 

C1.6.1.3. After major modifications. 

C1.6.1.4. After an AE accident. 

 C1.6.2. When these situations occur, the contractor shall provide sufficient notification to the 

ACO and Defense Contract Management Agency (DCMA) contract safety personnel, to provide 

adequate time for the Department of Defense to schedule and perform a preoperational survey.

C1.7. POST-AWARD CONTRACTOR RESPONSIBILITIES. The contractor shall: 

 C1.7.1. Comply with the requirements of this Manual and any other safety requirements 

contained within the contract. 

 C1.7.2. Develop and implement a demonstrable safety program, including operational 

procedures, intended to prevent AE-related accidents.

 C1.7.3. Designate qualified individuals to administer and implement this safety program.

000269
DEI Final Investigation Report January 2013

87

 C1.7.4. Prepare and keep available for review all hazard analyses used to justify alternative

methods of hazards control implemented in order to comply with the mandatory requirements in

this Manual. 

 C1.7.5. Provide access to facilities and safety program documentation to DoD safety 

representatives.

 C1.7.6. Report and investigate AE accidents in accordance with Chapter 2 of this Manual. 

 C1.7.7. Provide identification and location of subcontractors to the ACO for notification or 

approval in accordance with terms of the contract. 

 C1.7.8. Establish and implement management controls to ensure AE subcontractors comply 

with paragraphs C1.7.1. through C1.7.7. of this section.

C3.5. HOUSEKEEPING IN HAZARDOUS AREAS

 C3.5.1. Contractors shall keep structures containing AE clean and orderly. 

 C3.5.2. Contractors shall establish a regular cleaning program to maintain safe conditions. 

Personnel shall not perform general cleaning concurrently with hazardous operations. 

 C3.5.3. Explosives and explosive dusts shall not be allowed to accumulate on structural 

members, radiators, heating coils, steam, gas, air or water supply pipes, or electrical fixtures.

 C3.5.4. Contractors shall use proper design of equipment, training of employees, and catch or 

splash pans to prevent spillage of explosives and other hazardous materials. Operators shall 

promptly remove spillage of explosives and hazardous materials following proper procedures 

established per section C8.4. 

 C3.5.5. Personnel shall use cleaning methods, such as hot water, steam, etc., that do not 

create ignition hazards for cleaning floors in buildings containing explosives. When these 

methods are impractical, personnel may use nonabrasive sweeping compounds that are 

compatible with the explosives involved. Flammable compounds shall not be used. Combustible 

sweeping compounds (closed cup flash point less than 230oF) are acceptable for use. Personnel 

shall not use sweeping compounds containing wax on conductive floors if the wax can reduce 

conductivity. Personnel shall not use cleaning agents containing alkalis in areas with nitrated 

organic explosives, since these materials are incompatible and can form sensitive explosive 

compounds. 

 C3.5.6. Cleaning methods may use nonferrous wire brushes to clean explosives-processing

equipment only when other methods of cleaning are ineffective. A thorough inspection should 

follow such cleaning to ensure that no wire bristles remain in the equipment. This also applies to

cleaning magnesium ingot or other metal molds used in explosives processing. Cleaning methods 

should substitute fiber brushes for hairbrushes to reduce generation of static. 

000270
DEI Final Investigation Report January 2013

88

 C3.5.7. Contractors shall dispose of all loose explosives swept up from floors of operating 

buildings. Responsible personnel shall thoroughly inspect and determine disposition of 

explosives recovered from sources other than ammunition breakdown operations and equipment.

C3.9. SAFETY HAND-TOOLS

 C3.9.1. Unless a hazard analysis indicates otherwise, only hand tools constructed of wood or 

non-sparking metals such as bronze, lead, and “K” Monel shall be used for work in locations and 

on equipment that contain exposed explosives or hazardous concentrations of flammable dusts, 

gases, or vapors that are susceptible to mechanical spark. Hand tools shall be cleaned and 

inspected prior to use. Be aware that nonferrous metals used in so-called non-sparking tools may 

produce sparks. If the use of ferrous metal tools is required because of their strength and wear 

characteristics, the contractor’s safety office shall approve their use.

 C3.9.2. If their strength makes the use of ferrous metal hand tools necessary during

maintenance and repair operations, exposed explosives and other highly flammable and 

combustible materials shall be removed from the area. In addition, explosives operations in the 

immediate vicinity shall be discontinued to guard against accidental ignition of materials by

flying sparks, and potential contact surfaces should be oiled or covered to reduce the likelihood 

of sparks. 

C3.11. PROTECTIVE CLOTHING

 C3.11.1. All AE operations require a hazard assessment to determine the need for protective 

clothing and personal protective equipment. The assessment shall include an evaluation of all 

hazards and factors contained in paragraph C3.11.2. 

 C3.11.2. The contractor shall provide a changing area for employees who must remove their 

street clothes to wear protective clothing, such as explosive plant clothing, anti-contamination

clothing, or impervious clothing. To minimize the risk of exposure to unrelated personnel, AE 

operators shall not remove contaminated clothing from the AE areas. Employees shall not wear 

any static-producing clothing in areas where electrostatic discharge (ESD) is a hazard.

 C3.11.3. Explosives plant clothing, generally referred to as powder uniforms, shall have 

nonmetallic fasteners and be easily removable.

 C3.11.4. When sending explosives-contaminated clothing to an off-plant laundry facility, the 

contractor is responsible for informing the laundry of the hazards associated with the 

contaminants and any special laundering or disposal requirements.

C7.12. DISASSEMBLY

 C7.12.1. Equipment and tooling that require disassembly during the manufacturing process 

should be designed to prevent metal-to-metal contact and trapping of explosive material.

000271
DEI Final Investigation Report January 2013

89

 C7.12.2. Non-routine disassembly of equipment and tooling, such as that necessary for

equipment repair, shall not be started until potential hazards from trapped material or process 

residuals have been evaluated and controls or safeguards have been implemented to mitigate the

hazard.

SAFETY REQUIREMENTS FOR MANUFACTURING

AND PROCESSING PYROTECHNICS

C8.1. GENERAL. The safety precautions for manufacturing and processing pyrotechnics are 

similar to those required for many types of explosives and other energetic materials. However, 

pyrotechnics exhibit many different characteristics because they are formulated for different

purposes. Knowledge of the various pyrotechnic properties is critical to the establishment of 

proper hazard controls. Pyrotechnics can be divided into several general categories including: 

initiators (igniters), illuminants, smokes, gas generators, sound generators, heat producers, and 

timing compositions. Each of these categories has its own characteristics and attendant

processing requirements. Knowledge of these characteristics is necessary to assure safety in

processing. The range of characteristics associated with pyrotechnics includes compositions that

are easily initiated, including compositions that burn in seconds at temperatures exceeding 5000 

degrees Fahrenheit (°F) [2760 degrees Celsius (°C)] through compositions that require 

substantial energy for initiation and have relatively low output temperatures. As examples, the 

auto-ignition temperature for smoke compositions is typically about 356°F [180°C], while for 

illuminants it is about 932°F [500°C]. Illuminants burn approximately 2.7 times faster than 

smokes and the heat of reaction is 1.5 times as great. Infrared (IR) flare compositions are both 

hotter and faster burning than illuminants. Many of the compositions in the igniter or initiator

class are as sensitive to ESD, friction, or impact as are initiating explosives such as lead azide

and lead styphnate. Initiation thresholds to stimuli such as impact, friction, and ESD and energy 

output of initiator compositions shall be determined and understood to ensure adequate safety 

controls are implemented to provide personnel safety in specific processes. In addition to the 

safety precautions generally required for the handling of explosives and other energetic 

materials, section C8.2. provides specific guidance pertinent to pyrotechnic operations. 

C8.3. PROCESS REQUIREMENTS

 C8.3.1. Housekeeping and Cleanliness Guidelines. Pyrotechnic operations require stringent 

housekeeping and cleanliness due to the sensitive nature of the ingredients and compositions; the 

dangerous effects of contamination, including cross contamination of oxidizers and fuels; and the 

amount of open or exposed ingredients and mixtures. Materials control and cleanliness are 

mandatory not only to reduce the likelihood of accidental initiations, but also to minimize the

effects of an accident.

 C8.3.1.1. Do not allow ingredient or composition dusts to accumulate, whether on the 

exterior work surfaces or the interior of process equipment and ventilation systems. Accident

investigations frequently identify dust buildups as the source of initiation when items are 

dropped on or scraped across them. Dust accumulations also can provide a propagation path 

from the initiation of a small quantity to a much larger quantity, thereby increasing the

magnitude of an accident. 

000272
DEI Final Investigation Report January 2013

90

 C8.3.1.2. Vapor recovery methods or ventilation shall prevent the accumulation of volatile 

vapors, and ignition sources shall be eliminated or controlled to prevent the initiation of a solvent 

vapor cloud. Where volatile flammable solvents are part of the process, solvent vapors in 

ventilation systems, hallways, conduits, or pipes may also provide a propagation path from the 

initiation of a small quantity to larger quantities.

 C8.3.2. Static Control Systems. As many pyrotechnic ingredients, mixtures, or the solvents 

used in their production are highly susceptible to initiation by static electricity, static control

systems are mandatory where hazard analysis indicates a need. Static control systems include 

conductive floors or mats, shoes, wrist straps, grounding of equipment, etc. 

 C8.3.3. Hazard Analysis and Risk Assessment. For all pyrotechnic operations, a documented 

hazard analysis and risk assessment is mandatory to validate the layout of operations, selection 

of materials and equipment, and process control parameters. (See Chapter 11 of this Manual.)

C9.4. UNPACKAGED AE ITEMS AND DAMAGED CONTAINERS

 C9.4.1. Unpackaged AE items shall not be stored in magazines containing AE in their

original shipping container, but may be stored in separate magazines. 

 C9.4.2. Damaged containers of AE should not be stored in a magazine with serviceable 

containers of AE. Such containers should be repaired or the contents transferred to new or 

serviceable containers. All containers of AE in magazines shall be closed with covers securely

fastened. Containers that have been opened shall be properly closed before restoring them. 

Stored containers should be free from loose dust and grit. 

 C9.4.3. Do not permit loose powder, grains, powder dust, or particles of explosive substances 

from broken AE or explosive substance containers in magazines. In addition, clean up any 

spilled explosive substance as soon as possible following proper procedures established per 

section C8.4. and suspend all other work in the magazine until accomplished.

RISK IDENTIFICATION AND MANAGEMENT

C11.1. GENERAL. AE operations involve many hazards and risks. These include the type of 

hazards associated with any industrial enterprise, e.g., AE reactivity, lifting, slipping, tool use,

toxic chemicals, potential exposures to environmental extremes.

 C11.1.1. The evaluation of hazards and risk of accidents addressed in this section relate to 

processes, not end products. The safety of operations is a contractor responsibility. 

 C11.1.2. A basic risk identification and management system is a necessary element of a 

comprehensive AE safety program. The purpose of this chapter is to address risk identification 

and management for all AE processes.

000273
DEI Final Investigation Report January 2013

91

C11.2. RISK MANAGEMENT SYSTEM. Contractors shall have a risk identification and 

management system and perform a hazard analysis resulting in the evaluation of processes,

materials, equipment, and personnel hazards. This analysis will aid in the development of a

written SOP for AE contract operations. The analysis may include such factors as: initiation 

sensitivity; quantity of AE; heat output, burn rate, potential ignition and initiation sources; 

protection capabilities of shields; personnel protective equipment and clothing; fire protection; 

and personnel exposure with special considerations (such as toxic or corrosive chemicals). The 

contractor shall document the analysis and keep it as long as the SOP is active. The risk analysis

should identify normal and abnormal (planned and unplanned) energy input into the AE, 

documenting the comparison between energy input and the sensitivity of the AE. 

 C11.2.1. The contractor shall perform risk analyses using personnel knowledgeable in the 

process, materials, equipment, and relevant safety requirements.

 C11.2.2. A hazard is any condition, which, by itself or by interacting with other variables, 

may result in death or injury to personnel or damage to property. Controls only reduce the

likelihood or severity of hazards. Controls do not eliminate hazards. 

C11.2.2.1. After identifying a hazard, qualified contractor personnel shall determine the 

associated risk. The risk analysis of a potential accident shall address both the severity and the 

probability of occurrence of an accident. 

C11.2.2.2. Evaluation of the hazard provides information useful for ranking the degree of 

risk associated with a hazard. The degree of risk indicates which hazardous conditions should 

receive priority for corrective action when compared to other hazardous conditions. One 

technique for ranking hazardous conditions is the assignment of a risk assessment code. The 

evaluation of the hazard results in the assignment of a narrative or numerical risk assessment that

enables management to evaluate the seriousness of the risk before and after action is taken to 

control it.

000274
 U.S. Chemical Safety and Hazard Investigation Board

REPORT NO. 2010.02.I.PR 

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Final 

Final 

FINAL INVESTIGATION REPORT

CARIBBEAN PETROLEUM TANK TERMINAL 

EXPLOSION AND MULTIPLE TANK FIRES

CARIBBEAN PETROLEUM CORPORATION (CAPECO)

KEY ISSUES: BAYAMÓN, PUERTO RICO

TANK OVERFILL PREVENTION OCTOBER 23, 2009 

COMMUNITY IMPACT 

HAZARD ASSESSMENT

SAFETY MANAGEMENT SYSTEM

REGULATION GAPS: 

 NO RISK ASSESSMENT CONSIDERING PROXIMITY TO COMMUNITIES

 NO ADHERENCE TO RAGAGEP 

 NO REDUNDANT OR INDEPENDENT SAFEGUARDS TO PREVENT OVERFILLING A TANK

000275
Caribbean Petroleum Company Final October 2015 

2 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

 

[Page intentionally left blank.] 

000276
Caribbean Petroleum Company Final October 2015 

3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

CONTENTS 

CONTENTS .................................................................................................................................................................. 3

Acronyms and Abbreviations ................................................................................................................................... 7

PUERTO RICO EMERGENCY MANAGEMENT AGENCY .................................................................................... 8

1.0 EXECUTIVE SUMMARY ............................................................................................................................. 9

1.1 Incident Summary ........................................................................................................................................ 9

1.2 Public Impact and Emergency Response ..................................................................................................... 9

1.3 CSB Investigation ........................................................................................................................................ 9

1.4 CSB Findings ............................................................................................................................................. 10

1.5 Key Findings .............................................................................................................................................. 10

2.0 CARIBBEAN PETROLEUM CORPORATION .......................................................................................... 14

2.1 Company History ....................................................................................................................................... 14

2.2 Status of CAPECO ..................................................................................................................................... 14

2.3 Site Description .......................................................................................................................................... 14

3.0 SITE OPERATIONS ..................................................................................................................................... 16

3.1 Normal Site Operations .............................................................................................................................. 16

3.2 Tank Farm Operations ................................................................................................................................ 16

3.3 Storm Water and Oil Runoff Management ................................................................................................ 17

3.4 Ship Unloading and Tank-Filling Operations ............................................................................................ 17

3.5 Communication .......................................................................................................................................... 18

3.6 Process Description .................................................................................................................................... 18

4.0 INCIDENT DESCRIPTION ......................................................................................................................... 22

4.1 Physical Cause ........................................................................................................................................... 22

4.2 Tank Overflow ........................................................................................................................................... 25

4.3 Vapor Cloud Formation and Migration ...................................................................................................... 26

4.4 Open Dike Drain Valves ............................................................................................................................ 27

4.5 Ignition ....................................................................................................................................................... 28

5.0          EMERGENCY RESPONSE ......................................................................................................................... 29

5.1 Response Description ................................................................................................................................. 29

5.2 Response Assessment ................................................................................................................................. 30

5.3 Incident Impact .......................................................................................................................................... 31

5.4 Impact to the Commonwealth .................................................................................................................... 34

5.5 Environmental Impact ................................................................................................................................ 34

000277
Caribbean Petroleum Company Final October 2015 

4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

5.6 Impact to Transportation and Commerce ................................................................................................... 34

5.7 Impact of Overfill Incident on CAPECO ................................................................................................... 35

6.0 INCIDENT ANALYSIS ............................................................................................................................... 35

6.1 Systemic Failure at CAPECO Led to Failure of the Overfill Prevention System ...................................... 35

6.2 CAPECO History of Poorly Maintaining Terminal Operations ................................................................. 37

6.3 Previous Spill Incidents at CAPECO ......................................................................................................... 37

6.4 Normal Practice to Fill Tanks to Maximum Levels at Odds with Safety ................................................... 37

6.5 Unreliable Safety Critical Equipment ........................................................................................................ 38

6.6 Lack of Formal Procedures for Tank Terminal Operations ....................................................................... 42

6.7 Lack of Additional Safeguards such as High-Level Alarms and an Automatic Overfill Prevention System

 42

6.8 Other Potential Contributing Factors ......................................................................................................... 43

6.9 Human Factors ........................................................................................................................................... 45

6.10      Using a Risk-based Approach to Design an Overfill Prevention System .................................................. 47

7.0 TANK LOCATIONS, PREVALENCE OF INCIDENTS AND LESSONS LEARNED FROM PREVIOUS 

 CATASTROPHIC INCIDENTS ................................................................................................................... 49

7.1 Prevalence of Tank Incidents ..................................................................................................................... 50

7.2 Lessons Learned from Previous Incidents .................................................................................................. 51

7.3 Buncefield (Hertfordshire, UK) ................................................................................................................. 51

7.4 Texaco Oil Company (Newark, NJ) ........................................................................................................... 55

7.5 Indian Oil Company (Jaipur, India) ........................................................................................................... 55

8.0 REGULATORY ANALYSIS ....................................................................................................................... 56

8.1 Environmental Protection Agency (EPA) .................................................................................................. 58

8.2 Clean Air Act: The General Duty Clause ................................................................................................... 58

8.3 EPA: The List Rule .................................................................................................................................... 59

8.4 Risk Management Program ........................................................................................................................ 62

8.5 Chemical Accident Provisions, Risk Management Plan (RMP) ................................................................ 62

8.6 The Clean Water Act (CWA) ..................................................................................................................... 63

8.7 Occupational Safety and Health Administration (OSHA) ......................................................................... 70

8.8 Puerto Rico Occupational Safety and Health Administration (PR OSHA) ................................................ 73

8.9 Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) ...................................... 73

8.10 Industry and Consensus Standards ......................................................................................................... 74

8.11 Trade Associations ................................................................................................................................. 83

9.0 ROOT AND SYSTEMIC CAUSES ............................................................................................................. 83

10.0 RECOMMENDATIONS .............................................................................................................................. 86

000278
Caribbean Petroleum Company Final October 2015 

5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figures 

Figure 1. CAPECO tank farm, WWT, and decommissioned refinery overview................................15 

Figure 2. CAPECO Pipeline to Gulf Oil Dock where gasoline is offloaded from ship.........................16 

Figure 3. (A) Manual and (B) Automatic tank gauging............................................................19 

Figure 4. Side gauge mounted on side of a fuel storage tank displaying the liquid levels....................21 

Figure 5. CAPECO multiple tank farm fire, October 23, 2009................................................ 24 

Figure 6. Impact of the explosion and multiple tank fires after the October 23, 2009 incident..............24 

Figure 7. Topographic Survey of CAPECO Tank Farm..........................................................27 

Figure 8. CAPECO surveillance footage of flame propagation during CAPECO 

explosion.................................................................................................................27 

Figure 9. Communities neighboring the CAPECO facility.......................................................32 

Figure 10. Community damage surrounding the CAPECO facility............................................. 33 

Figure 11. Oil Spill into nearby wetlands and in a local community drain after CAPECO explosion and 

tank fires .................................................................................................................33 

Figure 12. Failure of Multiple Layers of Protection and Lack of Independent Prevention Safeguards at 

CAPECO................................................................................................................36 

Figure 13 Schematic of a Comprehensive Level Overfill Prevention System..................................39 

Figure 14. Tank 409 Specifications..................................................................................45 

Figure 15. Various dike drain valves at CAPECO. ................................................................47 

Figure 16. Distribution of tank terminals across the US ......................................................... 51 

Figure 17. Regulatory Policies Governing Above Ground Storage Tanks ....................................58 

000279
Caribbean Petroleum Company Final October 2015 

6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Tables 

Table 1. Estimated Volume of Gasoline Overfilling from Tank 409 ...........................................25 

Table 2. Comparison of CAPECO and Buncefield Incidents ..................................................................... 55 

Appendix 

Appendix A. Incident Timeline.............................................................................93 

Appendix B. Previous Incidents............................................................................94 

Appendix C. Caribbean Petroleum AcciMap.............................................................103 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

000280
Caribbean Petroleum Company Final October 2015 

7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Acronyms and Abbreviations 

ALARP As low as reasonably practicable 

AOPS Automatic Overfill Prevention System

API American Petroleum Institute 

AST Aboveground Storage Tank 

ATF Bureau of Alcohol, Tobacco, Firearms and Explosives 

ATG Automatic Tank Gauge 

Bbls Barrels 

bbls/hr Barrels per hour 

BSTG Buncefield Standards Task Group 

CA Competent Authority 

CAA Clean Air Act 

CAAA Clean Air Act Amendments 

CAPECO Caribbean Petroleum Company 

cbm/hr Cubic meter per hour 

CCPS Center for Chemical Process Safety 

CERCLA Comprehensive Environmental Response, Compensation, and Liability 

CH Critical high level 

COMAH Control of Major Accident Hazards 

CSB U.S. Chemical Safety and Hazard Investigation Board 

CWA Clean Water Act 

DFA Direct Federal Assistance 

DOH Department of Health 

DOJ Department of Justice 

EPA Environmental Protection Agency 

ESF Emergency Support Function Annexes 

FEMA Federal Emergency Response Agency 

FRP Federal Response Plans 

HAZOP Hazard and Operability Study 

HH High-high level 

HSE Health and Safety Executive 

ICC International Codes Council 

IFC International Fire Code 

IFR Internal Floating Roof 

ILTA International Liquid Terminals Association 

IOC Indian Oil Corporation (IOC) Petroleum Oil Lubricants 

IPL Independent Protection Layer 

000281
Caribbean Petroleum Company Final October 2015 

8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

IPAA Independent Petroleum Association of America 

ISA International Society for Automation 

JIC Joint Incident Command 

kPa Kilopascal 

LOC Level of concern 

MIIB Major Incident Investigation Board 

MOC Management of Change 

Mph Miles per hour 

MW Maximum Working Level 

NASA National Aeronautics and Space Administration 

NIMS Incident Command System/National Incident Management 

NFPA National Fire Protection Association 

OPA Oil Pollution Act 

OPP Overfill Prevention Process 

OSHA Occupational Safety and Health Administration 

PREPA Puerto Rico Electric Power Authority 

PHA Process Hazard Analysis 

PR DNR Puerto Rico Department of Natural Resources 

PR OSHA Puerto Rico Occupation Safety Health and Administration

PREMA Puerto Rico Emergency Management Agency 

Psi Pounds per square inch 

Psia Pounds per square inch absolute 

PSM Process Safety Management 

RAGAGEP Recognized and Generally Accepted Good Engineering Practices 

RCRA Resource Conservation and Recovery Act 

RMP Risk Management Program 

SBA Small Business Administration 

SCO State Coordinating Officer 

SIF Safety Instrumented Functions 

SIL Safety Integrity Levels 

SIS Safety Instrumented System 

SOPs Standard Operating Procedures 

UCP Unified Command Post 

UK United Kingdom 

USCG US Coast Guard 

USFWS US Fish and Wildlife Service 

WWT Wastewater treatment 

 

000282
Caribbean Petroleum Company Final October 2015 

9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

1.0 EXECUTIVE SUMMARY 

1.1 Incident Summary 

On the night of October 23, 2009, a large explosion occurred at the Caribbean Petroleum 

Corporation (CAPECO) facility in Bayamón, Puerto Rico, during offloading of gasoline from a 

tanker ship, the Cape Bruny, to the CAPECO tank farm onshore. A 5-million gallon 

aboveground storage tank (AST) overflowed into a secondary containment dike. The gasoline 

spray aerosolized, forming a large vapor cloud, which ignited after reaching an ignition source in 

the wastewater treatment (WWT) area of the facility. The blast and fire from multiple secondary 

explosions resulted in significant damage to 17 of the 48 petroleum storage tanks and other 

equipment onsite and in neighborhoods and businesses offsite. The fires burned for almost 60 

hours. Petroleum products leaked into the soil, nearby wetlands and navigable waterways in the 

surrounding area. 

1.2 Public Impact and Emergency Response 

The blast created a pressure wave registering 2.9 on the Richter scale1 and damaging 

approximately 300 homes and businesses up to 1.25 miles from the site. In particular, the nearby 

Fort Buchanan military facility suffered over $5 million in damages; air and vehicle 

transportation was interrupted; and thousands of gallons of oil, fire suppression foam, and 

contaminated runoff were released to the environment. (Figures 9 and 10 show a map of 

communities neighboring the CAPECO facility and community damage.) CAPECO and the local 

fire department lacked the appropriate equipment or training to extinguish multiple tank fires, 

prolonging the environmental effects of the incident. The accident resulted in an emergency 

declaration for assistance from President Obama for the affected municipalities. 

1.3 CSB Investigation 

The CSB team arrived at the incident scene two days after the October 23, 2009, incident. The 

investigation team photo-documented the incident site, inventoried key evidence, interviewed 

witnesses, and assessed community damages. The team consulted tank experts and researched 

previous tank overfill incident investigations. Using several analytical tools, including timeline 

construction (Appendix A) and logic tree and AcciMap analysis2

 (Appendix C), the team 

 

1

 Puerto Rico Seismic Network. Informe Especial, Explosión de Caribbean Petroleum en Bayamón, PR, 23 de 

octubre de 2009. University of Puerto Rico Mayagüez Campus. 2

 AcciMap analysis is a causal diagram showing how factors remote from the immediate accident sequence 

contribute to the accident. Hopkins, A. An AcciMap of the Esso Australia Gas Plant Explosion. Australian 

000283
Caribbean Petroleum Company Final October 2015 

10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

determined the root and systemic causes of this incident. The CSB investigators coordinated their 

work with the Puerto Rico Occupational Safety and Health Administration (PR OSHA) and the 

US Environmental Protection Agency (EPA). 

1.4 CSB Findings 

The CSB finds US regulations fail to consider bulk petroleum storage tank terminals similar to 

CAPECO as high-hazard facilities. Insufficient regulatory requirements for a hazard assessment, 

an unreliable level control and monitoring system, inadequate independent or redundant level 

alarms, and a poor safety management system led to CAPECO operating a high-hazard facility 

without the safeguards3

 necessary to prevent overfill. In addition, the CSB found the local Puerto 

Rico fire department was unprepared to address a vapor cloud explosion and multiple tank fires. 

This incident demonstrates that bulk aboveground tank terminals near residential populations are 

high-hazard facilities, and therefore regulations requiring a risk assessment and multiple layers 

of protection to prevent overfilling a tank, are necessary to protect workers and the public. 

1.5 Key Findings 

Physical Cause

1) During an operation to transfer gasoline from the vessel Cape Bruny tanker ship, 

Caribbean Petroleum Tank 409 overflowed with gasoline, resulting in a vapor cloud that 

encompassed 107 acres of the CAPECO tank farm. 

2) The topography of the tank farm allowed the gasoline vapor cloud to migrate through 

open dike valves to low-lying areas of the tank farm and to the storm water retention 

pond in the wastewater treatment area, where it ignited. 

3) Multiple physical causes likely contributed to Tank 409 overfill: 

 Malfunctioning of the tank side gauge or the float and tape apparatus during 

filling operations led to recording of inaccurate tank levels; 

 Normal variations in the gasoline flow rate and pressure from the Cape Bruny 

without the facility’s ability to identify and incorporate the flow rate change in 

real time into tank fill time calculations may have contributed to the overfill; 

 Potential failure of the tank’s internal floating roof due to turbulence and other 

factors may have contributed to the overfill. 

 

National University. Obtained from http://www.qrc.org.au/conference/_dbase_upl/03_spk003_Hopkins.pdf 

(accessed January 2012). 

3

 Safeguards are any device, system, or action that would likely interrupt the chain of events following an initiating 

event. 

000284
Caribbean Petroleum Company Final October 2015 

11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Control and Monitoring Failures

1) Inadequate tank filling procedures. 

2) CAPECO’s normal filling operations required that operators partially open the intake 

valve to a tank while filling another tank, because the pressure in the pipeline from the 

dock made manually opening a fully closed valve difficult. This inefficiency increased 

the potential error in fill time calculations. Refer to Section 6.9.4. 

3) Unreliable tank gauging equipment. 

Safety Management Systems 

1) Tanks were not equipped with an independent high-level alarm system. 

2) Tanks were not equipped with an independent Automatic Overfill Prevention System for 

terminating transfer operations. 

Human Factors

1) The design of the dike valve system made it difficult to distinguish between open and 

closed valve positions 

2) Insufficient lighting in the tank farm areas hindered operators from observing the 

overfilling of Tank 409 and the subsequent vapor cloud formation. 

Lack of Reporting Requirements 

1) An incomplete national incident database for assessing the frequency of specific types of 

incidents at bulk petroleum storage tank terminals inhibits the development and 

implementation of more tailored regulatory requirements, industry consensus standards, 

and best practices in this sector. 

Emergency Response Findings 

1) CAPECO and the local fire department lacked sufficient firefighting equipment to 

effectively fight and control a fire involving multiple tanks because they are not required 

to conduct a risk analysis where they have to consider and plan for the potential of a 

vapor cloud explosion involving multiple tanks. 

2) CAPECO did not preplan with local emergency responders or adequately train facility 

personnel to deal with a fire involving multiple tanks. 

3) Local fire departments lacked sufficient training and resources to respond to industrial 

fires and explosion. 

4) A lack of coordination among the 43 federal, commonwealth and nongovernmental 

organizations that responded to the CAPECO incident further complicated the emergency 

response. 

000285
Caribbean Petroleum Company Final October 2015 

12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Regulatory Findings 

1) The US regulatory system does not consider bulk aboveground storage tank terminals 

storing flammable liquid to be highly hazardous, even those near communities. Although 

the EPA characterizes facilities like CAPECO as substantial harm facilities, under the 

Facility Response Plan requirements, the risk assessment required for these facilities do 

not consider the potential of multiple tank releases as a worst case scenario. 

2) Due to a lack of regulatory coverage under the Occupational Safety and Health 

Administration’s (OSHA) Process Safety Management (PSM) standard and the 

Environmental Protection Agency’s (EPA) Risk Management Plan (RMP), tank terminal 

facilities are not required to conduct risk assessments to address flammable hazards on 

site or to follow Recognized and Generally Accepted Good Engineering Practices 

(RAGAGEP). 

3) A high-level alarm system or high-integrity overfill prevention system are not required by 

OSHA’s Flammable and Combustible Liquids standard, the EPA’s Spill Prevention 

Control and Countermeasure (SPCC) requirements. While facilities covered under SPCC 

must certify a SPCC plan by a Professional Engineer, only the EPA FRP plans meeting 

the substantial harm criteria are approved by the EPA. Furthermore, under SPCC 

facilities similar to CAPECO do not have to report overfill incidents unless oil is 

discharged to navigable waters. 

Industry Standards

1) Despite past incidents in the US and internationally, the response of US industry, trade 

associations, professional associations, and standard-setting organizations has been 

inadequate to prevent similar incidents in the US. 

2) NFPA 30 only requires one layer of protection on storage tanks, at minimum consistent 

gauging without requirement for an independent or redundant level alarm or an automatic 

overfill prevention system. 

3) ANSI/API 2350 only requires an automatic overfill prevention system for remotely 

operated facilities and does not offer substantial guidance on conducting a risk 

assessment that considers the complexity of site operations, the type of flammable and 

combustible liquids stored at the facility or proximity to nearby communities when 

considering the necessary safeguards to protect the public. In addition, there is a lack of 

one comprehensive industry standard to address tank terminal operations, including tank 

filling operations and overfill prevention. 

4) ICC does not require an independent audible or visual alarm to indicate rising liquid 

levels. 

To prevent a similar incident from occurring, the CSB recommends policy changes to the 

following regulatory agencies, consensus, and industry standard-making bodies: 

 United States Environmental Protection Agency (EPA) 

000286
Caribbean Petroleum Company Final October 2015 

13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

 United States Occupational Safety and Health Administration (OSHA) 

 American Petroleum Institute (API) 

 International Code Council (ICC) 

 National Fire Protection Association (NFPA) 

 

000287
Caribbean Petroleum Company Final October 2015 

14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

2.0 CARIBBEAN PETROLEUM CORPORATION 

2.1 Company History 

Petroleum refining operations first began at the CAPECO site in Bayamón, Puerto Rico in 1955. 

Ownership changed several times in the decades following the purchase of the refinery by Gulf 

Oil Corporation in 1962 and Chevron Corporation in 1984. First Oil Corporation acquired the 

refinery in 1987 and operated it as a 48,000 barrel-per-day petroleum refining facility until 

2000,4 when the refinery closed. After filing for bankruptcy in 2001, the company reorganized 

and reduced operations to the terminal and 170 Gulf service stations throughout Puerto Rico. 

CAPECO filed for bankruptcy in 2001 and reorganized in 2003 to operate solely as a petroleum 

storage terminal and distribution facility. 

2.2 Status of CAPECO 

In August 2010, CAPECO declared bankruptcy. (See Section 5.7.) On May 11, 2010, Puma 

Energy Caribe, LLC acquired the Bayamón facility and other CAPECO assets under a broader 

EPA settlement. The settlement required cleanup activities under the Comprehensive 

Environmental Response, Compensation, and Liability Act (CERCLA),5 Resource Conservation 

and Recovery Act (RCRA),6 and Oil Pollution Act (OPA).7

2.3 Site Description 

The CAPECO site covered 179 acres, 115 of which were developed into four areas: a tank farm, 

the decommissioned refinery, an administration area, and a wastewater treatment (WWT) plant. 

(See Figure 1.) The facility also owned and operated a loading dock on San Juan Bay in 

Guaynabo, 2.5 miles northeast of the site. (See Figure 2.) At the time of the incident, CAPECO 

employed 65 people. 

 

4 Documentation of Environmental Indicator Determination RCRA Corrective Action Environmental Indicator (EI) 

RCRIS Code (CA725), Current Human Exposures Under Control (U.S. Environmental Protection Agency, 1999). 5

 Congress enacted CERCLA, commonly known as Superfund, in 1980 to provide tax collected money to federal 

authorities to respond directly to releases or threatened releases of hazardous substances that may endanger public 

health or the environment. CERCLA Overview (Washington, DC: U.S. Environmental Protection Agency). 

http://www.epa.gov/superfund/policy/cercla.htm (accessed December 19, 2014). 

6

 RCRA, enacted in 1976, gives EPA the authority to control hazardous waste from “cradle to grave.” U.S. 

Environmental Protection Agency. http://www2.epa.gov/aboutepa/new-law-control-hazardous-wastes-end-opendumping-promote-conservation-resources (accessed December 19, 2014). 7

 Signed into law in August 1990, the OPA improved the nation’s ability to prevent and respond to oil spills by 

establishing provisions that expand the Federal government’s ability and provide money and resources necessary to 

respond to oil spills. Oil Pollution Act Overview (Washington, DC: U.S. Environmental Protection Agency). 

http://www.epa.gov/osweroe1/content/lawsregs/opaover.htm (accessed December 19, 2014). 

000288
Caribbean Petroleum Company Final October 2015 

15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

 

 Figure 1: CAPECO tank farm, WWT, and decommissioned refinery overview 

 

000289
Caribbean Petroleum Company Final October 2015 

16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

3.0 SITE OPERATIONS 

CAPECO operated as a storage and distribution facility for gasoline, fuel oil, jet, and diesel fuel. 

The site was capable of storing approximately 90 million gallons of product.8 

Figure 2: CAPECO Pipeline to Gulf Oil Dock where gasoline is offloaded from ships

3.1 Normal Site Operations 

During normal site operations, vessels connected to the facility’s pipeline at the dock in San Juan 

Bay and pumped petroleum products to one or more of the facility’s aboveground storage tanks. 

Onsite, pumps transferred fuels between tanks, to the onsite truck loading facility, to the Puerto 

Rico Electric Power Authority (PREPA), and to the airport. Tanker trucks also received fuel 

onsite at the facility loading station for distribution across Puerto Rico. 

3.2 Tank Farm Operations 

Two tank farm operators, one WWT operator, and one shift supervisor conducted normal site 

operations staffing work on three 8-hour rotating shifts at the facility, from 6 a.m. to 2 p.m., 2 

p.m. to 10 p.m., and 10 p.m. to 6 a.m. 

Tank farm operators recorded tank levels every morning during a regular shift. Taking 

instructions from the facility’s Planning Department, tank operators manually executed onsite 

 

8

 C. Jimenez, K. Glenn, G. Denning. International Oil Spill Conference Proceedings, 2011 (1) (Washington, DC, 

1999). http://ioscproceedings.org/doi/pdf/10.7901/2169-3358-2011-1-90 (accessed December 19, 2014). 

2.5 miles

CAPECO

Terminal

Dock

000290
Caribbean Petroleum Company Final October 2015 

17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

fuel transfers, blending gasoline with methanol, pumping products to PREPA and the airport via 

the pipeline, and receiving shipments from the dock in San Juan Bay. 

3.3 Storm Water and Oil Runoff Management 

Normal operations at the tank farm required that one operator inspect the secondary containment 

area for accumulating storm water and oil. Operations staff managed the secondary containment 

valves that drained storm water through storm water pipes to the storm water retention pond in 

the WWT plant. The morning operator closed the dike valves after rainstorms, and the evening 

WWT operator (2 p.m. to 10 p.m.) verified the valves were closed. Operators then recorded the 

secondary containment valve position in a valve inspection log. When oil was present in 

secondary containment, operators used a vacuum truck to remove it. (See Section 6.9.1.) 

3.4 Ship Unloading and Tank-Filling Operations 

The CAPECO Planning and Economics Department (Planning Department) was integral to the 

operations of the tank farm and management of fuel transfer operations.9 Its staff coordinated 

fuel deliveries with the company and its fuel suppliers and instructed operators on which tank to 

fill, specified the volume of materials, and determined the filling schedule during unloading 

operations. 

Similar to other tank terminals, the CAPECO Planning Department directed operations in the 

tank farm. After obtaining tank levels from the night-shift operations staff, the Planning 

Department rented tank space to various petroleum vendors interested in storing gasoline, jet 

fuel, or fuel oil. 

Prior to product delivery, the Planning Department, the petroleum vendor, and the fuel 

distributor, in this case the Cape Bruny, negotiated a fee schedule for charging CAPECO based 

on the length of time to complete tank-filling operations at the terminal. The purchase terms, fee 

schedules and delivery contracts contained credits and penalties for all parties involved in 

offloading operations. If CAPECO operators completed filling operations in less than the allotted 

time, the Cape Bruny would refund CAPECO fees for the unused time. If filling operations took 

longer, the Cape Bruny could charge CAPECO the negotiated rate for the additional time. The 

Daily Operation Report from the Planning Department contained all filling instructions, 

 

9

 Transfer operations for receiving a product into a tank encompasses all associated activities, including notification 

(verbally, electronically, or by other means) of a potential tank overfill and termination of flow into the tank 

(shutdown or diversion of product). American Petroleum Institute. ANSI/API Standard 2350. Fourth edition 

(Washington, DC: American Petroleum Institute, May 1, 2012). 

000291
Caribbean Petroleum Company Final October 2015 

18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

including the level of product the tank should receive and the time it should take to fill the tank 

to the appropriate level. The Planning Department calculated the time based on the capacity of 

the pipeline and the volume discharged from the ship. CAPECO operations personnel were 

required to report any discrepancies in filling time to the Planning Department. 

3.5 Communication 

Due to the manual nature of operations, communication was essential to the success of the 

unloading process. During unloading operations, the operators remained in communication via 

radio with the WWT operator or the shift supervisor to ensure all necessary valve alignments and 

efficient switching between tanks occurred. Tank sizes varied at the CAPECO tank terminal, and 

only one tank, Tank 107 (Figure 1), was large enough to receive a full shipload of gasoline from 

the Cape Bruny tanker ship. In addition, due to storage limitations only a few designated tanks 

held gasoline. Because of this arrangement, CAPECO tank operators commonly switched flow 

among multiple tanks during unloading operations of a single shipment, requiring constant 

contact between tank operators and the shift supervisor. 

3.6 Process Description 

3.6.1 Level Measurements 

CAPECO and cargo ship suppliers used multiple checks to ensure the correct amount of gasoline 

was unloaded and stored. Tank level measurement on a receiving tank occurred several times 

during filling operations. First, the tank farm operator recorded hourly readings by observing the 

level gauge on the side of the tank or the computer in the operator office displaying the same 

data. Then the tank farm operator and independent inspector placed car seals10 on the appropriate 

receiving tank valves. Finally, the independent inspector11 manually gauged the tank before and 

after filling operations and recorded it on gauge tickets shared with both the supplier and 

CAPECO. This dual verification measurement of tank levels was required for all material 

transfers involving a change of ownership. 

 

10 Car Seal: A security device consisting of a thin strip of metal cable usually attached to tank valve or hopper car 

closures. A broken seal indicates possible tampering or unauthorized tank entry. 11 The independent, third-party inspector, employed by Intertek Caleb Brett, was responsible for determining the 

tank levels before and after filling operations to ensure that the correct amount of product was discharged to the 

tank. Caribbean Petroleum Corporation, Bayamón, PR. Communication, 2009. 

000292
Caribbean Petroleum Company Final October 2015 

19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

3.6.2 Manual Tank Gauging 

Prior to the start and end of filling operations, the independent inspector manually measured the 

fuel tank levels by lowering a gauging tape12 into the tank. (Figure 3.) A CAPECO operator 

 

12 The gauging tape used to measure tank liquid levels is similar to a common household measuring tape; it coils and 

has markings in feet and inches. Because gasoline and other fuels float on water, the operator coats the tape with 

special pastes to measure both the depth of water in the bottom of the tank and the fuel above it. Knowing the 

depth of the two liquids, the independent inspector and tank operators read the total liquid volume and the water 

volume from the strapping table. The operators subtracted the volume of water from the total volume to calculate 

the amount of fuel in the tank. When properly executed, this system accounted for the water volume and 

determined the fuel amount in a tank. Caribbean Petroleum Corporation, Bayamón, PR. Communication, 2009. 

Figure 3: Manual and Automatic Tank Gauging. (A) Manual Gauging requires an operator to use 

a tape and measure to determine the liquid levels inside the tank. (B) Automatic Tank Gauging 

(ATG) requires an operator to read a level measurement from a tank gauge mounted to the side 

of the tank.

000293
Caribbean Petroleum Company Final October 2015 

20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

verified the measurements by comparing the tank liquid level to the strapping table13 for that 

tank. The independent inspector and the operator placed car seals on various block valves of 

receiving tanks to prevent flow into or out of the tank before measuring the level in the tank and 

recording the readings on a form called a tank gauge ticket. This tracking method assured the 

transfer of an accurate volume of purchased product to the specified tank. 

3.6.3 Manual and Automatic Tank Gauging 

In addition to manual gauging by the independent inspector, operators used a float and tape 

gauge14 mounted to the side of a tank, which automatically measured and displayed the tank 

level prior to the transfer, during transfer, and after product transfer termination.15 ANSI/API 

Standard 2350: Overfill Protection for Storage Tanks in Petroleum Facilities (2012)16 defines 

using float and tape level measurement instrumentation in this manner as an automatic tank 

gauging (ATG) system. (See Figure 4 and Section 6.5.)17

A typical float and tape gauge consists of depth-indicating dials, a motor, a long metal tape, and 

a sealed hollow cylinder called a float, which floats on the surface of the liquid in the tank. One 

end of the long metal tape attaches to the float, while at the other end, a motor winds the tape 

into a coil to maintain constant tension on the tape. As the liquid level in the tank falls, the 

weight of the float pulls the tape, and the motor allows the tape to extend farther into the tank. As 

the liquid level in the tank rises, the motor senses looseness in the tape and winds the tape into a 

coil to maintain the required tension. As the tape winds and unwinds, the mechanical dial rotates 

to indicate the total depth of liquid in the tank and displays the value on the side gauge (Figure 

4).18 Section 6.5 analyzes the failure of the ATG system in the incident. 

 

13 Strapping table is a tabular record of a tank’s volume versus height to convert measurements obtained from a tape 

(or strap) to liquid volumes. It is also known as a gauging table. Access Engineering, McGraw Hill. 

http://accessengineeringlibrary.com/search?q=strapping+table (accessed March 2012). 14 The Shand and Jurs level instrument used by CAPECO is actuated by a float and stainless steel tape that measures 

tank levels recorded on a digital counter mounted to the side of a tank, allowing operators to read the tank liquid 

levels. Automatic Tank Level Gauge Model 92021. Product Data Sheet. Shand & Jurs: Hillside, IL. 

15 Termination refers to stopping flow of a product into a tank. American Petroleum Institute. ANSI/API Standard 

2350, Fourth edition (Washington, DC: American Petroleum Institute, May 1, 2012). 

16 ANSI/API Standard 2350-2012: Overfill Protection for Storage Tanks in Petroleum Facilities. Fourth edition 

(Washington, DC: American Petroleum Institute, May 2012). 

17This system is similar to the level measurement system that led to the CSB investigation of the explosion and fire 

at the Barton Solvents Wichita facility in Valley Center, Kansas. CSB Barton Solvents Case Study. Static Spark 

Ignites Explosion Inside Flammable Liquid Storage Tank. No. 2007-06-I-KS (Washington, DC: U.S. Chemical 

Safety Board, 2008). http://www.csb.gov/assets/1/19/CSB_Study_Barton_Final.pdf (accessed December 18, 

2014). 

18 B. V Enraf. The Art of Tank Gauging. http://enraf.ru/userfiles/File/4416650_rev4.pdf (accessed January 2012). 

000294
Caribbean Petroleum Company Final October 2015 

21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

3.6.4 Computer Monitoring of Tank Level 

In 2004, CAPECO installed transmitter cards on the float and tape gauges that transmit the liquid 

depth to a computer in the operator’s office, the shift supervisor’s office, and the Planning 

Department. The computer instantaneously indicated the values for the liquid depth, the total 

volume based on the strapping table, and the flow rate into or out of the tank as it graphed the 

values over time and calculated the fill rate. When the computer data were unavailable, the shift 

supervisor and tank farm operator used information from the Planning Department, the start time 

of filling, and the strapping table, to calculate the estimated tank fill time. Refer to Section 6.5 

for analysis of the automatic overfill prevention system and Section 6.7 for analysis of overfill 

prevention safeguards in place to prevent overfilling a tank. 

Figure 4: Side gauge: mounted on the side on a tank and displaying the 

amount of liquid in the tank

000295
Caribbean Petroleum Company Final October 2015 

22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

4.0 INCIDENT DESCRIPTION 

4.1 Physical Cause 

On Wednesday, October 21, 2009, the Cape Bruny cargo ship arrived at the CAPECO dock in 

San Juan Bay to unload CAPECO’s near-weekly shipment of more than 11.5 million gallons of 

unleaded gasoline. CAPECO assigned four personnel and three contract employees to assist in 

offloading gasoline from the Cape Bruny to various tanks on site. 

Only Tank 107 with a capacity of 21 million gallons was large enough to hold a full shipment of 

gasoline, but it was already holding product. As a result, CAPECO planned to pump the gasoline 

shipment to four smaller storage tanks (405, 504, 409, and 411) and the balance to Tank 107, 

expecting the filling to take more than 24 hours (Figure 1). One CAPECO operator was 

overseeing transfer operations at the dock, while another was monitoring the gasoline delivery at 

the terminal. See Appendix A, Incident Timeline. 

According to testimony and CAPECO records, shortly after noon on October 22, Tank 411 valve 

was fully opened but operations staff closed the valve to Tank 504 after observing the level 

gauge was physically stuck. Operators then fully opened the valve on Tank 409 and partially 

cracked the valve on Tank 411 directing more than 7,000 gallons of gasoline per minute into 

Tank 409 and allowing a small flow into Tank 411. 

At approximately 6:30 p.m., the operator manually calculated that Tank 409 would reach 

maximum fill sometime between 9 p.m. and 10 p.m., during shift change. To avoid 

complications during shift change, the operator fully opened the valve on Tank 411 and almost 

completely closed the valve on Tank 409. 

CAPECO operators often did not rely on the information displayed on the computer because the 

transmitters were frequently out of service. Therefore, under normal operation, operators 

manually recorded the hourly readings. On the night of the incident, the transmitter on Tank 409 

was not sending level data measurements to the computer. 

At 10 p.m., as Tank 411 reached maximum capacity and was closed, operators fully opened the 

valve on Tank 409. One operator then read the level on the Tank 409 side gauge and reported it 

to his supervisor, who estimated that the tank would be full at 1 a.m.

000296
Caribbean Petroleum Company Final October 2015 

23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

At the 11 p.m. walk-around, the tank farm operator observed the side gauge on Tank 409 during 

his hourly check. The operator called the level into the supervisor who calculated once again that 

the tank should be full at 1 a.m.; however, between the 11 p.m. and 12 a.m. check, Tank 409 

began to overflow. At the 12 a.m. check, operations staff noticed a fog on the ground and on the 

road along Tanks 504, 411 and 409. Fuel gushed from the vents, creating a spray of gasoline that 

formed a vapor cloud and pooled in the secondary containment dike. 

At midnight, the tank farm operator started to perform the hourly check of Tank 409, but before 

reaching the tank, he observed a vapor cloud and a strong smell of gasoline. He contacted the 

dock operator to halt the flow of gasoline to the tank and notified the WWT operator and his 

supervisor to meet at the western edge of the terminal. Despite the lack of illumination, they 

observed a white fog approximately three feet above the ground but could not hear or see 

gasoline overflowing from the vents on Tank 409 due to lack of lighting and the topography of 

the tank farm.19 As they approached the fog, the men noticed the air cool as the fog condensed on 

their hands, despite the 79oF temperature. Noting the potential danger, the supervisor sent one 

operator to the security gate, while the supervisor and another operator drove around the facility 

attempting to find the source of the leak and developing vapor cloud.

At 12:23 a.m., on October 23, 2009, security cameras at CAPECO and neighboring facilities 

recorded the ignition of the vapor cloud in the WWT area. About seven seconds after ignition, 

the vapor cloud exploded, creating a pressure wave that damaged hundreds of homes and 

businesses up to 1.25 miles from the site. The fire propagated through the vapor cloud and 

ignited multiple subsequent tank explosions registering 2.9 on the Richter scale.20 

After the explosion, fuel in the damaged tanks burned for over two days while emergency 

responders fought to control the fire and prevent other tanks from igniting. The large fire 

demanded emergency personnel and resources from across the Commonwealth of Puerto Rico 

and the US mainland. Local fire departments with assistance from an industrial firefighting 

company took 66 hours to extinguish the fire after the explosion. As a result, 17 of the 48 tanks 

burned. (See Figures 5 and 6.) 

 

19 A CSB-commissioned topography study and visual modeling of the perspective from ground level on the night of 

the incident found that it would have been impossible for the operators and supervisor to observe the overflowing 

vents of Tank 409 because they were located a significant distance from the tank and at a lower elevation.. 

20 Puerto Rico Seismic Network. Informe Especial, Explosión de Caribbean Petroleum en Bayamón, PR, 23 de 

octubre de 2009. University of Puerto Rico, Mayagüez Campus. 

000297
Caribbean Petroleum Company Final October 2015 

24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figure 6: Impact of the explosion and multiple tank fires after the October 23, 2009 incident

Figure 5: CAPECO multiple tank farm fire, October 23, 2009.

000298
Caribbean Petroleum Company Final October 2015 

25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

4.2 Tank Overflow 

Based on information from the Cape Bruny and CAPECO, the CSB calculated that Tank 409 

overflowed for an estimated 26 minutes before the vapor cloud ignited (Table 1). 

Table 1

Estimated Volume of Gasoline Overfilling from Tank 409

during Filling Operations at CAPECO

Tank   Estimated Volume of Gasoline into

Tank

Tank 405 4,411bbls

Tank 504 62,984bbls

Tank 411 74,198 bbls

Tank 409 115,667 bbls

Total Offloaded Capacity 257,260 bbls

Total Offloaded from the Cape Bruny 261,878 bbls

Volume of Overfill   4,618 bbls

Volume of Overfill   193,974 gallons

*Overfill Duration   26 minutes

*Estimated flow rate 10,500 bbl/hr

All calculations are approximations based on the tank gauging tickets and

strapping tables from CAPECO.

The CSB determined nearly 200,000 gallons of gasoline,21 the equivalent of 20 fully loaded 

gasoline tanker trucks, rushed out of six vents in the tank. With a light breeze of about 5 mph22

on a 79oF night, the escaped gasoline formed a low-lying vapor cloud that encompassed an area 

equivalent to 107 acres.

The CSB found several possible scenarios could explain the tank overflow: malfunctions with 

the tank’s internal floating roof, increased gasoline flow rate from the ship, and a malfunction 

 

21 This calculated value was obtained using the tank gauging tickets, strapping tables for each tank involved in 

offloading operations and the estimated flow rate based on the pump pressure from the Cape Bruny. 22 According to the Beaufort Scale (Wind Speed), a light breeze is defined as 5-7 miles/hour. On October 22 and 23, 

2009, the average wind speed in San Juan, PR (12 miles from Bayamon, PR) was 5 miles/hour. Beaufort Scales 

(Wind Speed). http://www.unc.edu/~rowlett/units/scales/beaufort.html (accessed June 2012). Weather 

Underground, http://www.wunderground.com/history/airport/TJSJ/2009/10/14/MonthlyHistory.html?MR=1 

(accessed June 2012). 

000299
Caribbean Petroleum Company Final October 2015 

26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

with the side gauge in addition to many systemic failures in CAPECO’s safety management 

system. See Section 6.0 for incident analysis. 

4.3 Vapor Cloud Formation and Migration 

Tanks 409 and 410 were located within the same secondary containment dike.23 Similar to the 

Buncefield incident,24 during the overflow, gasoline sprayed from the tank vents, hitting the 

Tank 409 wind girder and aerosolized, 25 forming a vapor cloud. 26 A CSB topographic survey of 

the site shows that Tanks 409 and 411 were located at the highest point within the tank farm 

area, allowing the vapor cloud to spread to lower lying areas in the direction of the WWT (Figure 

7). See Figure 14, Tank 409 Specifications. 

 

23 Federal aboveground storage tank (AST) requirements mandate that facilities storing a large amount of petroleum 

product construct secondary containment to hold the contents of the largest tank/container with sufficient 

freeboard for rain and be sufficiently impervious to contain discharged oil. Secondary containment must be 

impermeable to the stored materials and have a manually controlled sump pump to collect rainwater. 40 CFR 

112.8(c )(2) states a facility “may empty diked areas by pumps or ejectors; however, you must manually activate 

these pumps or ejectors and must inspect the condition of the accumulation before starting, to ensure no oil will be 

discharged.” Drainage must be addressed in accordance with 40 CFR 112.8(b )(1-5) and 112.8(c)(3) i-iv Above 

Ground Storage Tank Requirements, Code of Federal Regulations, Part 112, Title 40, 2002. 24 The British Health and Safety Executive (HSE) performed a study to demonstrate the mechanism and rate of 

vapor formation after a similar gasoline tank overflow and subsequent vapor cloud explosion at the oil storage 

depot in Buncefield, England, in December 2005. The HSE study found that aerosolization occurs during free fall. 

As the gasoline splashes against the side of the tank and wind girder, the vapor formation rate increases. (A wind 

girder is a metal ring welded around the middle exterior circumference of a tank that reinforces its structural 

integrity.) 

25 Aerosolization is the production or dispersal of an aerosol from a solid or liquid. 

26 Vapour Cloud Formation Experiments and Modelling. RR908 (Harpur Hill, UK: Health and Safety Executive, 

2012). http://www.hse.gov.uk/research/rrhtm/rr908.htm (accessed July 2012). 

000300
Caribbean Petroleum Company Final October 2015 

27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figure 7. Topographic Survey of CAPECO Tank Farm showing the gasoline vapor cloud migration from 

higher elevation (Tank 409-Red and Tank 411-Blue) toward low-lying areas by the WWT plant, the south 

eastern end of the refinery and wetlands to the north. The cloud indicates the approximate area where the 

vapor cloud migrated based on surveillance footage. 

4.4 Open Dike Drain Valves 

Although the October 22, 2009, secondary containment valve inspection log indicated that the 

dike valve for Tank 409 was closed, the CSB determined that the valve was open after the 

incident.27 The open dike valve directed gasoline to the storm water retention pond located in the 

WWT area where the large surface area pond provided a second location for gasoline to collect 

and vaporize. Refer to Section 6.9 for dike valve and human factors analysis. 

 

27 CSB investigators tested the dike valve after the incident by pouring water into the dike area of Tank 409 and 

observed the flow to the storm water retention pond in the WWT area through the underground storm water 

channel. 

000301
Caribbean Petroleum Company Final October 2015 

28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

4.5 Ignition 

The developing vapor cloud expanded from east to west toward the WWT area, north toward the 

wetlands area and the highway, south toward an east-west CAPECO site road, and east toward 

the neighboring Fort Buchanan (Figure 7). Onsite security video captured the ignition and initial 

flash fire in the WWT area occurring seconds before the explosion (Figure 8). The open 

secondary containment valves allowed the gasoline pool to extend to the storm water retention 

pond in the WWT area, which is not electrically classified.28 The CSB did not determine the 

exact source of the ignition, but the areas where the vapor cloud traveled contained multiple 

potential ignition sources. 

 

28 NFPA 70 defines hazardous (Electrically Classified) locations as areas where a fire or explosion hazard may exist 

because of the presence of flammable gases or vapors, flammable liquids, combustible dust, or ignitable fibers. 

Electrical Classification: Using NFPA 70 and NFPA 499 to Classify Hazardous Locations. 

http://www.oshainfo.gatech.edu/comb-dust/elec-classification.pdf (accessed December 17, 2014). 

Figure 8: CAPECO surveillance footage of flame propagation during 

October 23, 2009 CAPECO explosion

000302
Caribbean Petroleum Company Final October 2015 

29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

5.0 EMERGENCY RESPONSE 

5.1 Response Description 

Forty-three organizations responded to the incident, including federal, commonwealth, and 

nongovernmental organizations. The large number of responding agencies made communication 

difficult because the incident commander and the Unified Command Post changed frequently 

when different agencies claimed priority jurisdiction. The Bayamón and Cataño Fire 

Departments first arrived at the front gate of CAPECO at approximately 12:30 a.m. on October 

23, 2009. At that time the fire had extended to approximately 103 acres (1,500 feet by 1,500 feet) 

of the tank farm, but firefighters were prohibited from entering the site until CAPECO safety 

personnel and the site fire chief arrived approximately 45 minutes later. Upon entering the 

facility, firefighters discovered that CAPECO lacked the necessary firefighting equipment to 

fight multiple tank fires at once. They found worn or missing fire hoses, stationary fire monitors 

without sufficient pressure to reach the tops of tanks, and insufficient equipment to provide the 

large quantities of foam necessary to control a fire of this magnitude. 

Furthermore, CAPECO personnel and local firefighters were trained only for a worst-case 

scenario involving one tank on fire, rather than 11 tank fires at the same time caused by a vapor 

cloud explosion. Without sufficient equipment or training, local responders attempted to fight the 

multiple tank fires but failed as the fire encompassed more tanks. 

The incident caused the governor of Puerto Rico to request federal assistance, and on October 

24, 2009, the President signed an emergency declaration29 providing assistance for the 

municipalities of Bayamón, Cataño, Guaynabo, San Juan, and Toa Baja (Figure 9). The federal 

emergency declaration activated 17 FEMA Emergency Support Function Annexes (ESF)30 and 

enabled FEMA to provide logistical support, Direct Federal Assistance (DFA), and public 

assistance grants to state and local municipalities.31 Logistical support included setting up a more 

 

29 On October 24, 2009, President Obama signed FEMA-3306-EM-PR for Category B (emergency measures) Direct 

Federal Assistance (DFA).

30 During an Emergency Declaration, FEMA has jurisdiction to release funding under its 17 FEMA Emergency 

Support Function Annexes. The ESFs provides structure and support for coordinating a federal interagency 

response to an incident. Emergency Support Function Annexes (Washington, DC: U.S. Federal Emergency 

Management Agency, 2008). 

31 Through the Emergency Declaration request, Puerto Rico also requested DFA because it lacked the resources to 

handle the event. Under the Stafford Act, DFA states that the President can authorize 100% federal funding for 

emergency work: debris cleanup and/or removal; provision of food, water, ice, and other consumable 

commodities; and other emergency protective measures, under sections 403 and 407. The President also 

authorized the state and municipalities affected by the incident to be reimbursed for emergency protection 

measures through FEMA’s Public Assistance (PA) grant programs. 

000303
Caribbean Petroleum Company Final October 2015 

30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

than 400-person Incident Command Post to assist state and federal agencies and to circulate 

information to the media and respond to public inquiries. In addition to the 530 firefighters and 

other responding agencies, approximately 900 National Guard personnel provided support in 

firefighting efforts, transportation, security, and environmental assessments. These efforts 

continued until Sunday, October 25, 2009, at 11:30 a.m., when the fires were extinguished.32

Ultimately, FEMA provided over $3.4 million33 to 27 entities for response efforts during and 

after the incident. 

5.2 Response Assessment 

The CSB found the following shortcomings in the emergency response to the CAPECO incident, 

many of which were also identified in the FEMA After Action Report,34 compiled after the 

incident. 

 Insufficient equipment. Tank terminals like CAPECO are not considered high-hazard 

facilities under existing EPA and OSHA regulations;35 therefore, they are not required to 

conduct a risk analysis where they consider the potential of a vapor cloud explosion and 

multiple tank fires. Neither CAPECO nor the fire department had the requisite amount of 

foam and adequate equipment to effectively fight and control a fire involving multiple tanks. 

 Insufficient preplanning with local fire departments or firefighter training at the site level. 

CAPECO did not preplan with local emergency responders, set up mutual aid with other 

hazardous materials sites, or adequately train facility personnel to address a tank farm fire 

involving multiple tanks. The CSB found that after the refinery shut down in 2000, the 

facility curtailed investment into its firefighting operations on-site. In fact, training for 

CAPECO personnel was limited only to fighting a fire involving one tank, not an incident 

involving multiple tanks.

 Limited emergency preparedness. Local fire departments did not have sufficient training or 

resources to respond to industrial fires and explosions, which resulted in firefighting delays 

from insufficient foam and equipment. The limited training and resources of the local fire 

 

32 The PR Fire Department extinguished the fires with assistance from a contractor that specialized in tank farm 

firefighting. 

33 Summary of Declaration Report: Public Assistance Program (Washington, DC: U.S. Federal Emergency 

Management Agency, June 11, 2012). 

34 Caribbean Petroleum Corporation (CaPeCo) / Gulf Refinery Explosion After Action Report (AAR). FEMA 3306-

EM-PR. October 23-26, 2009 (Washington, DC: U.S. Federal Emergency Management Agency, 2010). 

35 EPA considers facilities as CAPECO as a “significant and substantial harm facility” under the Facility Response 

 Plan regulations. See Section 8.6.6 for further discussion. 

000304
Caribbean Petroleum Company Final October 2015 

31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

departments resulted in an inefficient firefighting operation. The fires were not extinguished 

until an industrial firefighting company suppressed the last of the tank fires. FEMA’s After 

Action Report identified additional training and exercises for the Incident Management Team 

on an all-hazards approach to improve the initial multiagency response and recovery. 

 Overlapping multi-agency, multi-jurisdictional response. Forty-three federal, 

commonwealth, and nongovernmental organizations responded to the incident.36 As new 

agencies arrived, the person in the Incident Commander role changed without following the 

Incident Command System/National Incident Management System (ICS/NIMS). For 

example, the Puerto Rico Emergency Management Agency (PREMA) operated using 

ICS/NIMS, whereas the PR National Guard conducted operations using military standards.37

FEMA’s After Action Report also identified poor integration of Unified Command with the 

National Guard and PREMA after the Governor’s office declared the emergency. The report 

further emphasized the need for additional joint training and exercises to improve the 

integration of the ICS with the NIMS. The FEMA report also calls for the development of 

Mass Fatality and Mass Casualty plans to address catastrophic incidents. 

5.3 Incident Impact 

5.3.1 Community Impact 

Despite approximately 1,600 people residing adjacent to the CAPECO facility in the Puente 

Blanco community38 and about 48,500 residents living in Cataño three miles from the incident 

site (Figure 9), the 2009 explosion and fires did not result in any fatalities. However, shrapnel 

and glass from the blast caused minor injuries to three people at Fort Buchanan. Nearby residents 

of the surrounding communities were awakened by the blast and ensuing fire. The CSB learned, 

regulatory authorities in Puente Blanco issued unclear evacuation orders by bullhorn as they 

drove through the community. With no planned evacuation routes or shelters, residents crowded 

into the narrow streets. Some members of other nearby communities evacuated voluntarily to 

escape damaged homes and potential health effects from the smoke and vapors generated by the 

fire. 

 

36 Caribbean Petroleum Corporation (CaPeCo) / Gulf Refinery Explosion After Action Report (AAR). FEMA 3306-

EM-PR, October 23-26 2009 (Washington, DC: U.S. Federal Emergency Management Agency, 2010): 9.9. 

37 Ibid., p.6. 

38 Ibid., p.4. 

000305
Caribbean Petroleum Company Final October 2015 

32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Fort Buchanan experienced the most severe damage—suffering an estimated $5 million in repair 

costs. Community impact assessments39 found most of the structural damage occurred in the 

Puente Blanco neighborhood where PREMA and the Department of Housing (DOH) found 

damage to 232 of the 266 homes assessed; 139 were repaired and six were demolished by 

November 2009.40 The Puente Blanco community also experienced environmental contamination 

to several surface water bodies, including federally protected wetlands and streams surrounding 

the CAPECO site. After assessing 289 homes damaged by the explosion in the Cataño 

community, the Small Business Administration (SBA)41 designated 25 single-family homes as 

destroyed or severely damaged at or beyond 40% of their fair market value. (See Figure 10.) 

Figure 9: Communities neighboring the CAPECO facility 

 

39 The Small Business Administration (SBA), in conjunction with the PR Emergency Management Agency 

(PREMA) and the PR Department of Housing (DOH), conducted community assessments after the incident. 

40 Federal Emergency Management Agency. Caribbean Petroleum Corporation (CaPeCo) / Gulf Refinery Explosion 

After Action Report (AAR). FEMA 3306-EM-PR. October 23 – 26, 2009 Incident Recovery Activities Summary: 

Caribbean Petroleum Corporation Fuel Explosion (November 18, 2009). 41 The SBA’s mission is to help disaster-stricken communities through direct loans to businesses, homes, and non -

profit organizations. SBA Disaster Recovery Plan. https://www.sba.gov/content/disaster-recovery-plan (accessed 

December 19, 2014). 

000306
Caribbean Petroleum Company Final October 2015 

33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figure 10: Community damage surrounding the CAPECO facility 

Figure 11: Oil Spill into nearby wetlands (photo from NOAA.gov) and in a local community drain after 

CAPECO explosion and tank fires

000307
Caribbean Petroleum Company Final October 2015 

34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

5.4 Impact to the Commonwealth 

The incident forced the Commonwealth government and local officials to evacuate 

approximately 3,000 people in a nearby prison and other government facilities. Changing wind 

patterns caused the governor to prepare for the evacuation of over 30,000 individuals likely 

affected by particulate fallout from the smoke plume that extended miles out to sea. Overall, 

approximately 600 people used the shelters in Cataño, Guaynabo, and Toa Baja.42

5.5 Environmental Impact 

The CAPECO incident released thousands of gallons of oil, fire suppression foam, and 

contaminated runoff to Malaria Creek, which traverses the Puente Blanco community to the San 

Juan Bay. CAPECO and the EPA collected and shipped offsite an estimated 171,000 gallons of 

oil and 22 million gallons of contact water.43, 44 Overall, approximately 30 million gallons of 

petroleum was released via storm water channels, on-site and off-site surface water bodies, and 

neighboring wetlands to San Juan Bay.45 Environmental assessments jointly conducted by the 

EPA, the US Fish and Wildlife Service (USFWS), and the Puerto Rico Department of Natural 

Resources (PR DNR) found dead wildlife and both aquatic and avian species, including several 

legally protected species, covered in oil.46 (Figure 11.)

5.6 Impact to Transportation and Commerce 

The incident also disrupted commerce and transportation corridors on the ground and in the air in 

the San Juan area. A main interstate, PR-22, was closed for three days, limiting access to work 

and shopping malls and interrupting transportation of goods to and from the main port. The 

smoke plume also resulted in airspace interruptions and temporary flight restrictions for the Luis 

Muñoz Marín International Airport. The explosion caused many tourists in the San Juan area to 

 

42 Caribbean Petroleum Corporation (CaPeCo) / Gulf Refinery Explosion After Action Report (AAR). FEMA 3306-

EM-PR. October 23-26, 2009. (Washington, DC: U.S. Federal Emergency Management Agency, 2010): 11. 

43 Contact water contains petroleum product. 

44 C. Jimenez, K. Glenn, G. Denning. International Oil Spill Conference Proceedings, 2011 (1). 

http://ioscproceedings.org/doi/pdf/10.7901/2169-3358-2011-1-90 (accessed December 19, 2014). 

45 Environmental Protection Agency. Securing Cleanup from ashes at the Puma Energy Caribe Site. 2014. 

http://www2.epa.gov/enforcement/case-study-cleanup-puma-energy-caribe-site-puerto-rico (accessed May 4, 

2015). 

46 C. Jimenez, K. Glenn, G. Denning. International Oil Spill Conference Proceedings, 2011 (1). 

http://ioscproceedings.org/doi/pdf/10.7901/2169-3358-2011-1-90 (accessed December 19, 2014). 

000308
Caribbean Petroleum Company Final October 2015 

35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

flee, affecting the local economy. The total economic and psychological effects of these major 

disruptions have not been determined.47

5.7 Impact of Overfill Incident on CAPECO 

In May 2010, CAPECO was required to pay more than $8.2 million for environmental liabilities 

associated with the Bayamón petroleum distribution facility and the 170 service stations it owned 

and leased under a settlement agreement.48 In the same month, the EPA issued a Notice of 

Federal Assumption to take responsibility for the remaining cleanup at the CAPECO site.49

6.0 INCIDENT ANALYSIS 

6.1 Systemic Failure at CAPECO Led to Failure of the Overfill Prevention 

System 

The CSB determined that numerous technical and systemic failures contributed to the explosion 

and multiple tank fires at the CAPECO tank terminal. The CSB found that multiple layers of 

protection failed within the level control and monitoring system at the same time. In addition a 

lack of independent safeguards contributed to the overfill. James Reason’s Swiss Cheese Model 

best demonstrates these systemic failures that led to the accident.50 Reason postulates that an 

accident results from the breakdown of the “interaction between latent failures51 and a variety of 

local triggering events (active failures)”52 and although rare, the “adverse conjunction of several 

 

47 Ibid. 

48 United States Announces Bankruptcy Settlement with Oil Company in Wake of October 2009 Explosion and Fire.

(Washington, DC: U.S. Department of Justice, 2011) http://www.ju.tice.gov/opa/pr/2011/May/11-enrd-657.html

(accessed December 19, 2014). 

49 C. Jimenez, K. Glenn, G. Denning. International Oil Spill Conference Proceedings, 2011 (1) 

http://ioscproceedings.org/doi/pdf/10.7901/2169-3358-2011-1-90 (accessed December 19, 2014). 

50 Reason postulated that “a multiplicity of overlapping and mutually supporting defenses” both hard and soft, allow 

complex systems to function despite a single technical or human failure. Hard defenses include technical devices 

such as automated engineered safety features, physical barriers, alarms and annunciators, interlocks, keys, personal 

protective equipment, non-destructive testing, and improved system design (Reason, 1997). Soft defenses rely 

heavily on a combination of paper and people, i.e., legislation, regulatory surveillance, rules and procedures, 

training, drills and briefings, administrative controls, licensing, certification, supervisory oversight, front-line 

operators (Reason, 1997). 

51 Latent Failures arise from strategic and other top-level decisions made by governments, regulators, manufacturers, 

designers, and organizational managers. They include poor design, supervisory gaps, undetected manufacturing 

defects, maintenance failures, unworkable procedures, poor automation, inadequate training, and insufficient or 

inadequate tools and equipment. These failures can lay dormant in an organization for years and, if undetected or 

unfixed, can contribute to active failures by creating deviation from procedures (Reason, 1997). 

52 Active failures are unsafe acts committed by those at the human-system interface or the sharp end of the system 

by personnel. They are immediate and have short-lived effects (Reason, 1997). 

000309
Caribbean Petroleum Company Final October 2015 

36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

causal factors” from various layers.53 The deficiencies or holes at each layer of protection are 

constantly increasing or decreasing based on management decisions and operational deviations.54 

Figure 12: Contributing to the October 2009 overfill incident at CAPECO were multiple failures of the level 

control and monitoring system in addition to a lack of safeguards like a high level alarm, an independent 

level alarm and an automatic overfill prevention system that allows for automatic shutdown or diversion. 

6.1.1 Inadequate Safety Management System 

The CSB found that the CAPECO overfill incident resulted from a combination of multiple 

deficiencies in the safety management system, including the breakdown in the level control and 

monitoring system within an inadequate safety management system and a lack of safeguards,55

such as an independent high-level alarm and an automatic overfill prevention system. In 

terminals, the level control system includes procedures and equipment used to control tankfilling operations. For many tank operations, the level control system is the operator and the 

alarm system, which together are able to control the fuel receiving process. In some cases, the 

 

53 J. Reason. Human Error. (United Kingdom: Cambridge University Press, 1990). 

54 J. Reason. Managing the Risks of Organizational Accidents (Brookfield: Ashgate, 1997). 55 Safeguards are any device, system, or action that would likely interrupt the chain of events following an initiating 

event. 

000310
Caribbean Petroleum Company Final October 2015 

37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

level control system is an automatic level controller functioning to restrict flow into the tank. The 

CSB finds that systemic failures at CAPECO included: 

 a history of poorly maintaining terminal operations; 

 an inherent financial pressure to fill the tanks within the Planning Department’s stipulated 

time, which was at odds with safety; 

 a failure to learn from previous overfill incidents at the facility; 

 a lack of preventative maintenance for the malfunctioning float and tape device, 

automatic tank gauge transmitters; 

 an unreliable computer for calculating tank fill times; 

 a lack of overfill prevention safeguards as an independent alarm; 

 a lack of formal procedures for tank-filling operations for operators and managers; 

 an insufficient mechanical integrity program for safety critical equipment; 

 poor adherence to human factors principles for safety critical equipment. 

6.2 CAPECO History of Poorly Maintaining Terminal Operations 

The CSB found that CAPECO had a history of poorly maintaining its terminal operations. EPA 

inspection records from 1992 to 2004 indicate a lack of investment in tank valves, maintenance 

of secondary containment around the tank farm, and appropriate level gauges and engineering 

controls. For the 12-year period, SPCC inspections revealed problems with leaking transfer 

valves, leaking product lines, insufficient secondary containment, failure to lock valves that 

could release content, and oil sheen present in dikes and adjacent dikes, indicating the migration 

of oil from a leak or spill through the dike drain valves that were unaddressed in subsequent 

inspections. Although these deficiencies were noted for smaller tanks holding less than 10,000 

gallons of liquid and asphalt tanks not in the main tank farm, the SPCC records offer additional 

insight into how CAPECO management historically maintained the facility. Refer to Section 

8.6.2 for CAPECO SPCC deficiencies. 

6.3 Previous Spill Incidents at CAPECO 

The CSB learned CAPECO had multiple overfills and spills during transfer operations. 

CAPECO records show a history of 15 separate incidents involving tanks of varying sizes from 

1992 to 1999 and 3 others after 2005, when spills or overfills occurred during filling, draining, or 

transferring operations. Among the 15 incidents, 8 were overfills and 7 were spills. Incidents 

resulted from valves in the open position, tank gauge malfunctions, or corrosion of pipes or tank 

shells. 

6.4 Normal Practice to Fill Tanks to Maximum Levels at Odds with Safety 

The CSB found that despite the lack of computer-displayed tank levels, CAPECO operators 

received instructions from the Planning Department to fill the tanks to their maximum fill level 

during the October 21-23, 2009 filling operations, exposing the tank farm to the eventual 

000311
Caribbean Petroleum Company Final October 2015 

38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

incident. The Planning Department coordinated fuel deliveries with fuel suppliers and instructed 

operators on which tank to fill, specified the volume of materials, and determined the filling 

schedule during unloading operations. (See Section 3.4.) The contractual obligation to fill the 

specified tanks in the allotted time or at a faster rate was at odds with safely conducting filling 

operations. 

6.5 Unreliable Safety Critical Equipment 

The CSB found that CAPECO purchased the least effective level-measurement system and 

employed an inadequate maintenance program to care for that system. These shortfalls in safety 

critical equipment in the level control and monitoring system, including the transmitters on the 

side gauge and the float and tape device in the tank, prevented operators from determining tank 

levels during filling operations. Figure 10 illustrates the issues with the level control system at 

CAPECO. 

 

Figure 13: A comprehensive overfill prevention system includes the ATG, high-level alarm (LAH), and 

automatic overfill protection system (LAHH), in addition to the operator and facility procedures that 

govern, monitor, and control the flow of fuel into a tank. 

000312
Caribbean Petroleum Company Final October 2015 

39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

6.5.1 Unreliable Level Control and Monitoring Systems 

CAPECO lacked a reliable automatic level control and monitoring system for measuring tank 

levels. (See Figure 13.) The automatic gauging system at CAPECO, described in Section 3.6.3, 

had a history of repeated failures and prolonged out-of-service periods. On the night of the 

incident, the float and tape device inside Tank 504 became stuck and the transmitters for Tanks 

107 and 409 were not receiving data from the side gauge on Tank 409; therefore, data on the 

tank liquid level and a calculated fill rate into 409 were not available in real time on the 

computer. The computer monitoring system was often compromised by outages from lightning 

strikes and accidental breakage of the computer cables after maintenance activities in the tank 

farm area. In addition, the transmitters56 that sent the data to the computer were also susceptible 

to electromagnetic interference and frequently needed replacing after lightning storms. 

Records show, CAPECO took weeks to replace the faulty transmitters. Therefore, CAPECO 

operators found the computer monitoring system to be unreliable. After completing hourly 

rounds, the operator reported the tank level back to the shift supervisor, who then manually 

calculated the time it would take to fill the tank. The CSB learned that CAPECO operators had 

been calculating the tank levels by hand for decades. This method of monitoring the level in the 

tanks was unreliable given the 15 prior tank spill incidents at the facility and the extended time 

that the level detection equipment remained out of service due to failure. 

6.5.2 Float and Tape Gauges Prone to Failure 

Float and tape gauges, which the aboveground storage tank industry has used for many years, are 

also prone to failure due to historically well-known design flaws.57 Mechanical friction in 

pulleys, spring motors, and indicators degrade measurement reliability, causing the system to 

indicate the liquid depth inaccurately.58 In addition, the gear mechanism attached to the indicator 

and transmitter can disengage, resulting in inaccurate readings, and can disrupt synchronization 

of the transmitter.59 The float tape gauge is also subject to “excessive wear and tear,”60 resulting 

from continuous and sudden movement from turbulence generated by the fuel in the tank.61 

 

56 In accordance with ANSI/API Overfill Protection for Storage Tanks in Petroleum Facilities (ANSI/ANSI/API 

2350), operators recalibrate the level transmitter when they note more than a 3-inch discrepancy in tank levels 

between the physical gauge reading and the float and tape reading recorded at the side gauge. (See section 8.10 for 

API discussion.) 57 B. V. Enraf. The Art of Tank Gauging. http://enraf.ru/userfiles/File/4416650_rev4.pdf (accessed January 2012). 

58 Ibid. 

59 Ibid. 

60 Ibid. 

61 Ibid. 

000313
Caribbean Petroleum Company Final October 2015 

40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

6.5.3 Poor Float and Tape Gauge Maintenance 

The CSB found the float and tape gauges installed on CAPECO tanks were poorly maintained. 

Installed in February 2004, the float and tape gauges were frequently out of service for multiple 

tanks at the same time. The CSB learned that just nine months after initial installation, CAPECO 

hired L&J Engineering to service the level transmitter due to “volume discrepancies,” and one 

month prior to the 2009 explosion, CAPECO hired contractors to calibrate the side gauge on 

numerous tanks in the tank terminal. 

The CSB found CAPECO’s lack of preventative maintenance62 resulted in the failure to repair 

the tank gauging system. A review of CAPECO maintenance logs found no status update on 

maintenance activities addressing a broken float tension on Tank 411 in July 2009, or on fixing 

strapping problems with Tanks 405 or 411 in early October 2009. During October 2009, the level 

transmitter for Tank 409 was out of service from the week prior, and maintenance personnel 

were waiting for repair parts. Despite frequent outages, CAPECO management did not replace 

the level transmitter on any of the tanks and relied only on the float and tape gauge located on 

the side of the tank to obtain tank levels. 

The CSB found many of CAPECO’s tank gauging practices were contrary to the recommended 

practices in API Manual of Petroleum Measurement Standards (MPMS) Chapter 3.1A,63, 64

which might have contributed to inaccurately calculating liquid levels in Tank 409. Volume 

discrepancies in a tank could also arise from using a specific tank gauge, relying on a strapping 

table to calculate tank levels, and using unslotted still pipes. 

 

62CCPS Guidelines for Safe Process Operations and Maintenance: “Preventative maintenance seeks to reduce the 

frequency and severity of unplanned outages by establishing a fixed schedule of routine inspection and service. 

The chief advantage of a preventative maintenance program is that it gives maintenance management the 

flexibility to plan and execute required equipment service with a minimum disruption of essential plant 

operations. The importance of preventative maintenance to process safety management cannot be 

overemphasized.” American Institute of Chemical Engineers, Center for Chemical Process Safety. Guidelines for 

Safe Process Operations and Maintenance (New York: Wiley & Sons, 1995). 

63 American Petroleum Institute. Manual of Petroleum Measurement Standards, Chapter 3.1A, Standard Practice for 

the Manual Gauging of Petroleum and Petroleum Products, 3rd edition (August 2013). 

64 The Manual of Petroleum Measurement Standards, Chapter 3.1A applies to liquids with a Reid vapor pressure. 

Reid vapor pressure is the property of a liquid fuel that defines its evaporation characteristics and a common 

measure of and generic term for gasoline volatility. 

http://www.epa.gov/otaq/fuels/gasolinefuels/volatility/index.htm.) of less than 103 kPa. A Pascal is the SI-derived 

unit of pressure, internal pressure, stress, Young’s modulus, and tensile strength. 1 Kilopascals (kPa) ≡ 1000 Pa. 

or 15 psia. 

000314
Caribbean Petroleum Company Final October 2015 

41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

 Type of gauge: CAPECO did not use an innage gauge, as recommended by the MPMS 

Chapter 3.1A, but relied on an outage gauge65 to obtain tank levels. The MPMS Chapter 

3.1A recommends the use of innage gauges over outage gauges due to movement of the 

tank gauge reference point, but recognizes circumstances when outage gauges are more 

applicable. The MPMS Chapter 3.1A also recommends that facilities inspect both manual 

tape-and-bob assembly and portable electronic gauging devices daily for inconsistencies 

that may introduce error, and that they verify for accuracy at least annually. It also 

requires operations personnel to check the detection signal from the sensor/probe 

annually. The CSB did not find any inspection records demonstrating daily or annual 

float and tape checks at CAPECO. 

 Strapping table inaccuracies: API MPMS Ch. 3.1A advises that a volume discrepancy 

can arise from the inherent inaccuracies in strapping tables, which can lead to 

overestimating or underestimating of tank quantity, among other problems. 

 Calculating tank volume in the critical zone: According to API MPMS Ch. 3.1A, 

“computing tank volume in the critical zone66 is subject to considerable error.” 

Inaccuracies can also arise from strapping tape calibration or thermal expansion, tension 

of the strapping tape, correction of shell expansion due to liquid head (static head), 

measurement of shell plate thickness and calculation of deadwood.67 

 Using still pipes without slots: The independent inspector used a gauge hatch on the fixed 

roof and a gauging funnel on the floating roof to obtain liquid levels in Tank 409 but used 

an 8-inch still pipe68 to physically gauge Tank 107. According to API MPMS Ch. 3.1A, 

still pipes without slots can lead to “serious liquid height measurement, temperature 

determination, and sampling errors.” 

 

65 An innage gauge is a direct measurement of the linear distance along a vertical path from the datum plate or tank 

bottom to the surface of the liquid being gauged. An outage gauge is an indirect measurement of the linear 

distance along a vertical path from the surface of the liquid being gauged to the tank reference gauge point. 

66 The critical zone is the area where liquid is partially displaced by the roof between the point where the liquid just 

touches the lowest section of the roof and the point where the roof floats freely. 

67 Deadwood refers to the ducted weight of all parts of a floating roof, including the swing joint, the drain and other 

items attached to the tank shell or bottom that are resting on the roof supports when the floating roof is immersed 

in liquid. 

68 Still pipe is used to gauge liquid levels inside a tank. The reference gauge point is located on the upper lip, and the 

datum plate is located at the lower lip. Still pipes may have slots or be solid. 

000315
Caribbean Petroleum Company Final October 2015 

42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

6.6 Lack of Formal Procedures for Tank Terminal Operations 

The CSB learned that CAPECO’s standard operating procedures only addressed activities 

requiring a permit to work and did not cover terminal operations. When CAPECO became a fuel 

storage depot, it was no longer required to follow standards that would require regularly updated 

standard operating procedures (SOPs), such as OSHA PSM or EPA RMP. CAPECO last updated 

refinery SOPs to comply with PSM in 1999. In August 2009, CAPECO updated procedures that 

resulted in work permits (hot work, cold work, confined space, and lockout/tagout) but failed to 

update or write terminal operating procedures. The terminal often had activity outlines and 

checklists, but it did not have SOPs to instruct employees how to perform daily activities, such as 

discharging from a vessel or barge, gauging tanks, or operating dike drain valves. For example, 

CAPECO had a two-page document listing the activities to discharge from a vessel or barge, but 

the document did not provide details on how to perform the activities, who would be in charge, 

or what to do in an emergency. In addition, CAPECO lacked procedures dictating how to load 

multiple tanks at the same time. The normal practice of partially opening the tank valves of the 

next tank in line to be filled (See Section 6.9.4) directly influenced the tank fill rate, but the 

facility lacked procedures addressing the influence of valve cracking on calculating the tank fill 

time. As a result of the incident, the Puerto Rico Occupational Safety and Health Administration 

(PR OSHA) issued a serious violation to CAPECO for lacking tank filling procedures during 

transfer operations. See PR OSHA Section 8.8. 

6.7 Lack of Additional Safeguards such as High-Level Alarms and an 

Automatic Overfill Prevention System 

The CSB found that CAPECO tanks lacked effective safeguards to prevent a tank overfill. In 

addition to an accurate automatic tank gauging system with a reliable computer monitoring 

system, potential safeguards include independent high-level alarms, which give a visual or 

auditory indication when material in the tanks reach a specific high level, and an automated 

overfill prevention system,69 which allows for shutoff or flow diversion to prevent overfill. 

Tank 409 lacked an independent high level alarm.70 Without safety alarms and associated critical 

response procedures, CAPECO tank farm operators were left with a faulty level control and 

monitoring system to detect an overfill in Tank 409. 

 

69 ANSI/ANSI/API 2350 defines an automated overfill prevention system (AOPS) as an overfill prevention system 

not requiring the intervention of operating personnel to function. 

70 High-high level alarm: An alarm generated when the product level reaches the high tank level. American 

Petroleum Institute. ANSI/API Standard 2350-2012: Overfill Protection for Storage Tanks in Petroleum Facilities,

fourth edition (Washington, DC: American Petroleum Institute, May 2012). 

000316
Caribbean Petroleum Company Final October 2015 

43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

6.8 Other Potential Contributing Factors 

The CSB found that other factors might have contributed to the accident, such as the construction 

and limitations of the Tank 409 internal floating roof and the variable flow rates and line 

pressures into Tank 409. 

6.8.1 Internal Floating Roof Construction and Limitations 

The destruction of the Tank 409 internal floating roof in the explosion prevented the CSB from 

determining if it failed during filling operations. Therefore, internal floating roof failure might 

have contributed to the overfilling of Tank 409. The roof construction of Tank 409 was subject 

to numerous operational limitations. Tank 409 had a fixed cone roof with an aluminum internal 

floating roof (IFR), and a freeboard71 of 12 feet (24,157 bbls). (See Figure 14 for Tank 409 

specifications.) Aluminum IFRs are prone to corrosion when exposed to caustic liquids but 

sufficient for petroleum and organic materials. An internal floating roof can fail by means of 

turbulence,72 roof submersion,73 seal issues, and fatigue.74 

API MPMS Ch. 3.1A discusses the impact of the floating roof on tank volume. On the night of 

the incident, the final reading likely occurred when the floating roof was floating freely. When 

floating roofs are in the free-floating position, they displace the amount of liquid equal to the 

weight of the roof and attached deadwood. The only accurate way to obtain volume in the critical 

zone is by a liquid calibration procedure. API MPMS Ch. 3.1A advises that facilities calculate 

roof displacement by considering the roof weight, temperature, and density of the liquid of tank 

contents in the critical zone. CAPECO did not calculate the roof displacement of Tank 409. 

 

71 Freeboard is the vertical distance between the maximum liquid level and the top of the tank. 

72 Turbulence: high velocity of receipt fluid sufficient to generate waves at the surface of the liquid causing floating 

roofs to shake, move, and vibrate. Turbulence usually results from excessive receipt rates when the liquid level is 

low in the tank. 

73 Roof Submersion: Part or the entire roof becomes covered with the stored tank product. 

74 Fatigue is the creation of initiating cracks at discontinuities in steel structures resulting from stresses magnified 

by “stress risers” or discontinuities from corrosion. 

000317
Caribbean Petroleum Company Final October 2015 

44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figure 14: Tank 409 Specifications 

6.8.2 Variable Flow Rates and Line Pressure into Tank 

The CSB found that the fuel discharge flow rate to the terminal was controlled only by personnel 

from the Cape Bruny. CAPECO and the Cape Bruny had to complete filling operations in the 

allotted time negotiated by the Planning Department or face a financial penalty. (See section 

3.4). 

The CSB found it was normal for flow rates to vary from the barge to the tanks during filling 

operations. However, CAPECO lacked the ability to obtain product line flow rate information 

from the Cape Bruny to the CAPECO tank terminal via real time flow monitors, thus preventing 

CAPECO staff from accurately calculating the tank fill time and likely contributing to the 

overfill of Tank 409. The gasoline flow rate from the Cape Bruny to the terminal was determined 

before filling operations started in a pre-transfer meeting on the ship. Both CAPECO and Cape 

Bruny personnel determined the initial transfer limit to be 4,400 bbls/hr and a bulk transfer rate 

of 12,000 bbls/hr. Normal transfer operations from the Cape Bruny established a minimum 

allowable backpressure at 100 psig with a maximum discharge rate of 18,870 bbls/hr during 

transfer operations. However, CAPECO requested the discharge pressure to be 125 psig. At the 

time of the incident, CAPECO’s manifest showed gasoline was pumped at a rate of 10,000-

11,000 bbl/hr at a pressure of 100-110 psi, corresponding to about 7000-7700 gallons per minute. 

Despite the predetermined transfer rate and backpressure, CAPECO operators lacked 

information on the flow rate into the tanks during filling operations. 

000318
Caribbean Petroleum Company Final October 2015 

45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

To change the ship pumping pressure during filling operations, CAPECO tank farm operators 

communicated with the dock operator via radio. The dock operator then contacted the ship to 

increase or reduce the pressure of fuel pumped from the ship to the terminal. However, CAPECO 

personnel testified that stopping pumping from the ship was rare and only occurred if the tank 

farm lacked sufficient tank space onsite. Ship discharge records show the line pressure at the 

dock started at 50 psig on October 21, 2009, at 1 a.m. and increased by approximately 5-10 psig 

every three hours. At 11 p.m., approximately one hour before the incident, on October 22, 2009, 

the dock pressure was 115 psig, within the agreed-upon pump pressure. As the line pressure 

increased, the tank operator manually switched from Tank 405 (line displacement) to Tank 504 

then to Tank 411, and cracked the valve on Tank 409 to contain the gasoline. However, it was 

difficult for operators to determine the exact flow rate into the tanks after cracking the valves 

because gasoline flow rate was also dependent on the pipe diameter. Operators often went to the 

tank 10-30 minutes prior to the calculated filling time to switch the lines and address any 

discrepancy in flow rates. The lack of flow indicators coupled with various pipe diameters, the 

tank-switching process, and an unreliable gauging system all contributed to the overfilling of 

Tank 409. 

6.9 Human Factors 

Human factors-related deficiencies75 also contributed to the breakdown in the safety 

management system, including issues with dike valve designs, insufficient staffing, facility 

lighting, and valve cracking. 

6.9.1 Lack of Consistent Dike Valve Design 

A major contributor to the migration and dispersion of the vapor cloud was the open dike valves 

that enabled fuel to accumulate in the storm water retention pond in the WWT area. In addition, 

the use of multiple types of manual valves coupled with poor lighting made it impossible for 

operators to visually observe whether the dike valves were open or closed on the night of the 

incident. CAPECO operators failed to determine whether the dike drain valve for Tank 409 was 

properly shut. 

The CSB verified that the dike drain valve for Tank 409 was open at the time of the incident. 

EPA SPCC regulations require that dike drain valves be closed to prevent discharging oil. 

 

75 “Human factors refer to environmental, organizational and job factors, and human and individual characteristics 

which influence behavior at work in a way which can affect health and safety. A simple way to view human 

factors is to think about three aspects: the job, the individual and the organization and how they impact people’s 

health and safety-related behavior.” U.K. Health and Safety Executive. Introduction to Human Factors. 

http://www.hse.gov.uk/humanfactors/introduction.htm (accessed December 20, 2014). 

000319
Caribbean Petroleum Company Final October 2015 

46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

CAPECO’s normal practices required operators to open and close valves during the day shifts. 

Operators customarily inspected whether the dike drain valves were open or closed from their 

vehicles as they drove by. The tank farm used both rising stem and fixed stem valves on the dike 

drains leading to the storm water retention pond in the WWT area. Rising stem valves allowed 

operators to easily observe the open or closed position while fixed stem valves do not provide a 

visual indication of the position. The fixed stem valve on the dike drain for Tank 409 made it 

difficult for tank farm operators to observe its position without physically turning it. (See Figure 

15.) In some cases, the valve position could not be determined with a visual inspection because 

the rising stem valve position was hidden in the sump. (See Figure 15, center photo.) 

Furthermore, none of the dike valves shown in Figure 15 were consistent with RAGAGEP. 

Regulatory coverage under the EPA Risk Management Plan (RMP) or OSHA’s Process Safety 

Management (PSM) Standard requires that CAPECO use the best available engineering practices 

to assess valve open/close status. 

Figure 15: Various dike drain valves at CAPECO. Tank 409 fixed stem dike drain valve (left): position of 

the valve is undeterminable without physically turning the valve. Rising stem valves (center, right). In 

some cases, the valve position is hidden in the sump (center). 

6.9.2 Lack of Facility Lighting 

On the night of the incident, operators could not see the tank overflowing or the vapor cloud 

forming because the lighting was insufficient. Lighting in the tank farm area was limited; 

therefore, operators used flashlights to monitor tank farm activity and read liquid levels from the 

tank side gauges. A 1999 EPA inspection found insufficient lighting at the CAPECO tank farm 

to “detect spills and prevent vandalism.” Operators used flashlights, which were insufficient to 

monitor for unusual activity, such as a tank overflowing or a vapor cloud forming. In a 2010 

000320
Caribbean Petroleum Company Final October 2015 

47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

post-incident inspection report, the EPA again noted inadequate facility lighting for discovering 

unusual activity, such as vandalism and oil discharges in darkness.76

6.9.3 Lack of Sufficient Staffing during Offloading Operations 

The management decision to staff each fuel offloading shift with two operators at the tank farm 

and one operator at the dock provided insufficient staffing resources during filling operations. 

CAPECO often offloaded inventory into multiple tanks, which required manually switching fuel 

flow between tanks. This task often required two people due to the increased pressure of the fuel 

on the valve. Operators addressed this lack of staffing by cracking the valves of the next tank in 

line to fill. For example, Tank 409 and Tank 411 shared the same line connected to the pipeline. 

When the operator needed to change the line from the pipeline to fill another tank, he had to call 

the WWT operator for help, leaving the WWT area unattended.

6.9.4 Valve Cracking 

The lack of motor-operated valves compromised the accuracy of tank-filling time estimates. The 

valves for unloading gasoline were manually operated and as large as 16 to 20 inches. The 

pressure in the line from the dock was as high as 125 psig, which made opening the valves 

difficult. To easily change gasoline flow between tanks, operators fully opened the inlet valve to 

one tank and cracked open the inlet valve on the next tank to be filled. Cracking the inlet valve 

facilitated opening the valve for the next tank after the previous tank reached the target level. 

With both valves opened, the flow rate into the individual tanks varied, making it difficult to 

determine the exact filling time required. 

Installing motor-operated valves can eliminate the difficulty of manually opening large valves. 

6.10 Using a Risk-based Approach to Design an Overfill Prevention 

System 

Bulk petroleum storage and distribution facilities, like CAPECO’s Bayamón facility, are not 

considered highly hazardous under the U.S. regulatory system, despite often storing flammable 

liquids near highly populated areas. CAPECO was not required to use a risk-based approach to 

determine the level of risk posed by facility operations to the nearby community and to mitigate 

those risks accordingly. 

 

76 General requirements for Spill Prevention, Control, and Countermeasure Plans. Code of Federal Regulations, Part 

112, Section 7, Title 40, 2008.

000321
Caribbean Petroleum Company Final October 2015 

48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

 

A Safety Instrumented System (SIS)77 approach allows tank terminal operators to design an 

overfill prevention system for controlling the risk of an overfill incident to various safety 

integrity levels using multiple layers of protection. Following the promulgation of the US 

Occupational Health and Safety (OSHA) Process Safety Management (PSM) standard 

(1910.119), the International Society for Automation (ISA) created ISA 84.01-1996, the Safety 

Instrumented Systems (SIS) standard. Its intent was to augment the PSM standard for 

implementing instrumentation and controls necessary for safe operation.78 OSHA recognizes 

ISA-84 as Recognized and Generally Accepted Good Engineering Practice (RAGAGEP). See 

Section 8.9 for a discussion of RAGAGEP. 

Under this standard, a safety system requires robust design and rigorous management to achieve 

the required integrity.79 In applying SIS for process industries, ISA-84 uses two concepts to 

reduce the risk of facility-based hazards: a safety lifecycle and safety integrity levels (SIL).80 A 

safety lifecycle model uses a disciplined systemic approach to design, build, operate, and 

maintain a facility throughout its lifetime;81 a safety integrity level (SIL) is a probability-offailure measurement of safety system performance.82 There are four SILs,83 where a higher SIL 

means that an installed system has a lower potential to fail. 

 

77 SIS is an instrumented system used to implement one or more safety-instrumented functions (SIF). This software 

implements a safety-instrumented function by programming a single instrumented loop or multiple instrumented 

loops to a single electronic system. SIS removes the human element from a process when the expected human 

error rate increases because of automated controls with too many repeated and continuous control changes or 

when the complexity of work activity increases. A Safety Instrumented Function (SIF) is a safety function 

associated with a specific safety integrity level that is necessary to achieve functional safety. It can be a safety 

instrumented protection function or a safety instrumented control function. International Standard IEC 61511-1: 

Functional safety – Safety instrumented systems. 

78 A. Summers. Difference between IEC 8111 and ISA 84.01-1996 (Instrumentation, Systems and Automation 

Society, 2003). 

79 Buncefield Major Incident Investigation Board. The Buncefield Incident 11 December 2005 Volume 1. 2008.

http://www.buncefieldinvestigation.gov.uk/reports/volume1.pdf. 80 International Society for Automation. Technology ISA-84. http://www.isa-95.com/subpages/technology/isa84.php (accessed December 20, 2014). 

81 S. Gillespie. Safety Instrumented Systems. http://www.idconline.com/technical_references/pdfs/instrumentation/Safety_Instrumented_Systems.pdf (accessed December 20, 

2014). 

http://www.idc-online.com/technical_references/pdfs/instrumentation/Safety_Instrumented_Systems.pdf 

82 Buncefield Major Incident Investigation Board. The Buncefield Incident 11 December 2005 Volume 1 (2008). 

http://www.buncefieldinvestigation.gov.uk/reports/volume1.pdf (accessed December 20, 2014). 

83 SIL 0 = none is the lowest risk; SIL 1 = 95% of the safety instrumented function (ALARP); SIL 2 =5% SIF; SIL 3 

= <1% SIF; SIL 4 =highest risk (nuclear industry) 

Process Engineering Associates. http://www.processengr.com/ppt_presentations/safety_instrumented_systems.pdf 

000322
Caribbean Petroleum Company Final October 2015 

49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Facilities such as CAPECO are not covered under OSHA PSM Standard or the EPA RMP 

Program. They are not required to conduct risk assessments to address flammable hazards on 

site, or to follow RAGAGEP. Therefore, the CAPECO facility was not required to conduct a 

hazard assessment that would determine the necessary safeguards needed to prevent a 

catastrophic incident. This precaution would have alerted management to the need for 

RAGAGEP, including instrumentation and controls necessary for safe operations. Had CAPECO 

been covered by these standards, it likely would have installed an independent or redundant level 

alarm and an automatic overfill protection system with several independent safeguards to prevent 

a catastrophic overfill incident. 

7.0 TANK LOCATIONS, PREVALENCE OF INCIDENTS AND 

LESSONS LEARNED FROM PREVIOUS CATASTROPHIC 

INCIDENTS 

According to the US Census Bureau, there were 4,810 petroleum bulk stations and terminals in 

the US in 2007.84,85 The terminals include commercial facilities, proprietary terminals owned by 

refineries, chemical manufacturers, and Department of Defense facilities.86 

Tank terminals are located throughout the US in both rural and urban areas. Figure 16 illustrates 

the location of bulk petroleum tank terminals in all 50 states in 2012. In 2009, 3,807 bulk liquid 

storage facilities registered a release with the EPA Toxic Release Inventory (TRI).87,88 The CSB 

mapped 3,847 bulk petroleum storage tank terminal locations obtained from the EPA TRI 

database for 2012 and found 2,959 bulk petroleum storage terminals within one mile of 

communities with over 300,000 residents (Figure 16). 

 

84 Geographic Distribution: Petroleum Bulk Stations and Terminals (Washington, DC: U.S. Census Bureau, 2007). 

http://www.census.gov/econ/industry/geo/g424710.htm (accessed December 20, 2014). 

85 NAICS code 424710 – bulk petroleum stations and terminals includes industry establishments with bulk liquid 

storage facilities primarily engaged in the merchant wholesale distribution of crude petroleum and petroleum 

products, including liquefied petroleum gas. 

86 Advanced Resources International. Assessment of the Potential Costs and Energy Impacts of Spill Prevention, 

Control, and Countermeasure Requirements for Petroleum Bulk Storage and Distribution Terminals

(Washington, DC: US Department of Energy Office of Fossil Energy, August 22, 2006). 

87 The EPA Toxic Release Inventory is a database containing self-reported information on the disposal or release of 

650 chemicals from facilities in the US. 

88 Toxic Release Inventory: 2009 (Washington, DC: U.S. Environmental Protection Agency, 2010). 

000323
Caribbean Petroleum Company Final October 2015 

50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figure 16: Tank terminals distributed across the US in 2012 in proximity to 2010 population data. 

 (EPA TRI Database, 2012) 

7.1 Prevalence of Tank Incidents 

The lack of a comprehensive database of publicly available accident data makes it difficult to 

analyze for trends in overfill incidents. A 2006 study using published reports from various 

sources analyzed 242 storage tank accidents, finding that fires and explosions accounted for 85% 

of the accidents on six continents over 40 years (1960-2003).89 The study also found 105 

accidents that occurred in the US. Moreover, terminals and pumping stations accounted for 25%, 

or 64, of the accidents—the second most frequent sites for accidents after refineries (47.9% or 

 

89 J. I. Chang, et al. “A Study of Storage Tank Accidents.” Journal of Loss Prevention in the Process Industries. 

2006.19: 56.

000324
Caribbean Petroleum Company Final October 2015 

51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

116 cases).90 In addition, overfilling was cited as the most frequent cause of an accident during 

operation; among the 15 overfill incidents found, 87% led to a fire and explosion. Since 2005, 

three low-frequency, high-consequence incidents involving a vapor cloud formation from a 

gasoline storage tank resulted in catastrophic explosions and fires. 

The cost of overflow prevention systems is nominal in contrast with the societal and economic 

costs of incidents such as Buncefield and CAPECO. A 2006 US Department of Energy Office of 

Fossil Energy assessment found fully automated liquid level sensing alarms and shutoffs range 

from $12,000 to $18,000 per tank installation, and liquid level sensing devices with alarms cost 

$4,000 to $5,000.91 

7.2 Lessons Learned from Previous Incidents 

Similar overflow incidents have occurred in the US and internationally. The CSB found 22 

incidents of overfills and vapor cloud explosions at bulk petroleum tank terminals, 16 of which 

occurred in the US. The three incidents discussed below and in Appendix B demonstrate the 

catastrophic potential and high-hazard nature of storing flammable liquids in aboveground 

storage tanks. Yet US regulations and industry practices do not adequately reflect the lessons 

learned from such catastrophic incidents and fail to classify terminals storing flammable 

materials as high-hazard facilities. 

7.3 Buncefield (Hertfordshire, UK) 

One of the most notable recent incidents—resulting in a number of technical and regulatory 

recommendations in the United Kingdom—is an explosion and fire that occurred at the 

Buncefield Oil Storage Depot in Hemel Hempstead, Hertfordshire, UK, on December 11, 2005. 

Similar to the CAPECO incident, the vapor cloud explosion and multiple tank fires occurred 

after a tank was overfilled with gasoline. The overfilling tank was equipped with a gauge that 

allowed operators to monitor filling operations and an independent high-level switch that 

allowed for automatic shutdown of filling operations if the tank overfilled. But both were 

inoperable at the time of the incident.92 The explosion generated significant blast pressure, 

 

90 J. I. Chang, et al. “A Study of Storage Tank Accidents.” Journal of Loss Prevention in the Process Industries. 

2006.19: 56. 

91Advanced Resources International. Assessment of the Potential Costs and Energy Impacts of Spill Prevention, 

Control, and Countermeasure Requirements for Petroleum Bulk Storage and Distribution Terminals

(Washington, DC: U.S. Department of Energy, Office of Fossil Energy, August 22, 2006). 

92 The Competent Authority. Control of Major Accident Hazards. Buncefield: Why Did It Happen? (U.K. Health and 

Safety Executive (HSE) and Environment Agency). 

 http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed December 21, 2014). 

000325
Caribbean Petroleum Company Final October 2015 

52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

resulting in additional loss of containment that led to fire and other damage involving 22 tanks. 

There were no fatalities, but 43 people were injured and the damage to nearby commercial and 

residential property totaled $1.5 billion.93 The fire burned for four days. 

Following Buncefield, the UK Health and Safety Executive (HSE) established a Major Incident 

Investigation Board (MIIB),94 which made recommendations to the industry and regulators 

concerning the incident. The MIIB recommendations overhauled both the UK legal compliance 

standards and industry practices governing petroleum storage facilities similar in size to the 

Buncefield Storage Depot. Differing from the US viewpoint, the United Kingdom considers 

petroleum storage facilities to be high-hazard facilities, subjecting them to the regulations similar 

to the US OSHA Process Safety Management (PSM) standard. The UK view allows for 

additional oversight from the Competent Authority (CA) or the Control of Major Accident 

Hazards (COMAH). Therefore, covered facilities must demonstrate a major accident prevention 

policy and a safety management system.95 

The MIIB report emphasizes that controlling the risks associated with a major incident like 

Buncefield requires an integration of safety integrity levels at high-hazard sites, specifically 

addressing containment of dangerous substances and process safety with mitigation planning 

against offsite impact, preparedness of emergency response, land use planning for controlling 

societal risk, and regulatory system enforcement at high-hazard facilities.96 

Many of the MIIB recommendations are pertinent to CAPECO. The most salient MIIB 

recommendations address preventing primary loss of containment,97 conducting a risk 

assessment, maintaining sector leadership, cultivating a safety culture, and conforming 

petroleum storage facilities to high-reliability organization principles. Table 2 summarizes and 

 

93 D. M. Johnson, et al. “The Potential for Vapour Cloud Explosions: Lessons from Buncefield.” Journal of Loss 

Prevention in the Process Industries. (2010.23): 921-927. 

94 The Buncefield incident caused the MIIB to conduct a comprehensive review of the design and operation of 

storage sites, emergency preparedness for and response to incidents, and land use planning. In addition, the MIIB 

analyzed the regulatory system, including the HSE and UK Environmental Agency requirements governing 

petroleum storage depots and examined the explosion mechanism of the Buncefield incident. The MIIB 

produced nine reports published from 2006 to 2009. Follow-up reports resulting from recommendations issued 

by the MIIB address layer-of-protection analysis while other working groups issued subsequent analysis of the 

implementation of the HSE recommendations. 

95 Buncefield Standards Task Group. 2007. Safety and Environmental Standards for Fuel Storage Sites. 

 http://www.hse.gov.uk/comah/buncefield/bstgfinalreport.pdf. (accessed January 2012) 

96 Buncefield Major Incident Investigation Board. 2008. The Buncefield Incident 11 December 2005 Volume 1. 

 http://www.buncefieldinvestigation.gov.uk/reports/volume1.pdf. (accessed January 2012). 

97 Primary means of containment are the tanks, pipes, and vessels that hold liquids and the devices fitted to them to 

 allow safe operation. (Buncefield MIIB, 2008). 

000326
Caribbean Petroleum Company Final October 2015 

53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

compares both incidents. Because of the Buncefield incident, the API made changes to the Tank 

Overfill Prevention Standard (ANSI/API 2350) addressing risk assessment. This report issues 

additional recommendations to the API to enhance its guidance on conducting a risk assessment. 

(See Section 8.10.1.) 

 

000327
Caribbean Petroleum Company Final October 2015 

54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Table 2: Comparison of CAPECO and Buncefield Incidents 

 CAPECO Buncefield 

Incident Date October 23, 2009 December 11, 2005 

Number employee injuries 0 0 

Number of public injuries 3 40 

Number of tanks at facility 47 39 

Product being filled Unleaded Gasoline Unleaded Gasoline 

Time of explosion 12:23 am 6:00 am 

Storage capacity of site 283,233 tons (90 million gallons) 194,000 tons (61.6 gallons) 

Tank storage capacity 18.9 million liters 

(5 million gallons) 

6 million liters 

(1.58 million gallons) 

Vapor cloud explosion Yes Yes 

Richter Scale 2.9 2.4 

Estimated area of vapor cloud 107.2 acres (4,669,632 ft2) 32 acres (1,393,920ft2)) 

Number of tanks engulfed in 

fire 17 20 

Number of days to contain fire 2.5 5 

Tank involved in overfill Tank # 409 Tank # 912 

Estimated overfill volume 757,082 liters 

(200,000 gallons) of gasoline 

250,000 liters 

(66,043 gallons) of gasoline 

Volume of contaminated water 

released to environment 

647,305 liters (171,000 gallons) 

of collected oil; 

83,279,059 liters (22,000,000 

gallons) of contact water 

800,000 liters (211,338 gallons) 

Type of tank gauging system Manual tank gauging system 

Fully automated level control 

system under remote 

supervision 

Functionality of gauging 

system at incident Failed Failed 

Independent high level alarm Not present Present but not functioning 

Redundant alarms Not present Not functioning 

Root cause 

Deficient Management System Deficient Management System 

Production Pressure Production Pressure 

Lack of reliable instruments: 

Level control failure due to 

inaccurate available volume 

calculation; no high-level alarm 

to notify ship to stop transfer or 

divert flow; no AOPS with ability 

to shut down or divert flow into 

tank 

Lack of reliable instruments: 

Level control failure due to level 

sensor failure; failure of high 

level alarm; failure of the 

independent AOPS 

Contributing cause Failure of Safety Management 

System 

Failure of Safety Management 

System 

Regulatory consideration Not considered high-hazard 

facility Considered high-hazard facility 

000328
Caribbean Petroleum Company Final October 2015 

55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

7.4 Texaco Oil Company (Newark, NJ) 

On January 7, 1983, a similar incident occurred at the Texaco Oil Company tank terminal in 

Newark, New Jersey. A gasoline vapor cloud exploded when a 1.76-million gallon capacity tank 

overflowed, resulting in one fatality and 24 injuries. Inadequate monitoring of the rising gasoline 

levels in the storage tank during filling operations contributed to the overflow, explosion, and 

subsequent fire. An NFPA report on the incident also attributed the root cause to errors in 

calculating the available space and pumping rates.98 Equipment damage was observed up to 

1,500 feet away from the exploding tank. The overflowing tank had manual level controls. The 

facility also had no documentation of previous liquid level monitoring in the hours leading up to 

the explosion. The last “check” on the tank level occurred approximately 24 hours prior to filling 

operations.99 

Following the incident, the Newark Fire Department made recommendations to the NFPA to 

strengthen its guidance on overfill prevention under the Flammable and Combustible Liquids 

Code. (See Section 8.10.9.1 for further discussion on NFPA 30.) 

7.5 Indian Oil Company (Jaipur, India) 

Another recent incident occurred in Jaipur, India, at the Indian Oil Corporation (IOC) Petroleum 

Oil Lubricants terminal 16 miles south of Jaipur, India. On October 29, 2009, one week after the 

CAPECO explosion and fire, four operators were transferring gasoline to a tank when the 

delivery line developed a large leak, which continued unabated for 75 minutes after fumes 

overcame two operators. The pooling fuel migrated through an open dike drain valve to a storm 

drain, producing a large vapor cloud. The cloud was ignited by either non-intrinsically safe 

electrical equipment or a vehicle startup. The resulting explosion and fireball engulfed the entire 

site. Fire affected 11 tanks and persisted for 11 days. The incident resulted in 11 fatalities, 6 of 

them IOC employees, and the others from neighboring organizations. Among the 39 

recommendations issued, one was for an independent Hazard Operability study (HAZOP) or risk 

assessment, and another addressing automated operations and improving instrumentation and 

alarms.100 Appendix B contains a list of other similar incidents. 

 

98 Summary Investigation Report: Gasoline Storage Tank Explosion and Fire. Newark, NJ, 7 January 1983 (Quincy, 

MA: National Fire Protection Agency, 1983). 

99 Summary Investigation Report: Gasoline Storage Tank Explosion and Fire. Newark, NJ, 7 January 1983 (Quincy, 

MA: National Fire Protection Agency, 1983). 

100 T. Fishwick. “The Fire and Explosion at Indian Oil Corporation, Jaipur: A Summary of Events and Outcomes.” 

Loss Prevention Bulletin (2011. 222): 9. 

000329
Caribbean Petroleum Company Final October 2015 

56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

8.0 REGULATORY ANALYSIS 

The CSB analysis of the relevant regulatory, industry, and consensus standards for safety and 

management of bulk petroleum aboveground storage facilities found that the accident at 

CAPECO might have been prevented had OSHA and EPA considered the facility to pose a high 

hazard and required the facility to: 

1) Conduct a hazard assessment; 

2) Implement more than one layer of protection as an independent level alarm system; and 

3) Incorporate changes based on lessons learned from previous similar incidents. 

The CSB determined that existing regulatory, industry, and consensus standards do not 

adequately protect workers and the public from the dangers posed by bulk petroleum storage 

tank terminals. The following section discusses shortcomings of the regulatory, standard and 

recommended practice framework governing this industry. (See Figure 17.) 

000330
Caribbean Petroleum Company Final October 2015 

57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD 

Final

Figure 17: Many regulatory policies, voluntary and consensus standards contain safety requirements or 

recommendations for bulk petroleum aboveground storage tanks, but not all are required, and storage 

tank facilities are not generally covered by the RAGAGEP provisions of the OSHA PSM and EPA RMP 

programs. The voluntary industry and consensus standards could be considered RAGAGEP, if the 

process or facility were covered under these programs.

000331
Caribbean Petroleum Company Final October 2015 

58 

8.1 Environmental Protection Agency (EPA) 

Although certain environmental statutes and EPA regulations apply to bulk petroleum 

aboveground storage tank terminals such as CAPECO, the CSB finds these regulations do not 

adequately protect the public from catastrophic incidents at bulk petroleum storage tank 

terminals storing NFPA 704, Class 3 flammable liquids: 

 The EPA Clean Air Act General Duty Clause (CAA Section 112(r)(1)) lacks specific 

guidance for preventing accidental releases, while other regulations, such as the Risk 

Management Program (RMP), the Spill Prevention, Control and Countermeasure 

(SPCC), and the Facility Response Plan (FRP), do not require an overfill prevention 

program and a robust hazard assessment. 

 The Clean Air Act (CAA) General Duty Clause protects the public living near facilities. 

Due to a gasoline exemption and the flammable mixture provision101 under the List Rule 

(see Section 8.3), bulk petroleum storage tank terminals are not subject to the EPA risk 

management program regulations because they store NFPA Class 3 flammable liquids 

not regulated by the standard. 

 The Clean Water Act (CWA) SPCC regulations, which protect navigable waterways and 

shorelines from oil spills, require only one layer of protection for overfill prevention and 

do not require that bulk petroleum tank terminals implement a second layer of protection, 

such as an independent high level alarm. 

8.2 Clean Air Act: The General Duty Clause 

Section 112(r)(1) of the CAA, the General Duty Clause, 42 U.S.C. § 7412(r)(1), requires owners 

and operators of stationary sources102 who produce, store and handle extremely hazardous 

substances to identify hazards, design, and maintain a safe facility to prevent their release and 

protect the public.103 The EPA issues chemical safety alerts advising industry on the types of 

issues covered by the General Duty Clause and publishes alerts on reactive hazards, lightning, 

 

101 Flammable mixtures containing more than 1% of a regulated substance and the overall mixture meets the NFPA 

4 flammability criteria are covered and must submit a Risk Management Plan to the EPA. General Duty Clause 

of the Clean Air Act (Washington, DC: U.S. Environmental Protection Agency, March 2009). 

http://www.epa.gov/oem/docs/chem/gdc-fact.pdf (accessed December 21, 2014). 

102 Stationary source means any buildings, structures, equipment, installations, or substance-emitting stationary 

activities that belong to the same industrial group, which are located on one or more contiguous properties and 

under the control of the same person (or persons under common control), and from which an accidental release 

may occur (63 FR 645). 

103 Guidance for Implementation of the General Duty Clause Clean Air Act, Section 112( r )(1) (Washington, DC: 

U.S. Environmental Protection Agency, Office of Solid Waste and Emergency Response Office of Enforcement 

and Compliance Assurance, May 2000). http://www2.epa.gov/sites/production/files/2013-

10/documents/gdcregionalguidance.pdf (accessed December 21, 2014). 

000332
Caribbean Petroleum Company Final October 2015 

59 

and other catastrophic hazards. In 2009, the EPA issued a Chemical Safety Alert for Rupture 

Hazard from Liquid Storage Tanks to address catastrophic hazards posed by fertilizer storage 

tanks.104 

However, to date, the EPA has not issued any alerts for overflow hazards from flammable liquids 

in storage tanks, despite the occurrence of high-consequence incidents such as Texaco Oil 

Company and Buncefield incidents prior to CAPECO. In addition, the performance-based105

nature of the general duty clause leaves the responsibility of protecting the public up to each 

covered facility, without any specific requirements from the EPA. The CSB found that further 

guidance under the General Duty Clause may be necessary to encourage more than one layer of 

overfill protection for bulk aboveground petroleum storage tank terminals near communities. 

8.3 EPA: The List Rule 

After a number of chemical accidents in the US and overseas, Congress enacted the Clean Air 

Act Amendments (CAAA) of 1990. Sections 301 and 112 of the CAAA require that the EPA 

issue regulations preventing accidental releases that could harm the public.106 Section 112(r) of 

the CAAA, 42 U.S.C. § 7412 (r), requires owners and operators of stationary sources to identify 

hazards and to prevent and minimize the effect of accidental releases when extremely hazardous 

substances are present.107 The EPA promulgated the Risk Management Program rule in 1996 to 

address accidental releases.108 The CAAA required EPA to promulgate an initial list of 100 

substances “known to cause or may [reasonably] be anticipated to cause death, injury, or serious 

adverse effects to human health or the environment”109 in the event of an accidental release.110 

 

104 Chemical Safety Alert: Rupture Hazard from Liquid Storage Tanks. U.S. Environmental Protection Agency: 

Washington, DC, September 2009. http://www.epa.gov/osweroe1/docs/chem/tanks7.pdf (accessed December 21, 

2014). 

105 A performance-based standard, also referred to as a functional approach, allows facilities to define their own 

methods to achieve the regulatory goal or standard. Examples of performance-based standards are the OSHA 

PSM standard and a numeric limit on emissions that does not prescribe how it is achieved. 

106 CONSAD Research Corporation. Analytical Support and Data Gathering for an Economic Analysis of the 

Addition of Selected Reactive Chemicals within the Scope of the OSHA Process Safety Management Standard

(Washington, DC: U.S. Occupational Safety and Health Administration, 1998). 

107 Guidance for the Implementation of the General Duty Clause of the Clean Air Act, Section 112(r)(1). 550-B00-

002 (Washington, DC: U.S. Environmental Protection Agency, May 2000): 2. 

108 EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases. 09-P-0092 

(Washington, DC: U.S. Environmental Protection Agency, February 10, 2009). 

109 Guidance for Implementation of the General Duty Clause Clean Air Act, Section 112( r )(1) (Washington, DC: 

U.S. Environmental Protection Agency, Office of Solid Waste and Emergency Response Office of Enforcement 

and Compliance Assurance, May 2000). http://www2.epa.gov/sites/production/files/2013-

10/documents/gdcregionalguidance.pdf (accessed December 21, 2014). 

110 The Public Health and Welfare. U.S. Code, Section 7412(r)(3), Title 42, 2009. 

000333
Caribbean Petroleum Company Final October 2015 

60 

Known as the List Rule, this requirement obliged covered facilities, in addition to other 

requirements, to submit a Risk Management Plan (RMP) to the EPA when they exceeded the 

threshold quantity of a regulated substance on the list. The initial list included 77 acutely toxic 

substances, 63 flammable gases and volatile flammable liquids, and Division 1.1 high-explosive 

substances as designated by the Department of Transportation (DOT). 

The List Rule has been amended several times since its promulgation. Shortly after enactment,111

the API and the Institute of Makers of Explosives (IME) filed petitions requesting a judicial 

review of the List Rule. In settlement of these petitions, the EPA specifically exempted regulated 

substances in gasoline112 from determining whether a threshold quantity was present in a

process.113 The EPA stated, “risks associated with the storage and handling of flammable 

substances are a function of the properties of the materials, not their end use.”114 The agency 

argued for “exempting gasoline because it does not meet the NFPA 4 flammability criteria,”115

and “the EPA believes it does not represent a significant threat to the public of vapor cloud 

explosions.”116

The EPA also exempted flammable mixtures including blendstocks117 and natural gasoline that 

do not meet the NFPA flammability rating of 4.118 However, flammable mixtures and 

 

111 Petitions were filed within the standard 60-day period under CAA 307(b), around March 1994. The settlement of 

the petitions occurred in early 1996. 112 Gasoline is exempt from the EPA List Rule because it does not meet the boiling point criterion for listing (NFPA 

4 criteria, flammability hazard rating of 4); therefore, this substance is not assigned a threshold level. Approval 

of Colorado’s Petition To Relax the Federal Gasoline Reid Vapor Pressure Volatility Standard for 1996 and 

1997. Federal Register (1996): 61, 73. 113 Regulated Substances for Accidental Release Prevention – Threshold Determination. Code of Federal 

Regulations, Part 68.115(b)(2)(ii), Title 40, 1998. 114 40 CFR Part 68, List of Regulated Substances and Thresholds for Accidental Release Prevention; Final Rule. 

Rules and Regulations, January 6, 1998. Federal Register (1998): 63 (3), 

115 NFPA 704 defines NFPA 4 flammability criteria to include materials that rapidly or completely vaporize at 

atmospheric pressure and normal ambient temperature or that are readily dispersed in air and burn readily. This 

may include flammable gases, flammable cryogenic materials, any liquid or gaseous material that is liquid while 

under pressure and has a flash point below 22.8°C (73°F) and a boiling point below 37.8°C (100°F) (i.e., Class 

IA liquids), and materials that ignite spontaneously when exposed to air. Solids containing greater than 0.5 

percent by weight of a flammable or combustible solvent are rated by the closed cup flash point of the solvent. 

NFPA 704. http://www.nfpa.org/codes-and-standards/document-information-pages?mode=code&code=704

(accessed December 21, 2014).

116 40 CFR Part 68 List of Regulated Substances and Thresholds for Accidental Release Prevention; Final Rule. 

Rules and Regulations, January 6, 1998. Federal Register (1998): 63 (3). 

117 Blendstocks are motor gasoline blending components intended for blending with oxygenates to produce finished 

reformulated motor gasoline. (Energy Information Administration, Definitions, Sources and Explanatory Notes

http://www.eia.gov/dnav/pet/tbldefs/pet_move_wkly_tbldef2.asp (accessed December 21, 2014). 

118 40 CFR Part 68, List of Regulated Substances and Thresholds for Accidental Release Prevention. Final Rule. 

Rules and Regulations, 6 January 1998. Federal Register (1998): 63 (3). 

000334
Caribbean Petroleum Company Final October 2015 

61 

blendstocks meeting the NFPA 4 flammability are subject to threshold determinations119

irrespective of their end use. If a mixture consists of 1% or greater concentration of a regulated 

flammable substance and the mixture meets the NFPA 4 flammability criteria, the EPA considers 

the entire weight of a flammable mixture as the regulated flammable substance.120 The EPA 

recognizes specific circumstances in which a facility not covered under the List Rule has the 

potential for a vapor cloud explosion, and it asserts that the General Duty Clause protects against 

site-specific factors that “make an unlisted chemical extremely hazardous.”121 

The unleaded gasoline involved in the CAPECO incident had an NFPA 704 flammability rating 

of 3, falling outside the RMP criteria. The flammable mixture also had an API gravity122 of 

63.7, characterizing it as highly flammable. Although the components of unleaded gasoline— 

benzene, toluene, xylene, cyclohexane, trimethyl benzene, and alcohol additives—are not 

regulated substances under the List Rule, they contribute to its high flammability. In the 

CAPECO incident, these components resulted in a vapor cloud formation and explosion.123 The 

magnitude of the CAPECO incident warrants that the EPA reassess its criteria for exempting 

blendstocks and flammable mixtures that do not meet NFPA 4 flammability criteria. 

Furthermore, the EPA did not consider the previous incidents when it granted the gasoline and 

flammable mixture exemption.124 These incidents and the CAPECO explosion demonstrate that a 

vapor cloud formation from a flammable mixture such as unleaded gasoline can result in 

catastrophic impact to local communities and workers. In addition, despite a requirement to 

protect the public under the General Duty Clause, CAPECO did not implement an adequate 

safety management system to prevent the catastrophic explosion and fire. 

 

119A threshold determination is the method by which a source calculates whether a threshold quantity is present in a 

process. Exemptions and exclusions of regulated substances from threshold determination allow a source not to 

include regulated substances in a mixture in specified instances. 

120 40 CFR Part 68, List of Regulated Substances and Thresholds for Accidental Release Prevention. Final Rule. 

Rules and Regulations, January 6, 1998. Federal Register (1998): 63 (3). 121 Ibid. 122 The American Petroleum Institute (API) characterizes flammability of crude oil and condensate by gravity level. 

The higher the gravity, the lighter and more flammable the compound; materials below an API gravity value of 

35 are characterized as crude oil, while those above 45 are considered condensate. 

123 Gasoline with blends that include more than 1% of pentane is subject to coverage under the RMP. 124 See Section 7.2 and Appendix B for incidents excluded from EPA consideration in its gasoline and flammable 

mixture exemption. 

000335
Caribbean Petroleum Company Final October 2015 

62 

8.4 Risk Management Program

Under 40 CFR §68, covered facilities fall into three Program Levels (Program 1, 2, or 3) based 

on a process unit’s potential to affect the public and the requirements to prevent accidents.125

Consistent with OSHA’s PSM requirements, facilities that fall under Program 3 must implement 

a prevention program that includes process safety information, process hazard analysis, standard 

operating procedures, training, mechanical integrity, compliance audits, incident investigations, 

management of change (MOC), pre-startup reviews, employee participation, and hot work 

permits. Tank terminals similar to CAPECO that store gasoline do not fall under Program 1, 2 or 

3 requirements. In addition, under the Risk Management Program, covered facilities are subject 

to the same recognized and generally accepted good engineering practices (RAGAGEP) 

requirements for mechanical integrity and process hazard analyses (PHAs) as the OSHA PSM 

standard. 

8.5 Chemical Accident Provisions, Risk Management Plan (RMP) 

The EPA’s Chemical Accident Provisions (40 CFR §68) require facilities that have more than a 

threshold quantity of a List Rule-regulated substance to submit a Risk Management Plan (RMP) 

identifying the quantity of flammable or toxic material and to report on their accident prevention 

program, accident history, and planning.126 Every five years, covered facilities must conduct a 

hazard assessment that considers worst-case scenarios, certify to the EPA their compliance with 

prevention program requirements,127 and coordinate their emergency response preparedness with 

local responders. Had CAPECO been required to conduct a hazard assessment that evaluated the 

quantity of flammable products stored at the terminal and their proximity to the neighboring 

community, the facility may have had to address the risk of a vapor cloud explosion and 

resulting multiple tank fires. Under RMP, CAPECO would have had to develop accident 

prevention programs and coordinate response planning with local emergency responders, actions 

that might have mitigated the incident. 

The EPA requested more information from the public and regulated community on amending the 

RMP rule to include more specific siting requirements as part of the PHA in a July 31, 2014, 

Request for Information (RFI).128 The CSB issued comments under the RFI encouraging the 

 

125 40 CFR §68.10. Applicability. http://www.law.cornell.edu/cfr/text/40/68.10 (accessed December 21, 2014). 

126 Regulated Substances for Accidental Release Prevention. Code of Federal Regulations, Part 68.115(b)(2), Title 

40, 1998. 

127 Ibid. 

128 The RFI was issued under 40 CFR §68, Accidental Release Prevention Requirements: Risk Management 

Programs Under the Clean Air Act, Section 112(r)(7). 

000336
Caribbean Petroleum Company Final October 2015 

63 

EPA to provide more guidance on facility siting.129 Examples of siting requirements provided by 

the EPA include buffer or setback zones for newly covered stationary sources, or establishing 

safety criteria for siting of structures that house people inside a facility.130 

8.6 The Clean Water Act (CWA) 

The Federal Water Pollution Act of 1972, or Clean Water Act (CWA), as amended, gives the 

EPA jurisdiction131 to protect navigable waters from pollution. Section 311 authorizes a program 

to prevent, prepare for, and respond to discharges of oil and hazardous substances. Section 

§311(j)(1)(C) provides that the President shall issue regulations establishing procedures, 

methods, equipment, and other requirements to prevent and contain discharges of oil132 from 

facilities and vessels, and to contain such discharges. CAPECO was subject to various EPA 

regulations promulgated under the CWA. 

8.6.1 Spill Prevention, Control and Countermeasure (SPCC) 

Regulations 

The Spill Prevention, Control, and Countermeasure (SPCC) requirements govern oil discharge at 

aboveground storage tank sites. The EPA promulgated the SPCC regulation (40 CFR §112) on 

January 10, 1974 (See 38 FR 34164). The SPCC regulation requires a facility to prepare and 

certify by a Professional Engineer, a plan detailing the equipment, workforce, procedures, and 

steps to prevent and control an oil discharge to navigable waters and shorelines. The regulation at 

40 CFR §112.8(c)(8) requires SPCC-subject facilities to provide for overfill protection for each 

container in accordance with good engineering practice including applicable industry 

standards.133 The regulation allows the owner/operator of a container to select only one 

suggested method of overfill controls. The options include, high liquid level alarms at a 

constantly attended location or surveillance station, high liquid level pump cut off devices to stop 

 

129 Docket No. EPA-HQ-OEM-2014-0328 http://www.csb.gov/assets/1/7/EPA_RFI.pdf. (accessed January 7, 2015) 

130 Environmental Protection Agency. 40 CFR Part 68. Accidental Release Prevention Requirement: Risk 

Management Programs Under the Clean Air Act, Section 11(r)(7). Proposed Rule. Federal Register. (2014): 79 

(147), 44604-44633. 

131 CWA jurisdiction includes navigable waters of the United States and adjoining shorelines, the waters of the 

contiguous zone, and the high seas beyond the contiguous zone in connection with activities under the Outer 

Continental Shelf Lands Act. It covers activities under the Deepwater Port Act of 1974 or activities that may 

affect natural resources belonging to, appertaining to, or under the exclusive management authority of the United 

States, including resources under the Magnuson Fishery Conservation and Management Act of 1976. 

132 Under CWA §311(a)(1), “oil” means “oil of any kind or in any form, including, but not limited to, petroleum, fuel 

oil, sludge, oil refuse, and oil mixed with wastes other than dredged spoil.” Clean Water Act 

Section 311 – Oil and Hazardous Substances Liability. 

http://www.epa.gov/region7/public_notices/CWA/section311.htm (accessed December 21, 2014). 

133 Environmental Protection Agency. 40 CFR Part 112.8(c)(8). Spill Prevention, Control, and Countermeasure Plan 

requirements for onshore facilities (excluding production facilities). Section 112.8(c)(8). (2002). 

000337
Caribbean Petroleum Company Final October 2015 

64 

the liquid flow into a tank at a previously established level, direct audible or code signal 

communication between the container gauger and the pumping station, and a fast response 

system such as a digital computer, telepulse or direct vision gauges to determine liquid levels in 

a tank or container. 134 The regulation also requires regular testing of level sensors for the 

selected overfill prevention option.135 

8.6.2 CAPECO’s SPCC History 

The CAPECO facility had a history of noncompliance with SPCC regulations. In 1993, EPA 

inspections noted poor housekeeping, including oil in tank berm areas and inadequate control of 

vegetation in the secondary containment areas. In 1996, the EPA cited CAPECO for deficiencies 

in their SPCC plan that include not adequately explaining the engineering controls in place to 

prevent a spill. The facility also experienced an overfill incident in 1999, when fuel spilled from 

an asphalt tank outside the tank farm area. Oil flowed out of a vent located at the top of the tank 

into the secondary containment. Although this incident occurred in a separate process from the 

tank farm, the EPA findings are relevant to the 2009 overfill incident. The EPA cited the facility 

for not updating the bulk storage tank installations and for not incorporating fail-safe engineering 

to prevent the overfill incident.136 After this incident, the EPA recommended that CAPECO 

consider installing one or more of the following safeguards: 

 High-level alarms with an audible or visual signal at a constantly manned operation or 

surveillance station; 

 High-liquid-level pump cutoff devices set to stop flow at a predetermined tank content 

level; 

 Direct audible or code signal communication between the tank gauger and the pumping 

station; or 

 A fast response system for determining the liquid of each bulk storage tank, including 

digital computers, telepulse, or direct vision gauges or their equivalent. 

According to EPA records, CAPECO was compliant with recommendations by 2001. The 

facility installed two levels of protection, the computer system, equipped with a high-liquid level 

 

134 Spill Prevention, Control, and Countermeasure Plan requirements for onshore facilities (excluding production 

facilities). Code of Federal Regulations, Part 112.8, Title 40 (2002). http://www.ecfr.gov/cgi-bin/textidx?SID=67da1ecbd5068d7f144a92e0e59ef956&mc=true&node=pt40.22.112&rgn=div5#se40.22.112_18 

(accessed June 2015). 

135 Ibid. 

136 US Environmental Protection Agency Region 2. Review of Revised SPCC Plan for the Caribbean Petroleum 

Refining Facility, Bayamón, Puerto Rico (Washington, DC: U.S. Environmental Protection Agency, September 

20, 1999). 

000338
Caribbean Petroleum Company Final October 2015 

65 

audible/visual alarm, and established direct communication between the gauger and the pump 

station, but was not required to conduct a hazard assessment to determine if the two safeguards 

adequately prevented an overfill. See Section 6.5.1 for discussion on the computer system. 

After the October 23, 2009, incident, the EPA cited CAPECO again for not having “fail safe 

engineering”137 on any of its bulk storage tanks at the time of the incident. CAPECO contended 

that the facility did employ “fail safe engineering,” as evidenced by its gauging system, which 

included reading the tank side gauge and using the Digital Electric Level Transmitter. The EPA 

deferred to guidance on fail-safe engineering, referring CAPECO to industry standards. 

However, the CSB found, both the consensus standards (NFPA 30, Section 8.10.2.1) and 

industry standard (ANSI/API 2350, Section 8.10.1.1) offer little guidance on fail-safe 

engineering practices at tank terminals. Furthermore, the 2009 incident breached secondary 

containment and spilled into navigable waterways. Although the secondary containment captured 

the gasoline from Tank 409, the open dike valves allowed oil, fire suppression foam, and an oilywater mixture to migrate to the storm water retention pond in the WWT area. The fuel mixture 

discharged into Las Lajas Creek, which feeds 100 acres of wetlands and nearby Malaria Creek 

flowing into the Bay of San Juan. (See Section 5.3.1 for a discussion of community impact.) The 

pooling gasoline in the containment dike also contributed to the formation of the flammable 

vapor cloud. (See Section 4.3 on flammable vapor cloud development.) The CSB further 

concludes that a high-level alarm system as part of an automatic overfill prevention system 

equipped with one additional layer of protection under SPCC could have alerted operators to the 

high liquid levels, or automatically shut down transfer operations, or diverted the flow operations 

to another tank. 

The CSB learned that tank terminal facilities do not have to register or report overfill incidents 

unless those discharges are in violation of CWA section 311(b)(3), as per 40 CFR §110.6. A 

2008 Government Accountability Office (GAO) report found that the EPA did not have a clear 

understanding of the universe of facilities regulated under SPCC. This limited knowledge 

hinders the agency’s ability to effectively identify regulated facilities, establish inspection 

priorities, and evaluate whether the program is achieving its goals.”138 These findings were 

again reiterated in a 2012 report that found the EPA lacked sufficient data on the facilities 

covered in the Oil Prevention Program, which includes both the SPCC and Facility Response 

 

137 Fail Safe Engineering refers to the design of a product to fail in a predictable manner, to a “safe state.” P. Herena. 

The Principle of Fail Safe (American Institute of Chemical Engineers, February 23, 2011).

http://chenected.aiche.org/process-safety/the-principle-of-fail-safe/ (accessed December 21, 2014). 

138 Government Accountability Office. Aboveground Oil Storage Tanks: More Complete Facility Data Could 

Improve Implementation of EPA’s Spill Prevention Program, GAO-08-482 (Washington, DC: U.S. Government 

Accountability Office, April 30, 2008). 

000339
Caribbean Petroleum Company Final October 2015 

66 

Plan (FRP). The 2012 report stated, “the Agency [EPA] remains largely unaware of the identity 

and compliance status of the vast majority of CWA Section 311 regulated facilities.”139 

Furthermore, the 2012 report calls attention to the inadequacy of data collection for OPP-covered 

facilities: “Agency data systems cannot exchange data with each other, and lack consistent and 

sufficient codes to categorize deficiencies and noncompliance. These data systems limitations 

prevent EPA from capturing the full details of a violator’s history and identifying trends in 

compliance and enforcement.”140 A registry of incidents occurring at tank terminal facilities, 

such as CAPECO, would allow the EPA to tailor overfill protection requirements more 

effectively. 

8.6.3 Facility Response Plans (FRP) 

Section 311(j)(5) of the CWA, amended by the 1990 Oil Pollution Act (OPA), calls for facilities 

that could cause substantial harm141 from an oil discharge to submit a Facility Response Plan 

(FRP). The FRP requires contingency measures for oil discharged from an incident.142 Designed 

in accordance with Sections 112.20, 112.21 and Appendices C-F of the CWA FRP regulation, 

FRPs demonstrate a facility’s response to a worst-case discharge of oil. Because CAPECO had 

vessel loading and unloading capabilities, the terminal was also subject to USCG’s FRP 

regulation at 33 CFR §154. Both the EPA and USCG conducted multiple inspections at the 

CAPECO facility prior to the incident. The EPA and USCG have separate regulatory jurisdiction 

for this facility. EPA’s jurisdiction begins at the first valve inside secondary containment 

whereas the USCG’s jurisdiction begins at this first valve inside secondary containment for the 

EPA regulated tank and extends to the vessel. The USCG inspects marine operations at the dock 

and the pipeline carrying fuel to the first valve inside secondary containment. 

The FRP rule at 40 CFR §112.20(f)(1) outlines the substantial harm criteria that allows for 

owner/operators to self-identify whether their facilities are subject to the FRP regulation. A 

facility can be classified for the potential to cause substantial harm if they meet the following 

 

139 Environmental Protection Agency, Office of Inspector General. EPA Needs to Further Improve How It Manages 

Its Oil Pollution Prevention Program. Report No. 12-P-0253 (Washington, DC: U.S. Environmental Protection 

Agency, February 6, 2012). 

140 Ibid., p.9. 141 A facility could reasonably be expected to cause substantial harm to the environment if it has 42,000 gallons or 

more in oil storage capacity and transfers of oil over water to or from vessels, or if it has 1 million gallons or 

more in oil storage capacity, and if one of the following is true: 1) it has inadequate secondary containment and 

freeboard; 2) a discharge could cause injury to fish and wildlife and sensitive environments; 3) a discharge could 

shut down a public drinking water intake; or 4) it has had a reportable oil discharge of 10,000 gallons or more 

within the last 5 years. 142 Subpart D-Response Requirements: Facility Response Plans, Code of Federal Regulations, Part 112.20, Title 40 

(2000). 

000340
Caribbean Petroleum Company Final October 2015 

67 

criteria: 1) The facility transfers oil over water to or from vessels and has a total oil storage 

capacity greater than or equal to 42,000 gallons; or 2) The facility’s oil storage capacity is 

greater than or equal to 1 million gallons and one of the following is true: 

 The facility does not have adequate sized secondary containment for each 

aboveground storage area; 

 The facility is located at a distance such that a discharge from the facility could cause 

injury to fish and wildlife and sensitive environments;143 

 The facility is located at a distance (i.e., planning distance) such that a discharge from 

the facility would shut down a public drinking water intake; or

 The facility has experienced a reportable oil discharge greater than or equal to 10,000 

gallons within the last 5 years.144 

In accordance with 40 CFR §112.20(f)(3), all FRPs submitted to EPA are reviewed by EPA to 

determine whether an oil discharge from the facility could cause significant and substantial harm. 

Facilities with this harm designation require the EPA approval of their FRP. CAPECO met the 

substantial harm criteria, had submitted an FRP to EPA Region 2, was designated as a 

“significant and substantial harm” facility, and was inspected multiple times by EPA inspectors 

for SPCC and FRP compliance. 

8.6.4 EPA FRP Inspection History 

Similar to its SPCC record, CAPECO had a history of non-compliance related to FRP 

requirements. CAPECO submitted its first FRP to the EPA in 1997. However, a 1998 EPA field 

inspection identified violations, which the facility failed to correct when reapplying for approval 

in 1999 and 2001. The EPA denied approval of CAPECO’s FRP in 1999 and March 2001.145

CAPECO received approval for its FRP in July 2001; however, another EPA FRP inspection in 

2005 revealed deficiencies in maintaining discharge prevention meetings or logs.146 

8.6.5 USCG FRP Inspection History 

The USCG conducted annual FRP inspections of the CAPECO facility from 2004 to 2011 to 

evaluate communications, pollution prevention/response, operations/management, firefighting, 

documentation, and other emergency response elements. However, the FRP inspection failed to 

 

143 This distance is referred to as the “planning distance.” Calculation instructions are outlined in Appendix C of 40 

CFR §112. 144 40 CFR §112.20 Facility response plans. (f)(1) 

145 Caribbean Petroleum Refining LP. US EPA Region 2 Facility Response Plan (FRP); FRP ID 20027. Caribbean 

Petroleum Refining LP: Bayamon, PR (2001). 

146Ibid., p.1. 

000341
Caribbean Petroleum Company Final October 2015 

68 

document CAPECO’s ability to fight a catastrophic loss of containment that could result in 

multiple tank fires. CAPECO received a satisfactory inspection from 2004 to March 2008. Seven 

months prior to the October explosion and fires CAPECO submitted an updated FRP and 

received a satisfactory inspection.147 

8.6.6 Lack of Robust FRP Inspections 

Despite receiving a satisfactory rating on the various components of emergency response, 

CAPECO experienced the 2009 overfill incident that spilled into nearby wetlands. The CSB 

found the FRP inspection process does not require FRP inspectors to conduct a thorough 

evaluation of an emergency response plan that encompasses catastrophic failure of multiple tanks 

at once. Under the EPA’s jurisdiction, Appendix F of 40 CFR §112.20(h) and Appendix F, 

Section 1.5.1.2 requires a facility to address chain reactions148 of a tank failure leading to 

contaminating navigable waters, while the USCG FRP inspection report assesses oil spill 

preparedness by evaluating a terminal’s pollution prevention and response, firefighting, 

communications, deck, and cargo, among other factors. However, both FRP inspections lack 

substantive evaluation of a covered facility’s mitigation efforts to prevent a catastrophic incident 

like an explosion and multiple tank fires that can contaminate navigable waters. 

 

Had the EPA and USCG FRP inspectors been required to fully assess the functioning of the 

containment dike, dike drain valves, and the full scope of CAPECO’s emergency discharge plan, 

CAPECO might not have received a satisfactory inspection and would have had to evaluate its 

inadequate dike drainage system, which led to the spread of the gasoline vapor cloud. See 

Section 6.9.1 for discussion on dike drain valves. 

8.6.7 EPA RMP and SPCC Programs Lack Resources to Inspect Tank 

Facilities 

The CSB has identified significant gaps in the RMP and SPCC programs that warrant the EPA to 

extend coverage to bulk petroleum terminals storing NFPA 704 Class 3 flammable liquids and 

above. However, both programs lack the resources to sufficiently inspect all covered facilities. 

The CSB Chevron investigation report discusses how the EPA’s Risk Management Program 

lacks the ability to inspect all covered facilities and made recommendations to the Governor of 

California to “Ensure that a means of sustained funding is established to support an independent, 

 

147United States Coast Guard. Activity Summary Report. Annual Exam, Activity ID 1985003, 2521895, 3093795, 

3162359, 3428543 (Washington, DC: U.S. Department of Homeland Security, 2009). 

148 A chain reaction of a failure requires a covered facility to consider the impact of the failure on the environment. 

Facility response training and drills/exercises. Code of Federal Regulations, Part 112.20(h) and Appendix F, 

Section 1.5.1.2, Title 40 (2000). 

000342
Caribbean Petroleum Company Final October 2015 

69 

well funded, well staffed, technically competent regulator.”149 Federal EPA RMP and SPCC 

programs lack the capacity to undertake inspection of such tank terminals. 

A 2009 report of the EPA Risk Management Program found that EPA inspected only 197 of the 

493 high-risk facilities identified by the EPA’s Office of Emergency Management. Among the 

296 uninspected facilities, 151 had the potential to affect 100,000 people or more in a worst-case 

accident.150 The report identified a lack of full-time inspectors as one of the main factors limiting 

the EPA’s ability to conduct on-site audits or inspections of facilities covered under the Risk 

Management Program. In fiscal year 2009, the EPA had 24 full-time inspectors to cover 11,529 

facilities covered in the program.151 For the EPA to sufficiently inspect tank terminals like 

CAPECO, the Risk Management Program will require additional resources. 

8.6.8 The OPP Program Lacks Resources 

EPA lacks sufficient staff to inspect all its SPCC- and FRP-covered facilities and lacks a 

comprehensive understanding of the facilities it regulates. EPA has an estimated 30 to 40 fulltime employees to inspect all SPCC- and FRP-covered facilities. From 2008 to 2012, the EPA 

inspected only 3,700 of the 640,000 facilities covered under SPCC.152 In addition, a 2008 report 

found “Without more comprehensive data on the universe of facilities that are subject to the 

SPCC rule, EPA cannot employ a risk-based approach to target its SPCC inspections to those 

facilities that pose the greatest risks of oil spills into or upon U.S. navigable waters and adjoining 

shorelines.”153 The same report found that the “incomplete information on the universe of SPCC 

facilities prevents EPA from determining whether and to what extent the SPCC program is 

achieving its goals.”154 

 

149 U.S. CSB. Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire, Chevron Richmond Refinery 

#4 Crude Unit, Richmond, CA. August 6, 2012. 2012-03-I-CA (Washington, DC: U.S. Chemical Safety Board, 

October 2014). http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf

(accessed December 21, 2014). 

150 Environmental Protection Agency. Office of Inspector General. EPA Can Improve Implementation of the Risk 

Management Program for Airborne Chemical Releases. 09-P-0092 (Washington, DC: U.S. Environmental 

Protection Agency, February 10, 2009). 

151 Ibid. 

152 Environmental Protection Agency, Office of Inspector General. EPA Needs to Further Improve How It Manages 

Its Oil Pollution Prevention Program. 12-P-0253 (Washington, DC: U.S. Environmental Protection Agency, 

February 6, 2012). 

153 Government Accountability Office, Aboveground Oil Storage Tanks: More Complete Facility Data Could 

 Improve Implementation of EPA’s Spill Prevention Program, GAO-08-482, April 30, 2008. 

154 Ibid. 

000343
Caribbean Petroleum Company Final October 2015 

70 

8.7 Occupational Safety and Health Administration (OSHA) 

A CSB analysis found deficiencies in various OSHA standards addressing tank terminals in 

protecting workers from the flammable hazards. In addition, similar to the EPA’s policies, 

OSHA’s exemption of atmospheric storage tanks from the Process Safety Management (PSM) 

standard undermines the development of hazard assessments and management of change (MOC) 

reviews that would have required CAPECO personnel to analyze the hazards posed by terminal 

operations. Furthermore, specific requirements for robust overfill prevention and risk 

management are lacking because OSHA regulations do not consider tank terminals as PSMcovered or high-hazard facilities.155

8.7.1 Flammable and Combustible Liquids (1910.106) 

OSHA’s Flammable and Combustible Liquids standard (1910.106), which covers tank terminals 

containing flammable materials, does not require overfill protections for aboveground storage 

tanks.156 Based on the 1968 version of NFPA 30: Flammable and Combustible Liquids Code, the 

standard offers no guidance on overfill prevention at terminal facilities during the transfer of 

flammable or combustible fluids. While recent versions require limited overfill protection, 

OSHA has not updated 1910.106 to include newer versions of NFPA 30 or other updated good 

engineering practices. (See Section 8.10.2.1.) 

The Puerto Rico Occupational Safety and Health Administration (PR OSHA)157 cited CAPECO 

for endangering the lives of tank farm workers following the incident. Although the October 23, 

2009, explosion did not result in any worker injuries, tank farm operators escaped the initial 

vapor cloud ignition by a few minutes. PR OSHA cited CAPECO under 1910.106, stating: 

“At Caribbean Petroleum Refining in Bayamón employees that worked performing 

routine tasks such as tank operator, waste treatment operator, loading rack operator, 

among others were exposed or could be exposed to flammable and combustible release, 

fire and or explosion during the performance of their duties. At the tank farm area the 

employer stored gasoline, jet fuel, fuel oil and diesel, in above ground tanks, ranging 

 

155 A PSM-covered facility or high-hazard facility, as defined by OSHA PSM, has the potential for a catastrophic 

release (major uncontrolled emission, fire, or explosion, involving one or more highly hazardous chemicals that 

present serious danger to employees in the workplace). A facility is defined as the buildings, containers, or 

equipment which contain a process. Highly hazardous chemical is defined as a substance possessing toxic, 

reactive, flammable, or explosive properties. Process safety management of highly hazardous chemicals. Code of 

Federal Regulations, Part 1910.119, Title 29, 2012. 

156 1910.106 contains some overfill provisions for tank trucks and tank cars. 

157 Puerto Rico OSHA operates as a state plan. Established by the 1975 Occupational Safety and Health Act of 

Puerto Rico, the Puerto Rico Occupational Safety and Health Administration (PR OSHA) oversees 29 CFR 

1910.106 – Flammable and Combustible Liquids, 29 CFR 1910.119 – Process Safety Management of Highly 

Hazardous Chemicals, 29 CFR 1910.120 – Hazardous Waste Operations and Emergency Response. 

000344
Caribbean Petroleum Company Final October 2015 

71 

from 500 to 500,000 barrels. The employer did not review the Operational hazard of a 

large Hydrocarbon release from on-site piping entering the process sewer and storm 

water sewer systems. Equipment hazards like the additional hazards created by the use of 

expansion joints on the gasoline transfer lines at the Cummins pump station area. Human 

factors analysis related to what could occur if operators did not follow instructions for 

conducting rounds or gauging tanks. Level reading erroneous at the tank gauge and at 

the operators console. Additional hazards created when operators had to read tank sight 

gauge levels during the night in low light conditions. Lack of formal written operating 

procedures for determining the level of storage tanks during filling operations.” 

 The CSB found OSHA’s Flammable and Combustible Liquids standard to be outdated, 

concluding that requiring terminal facilities to implement more than one safeguard and good 

engineering practice would have spared endangering the lives of CAPECO tank farm operators, 

and they would have likely been notified of the overfill before the vapor cloud developed. 

8.7.2 Incorporating Elements of Process Safety Management (PSM) 

into 1910.106 

OSHA’s PSM Standard (29 CFR §1910.119) is a performance-based standard that requires 

covered entities, such as refineries and chemical plants, to implement a safety management 

system to prevent accidental releases from highly hazardous processes. PSM requires periodic 

audits, process hazard analysis (PHA),158 and a management of change (MOC) process. 

Although the standard needs strengthening,159 these tools indoctrinate additional safety measures 

into a covered entity’s procedures. OSHA requires employers to use appropriate methods, such 

as hazard and operability studies (HAZOP), failure mode and effects analyses (FMEA), or fault 

tree analyses, among other safeguards, to identify and control hazards when conducting a PHA. 

 

158 “The process hazard analysis is a thorough, orderly, systematic approach for identifying, evaluating, and 

controlling the hazards of processes involving highly hazardous chemicals. The employer must perform an initial 

process hazard analysis (hazard evaluation) on all processes covered by the [PSM] standard. The process hazard 

analysis methodology selected must be appropriate to the complexity of the process and must identify, evaluate, 

and control the hazards involved in the process.” U.S. Department of Labor OSHA. Process Safety Management. 

OSHA 3132 (Washington, DC: U.S. Department of Labor Occupational Safety and Health Administration, 

2000). 

159 The CSB made recommendations to amend the PSM regulations in the following investigations: BP Texas City, 

Motiva, Universal Form Clamp, Chevron and Tesoro. OSHA is undertaking measures to strengthen the standard. 

The CSB submitted comments to OSHA’s request for information addressing PSM in January 2014. These 

comments are located on the CSB website: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed 

December 21, 2014). 

000345
Caribbean Petroleum Company Final October 2015 

72 

This performance-based standard requires the PHA methodology to address factors160 such as 

engineering and administrative controls and appropriate detection methods, including process 

monitoring and control instrumentation with alarms.161 Additionally, the standard requires 

covered facilities to update or revalidate their PHA every five years. PR OSHA adopted the 

Federal PSM standard as written. 

 

The CSB found that the CAPECO incident was attributable to a lack of controls, enforcement, 

and adherence to these best engineering practices: 

(1) A PHA, which might have identified additional engineering controls to prevent the 

vapor cloud formation. 

(2) Engineering controls, such as automatic tank overflow protection system with a 

separate independent high-level alarm, which could have prevented the overflow. 

(3) Facility design and tank spacing in a hazard analysis under aspects of PSM, likely 

increasing the number of safeguards to prevent an overfill. 

Following the shutdown of the CAPECO refinery in 2000, the tank farm facility was no longer 

covered under PSM due to standard Section (a)(ii)(B) of the PSM standard, which expressly 

exempts flammable liquid stored in atmospheric storage tanks not connected to a covered 

process that are below normal boiling point. Under PSM, the facility was required to conduct 

periodic PHAs and MOCs of its process equipment. Facing fewer regulatory requirements for the 

tank farm, CAPECO management was not required to maintain the safety management system 

an MOC, and a periodic hazard assessment mandated under the PSM standard. Any of these 

requirements might have identified the lack of independent or redundant level alarm, overfill 

prevention safeguards and poor preventive maintenance. Including elements of PSM like the 

process hazard methodology into 1910.106 would compel tank terminals storing flammable 

liquids to reduce the risk posed to the workers and the public. 

 

160 Other PHA factors include the hazards of the process, previous incidents, consequences of failure of engineering 

and administrative controls, facility siting, human factors, and a qualitative evaluation of possible safety and 

health effects on employees in the workplace. 

161 U.S. Department of Labor OSHA. Process Safety Management. OSHA 3132 (Washington, DC: U.S. Department 

of Labor Occupational Safety and Health Administration, 2000). 

000346
Caribbean Petroleum Company Final October 2015 

73 

8.8 Puerto Rico Occupational Safety and Health Administration (PR 

OSHA) 

The Puerto Rico Occupational Safety and Health Administration (PR OSHA) visited the 

CAPECO facility nine times between 1988 and 2000. None of the visits occurred after the 

refinery shutdown in 2000 when the facility operated solely as a tank farm. 

In 1988, PR OSHA fined CAPECO for serious violations under the General Duty Clause and the 

Flammable, Combustible Liquids standard (1910.106) after an employee was fatally injured, and 

another hospitalized while removing a blind from the pipeline when gasoline spilled and ignited. 

PR OSHA inspected CAPECO after the October 23, 2009 incident, issuing general duty citations 

for inadequate overfill prevention consistent with the recommended practice of ANSI/ANSI/API 

2350, Recommended Practice, Overfill Protection for Storage Tanks in Petroleum Facilities, and 

NFPA 30, Flammable and Combustible Liquids Code. Unable to issue citations under the PSM 

standard due to the atmospheric storage tank exemption, PR OSHA issued multiple serious 

violations and fines for lacking written procedures and not providing a safe workplace, and it 

referred to consensus and industry standards to address the flammable hazards onsite. The PHA, 

MOC, and procedural components of the PSM standard address most of the deficiencies cited by 

PR OSHA, but CAPECO was not compelled to follow them. If the OSHA PSM standard covered 

tank terminals, not only would terminals like CAPECO have to conduct a periodic analysis of 

their hazards, but also PR OSHA would be empowered to issue appropriate citations aimed at 

preventing similar incidents. The CSB issued a similar recommendation to remove the storage 

tank exemption in its Motiva investigation.162

8.9 Recognized and Generally Accepted Good Engineering Practices 

(RAGAGEP) 

CFR §1910.119(d)(3)(ii) of the PSM and RMP standards require covered facilities and highhazard facilities to ensure their equipment complies with recognized and generally accepted good 

engineering practices (RAGAGEP). These may include the Center for Chemical Process Safety 

(CCPS) research and publications; ASTM standards; piping, mechanical, and electrical codes; 

professional society standards; fire codes; and lessons learned from previous incidents.163 OSHA 

and the EPA can cite facilities covered under PSM and RMP for noncompliance with 

 

162 The CSB Motiva Enterprises LLC investigation called for OSHA to extend PSM coverage to atmospheric storage 

tanks that could be involved in a catastrophic release interconnected to a covered process with 10,000 pounds of 

a flammable substance. This recommendation came after one worker was fatally injured and eight were injured 

when hot work on an aboveground storage tank holding sulfuric acid ignited the flammable vapors inside the 

tank, releasing contents into the Delaware River on July 17, 2001. 

163 A. S. Blair. “RAGAGEP Beyond Regulation: Good Engineering Practices for the Design and Operation of 

Plants.” Process Safety Progress 26.4: 330–332. 

000347
Caribbean Petroleum Company Final October 2015 

74 

RAGAGEP. Covering tank terminal facilities like CAPECO under PSM and RMP would ensure 

that they use the best available engineering practices.

8.10 Industry and Consensus Standards 

Industry and consensus standards serve as industry best practices and fire codes for tank terminal 

facilities. In some cases, specific versions of industry standards and fire codes are incorporated 

by reference into different regulations. The API and the National Fire Protection Association 

(NFPA) have a number of standards and codes that apply to overfilling a petroleum storage tank. 

8.10.1 American Petroleum Institute 

The American Petroleum Institute (API), a national trade association representing the oil and 

natural gas industry, develops voluntary industry standards and recommended practices widely 

used in industry. Updated periodically, API standards and recommended practices use the term 

“shall” to communicate requirements and “should” to indicate a recommendations. The 

American National Standards Institute, ANSI/API Standard 2350 and API Manual of Petroleum 

Measurement Standards (MPMS) Ch. 3.1A are the most relevant to overfilling of tanks at storage 

terminals. 

8.10.2 ANSI/API Standard 2350 and the Overfill Prevention Process 

ANSI/ANSI/API 2350, Overfill Protection for Storage Tanks in Petroleum Facilities, offers 

guidance on preventing overfills in petroleum storage tanks. The current, fourth edition, released 

in 2012, recommends that heavier oils including gasoline be included in the scope of a facilityspecific overfill prevention program. The standard recognizes that prevention provides the most 

basic level of protection; thus, while using both the terms “protection” and “prevention,” the 

document emphasizes prevention. The standard covers minimum overfill (and damage) 

prevention practices for aboveground storage tanks in petroleum facilities, including refineries, 

marketing terminals, bulk plants, and pipeline terminals that receive flammable and combustible 

liquids. 

8.10.3 Overfill Prevention Process 

To prevent tank overfills, ANSI/API Standard 2350 (2012) calls for implementing an overfill 

prevention process (OPP) and an automatic overfill prevention system (AOPS) supported by a 

risk assessment or risk analysis. The standard recommends that an OPP contain a management 

system, a risk assessment system, defined operational parameters, and other procedures, 

000348
Caribbean Petroleum Company Final October 2015 

75 

including those for receipt termination.164 Incorporating a management system into the overfill 

prevention process is a significant revision to the standard from previous editions. The standard 

recommends that facilities implement a safety management system that includes, among other 

safeguards: 

 Formal documented operating procedures; 

 Competent operating personnel; 

 Scheduled inspections; 

 A management of change process for personnel and equipment changes; and 

 Systems for investigating and communicating overfill near misses and lessons learned. 

The standard asserts overfill prevention is best achieved through awareness of available tank 

capacity and inventory, careful monitoring, product movement control, reliable instrumentation 

and sensors and systems, and automatic overfill prevention systems when recommended by a 

risk assessment or risk analysis.165 Although this standard did not exist in its current form at the 

time of the incident, CAPECO lacked formal procedures, sufficient operations personnel, and an 

effective safety management system. 

8.10.4 Inadequate Guidance on Conducting a Risk Assessment 

The CAPECO facility was not required to conduct a risk assessment. However, if the facility 

looked to API for guidance, neither the 2008 nor the current 2012 edition of the ANSI/ANSI/API 

2350 standard offers guidance on how to conduct a thorough risk assessment. The risk 

assessment component of ANSI/ANSI/API 2350 asks the owner and operator of facilities to 

“categorize risks associated with potential tank overfills as either meeting or not meeting the 

criteria of the stakeholders.”166 It offers a conceptual framework for conducting an overall risk 

assessment, without significant details on what is necessary. 

While this standard provides a level of autonomy to tank terminal owners and operators, it 

should offer clear guidance on minimum criteria. The standard says tank terminals “shall 

consider” incorporating regulatory requirements when conducting a risk analysis, but facilities 

are not limited to using regulatory requirements to define the parameters of their risk analysis. 

Since the basis for the AOPS is contingent on results from a risk assessment, API should provide 

more guidance on the risk assessment process or provide authoritative resources for this purpose. 

 

164 Receipt termination refers to stopping or completing tank-filling operations. 

165 ANSI/API Standard 2350-2012. Overfill Protection for Storage Tanks in Petroleum Facilities. Fourth edition. 

(Washington, DC: American Petroleum Institute, May 2012). 

166 Ibid. 

000349
Caribbean Petroleum Company Final October 2015 

76 

8.10.5 Insufficient Requirement for Alarm Levels 

Another deficiency of the ANSI/ANSI/API 2350 standard is the levels of concern (LOC) 

required for necessary level alarms. The standard recommends terminal owners and operators 

consider a number of parameters167 when establishing LOC for all tanks and at minimum 

establish three levels: critical-high (CH) levels, high-high level (HH), and maximum-working 

level (MW).168 ANSI/ANSI/API 2350 recommends using the LOC to set level alarms. The 

standard also recommends a minimum of three inches separating the CH and HH tank levels to 

account for potential errors in data and measurement.169 Each level should be set sufficiently 

below the other to allow appropriate response time to terminate the process if necessary. 

ANSI/ANSI/API 2350 also stipulates that an AOPS level for emergency action be set below the 

critical-high level to allow for automatic termination of a receipt before the critical level is 

reached. 

The aboveground storage tank industry should implement either a high-level alarm, an automatic 

overfill prevention system, or both, but the current edition of ANSI/API 2350ANSI/ANSI/API 

2350 recommends only a high-level alarm. ANSI/API 2350 neither specifies using a highly 

reliable alarm nor provides guidance on when a high-level alarm is sufficient to reduce the 

overfill risk. In the case of CAPECO, the level alarms were prone to failure because the 

transmitter signal did not transmit the level signal to the computer, forcing operators to work 

with no automatic fill rate or time to fill estimate. The lack of guidance on when to use highlevel alarms may encourage owners and operators of tank terminals to use only one level of 

alarm when two may be necessary. The UK Government and industry response to Buncefield 

included comprehensive new guidance on Safety and Environmental Standards for Fuel Storage 

Sites. Process Safety Leadership Group, Final, (PSLG) report sets minimum standards of 

overfill protection for gasoline storage tanks.170 The UK Regulator (COMAH Competent 

 

167 ANSI/API 2350 recommends tank terminals consider the product stored, operating practices in the field and for 

each tank, operating limits for valves and manifolds, tank capacities and physical conditions, the amount of 

product transferred, delivered or received and the rate of flow into each tank. 

168 The critical-high level of concern delineates the highest level that product in the tank can reach without 

detrimental impacts. The high-high level alarm is set below the critical-high level to enable termination of 

product receipt before reaching the critical-high level. Maximum-working level is an operational level and the 

highest product level to fill the tank during normal operations. No alarm is required at this level, but alerts are 

recommended. 

169 ANSI/API Standard 2350-2012: Overfill Protection for Storage Tanks in Petroleum Facilities. Fourth edition 

(Washington, DC: American Petroleum Institute, May 2012). 

170 The Process Safety Leadership Group Report: Safety and Environmental Standards for Fuel Storage Sites, Final 

Report (Kew, Richmond, UK: U.K. Health and Safety Executive, The Office of Public Sector Information, 

Information Policy Team, 2009): 25-37. www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed 

December 21, 2014). 

000350
Caribbean Petroleum Company Final October 2015 

77 

Authority) treats these as the minimum standard to meet UK legal requirements for major hazard 

sites. 

8.10.6 Categories 

ANSI/API 2350 also establishes the level of overfill protection based on three categories of 

onsite or remote monitoring: 

 Category 1 includes fully attended and continuously monitored storage facilities, which 

have the option to install level instrumentation. Operations staff may terminate receipt of 

product if emergencies arise. 

 Category 2 includes semi-attended facilities and requires personnel to be present during 

the start of receipt and transfer operations and to attend the operations for 30 minutes. 

This category requires a storage facility to have an automatic tank gauging system with 

an independent high-level alarm transmitted to a local or remote control center. 

 Category 3 is for unattended facilities. It requires both an automatic tank gauging system 

and an independent high-level alarm. 

Overall, these categories are arbitrary—API does not explain its rationale—despite increasing 

layers of protection with each category. CAPECO, for example, was a fully attended facility that 

would have fallen under Category 1. Because the level instrument did not function appropriately, 

operators were unable to terminate receipt because they were unable to recognize they had an 

overfill developing. Had CAPECO been required to use a functioning independent high-level 

alarm and automatic overfill prevention system, surpassing the Category 3 requirements, 

notification of the overflow would have sounded, and automatic termination of the transfer 

would have occurred prior to the tank overfill. 

Additionally, ANSI/API 2350 does not discuss the risk reduction achieved in each of these 

categories compared to an automatic overfill prevention system. It also does not consider that 

increased flow rates or flammability of various products may require more layers of protection. 

At CAPECO, the tank farm stored unleaded gasoline (NFPA flammability 3), jet fuel (NFPA 

Flammability 2), diesel fuel (NFPA flammability 2), and fuel oil (NFPA flammability 2), all with 

different NFPA ratings requiring varying layers of protection. 

The current ANSI/API 2350 does not go far enough to require implementing an automatic 

overflow prevention system for all tank terminals but acknowledges it may be necessary based 

on risk level. It leaves the decision to the owner/operator of the facility. Finally, the standard 

 

000351
Caribbean Petroleum Company Final October 2015 

78 

does not provide sufficient guidance to facilities on how to fully assess their hazards and make 

decisions based on the best overfill prevention plan. 

To further streamline the hazard assessment process and facilitate safety audits on new or 

existing tank farms, ANSI/API 2350 should provide guidance on creating a risk-based system to 

assign all tanks a risk level. 

8.10.7 Lack of One Industry Standard for Operations at Tank Farms 

The CSB found that while multiple standard practices govern tank farm operations, a single 

industry standard for tank terminal operations does not exist, including for filling operations. For 

example, to avert hydrocarbon ignition in the petroleum industry, API 2003, “Protection against 

Ignitions Arising out of Static, Lightning, and Stay Currents” (2008), provides best practices for 

preventing static and stray electrical currents.171 While the standard provides charts that compare 

pipe diameter, flow velocities, and flow rates that minimize static and stray currents, it is not 

specific to tank filling operations. 

Similarly, API MPMS, Chapter 3.1A, Standard Practice for the Manual Gauging of Petroleum 

and Petroleum Products, 3rd edition (August 2013), discussed in Section 6.5, offers useful 

information on manual gauging and floating roof displacement, but it is unlikely that the 

standard practice is accessible to the aboveground tank industry. Furthermore, in addition to 

ANSI/ANSI/API 2350, these standard practices are not mandatory but considered RAGAGEP 

under PSM and RMP. Creating one standard practice, or publicizing the existence of all standard 

and recommended practices governing aboveground storage tank operations including references 

to international standards172 and best practices at tank terminals, would enable facilities to readily 

access these good engineering practices. 

8.10.8 International Fire Code (IFC) 

The International Code Council (ICC) is a consensus organization that develops the International 

Fire Code (IFC) in addition to other I-Codes. I-Codes are “minimum safeguards for people at 

 

171 ANSI/API Standard API 2003-2008. Protection against Ignitions Arising out of Static, Lightning, and Stay 

Currents. Seventh edition (Washington, DC: American Petroleum Institute, January 2008), 

172 The UK Government response to Buncefield published guidance on 'Identification of Instrumental level detection 

systems used with Buncefield in-scope substances. 

Health and Safety Laboratory. Identification of Instrumented Level Detection and Measurement Systems Used with 

Buncefield In-scope Substances (Buxton, Derbyshire, UK: U.K. Health and Safety Executive, 2011). 

www.hse.gov.uk/research/rrpdf/rr872.pdf (accessed December 21, 2014). 

000352
Caribbean Petroleum Company Final October 2015 

79 

home, at school and in the workplace.” 173 The I-Codes are building safety and fire prevention 

codes. Puerto Rico adopted the International Fire Code (IFC); therefore, all municipalities on the 

island are required to follow the IFC guidance to prevent fires. 

At the time of the incident, the 2009 edition of IFC was in place. The 2009 IFC Section 

3404.2.7.5.8, “Overfill Prevention,” requires the use of an overfill prevention system for each 

tank over 1,320 gallons of flammable liquids falling within Class I, II and IIIA.174 Same as the 

NFPA, the IFC defines gasoline as a class 1B liquid. Similar to the NFPA recommendations and 

the SPCC requirements for filling operations, the IFC requires that in no case should the tank fill 

in excess of 95% of its capacity. IFC provides two options to achieve this requirement: 

1. Install an audible or visual alarm system that signals the tank has reached 90% of the 

capacity, and automatically shut off flow after a tank reaches 95% of its capacity. 

2. Reduce the flow rate to not more than 15 gallons per minute (0.95 L/sec) in the system so 

that at the reduced flow rate, the tank will not overfill for 30 minutes and automatically 

shut off flow into the tank so that none of the fittings on the top of the tank are exposed to 

product because of overfilling.175 

Although CAPECO had audible alarms that were not functioning, they were not required to have 

an independent audible or visual alarm to indicate rising liquid levels in Tank 409. 

The ICC modified the overfill prevention text above in the 2015 edition IFC by requiring 

terminal owners and operators to provide an independent means of notifying the person filling 

the tank that the fluid level has reached 90% of tank capacity. The code then provides options 

that include an audible or visual alarm signal, a level gauge marked at 90% of tank capacity or 

other approved means. The CSB recognizes the ICC for requiring the independent level 

notification in addition to automatic shutdown as one viable option to prevent an overfill 

incident. However, the ICC did not go far enough to require: 

1) A visual or audible alarm physically separate and independent from the level control 

and monitoring system; 

2) A hazard assessment to determine the necessary safeguards and operations, as well as 

the reliability of the gauging system and operator monitoring, to prevent an overfill, 

especially for terminals near a community or sensitive environment, or 

 

173 International Code Council. http://www.iccsafe.org/AboutICC/Pages/default.aspx (accessed December 21, 2014). 

174 ICC defines flammable liquids as a liquid having a closed cup flash point below 100oF (38oC). Class 1 liquids 

include Class 1A liquids having a flash point below 73oF (23oC) and a boiling point below 100oF (38oC); Class 

IB liquids having a flash point below 73oF (23oC) and a boiling point at or above 100oF (38oC); and Class IC 

liquids having a flash point at or above 73F (23oC) and below 100F (38oC). 

175 International Fire Code 2009. http://publicecodes.cyberregs.com/icod/ifc/2009/ (accessed December 21, 2014). 

000353
Caribbean Petroleum Company Final October 2015 

80 

3) Proof testing to ensure the overfill prevention system is tested regularly. 

Including these safety parameters into the IFC and extending it to both existing and new tank 

terminals will further ensure an incident like CAPECO does not occur. 

8.10.9 National Fire Protection Association (NFPA) 

The NFPA, a nonprofit organization, develops consensus codes and standards for fire protection 

and prevention. The standards are voluntary but can be adopted by reference into law. Various 

groups, including insurance companies, engineers, and safety professionals, use the codes and 

standards. Approximately 250 panels and committees within the NFPA develop and revise 

NFPA codes and standards. Although Puerto Rico adopted the International Fire Code (IFC) 

issued by the International Code Council (ICC), many states have adopted NFPA codes. NFPA 

30, Flammable and Combustible Liquids Code (2003), had overfill provisions that applied to 

tank terminals like CAPECO at the time of the 2009 incident. 

8.10.9.1 NFPA 30: Code for Storage of Flammable and 

Combustible Liquids 

NFPA 30 provides guidance on storing and transporting flammable and combustible liquids from 

mainline pipelines and marine vessels. The NFPA defines flammable liquids having an NFPA 

704 flammability rating of 3 as class 1B liquids.176 Section 21.7.1 of the NFPA 30 code, 

“Prevention of Overfilling of Storage Tanks,” addresses overfill hazards for tanks containing 

flammable liquids, such as those at CAPECO, but lists an automatic overfill prevention system 

as only one of three options. The code also references ANSI/API 2350, Overfill Protection for 

Storage Tanks in Petroleum Facilities, for additional guidance. The 2008, 2012, and 2015 

editions of NFPA 30 require terminal facilities storing gasoline to follow formal written 

procedures or to provide equipment or both to prevent overfilling of tanks by choosing one of the 

following options: 

 

176 NFPA 30 defines flammable liquids as any liquid that has a closed-cup flash point below 100oF (37.8oC). 

Flammable liquids are further classified into Class I, II, and III liquids. Class I liquids include Class IA, which is 

any liquid with a flash point below 73oF (22.8oC) and a boiling point below 100oF (37.8oC); Class IB, which is 

any liquid with a flash point below 73oF (22.8oC) and a boiling point of or above 100oF (37.8Co); and Class IC, 

which is any liquid with a flash point at or above 73oF (22.8oC), but below 100oF (37.8oC). Class II and Class III 

liquids are considered combustible liquids because they have a flash point at or above 100oF (37.8oC) and at or 

above 140oF (93oC). NFPA 30: Flammable and Combustible Liquids Code (Quincy, MA: National Fire 

Protection Association, 2014). http://www.nfpa.org/codes-and-standards/document-informationpages?mode=code&code=30 (accessed December 21, 2014). 

000354
Caribbean Petroleum Company Final October 2015 

81 

1) Gauge tanks at intervals in accordance with established procedures by deploying 

personnel continuously on the premises during product receipt. Maintain 

communication with the supplier so flow can be shut down or diverted in accordance 

with established procedures. 

2) Equip tanks with a high-level detection device that is either independent of any 

gauging equipment or incorporates a gauging and alarm system with electronic selfchecking to indicate when the gauging and alarm system has failed. Locate alarms 

where on-duty personnel throughout product transfer can arrange for flow stoppage or 

diversion in accordance with established procedures. 

3) Equip tanks with an independent high-level detection system that will automatically 

shut down or divert flow in accordance with established procedures. 

CAPECO was fully compliant with the NFPA 30 since the facility implemented option 1, but it 

had neither a high-level alarm nor an automatic overfill prevention system that allowed for 

automatic shutdown. The only overfill protection was the hourly gauging performed as part of 

the level control and monitoring system. This was insufficient given the fill rate of Tank 409. 

The NFPA first amended the overfill prevention guidance in 1981 to require overfill prevention 

for tanks located near a residence or community.177 Then after the Texaco Tank Farm incident in 

Newark, New Jersey, occurred during the 1984 revision cycle (see Section 7.4 and Appendix B), 

the Newark Fire Department issued a comment, asking the NFPA 30 committee to require: 

1) Gauging tanks at frequent intervals during transfer of product; 

2) Increasing communication with pipeline or marine personnel; 

3) Equipping terminals with the ability to rapidly shut down or divert flow; and 

4) Installing independent high-level alarms that automatically shut down or divert flow 

during filling operations. 

The NFPA 30 committee amended the standard to require one of the four recommendations,178

stating, “It would be inappropriate and unjustifiably burdensome to require cumulative 

provisions.” The technical committee of NFPA 30 stated that any one of the methods would 

 

177 R. Benedetti. Flammable and Combustible Liquids Code Handbook. Third edition (Quincy, MA: National Fire 

Protection Association, 1987). 

178 In 1984, the NFPA 30 committee required overfill protection whenever Class 1 liquids were transferred from 

mainline pipelines or marine vessels, formal written procedures, a continuous presence of personnel during the 

transfer operation at manned facilities, and two-way communication with the supply source. The committee also 

required a high-level detection device independent of any gauging equipment and allowed alternatives to the three 

options if approved by the local authority with jurisdiction. 

000355
Caribbean Petroleum Company Final October 2015 

82 

provide an acceptable degree of safety.179 It asserted that one of the four options would also 

protect unmanned, fully automated receiving terminals that have a good safety record. These 

remote terminals would have been required to implement all four level control recommendations, 

had the Newark Fire Department recommendations been adopted by the NFPA 30 committee.180

The four options taken together improve the reliability of the level control and monitoring 

system and ensure that an automatic overfill prevention system is used to detect and prevent an 

overflow incident. Recent findings from Buncefield and now CAPECO further enhance the need 

for more robust overfill prevention guidance beyond one of the four options presented by the 

NFPA 30 committee in 1984. 

The CSB finds it necessary to further strengthen the overfill protection language in NFPA 30 to 

require all four options within an automatic overfill prevention system. In addition, a hazard 

assessment should be completed considering a facility’s proximity to neighboring communities 

and sensitive environments, the complexity of terminal operations, the reliability of tank gauging 

system and operator monitoring, and periodic proof testing.181 This assessment should ensure 1) 

the overfill system continues to function appropriately and 2) a facility implements and 

maintains an overfill prevention system that addresses the site-specific hazards. These 

requirements should extend to both old and new tanks. 

 

The OSHA Flammable and Combustible Liquids standard (1910.106), incorporates by reference 

the 1968 version of NFPA 30. (See Section 8.7.1.) However, the current 2015 version of NFPA 

30 does not require an automatic overfill prevention system and an independent high-level alarm 

or automatic shutdown to prevent a similar incident like CAPECO from occurring—despite prior 

recommendations to do so following the Texaco Oil Company tank overfill incident in 1983 

discussed in Section 7.4. 

 

179 R. Benedetti. Flammable and Combustible Liquids Code Handbook. Third edition. (Quincy, MA: National Fire 

Protection Association, 1987). 

180 Ibid. 

181 ANSI/ANSI/API 2350 defines proof testing as a complete overfill prevention system instrumentation loop test 

through the primary sensing element verifying appropriate response all the way from sensors to the final control 

element including alarms. The standard identifies proof testing as an essential element in maintaining the 

reliability of overfill prevention systems. Section 4.5.5.4 of the ANSI/ANSI/API 2350 standard recommends the 

testing procedures be in sequential format to ensure safe, consistent practices and the testing procedures be 

accessible to personnel responsible for testing, inspection, and maintenance of the overfill prevention system. 

American Petroleum Institute. ANSI/API Standard 2350-2012. Overfill Protection for Storage Tanks in Petroleum 

Facilities. Fourth edition (Washington, DC: American Petroleum Institute, May 2012). 

000356
Caribbean Petroleum Company Final October 2015 

83 

To prevent another overfill incident like CAPECO’s, OSHA should incorporate the most updated 

version of NFPA 30 with the CSB recommendation to incorporate more than one safeguard. 

8.11 Trade Associations 

Both the International Liquid Terminals Association (ILTA) and the Independent Petroleum 

Association of America (IPAA) represent small independent producers and storage terminals in 

the US. They can advocate for safer operations at their member facilities by endorsing and 

publicizing best industry practices. 

9.0 ROOT AND SYSTEMIC CAUSES 

The CSB’s investigation identified the following key findings: 

Physical Cause

1) During an operation to transfer gasoline from the vessel Cape Bruny tanker ship, gasoline 

overflowed from CAPECO Tank 409, resulting in a vapor cloud formation encompassing 

approximately 107 acres of the CAPECO tank farm. 

2) The gasoline vapor cloud migrated to low-lying areas of the tank farm and to the storm 

water retention pond in the wastewater treatment (WWT) area through open dike valves. 

3) The vapor cloud ignited in the WWT area, which was not electrically classified for use in 

a flammable atmosphere. 

4) Multiple proximate causes likely contributed to Tank 409 overfill: 

 Malfunctioning tank side gauge during filling operations that led to inaccurate tank 

levels being recorded; 

 Normal variations in the gasoline flow rate and pressure from the Cape Bruny without 

the facility’s ability to identify and incorporate the flow rate change in real time into 

tank fill time calculations may have contributed to the overfill; 

 Potential failure of the tank’s internal floating roof due to turbulence and other factors 

may have contributed to the overfill. 

Control Failures

1) An unreliable level control and monitoring system did not provide accurate and timely 

information for the operator to prevent overfilling Tank 409. 

2) The failure-prone float and tape gauges and the unreliable level transmitters proved 

ineffectual. The level transmitters were frequently out of service due to lightning damage. 

3) Insufficient independent and separate safeguards to prevent overfill, such as a high-level 

alarm and an automatic overfill prevention system (AOPS) compromised facility safety. 

Safety Management Systems 

1) Inadequate formal tank filling procedures were restricted to a list of equipment to be 

manipulated. In addition, the outdated procedures were often applicable to the tank farm 

when the refinery was in operation. 

000357
Caribbean Petroleum Company Final October 2015 

84 

2) The automatic tank gauging system, the only level control and monitoring system to 

support the operator in preventing overfill, was often out of service. 

3) The defective level transmitter was not sending data for Tank 409 or 107 to the computer 

in the operator shack or to the supervisor’s office on the day of the incident. 

4) A nonexistent automatic overfill prevention system and the inability to rapidly stop 

transfer operations or divert flow before an overfill weakened CAPECO’s safety program. 

5) Ill-equipped CAPECO tanks were left with an unreliable level monitoring and control 

system or a high-level alarm system. 

Safety Management Systems 

1) Tanks were not equipped with an independent high-level alarm system. 

2) Tanks were not equipped with an independent Automatic Overfill Prevention System 

(AOPS) for terminating transfer operations. 

Human Factors

1) The design of the dike valve system made it difficult to distinguish between open and 

closed valve positions 

2) Insufficient lighting in the tank farm areas hindered operators from observing the 

overfilling of Tank 409 and the subsequent vapor cloud formation. 

Lack of Reporting Requirements 

1) The CSB analysis of the EPA’s Toxic Release Inventory data for 2012 found that 2,959 

bulk petroleum tank terminals are within one mile of communities with over 300,000 

residents. 

2) An incomplete national incident database for assessing the frequency of specific types of 

incidents at bulk petroleum storage tank terminals inhibits the development and 

implementation of more tailored regulatory requirements, industry consensus standards, 

and best practices in this sector. 

Emergency Response Findings 

1) CAPECO and the local fire department lacked sufficient firefighting equipment to 

effectively fight and control a fire involving multiple tanks because they are not required 

to conduct a risk analysis where they have to consider and plan for the potential of a 

vapor cloud explosion involving multiple tanks. 

2) CAPECO did not preplan with local emergency responders or adequately train facility 

personnel to deal with a fire involving multiple tanks. 

3) Local fire departments lacked sufficient training and resources to respond to industrial 

fires and explosion. 

4) There was a lack of coordination among the 43 federal, commonwealth and 

nongovernmental organizations that responded to the CAPECO incident. 

000358
Caribbean Petroleum Company Final October 2015 

85 

Regulatory Findings 

1) The US regulatory system does not consider bulk aboveground storage tank terminals 

storing flammable liquid to be highly hazardous, even those near communities. Although 

the EPA characterizes facilities like CAPECO as substantial harm facilities, under the 

Facility Response Plan requirements, the risk assessment required for these facilities do 

not consider the potential of multiple tank releases as a worst case scenario. 

2) Due to a lack of regulatory coverage under the Occupational Safety and Health 

Administration’s (OSHA) Process Safety Management (PSM) standard and the 

Environmental Protection Agency’s (EPA) Risk Management Plan (RMP), tank terminal 

facilities are not required to conduct risk assessments to address flammable hazards on 

site or to follow Recognized and Generally Accepted Good Engineering Practices 

(RAGAGEP). 

3) A high-level alarm system or high-integrity overfill prevention system are not required by 

OSHA’s Flammable and Combustible Liquids standard, the EPA’s Spill Prevention 

Control and Countermeasure (SPCC) requirements. While facilities covered under SPCC 

must certify an SPCC plan by a Professional Engineer, only the EPA FRP plans meeting 

the substantial harm criteria are approved by the EPA. Furthermore, under SPCC 

facilities similar to CAPECO do not have to report overfill incidents unless oil is 

discharged to navigable waters. 

Industry Standards

1) Despite past incidents in the US and internationally, the response of US industry, trade 

associations, professional associations, and standard-setting organizations has been 

inadequate to prevent similar incidents in the US. 

2) NFPA 30 only requires one layer of protection on storage tanks, at minimum consistent 

gauging without requirement for an independent or redundant level alarm or an automatic 

overfill prevention system. 

3) ANSI/API 2350 only requires an automatic overfill prevention system for remotely 

operated facilities and does not offer substantial guidance on conducting a risk 

assessment that considers the complexity of site operations, the type of flammable and 

combustible liquids stored at the facility or proximity to nearby communities when 

considering the necessary safeguards to protect the public. In addition, there is a lack of 

one comprehensive industry standard to address tank terminal operations, including tankfilling operations and overfill prevention. 

4) ICC does not require an independent audible or visual alarm to indicate rising liquid 

levels. 

000359
Caribbean Petroleum Company Final October 2015 

86 

10.0 RECOMMENDATIONS 

Environmental Protection Agency (EPA) 

2010-02-PR R1 

Revise where necessary the Spill Prevention, Control and Countermeasure (SPCC); Facility 

Response Plan (FRP); and/or Accidental Release Prevention Program (40 CFR Part 68) rules to 

prevent impacts to the environment and/or public from spills, releases, fires, and explosions that 

can occur at bulk aboveground storage facilities storing gasoline, jet fuels, blendstocks, and other 

flammable liquids having an NFPA 704 flammability rating of 3 or higher. 

At a minimum, these revisions shall incorporate the following provisions: 

a) Ensure bulk above ground storage facilities conduct and document a risk assessment that 

takes into account the following factors: 

1. The existence of nearby populations and sensitive environments;

2. The nature and intensity of facility operations; 

3. Realistic reliability of the tank gauging system; and 

4. The extent/rigor of operator monitoring

b) Equip bulk aboveground storage containers/tanks with automatic overfill prevention systems 

that are physically separate and independent from the tank level control systems. 

c) Ensure these automatic overfill prevention systems follow good engineering practices. 

d) Engineer, operate, and maintain automatic overfill prevention systems to achieve appropriate 

safety integrity levels in accordance with good engineering practices, such as Part 1 of 

International Electro-technical Commission (IEC) 61511-SER ed1.0B-2004, Functional 

Safety – Safety Instrumented Systems for the Process Industry Sector. 

e) Regularly inspect and test automatic overfill prevention systems to ensure their proper 

operation in accordance with good engineering practice.

2010-02-PR R2

Conduct a survey of randomly selected bulk aboveground storage containers storing gasoline or 

other NFPA 704 flammability rating of 3 or higher at terminals in high risk locations (such as 

near population centers or sensitive environments) that are already subject to the Spill 

Prevention, Control and Countermeasure (SPCC) and/or Facility Response Plan (FRP) rules to 

determine: 

a) The nature of the safety management systems in place to prevent overfilling a 

storage tank during loading operations. Analysis of the safety management 

systems should include equipment, training, staffing, operating procedures and 

preventative maintenance programs. 

b) The extent to which terminals use independent high level alarms, automated 

shutoff/diversion systems, redundant level alarms or other technical means to 

prevent overfilling a tank 

000360
Caribbean Petroleum Company Final October 2015 

87 

c) The history of overfilling incidents at the facilities, with or without consequence 

d) Whether additional reporting requirements are needed to understand the types of 

incidents leading to overfilling spills that breach secondary containment and have 

the potential to impact the environment and/or the public, as well as the number 

of safeguards needed to prevent them. 

 2010-02-PR R3

As an interim measure, until the rule changes in CSB Recommendation No. 2010-02-I-PR-R1are 

adopted and go into effect: issue appropriate guidance or an alert, similar to EPA’s previously 

issued Chemical Safety Alert addressing Rupture Hazard from Liquid Storage Tanks, to illustrate 

the hazards posed by spills, releases, fires and explosions due to overfilling bulk aboveground 

storage containers storing gasoline, jet fuel, blendstocks, and other flammable liquids having 

an NFPA 704 flammability rating of 3 or higher. 

Occupational Safety and Health Administration (OSHA) 

2010-02-PR R4

a) Revise the Flammable and Combustible Liquids standard (29 CFR§ 1910.106) to require 

installing, using, and maintaining a high-integrity automatic overfill prevention system 

with a means of level detection, logic/control equipment, and independent means of flow 

control for bulk aboveground storage tanks containing gasoline, jet fuel, other fuel 

mixtures or blendstocks, and other flammable liquids having an NFPA 704 flammability 

rating of 3 or higher, to protect against loss of containment. At a minimum, this system 

shall meet the following requirements: 

1. Separated physically and electronically and independent from the tank 

gauging system. 

2. Engineered, operated, and maintained to achieve an appropriate level of 

safety integrity in accordance with the requirements of Part 1 of International 

Electrotechnical Commission (IEC) 61511-SER ed1.0B-2004, Functional 

Safety – Safety Instrumented Systems for the Process Industry Sector. Such a 

system would employ a safety integrity level (SIL) documented in 

accordance with the principles in Part 3 of IEC 61511-SER ed1.0B-2004, 

accounting for the following factors:

i. The existence of nearby populations and sensitive environments;

ii. The nature and intensity of facility operations;

iii. Realistic reliability for the tank gauging system; and

iv. The extent/rigor of operator monitoring.

3. Proof tested in accordance with the validated arrangements and procedures 

with sufficient frequency to ensure the specified safety integrity level is 

maintained.

b) Establish hazard analysis, management of change and mechanical integrity management 

system elements for bulk above ground storage tanks in the revised 1910.106 standard 

000361
Caribbean Petroleum Company Final October 2015 

88 

that are similar to those in the Process Safety Management of Highly Hazardous 

Chemicals standard (29 CFR §1910.119) and ensure these facilities are subject to 

Recognized and Generally Accepted Good Engineering Practices (RAGAGEP). 

International Code Council (ICC) 

2010-02-PR R5

Revise the Section 5704.2.7.5.8 (2015), Overfill Prevention of the International Fire Code (IFC) 

to require an automatic overfill prevention system (AOPS) for bulk aboveground storage tank 

terminals storing gasoline, jet fuel, other fuel mixtures or blendstocks, and other flammable 

liquids having an NFPA 704 flammability rating of 3 or higher, or equivalent designation. These 

safeguards shall meet the following requirements: 

a) Engineered, operated, and maintained to achieve an appropriate safety integrity level in 

accordance with the requirements of Part 1 of International Electrotechnical 

Commission (IEC) 61511-SER ed1-2004, Functional Safety – Safety Instrumented 

Systems for the Process Industry Sector.

b) Specified to achieve the necessary risk reduction as determined by a documented risk 

assessment methodology in accordance with Center for Chemical Process Safety 

Guidelines for Hazard Evaluation Procedures, 3rd Edition, accounting for the following 

factors:

i. The existence of nearby populations and sensitive environments;

ii. The nature and intensity of facility operations;

iii. Realistic reliability for the tank gauging system; and

iv. The extent/rigor of operator monitoring. 

c) Proof tested in accordance with the validated arrangements and procedures with 

sufficient frequency to maintain the specified safety integrity level.

d) Ensure that the above changes are not subject to grandfathering provisions in the codes. 

National Fire Protection Association (NFPA) 

2010-02-PR R6

Revise NFPA 30, Flammable and Combustible Liquids Code, Section 21.7.1.1 (2015) for bulk 

aboveground storage tank terminals storing gasoline, jet fuel, other fuel mixtures or blendstocks, 

and other flammable liquids having an NFPA 704 flammability rating of 3 or greater. This 

modification shall meet the following requirements: 

a) More than one safeguard to prevent a tank overfill, all within an automatic overfill 

prevention system as described in ANSI/API Standard 2350 (2015) Overfill 

Protection for Storage Tanks in Petroleum Facilities with an independent level alarm 

as one of the safeguards. The safeguards should meet the following standards: 

1. Separated physically and electronically and independent from the tank gauging 

system; 

000362
Caribbean Petroleum Company Final October 2015 

89 

2. Engineered, operated, and maintained for an appropriate level of safety based 

on the predetermined risk level after considering part b of this 

recommendation; and

3. Proof tested with sufficient frequency in accordance with the validated 

arrangements and procedures.

b) Specified to achieve the necessary risk reduction as determined by a documented risk 

assessment methodology conducted in accordance with Center for Chemical Process 

Safety Guidelines for Hazard Evaluation Procedures, 3rd Edition, accounting for the 

following factors:

1. The existence of nearby populations and contamination of nearby

environmental resources;

2. The nature and intensity of facility operations;

3. Realistic reliability for the tank gauging system; and

4. The extent/rigor of operator monitoring. 

c) Ensure that the above changes not subject to grandfathering provisions in the code. 

American Petroleum Institute (API) 

2010-02-PR R7

Revise ANSI/API 2350, Overfill Protection for Storage Tanks in Petroleum Facilities (2015), to 

require the installation of an automatic overfill prevention systems for existing and new facilities 

at bulk aboveground storage tanks storing gasoline, jet fuel, other fuel mixtures or blendstocks, 

and other flammable liquids having an NFPA 704 flammability rating of 3 or higher. At a 

minimum, this system shall meet the following requirements: 

a) Separated physically and independent from the level control and monitoring system. 

b) Engineered, operated, and maintained to achieve an appropriate safety integrity level 

in accordance with the requirements of Part 1 of International Electrotechnical 

Commission (IEC) 61511-SER ed1-2004, Functional Safety – Safety Instrumented 

Systems for the Process Industry Sector.

c) Specified to achieve the necessary risk reduction as determined by a documented risk 

assessment methodology set in accordance with Center for Chemical Process Safety 

Guidelines for Hazard Evaluation Procedures, 3rd Edition, accounting for the 

following factors:

1. The existence of nearby populations and contamination of nearby

environmental resources;

2. The nature and intensity of facility operations;

3. Realistic reliability for the tank gauging system; and

4. The extent/rigor of operator monitoring. 

d) Proof tested with sufficient frequency in accordance with the validated arrangements 

and procedures to maintain the required safety integrity level.

e) Ensure that the above changes are not subject to grandfathering provisions in the 

standard. 

000363
Caribbean Petroleum Company Final October 2015 

90 

2010-02-PR R8

Develop detailed guidance on conducting a risk assessment for onsite and offsite impacts of a 

potential tank overfill during transfer operations involving one and multiple tanks and for 

determining the Safety Integrity Level of the required overfill prevention safeguard to replace 

Annex E of ANSI/API 2350, Overfill Protection for Storage Tanks in Petroleum Facilities 

(2015). 

2010-02-PR R9

Develop a single publication or resource describing all API standards and other relevant codes, 

standards, guidance, and information for filling operations of aboveground storage tanks in 

petroleum facilities that describes: 

a) The required design and management practices for control of filling operations; 

b) The minimum set of independent overfill prevention safeguards if the control fails; 

and 

c) Operational challenges (e.g., monitoring/calculating flow rates, ability to maintain 

constant line pressures, and influences of valve cracking) related to loading multiple 

tanks concurrently from a single product source. 

 

000364
Caribbean Petroleum Company Final October 2015 

91 

Appendix A INCIDENT TIMELINE 

Timeline of events leading to explosion and fire 

Date Time Events

10/21/09 8:47 p.m. Pumping starts. Verification pumping is sent to Tank 405. 

10/21/09 9:43 p.m. Pumping verification ends. Valves lined to fill tank 504. 

10/22/09 12:20 a.m. Product movement begins into Tank 504. 

10/22/09 1:18 a.m. Line displacement into Tank 504 ends. 

10/22/09 1:40 a.m. Bulk pumping begins into 504, 409 and 411. 

10/22/09 4:00 a.m. 

Tank levels, posted in the daily log, read as follows: 

504 @ 14’6.5” (from 5’ 24 hours prior) Increase 

409 @ 8’4” (from 3’2.8” 24 hours prior) Increase 

411 @ 4’7” (from 8’8.8” 24 hours prior) Decrease 

10/22/09 ~11:00 a.m. 

The tank farm operator notes the level of Tank 504 before going to lunch (level unknown) 

and calculates that the tank would be full around 1 p.m. 

10/22/09 11:20 a.m. 411 @ 2’5.7” Decrease (contractor gauge)

10/22/09 ~12:15 p.m. 

The operator returns to see that the same numbers on Tank 504 that he noted before 

lunch are still on display. The level instrument is physically stuck inside of the tank. He 

climbs to the top of Tank 504 to visually inspect the level and finds that it is well below the 

fill level – 42.75’ (out of ~54’). 

10/22/09 ~12:15 p.m. 

The operator and supervisor decide to close Tank 504 early. Tank 409 is fully opened, 

and Tank 411 is cracked open. 

10/22/09 ~1:00 p.m. 

Tank 409 is fully opened, and Tank 411 is cracked open. 

2 p.m. is shift change (8-hour shifts: 2 p.m.-10 p.m., 10 pm-6 a.m., 6 a.m.-2 p.m.). 

10/22/09 1:25 p.m. Tank 504 is gauged by the contractors and CAPECO personnel: Level 42’ 23/4”. 

10/22/09 ~6:00-6:30 p.m. 

The tank farm operator calculates that Tank 409 will be full at shift change (9-10 p.m.). 

Since Tank 409 does not display properly on the computers and to avoid complications at 

shift change, the operator fully opens the valve to Tank 411 and cracks down the valve to 

409 (cracked open). 

409 @ ~44’ 

411 @ ~20’-27’ 

10/22/09 ~9:00-9:30 p.m. 

Shift Change. 

Relief for the wastewater and tank farm operators arrive. 

The tank farm operator rotates to the dock (working a double shift). 

10/22/09 10:10 p.m. 

The tank farm operator determines that Tank 411 is full; with help from the other operator,

he closes 411 and fully opens 409. 

He asks the assistant to briefly close Tank 409, while he observes the full flow rate into 

Tank 411; then they perform the switch. 

The tank operator estimates that 409 will be full around 1 a.m.

10/22/09 11:20 p.m. 

Tank 411 is gauged by the outside inspectors and CAPECO personnel: Level 46’ 73/4”. 

Nothing abnormal is observed. 

10/22/09 

~11:25 p.m.-

12:00 a.m. 

Tank 409 begins to overflow. The CSB calculates that the overflow lasted approximately 

26 minutes. See Appendix E. 

10/23/09 ~12:00 a.m. 

The tank farm operator notices a fog on the ground and on the road along Tanks 504, 

411, and 409. 

He notifies the supervisor, who then instructs the ship to stop pumping and for the WWT 

operator to assist the guards at the gate. 

The supervisor and the tank farm operator attempt to drive around to the other side of the 

fog to determine its origin. 

10/23/09 12:23 a.m. Explosion occurs. 

000365
Caribbean Petroleum Company Final October 2015 

92 

Appendix BTANK INCIDENTS IN THE PAST 50 YEARS 

  

Facility Name

/

Location

Incident Date

Injured

Fatality

Cost

Product

Incident Type

Description

1

Houston,

TX, USA

[4]  

4/1962 0 0     Gasoline

Leak,

Vapor

Cloud

Explosio

n  

A 12,700 M gasoline tank leaked

and vapors accumulated. A car

driving on a nearby highway

ignited the vapor cloud.

2

Collegeda

le, TN,

USA [8]

9/25/197

2 0 0     Gasoline Overfill

An overfill of a 55 ft diameter

gasoline tank ignite while

emergency responders were

preparing to foam the spill

surface. Multiple tank explosion

involving five tanks followed. A

dike fire burned for over 24 hours

due to leaking flanges and

manways and lack of firefighting

foam.  

3

Gulf Oil

Co.,

Philadelp

hia, PA,

USA [1]

8/17/197

5 8 14     Gasoline

Overfill,

Vapor

Cloud

Explosio

n

Flammable vapors were released

from an overfilled. Crude oil tank,

which exploded. A second

explosion occurred in the crude

tank during the incident response,

killing 8 firefighters and injuring

14.  

4

Baytown,

TX, USA

[5]  

1/27/197

7 0 0     Gasoline

Ship

Hold

Overfill,

Vapor

Cloud

Explosio

n  

In a ship overfilling incident, a

tugboat ignited as it was tied up

alongside a dock on the opposite

side of the ship. The explosion

overturned the tug, which sank.

Little other explosion damage

occurred.  

000366
Caribbean Petroleum Company Final October 2015 

93 

5

Rialto,

CA, USA

[8]

2/21/197

8 0 0     Gasoline

Overfill,

Vapor

Cloud

Explosio

n

Gasoline vapors ignited after an

overfill of a 50 ft gasoline tank. A

valve was mistakenly opened

causing fuel to spill out of the tank

vents into the secondary

containment dike at

approximately 30,300 L/min(8000

gpm).

6

Chevron

Tank

Terminal,

HI, USA

[8]

1980 4 2     Gasoline

Overfill,

vapor

cloud

ignition

At 10:30 am, an overfilling

gasoline tank created a vapor

cloud that ignited after reaching a

switch‐room at an adjacent Shell

facility.  

7

Texaco

Oil

Company

, Newark,

NJ, USA

[1]

1/7/1983 1 24     Gasoline

Overfill,

Vapor

Cloud

Explosio

n

A gasoline vapor cloud exploded

when a 1.76‐million gallon

capacity tank overflowed,

resulting in one fatality and 24

injuries. Lack of monitoring of the

rising gasoline levels in the

storage tank during filling

operations contributed to the

overflow, explosion, and

subsequent fire.

8

Naples

Harbour,

Italy [4]  

12/21/19

85 0 4 $50.9M Gasoline

Overfill,

Vapor

Cloud

Explosio

n

A gasoline storage tank

overflowed and spilled nearly 800

tons into a diked area. A vapor

cloud formed and ignited. The

explosion killed 2 employees and

2 members of the public,

destroyed 24 of the 32 tanks

onsite, caused serious structural

damage within 100 meters, and

broke glass out to 1 kilometer.

Fire covered 3.7 acres, caused

severe damage to nearby

industrial and residential areas,

and took 3.5 days to extinguish.

The estimated loss was $50.9

million.  

9

Saint

Herblain,

France

[3]  

1991 0 0     Gasoline

Pipe

leak,

Vapor

Cloud

Explosio

n  

A release of gasoline from a

section of pipe inside a bund

produced a vapor cloud. Ignition

of the vapor cloud produced

extensive damage.

000367
Caribbean Petroleum Company Final October 2015 

94 

10 Brenham,

TX, USA   4/7/1992 0 0     Gasoline

Vapor

Cloud

Explosio

n  

The ignition of a vapor cloud

comprising a mixture of

hydrocarbons in a rural area

resulted in significant damage to

nearby buildings. No pipework

congestion was present but the

cloud engulfed wooded areas.  

11

Steuart

Petroleu

m,

Jacksonvil

le, FL

USA[8]

1/2/1993 0 1     Gasoline

Overfill,

Vapor

Cloud

Explosio

n

Gasoline vapors ignited after an

overfill of a 2.3 million gallon

gasoline tank fatally injuring one

terminal operator who was driving

into the spill. A large ground fire

persisted impinging two

additional tanks located

approximately 50 feet away.

Gasoline flowed from the tank's

eyebrow vents, complicating

firefighting activities. The fire

covered about one acre and

exposed unprotected

aboveground pipelines, manifolds

and a number of flange

connections.  

12 Nanjing,

China

10/21/19

93 0 2     Gasoline

Overfill,

Vapor

Cloud

Explosio

n

A gasoline storage tank (10,000

m3 tank) overflowed resulting in a

gasoline spill and vapor cloud. The

vapor cloud ignited by passing

tractor and killed 2 employees.

Fire involved at least 100 tons of

gasoline. The fire took 17 hours to

control.  

13

IOCL

Baroda,

Gujarat,

India

8/4/1995 N/A N/A N/A Gasoline

Overfill,

Vapor

Cloud

Ignition

An overfill of a tank created a

vapor cloud which ignited. The fire

encompassed two tanks in the

same secondary containment

area. Nearby tanks were cooled to

prevent further fire impact.  

000368
Caribbean Petroleum Company Final October 2015 

95 

14

Thai Oil

Company

, Laem

Chabang,

Thailand

[2]  

12/2/199

9 0 7 $22.3M Gasoline

Overfill,

Vapor

Cloud

Explosio

n  

A gasoline storage tank

overflowed forming a vapor cloud.

It exploded and killed seven onsite

personnel. Thai Oil Company was

blending product onsite when an

operator manually opened a valve

to fill a tank, which was already

filled with product. It began to

overfill. The rising liquid level set

off two safety alarms at an offsite

control room, but the control

room operators did not hear the

alarms. Five gasoline storage

tanks and 250,000 barrels of

gasoline were destroyed. The fire

burned for 35 hours and total

damages cost $22.3 million.

15

Conoco,

Helana,

MT, USA

[1]

12/13/20

00 0 0 0 Gasoline TankOverfill

Approximately 60,000 gallons of

gasoline spilled from a storage

tank causing the evacuation of

100 residents and restricting

traffic to the area.  

16

Amerada

Hess

Corp.,

Wilmingt

on, DE,

USA [1]

3/13/200

0 0 0 0 Gasoline TankOverfill

A million gallon capacity storage

tank overfilled while being filled

by a barge unloading gasoline

creating a vapor cloud that caused

local residents to evacuate their

homes.

17

Buncefiel

d Oil

Storage

Depot

Hemel

Hempste

ad,

Hertfords

hire UK  

12/11/20

05 43 0 $1.5B Gasoline

Overfill,

Vapor

Cloud

Explosio

n

An overfill of an atmospheric

storage tank of gasoline resulted

in the development of a vapor

cloud which ignited damaging 22

tanks.  

18

BP Milne

Point, AK,

USA [1]

1/15/200

9 0 0 0 Crude Oil TankOverfill

Approximately 24,400 gallons of

crude oil spilled from an overfilled

tank at BP's Milne Point oil field.

Reportedly, a malfunction in the

automated flow control system

caused the overfill. Workers were

able to manually cut off flow to

the tank.  

000369
Caribbean Petroleum Company Final October 2015 

96 

19

CAPECO,  

Bayamón,

Puerto

Rico, USA

[1]

10/23/20

09 3 0     Gasoline

Tank

Overfill,

Vapor

Cloud

Explosio

n  

An overfill of a 5 million gallon

capacity atmospheric storage tank

with gasoline caused a vapor

cloud which ignited causing

multiple tank explosions and tank

fires. 17 of 48 tanks were burned.

The fire took three days to

control.  

20

Gladieux

Trading

and

Marketin

g

Huntingt

on, IN,

USA [1]

3/10/201

0 0 0 N/A Dieselfuel

Tank

Overfill

A gasoline storage tank

overflowed at Gladieux Trading

and Marketing in Huntington, IN,

when a pump that was

transferring product was left on at

the end of a shift. A high‐ and

high‐high level safety alarm

activated, but it was hidden from

view on the alarm monitoring

screen. An offsite contracted

employee spotted the product

overflowing from the tank 157

minutes after the overfill occurred

and alerted the control operator

to the incident.

21

Aloha

Petroleu

m Bulk

Storage

Facility,

HI, USA

[1]

11/1/201

1 0 0 0 Dieselfuel

Tank

Overfill

Approximately 14,700 gallons of

diesel fuel spilled during transfer

operations when diesel fuel was

being pumped from a barge to

storage tanks at the Aloha

Petroleum Bulk Storage facility.

Workers reportedly miscalculated

the amount of fuel that could be

pumped into the storage tank.  

22

Internatio

nal‐

Matex

Tank

Terminlas

, NJ, USA

[1]

6/2/2014 0 0 0 Gasoline Tank

Overfill

A fuel tank overfilled during

transfer operations spilling

approximately 6,000 gallons of

gasoline into the soil.

[1] CSB data.

[2] The 100 Largest Losses 1972‐2001, Large Property Damage Losses in the Hydrocarbon‐Chemical Industries, 20th

Edition: February 2003, a publication of Marsh’s Risk consulting practice.

[3] J.F. Lechaudet and Y. Mouilleau. “Assessment of an accidental vapour cloud explosion. A case study: Saint

Herblain, October the 7th 1991, FRANCE,” Loss Prevention and Safety Promotion in the Process Industries, 1995, 1,

pp. 377‐388.

000370
Caribbean Petroleum Company Final October 2015 

97 

[4] M. Maremonti, G. Russo, E.Salzano, et al. “Postaccident Analysis of Vapour Cloud Explosions in Fuel Storage

Areas,”” Trans IChemE 1999 77 (B) 360365. Persson, H. and Lennermark, A. 2004. Tank Fires Review of fire

incidents 1951‐2003. SP Swedish National Testing and Research Institute. Accessed October 1, 2014.  

[5] Eric M. Lenoir and John A. Davenport[v] “A Survey of Vapour Cloud Explosions, Second Update.” Hartford:”

Industrial Risk Insurers, Paper No. 74d, 26th Annual Loss Prevention Symposium, AIChE, New Orleans, 1992.

[6] Lenoir and Davenport, 1992.

[7] Persson,H. and Lennermark, A. 2004. Tank Fires Review of fire incidents 1951‐2003. SP Swedish National Testing

and Research Institute. Accessed October 1, 2014. Available at http://rib.msb.se/Filer/pdf%5C19108.pdf. [Edward

C. Avant‐Frie Journal July 1974 (reprint from Fire Engineering April 1973); Herzog G. R. reprint Frie Journal July

1974; Mahley H. S. rreprint Hydrocarbon Proccessing, 1975.  

[8] Persson, H. 3M Case History 7; Fire Engineering, August 1978.

000371
Caribbean Petroleum Company Final October 2015 

98 

Appendix C CARIBBEAN PETROLEUM ACCI MAP 

TANK 

OVERFLOW

VAPOR CLOUD 

FORMED

VAPOR CLOUD 

IGNITED

1. PHYSICAL ACCIDENT SEQUENCE

2. ORGANIZATIONAL / SITE

3. COMPANY

4. GOVERNMENT / REGULATORY SYSTEM

5. SOCIETAL

HUMAN 

FACTORS –

DIFFERENT DIKE 

VALVE LED 

GASOLINE TO 

WWT

VAPOR CLOUD 

REACHED AREA NOT 

CLASSIFIED FOR 

HAZARDOUS 

SERVICE (WWT)

DAMAGE TO 

COMMUNITY

DAMAGE TO 

SITE

DAMAGE TO 

EXPLOSION ENVIRONMENT

DATA 

ACQUSITION 

SYSTEM 

FREQUENTLY 

DIDN’T 

TRANSMIT DATA 

MECHANICAL 

INTEGRITY –

EQUIPMENT NOT 

MAINTAINED IN 

TIMELY MANNER

EQUIPMENT 

DESIGN NOT 

EMF PULSE 

RESISTANT

WERE THERE COST 

PRESSURES AGAINST 

MAINTAINING OR 

IMPROVING THE 

SYSTEM? 

RELEASE OF 

FUEL

FROM TANK 409

INACCURATE INFO 

FROM GAUGING DEVICE TO FILL 

TANK

OSHA EPA

RAGAGEP

PROSHA AMERICAN PETROLEUM 

INSTITUTE

NFPA

AMERICAN FUEL 

AND 

PETROCHEMICAL 

MANUFACTURERS

DEMAND FOR 

FUELS

AIR 

TRANSPORTATION 

DEMAND

ELECTRICITY 

DEMAND

GROUND 

TRANSPORT 

DEMAND

COMPLACENCY/

FAILURE TO 

LEARN /

INCIDENT 

INVESTIGATION

SAFETY AND 

ORGANIZATIONAL 

CULTURE

NO REQ FOR RAPSM-1910.106

HAZARD 

EVALUATION/

ASSESSMENT

RISK 

ASSESSMENT 

NOT REQUIRED 

BY COMPANY

RISK 

ASSESSMENT 

NOT REQUIRED 

BY 

REGULATORS

FACILITY NOT 

REQUIRED TO 

DO RELIABILITY 

ASSESSMENT 

OR RA

SOURCES 

FOR 

REDUCED 

INVESTMENT

BANKRUPTCY

EMERGENCY 

RESPONSE

LACK OF 

EMERGENCY 

PREPAREDNESS

4. GO

REDUCED 

INVESTMENT

REFINERY 

SHUTDOWN IN 

2000

ENDED 

COLLABORATION 

WITH OFF-SITE

FIREFIGHTERS

ENDED ON-SITE 

FIRE BRIGADE

REDUCED 

EMPHASIS ON 

MECHANICAL 

INTEGRITY

PERSONNEL 

LAYOFFS

ECONOMIC 

STRESSORS

CHANGE IN 

OWNERSHIP

NEED TO 

INVESTIGATE 

FURTHER

REDUCED SHE 

STAFF

FACILITY NOT 

RECOGNIZED AS 

HIGH HAZARD

FISH AND 

WILDLIFE 

SERVICE

DECLARED STATE 

EMERGENCY

DECLARED 

NATIONAL 

EMERGENCY

PUERTO RICO 

FIRE 

DEPARTMENT 

PUT OUT FIRE 

WITH HELP 

FROM 

CONSULTANT

GOVERNOR O

PUERTO RICO 

FEMA

GOVERNOR OF 

PUERTO RICO

SO

NEIGHBO

NOT RE

WETLANDS, 

AIR, SOIL

COAST GUARD

NATIONAL 

GUARD

DECISION TO 

DECLARE 

NATIONAL 

EMERGENCY

FACILITY 

SHUTDOWN AND 

RESTARTED THE 

REFINERY 

MULTIPLE TIMES 

IN PAST

MECHANICAL 

INTEGRITY –

DESIGN – LACK OF 

STANDARDIZATION

EPCRA

CONSISTENT 

WITH INDUSTRY 

CULTURE

SMOKE 

IMPACTED 

TOURISM ON 

NEIGHBORING 

ISLANDS

000372
Caribbean Petroleum Company Final October 2015 

99 

[Intentionally left Blank] 

000373
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

REPORT NO. 2010-6-I-WV

SEPTEMBER 2011 

Final Report

E.I. DUPONT DE NEMOURS & CO., INC. BELLE, WEST VIRGINIA

METHYL CHLORIDE RELEASE

JANUARY 22, 2010

OLEUM RELEASE

JANUARY 23, 2010

PHOSGENE RELEASE

JANUARY 23, 2010

One Fatality 

One Confirmed Exposure 

One Possible Exposure

KEY ISSUES:

• MECHANICAL INTEGRITY

• ALARM MANAGEMENT

• OPERATING PROCEDURES

• COMPANY EMERGENCY RESPONSE & NOTIFICATION

000374
E.I. DuPont de Nemours & Co. Final Report September 2011

ii

CONTENTS

1.0 INTRODUCTION ......................................................................................................................... 13

1.1 Background.................................................................................................................................... 13

1.2 Investigative Process...................................................................................................................... 14

1.3 E.I. DuPont de Nemours & Co., Inc. ............................................................................................. 16

1.3.1 Company History.............................................................................................................. 16

1.3.2 DuPont Business Areas and Corporate Management ....................................................... 16

1.3.3 Safety at DuPont ............................................................................................................... 17

1.4 DuPont Belle Plant......................................................................................................................... 20

2.0 METHYL CHLORIDE RELEASE (JANUARY 22, 2010).......................................................... 22

2.1 Background .................................................................................................................................... 22

2.1.1 Methyl Chloride................................................................................................................ 23

2.2 Incident Description....................................................................................................................... 24

2.2.1 ECF Sensor Alarm............................................................................................................ 25

2.2.2 Odor Detection Considerations......................................................................................... 25

2.2.3 Incident Response ............................................................................................................. 26

2.2.4 Community Impact ........................................................................................................... 29

2.3 Incident Analysis ........................................................................................................................... 29

2.3.1 Mechanical Integrity ......................................................................................................... 29

2.3.2 Design and Maintenance of Rupture Discs....................................................................... 31

2.3.3 Previous Incidents of Rupture Discs Bursting .................................................................. 32

2.3.4 Management of Change--Technology and Subtle Change ............................................... 34

2.3.5 F3455 Unit Turnaround .................................................................................................... 35

2.3.6 Second-Party Process Safety Management Audit............................................................. 38

2.4 Key Findings.................................................................................................................................. 39

2.5 Root Causes ................................................................................................................................... 39

3.0 OLEUM RELEASE (JANUARY 23, 2010).................................................................................. 40

3.1 Background.................................................................................................................................... 40

3.2 Incident Description....................................................................................................................... 40

3.2.1 Incident Response ............................................................................................................. 42

3.3 Incident Analysis ........................................................................................................................... 42

000375
E.I. DuPont de Nemours & Co. Final Report September 2011

iii

3.3.1 Reconstructive Analysis ................................................................................................... 42

3.3.2 Pipe Testing and Analysis................................................................................................. 45

3.3.3 Previous Incident Investigation......................................................................................... 46

3.3.4 PM Program Recommendation from 2009 Incident......................................................... 47

3.3.5 Mechanical Integrity ......................................................................................................... 47

3.3.6 Heat Tracing Design ......................................................................................................... 48

3.4 Key Findings.................................................................................................................................. 48

3.5 Root Causes ................................................................................................................................... 49

4.0 PHOSGENE RELEASE (JANUARY 23, 2010)........................................................................... 49

4.1 Background.................................................................................................................................... 49

4.1.1 Phosgene ........................................................................................................................... 49

4.1.2 Phosgene Stainless Steel Hose Transfer Operation .......................................................... 50

4.1.3 Phosgene Highly Toxic Material Guardian Committee.................................................... 56

4.2 Incident Description....................................................................................................................... 57

4.2.1 Community Impact ........................................................................................................... 61

4.3 Incident Analysis ........................................................................................................................... 61

4.3.1 Hose Failure Analysis....................................................................................................... 61

4.3.2 Effect of Plastic Adhesive Tape........................................................................................ 62

4.3.3 Hose Degradation Issues................................................................................................... 64

4.3.4 Hose Change-out Frequency............................................................................................. 64

4.3.5 SAP Work Process............................................................................................................ 66

4.3.6 Near-Miss Phosgene Incident ........................................................................................... 67

4.3.7 Mechanical Integrity ......................................................................................................... 68

4.3.8 Flex Hose Materials of Construction ................................................................................ 70

4.3.8 Non-routine Job Planning ................................................................................................. 72

4.4 Process Hazard Analysis................................................................................................................ 73

4.5 Audits............................................................................................................................................. 75

4.5.1 Unit Second-Party PSM Audit.......................................................................................... 75

4.5.2 2006 Phosgene Committee Audit ..................................................................................... 79

4.6 Standards and Guidelines............................................................................................................... 80

4.7 Key Findings.................................................................................................................................. 86

4.8 Root Causes ................................................................................................................................... 87

000376
E.I. DuPont de Nemours & Co. Final Report September 2011

iv

5.0 THREE INCIDENTS IN 33 HOURS............................................................................................ 88

5.0.1 Additional DuPont Incidents............................................................................................. 90

5.1 Management Systems .................................................................................................................... 91

5.1.1 Knowledge Management .................................................................................................. 91

5.1.2 Hierarchy of Controls ....................................................................................................... 93

6.0 REGULATORY ANALYSIS........................................................................................................ 97

6.1 Occupational Safety and Health Administration (OSHA)............................................................. 97

6.1.1 Process Safety Management Program .............................................................................. 97

6.1.2 Compressed Gases............................................................................................................ 99

6.1.3 Inspection History........................................................................................................... 100

6.2 Environmental Protection Agency............................................................................................... 101

6.3 State Hazardous Chemical Release Prevention Program............................................................. 103

7.0 RECOMMENDATIONS............................................................................................................. 105

REFERENCES ......................................................................................................................................... 112

APPENDIX A: THREE EVENT LOGIC TREE...................................................................................... 114

APPENDIX B: HISTORICAL AND EVENT TIMELINE ...................................................................... 119

APPENDIX C: SAP PROGRAM............................................................................................................. 120

APPENDIX D: PHOSGENE RELEASE CALCULATIONS.................................................................. 123

APPENDIX E: HAZARD ANALYSIS FOR PHOSGENE USE AT BELLE.........................................130

APPENDIX F: HARD PIPE TO FLEXIBLE HOSE TRANSITION CORRESPONDENCE.................130

APPENDIX G: PHA RECOMMENDATION DELAY LETTER ........................................................... 165

000377
E.I. DuPont de Nemours & Co. Final Report September 2011

 v 

List of Figures 

Figure 1. DuPont Belle, WV, facility on the Kanawha River (EPA, 1973)................................................ 20

Figure 2. Simplified thermal oxidizer and rupture disc block flow diagram.............................................. 23

Figure 3. 0.5-inch NPS vent/drain pipe and rupture disc............................................................................ 25

Figure 4. Rupture disc piping and vent pipeline to atmosphere on roof..................................................... 28

Figure 5. Rupture disc burst sensor post-incident....................................................................................... 30

Figure 6. New rupture disc.......................................................................................................................... 32

Figure 7. Process data showing sudden pressure decrease when rupture disc burst................................... 37

Figure 8. Photo of the position of the 1-inch sample line, which had not yet been replaced...................... 41

Figure 9. The pitting phenomena observed in the small initial hole of the oleum sample line wall........... 43

Figure 10. The large hole eroded from the outside-in on the oleum sample line........................................ 44

Figure 11. Photo showing the orientation of the small hole to the main hole............................................. 45

Figure 12. Phosgene shed and full (F) and empty (MT) cylinder locations on day of incident 

(not to scale)........................................................................................................................................ 51

Figure 13. SafeAir Phosgene Dosimeter Badge.......................................................................................... 55

Figure 14. The distinct effect of the white plastic adhesive tag on the corrosion of the stainless steel 

overbraid ............................................................................................................................................. 63

Figure 15. Damaged hillside phosgene hose removed from phosgene cylinder. The plastic adhesive tag 

that covered the damaged section fell off during the hose decontamination procedure. .................... 67

Figure 16. Flex hose comparison photographs: (top to bottom) ruptured riverside hose, flow restricted 

hillside hose, a new hose with attached ID tag ................................................................................... 72

Figure 17. Hierarchy of Controls................................................................................................................ 93

Figure 18. The hose and piping system that supplied phosgene for the release ....................................... 123

Figure 19. ALOHA estimate of phosgene concentrations with MARPLOT GIS overlay........................ 128

List of Tables

Table 1. Previous rupture disc events in the F3455 unit............................................................................. 34

Table 2. Phosgene hose change-out frequency ........................................................................................... 65

Table 3. Flexible hoses for phosgene service as listed in the DuPont P3H Standard: Flexible Chemical 

Hose for Highly Toxic Services.......................................................................................................... 69

Table 4. Preliminary Risk Assessment by DuPont Engineering, 1988 (Appendix E)................................ 76

Table 5. PHA enclosure recommendation delays timeline ......................................................................... 78

000378
E.I. DuPont de Nemours & Co. Final Report September 2011

vi

Table 6. Sum of Belle plant retirements and new hires from 2005 to 2009................................................ 92

Table 7. DuPont Belle RMP-covered chemicals and threshold quantities ............................................... 102

000379
E.I. DuPont de Nemours & Co. Final Report September 2011

vii

List of Acronyms and Abbreviations 

ACC American Chemistry Council

ACGIH American Conference of Governmental Industrial Hygienists

AIHA American Industrial Hygiene Association

ALOHA Area Locations of Hazardous Atmospheres

CERCLA Comprehensive Environmental Response, Compensation, and Liability Act

CFR Code of Federal Regulations 

Cl2 chlorine

CMMS Computerized Maintenance Management System

CO carbon monoxide

CSB U.S. Chemical Safety and Hazard Investigation Board

DCS distributed control system

DMA dimethylamine

DMS dimethylsulfate

ECF ethyl chloroformate

EMS emergency medical services

FRC flame-resistant clothing

EPA U.S. Environmental Protection Agency

GIS Graphical Information System

HCl hydrochloric acid

HTM Highly Toxic Materials

IDLH immediately dangerous to life and health

KCEAA Kanawha County Emergency Ambulance Authority

KPEPC Kanawha-Putnam County Emergency Planning Committee

LDAR Leak Detection and Repair

MIC methyl isocyanate

MM million (old notation style)

MOC Management of Change

NDE non-destructive examination

NIMS National Incident Management System

NIOSH National Institute for Occupational Safety and Health 

NOAA National Oceanic and Atmospheric Administration 

NPS nominal pipe size

000380
E.I. DuPont de Nemours & Co. Final Report September 2011

viii

OSHA U.S. Department of Labor, Occupational Safety and Health Administration

OTPT Oleum Tower Pump Tank

PEL Permissible Exposure Limit

PHA Process Hazard Analysis

PM Preventive Maintenance

ppm parts per million

psig pound-force per square inch gauge

PSSR pre-startup safety review

PSM OSHA Process Safety Management Standard (29 CFR 1910.119)

PTFE polytetrafluoroethylene

RCRA Resource Conservation and Recovery Act

RMP Risk Management Plan

RQ reportable quantity

SAP System Application & Products

SAR Spent Acid Recovery Unit

SCBA self-contained breathing apparatus

SLM Small Lots Manufacturing Unit

SOPs Standard Operating Procedures

TQ threshold quantity 

TWA time-weighted average

VOC volatile organic compounds

000381
E.I. DuPont de Nemours & Co. Final Report September 2011

 9 

Executive Summary 

On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases 

of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response agencies. 

The incident involving the release of phosgene gas led to the fatal exposure of a worker performing 

routine duties in an area where phosgene cylinders were stored and used.

Operators discovered the first incident, the release of methyl chloride, the morning of January 22, 2010, 

when an alarm sounded on the plant’s distributed control system monitor. They confirmed that a release 

had occurred and that methyl chloride was venting to the atmosphere. Managers assessing the release 

estimated that more than 2,000 pounds of methyl chloride may have been released over the preceding 5 

days.

The oleum release, the second incident, occurred the morning of January 23, 2010. Workers discovered a 

leak in an overhead oleum sample pipe that was allowing a fuming cloud of oleum to escape to the 

atmosphere. The plant fire brigade, after donning the appropriate personal protective equipment, closed a 

valve that stopped the leak about an hour after it was discovered. No injuries occurred, but the plant called 

the Belle Volunteer Fire Department to assist.

The third incident, a phosgene release, occurred later that same day when a hose used to transfer 

phosgene from a 1-ton cylinder to a process catastrophically failed and sprayed a worker in the face while 

he was checking the weight of the cylinder. The employee, who was alone when exposed, was assisted by 

co-workers who immediately responded to his call for help. Initial assessments by the plant’s 

occupational health nurse indicated that the worker showed no symptoms of exposure prior to transport to 

the hospital for observation and treatment. A delayed onset of symptoms, consistent with information in 

phosgene exposure literature, occurred after he arrived at the hospital. His condition deteriorated over the 

next day and he died from his exposure the next night.

000382
E.I. DuPont de Nemours & Co. Final Report September 2011

10

At the request of the Board, the U.S. Chemical Safety and Hazard Investigation Board (CSB) 

investigation team examined all three incidents at Belle due to the severity and potential for even greater 

consequences and to understand how and why they could occur at a DuPont facility. DuPont is regarded

as an industry leader in the advancement of health and safety practices and develops sound, respected, and 

widely used safe practice guidance. With such a reputation, the CSB was interested in examining the 

conditions at the Belle facility that led to a decline in adherence to the higher standard of performance that 

the corporation historically held.

The CSB incident investigation determined root and contributing causes for each of the three incidents. 

An overall analysis revealed common deficiencies in the following management systems:

• Maintenance and inspections

• Alarm recognition and management

• Incident investigation

• Emergency response and communications

• Hazard recognition

The CSB found that each incident was preceded by an event or multiple events that triggered internal 

incident investigations by DuPont, which investigated all of these precursor events and issued

recommendations and corrective actions. Despite investigating these preceding events, the

recommendations and corrective actions did not prevent the occurrence of similar events. 

Because of recent changes to the Kanawha County Metro 9-1-1 response policies and procedures that 

could lead to delays in treatment for future incidents, the CSB investigators also examined concerns 

raised by the emergency response organizations. These concerns included the timeliness and quality of 

000383
E.I. DuPont de Nemours & Co. Final Report September 2011

11

information provided to dispatchers and EMS personnel who responded to two of the incidents and which

mirrors issues identified in the CSB Bayer CropScience August 2008 incident investigation.

1

The CSB identified the following root causes: 

 

Methyl Chloride Incident (January 22, 2010, 5:02 a.m.) 

• DuPont management, following their Management of Change process, approved a design for the 

rupture disc alarm system that lacked sufficient reliability to advise operators of a flammable 

methyl chloride release. 

Oleum Release Incident (January 23, 2010, 7:40 a.m.) 

• Corrosion under the insulation caused a small leak in the oleum pipe.

Phosgene Incident (January 23, 2010, 1:45 p.m.) 

• DuPont’s phosgene hazard awareness program was deficient in ensuring that operating personnel 

were aware of the hazards associated with trapped liquid phosgene in transfer hoses.

• DuPont relied on a maintenance software program that was subject to changes without 

authorization or review, did not automatically initiate a change-out of phosgene hoses at the 

prescribed interval, and did not provide a back-up process to ensure timely change-out of hoses.

• DuPont Belle’s near-miss reporting process was not rigorous enough to ensure that the near 

failure of a similar phosgene transfer hose, just hours prior to the exposure incident, would be 

immediately brought to the attention of plant supervisors and managers. 

• DuPont lacked a dedicated radio/telephone system and emergency notification process to convey 

the nature of an emergency at the Belle plant, thereby restricting the ability of personnel to 

provide timely and quality information to emergency responders. 

 

1 CSB-2008-I-WV (Bayer CropScience).

000384
E.I. DuPont de Nemours & Co. Final Report September 2011

12

The CSB makes recommendations to

• Occupational Safety and Health Administration (OSHA)

• DuPont Belle, WV, plant

• E.I. DuPont de Nemours & Co., Inc.

• Compressed Gas Association of America (CGA)

• American Chemistry Council (ACC) Phosgene Panel

000385
E.I. DuPont de Nemours & Co. Final Report September 2011

13

1.0 Introduction 

1.1 Background 

At 5:02 a.m. on Friday, January 22, 2010, a release of methyl chloride activated an alarm in the F3455

unit control room, signaling the first of three incidents that would occur over the next 33 hours at the 

DuPont Belle, WV, facility. No injuries were associated with this incident, but the release went 

undetected for as long as 5 days. DuPont estimates that more than 2,000 pounds of methyl chloride 

released to the atmosphere.

At 7:40 a.m. on Saturday, January 23, 2010, a contractor reported seeing a fuming plume on a 1-inch

diameter sample pipe in the Spent Acid Recovery (SAR) unit. Operations personnel confirmed that oleum 

was leaking; thus, a fume alert was activated for the entire Belle plant. Plant fire brigade members 

responded to the release and closed valves that stopped the leak at about 8:09 a.m., after which the “all 

clear” was sounded.

The third incident occurred just 6 hours later. At approximately 1:45 p.m., an operator walked into the 

phosgene cylinder storage area in the Small Lots Manufacturing (SLM) unit and was sprayed in the face 

and upper torso with phosgene when a flexible hose suddenly ruptured. The worker called for assistance 

and coworkers immediately went to his aid. His personal dosimeter indicated that he had been exposed to

a significant dose of phosgene; however, he did not exhibit immediate signs of breathing problems. About

3 hours after arriving at the hospital his condition deteriorated, and he died the following night.

No injuries occurred as a result of the first two releases, but communication to Metro 9-1-1 dispatchers 

regarding the nature of each release on Saturday became an issue post-incident. The CSB investigators 

examined how information related to the incidents was conveyed to Metro 9-1-1 dispatchers. The CSB 

also interviewed Kanawha County Ambulance Authority (KCEAA), Kanawha-Putnam Emergency 

Planning Committee (KPEPC), and Metro 9-1-1 representatives to assess each incident and determine if 

000386
E.I. DuPont de Nemours & Co. Final Report September 2011

14

actions could be taken to improve communication methods to prevent recurrence of the issues brought to 

the attention of county officials. During the Saturday afternoon call for assistance from DuPont, Metro 9-

1-1 dispatchers were not provided with sufficient information regarding the nature of the emergency and 

the chemicals involved to adequately inform responding EMS personnel. Many of those interviewed were 

familiar with the role of the CSB, having participated in conferences and interviews as part of the CSB 

investigation of the August 2008 Bayer CropScience incident. 

Due to recurring communication problems associated with emergency responses to chemical plants in the 

Kanawha Valley, responding medical units established a practice of waiting before going onto a property 

that called for assistance. EMS personnel respond to a staging area as far as a mile away where they 

remain until they receive more detailed information about the material involved and whether the victim 

has been, or will need to be, decontaminated prior to transport to a hospital. Emergency response 

organizations developed this practice as EMS personnel were receiving information that was sometimes 

so imprecise that they could not ensure that they or their equipment would not be contaminated by a 

hazardous chemical as a result of transporting an exposed victim.

In examining the activities of employees involved in the response, the CSB learned that two other DuPont 

employees were also possibly exposed to phosgene. One worker, after he transported the victim part of 

the way to the plant medical center in a company truck, noticed that his dosimeter was discolored, 

indicating exposure. The second exposure occurred when a worker, unaware of the phosgene release, 

went into the area of the phosgene shed and noticed an odor that he had never smelled before. Unsure of 

what the odor was, he left the area and joined his co-workers in the control room.

1.2 Investigative Process 

Via the media and the National Response Center (NRC), the CSB monitored and tracked information 

related to the chemical release incidents at the DuPont Belle, WV, facility throughout the weekend of 

January 22 and 23, 2010. On January 25, 2010, the CSB Board deployed an investigation team. Because 

000387
E.I. DuPont de Nemours & Co. Final Report September 2011

15

of the number and potential for more severe consequences at the DuPont Belle plant over this 2-day 

period, the CSB launched an investigation to determine the root and contributing causes, which it would 

use to issue recommendations to help prevent similar occurrences. Although the consequences of the first 

two incidents were not as severe as the third, the CSB decided that since the three incidents occurred in 

less than 2 days, including one that led to a fatality, all three would be investigated to determine any 

common causes. 

The investigative team arrived at the Belle Plant on January 26, 2010, and met with Occupational Safety 

and Health Administration (OSHA) inspectors; U.S. Environmental Protection Agency (EPA) officials; 

and DuPont representatives to explain the CSB’s authority and purpose for conducting the investigation.

The CSB investigation team remained onsite for 2 weeks and subsequently visited Belle to conduct 

independent investigations of each of the three DuPont Belle, WV, facility incidents. During its 

investigations, CSB investigators

• interviewed plant personnel, emergency responders, plant supervisors and managers, and 

corporate personnel; 

• coordinated the examination, removal, and storage of physical evidence; 

• requested and reviewed relevant documentation; 

• reviewed technical and industry guidance, standards, and regulations; 

• discussed emergency response issues with the KPEPC, KCEAA, and Metro 9-1-1 dispatch center 

officials; 

• entered into joint testing protocol agreements with DuPont, OSHA, and the EPA;

• observed metallurgical testing of the oleum sample line and the phosgene stainless steel overbraid

hose; and

• observed analytical testing and analysis of the polytetrafluoroethylene (PTFE) transfer hoses 

involved in the phosgene release. 

000388
E.I. DuPont de Nemours & Co. Final Report September 2011

16

1.3 E.I. DuPont de Nemours & Co., Inc.

1.3.1 Company History 

E.I. DuPont de Nemours and Co, named after its French founder, Eleuthère Irénée du Pont, was 

established in 1802 as a gunpowder manufacturing company on the Brandywine River in Wilmington, 

DE. DuPont grew as a manufacturer of gunpowder and explosives in the United States and in 1902 

transitioned into a science-based chemical company. DuPont established Experimental Station, the first 

industrial laboratory where researchers and scientists began work on nitrocellulose chemistry and 

smokeless powders to improve military rifles for the World War I effort. By the 1920s, DuPont purchased 

several chemical companies and focused on polymers, which led to the discovery of neoprene (synthetic 

rubbers), polyester, and nylon by 1935. Many of these products were in demand during the Second World 

War. Further work with plastics and fibers led to the development of TeflonTM, LuciteTM, NomexTM, and 

MylarTM in the 1950s. DuPont also introduced a number of inorganic insecticides and fungicides such as 

Lannate® (methomyl) and Telvar®, which eventually led to the establishment of its agricultural products 

business. By the mid-1980s, DuPont had grown to almost 100 major businesses selling a wide range of 

materials such as textiles, agricultural chemicals, petroleum, and biomedical products.

1.3.2 DuPont Business Areas and Corporate Management 

DuPont, headquartered in Wilmington, DE, has 58,000 employees in more than 80 countries. The 

company offers a broad range of products for industry and consumer use, including pesticides, 

electronics, apparel, and biomedical supplies. Five business platforms comprise the DuPont organization: 

Agriculture and Nutrition, Coatings and Color Technologies, Performance Materials, Electronics and 

000389
E.I. DuPont de Nemours & Co. Final Report September 2011

17

Communications, and Safety and Protection. Within each business platform are strategic business areas2

The Crop Protection business area, a segment of the Agriculture and Nutrition platform, is responsible for 

the development, manufacture, and sale of fungicides, herbicides, insecticides, and seed treatments 

globally. The agriculture industry uses DuPont Crop Protection products on a variety of crops worldwide 

including cotton, soybeans, fruits, and vegetables. The F3455 and SLM units at the Belle Plant 

manufacture intermediate chemicals for their Crop Protection products. In 2009, the Agriculture and 

Nutrition platform had the most sales of any business area at $8.3 billion.

focusing on the production, sale, and distribution of products and services related to each marketing area.

A 13-member Board of Directors, including the chairperson and CEO, manage DuPont. Executive

committees made up of board members and representatives from DuPont businesses oversee areas such as 

environmental policy, corporate governance, strategic direction, and auditing. In 2010, DuPont had global 

sales of $31.5 billion and ranked as the third-largest chemical company in profits and second in revenues

in the world. 

1.3.3 Safety at DuPont 

Concern for safety and health at DuPont became a part of the company’s structure in 1805 due to the 

hazards of producing gunpowder and explosives. The early corporate safety program was rooted in 

process safety concepts more than a century before governing safety regulations existed. Practices such as 

safe siting of buildings, explosion venting concepts, incident investigation processes, and emergency 

response were implemented in the DuPont gunpowder mills throughout the 19th century.

 

2

 Pioneer Hy-bred, Crop Protection, Nutrition and Health, Electronics and Communications, Performance Coatings, 

Performance Polymers, Protection Technologies, Building Innovations, Sustainable Solutions, Chemicals and 

Fluoroproducts, Titanium Technologies, and Applied Biosciences.

000390
E.I. DuPont de Nemours & Co. Final Report September 2011

18

The company continued to focus on health and safety to improve safety performance and in 1915 created 

its first corporate safety division, which was responsible for technical training, safety inspections, project 

design reviews, and the purchase of safety equipment. According to DuPont incident records, the safety 

division participation in facility operations decreased incident rates throughout the company. As a result, 

individual sites established site-specific safety groups in the mid-1930s. Hazard elimination was 

recognized as a priority above education and personal protection (Klein, 2009). 

1.3.3.1 Early Process Safety Program

The release of highly toxic methyl isocyanate (MIC) at the Union Carbide Corp. in Bhopal, India, resulted 

in nearly 3,800 immediate deaths, and 16,000 are estimated to have since died as a result of exposure, 

while more than 100,000 still report associated illnesses. In response to the Union Carbide incident, 

chemical companies, industry associations, and government agencies directed efforts to decrease process 

safety risks, which eventually led to the establishment of the OSHA Process Safety Management (PSM) 

Standard (29 CFR 1910.119), EPA Chemical Accident Prevention Program, and the creation of the CSB 

as part of the Clean Air Act amendment of 1990.

Prior to establishing the OSHA PSM Standard, DuPont was practicing many process safety concepts at its

facilities as part of the DuPont Process Hazards Management (PHM) Program. After a 1965 incident in 

Louisville, KY, killed 12, the company directed all sites to perform hazard reviews to evaluate the safety 

of site processes, which eventually became a corporate Process Hazards Review (PHR) program. The 

PHR was intended to prevent serious process-related incidents, and each site handling hazardous 

substances had to have a PHM program.

The Bhopal incident contributed to an increase in DuPont’s focus on PHM, particularly in the 

manufacture of MIC. DuPont developed an inherently safer method of manufacturing and handling MIC 

that eliminated MIC bulk storage, as it relied on producing and directly consuming MIC. The company 

also created the Highly Toxic Materials (HTM) Subcommittee to review the global management of toxic 

000391
E.I. DuPont de Nemours & Co. Final Report September 2011

19

chemicals. In 1985, HTM became a corporate guideline, and a separate subcommittee was established to 

focus on each of the 15 highly hazardous materials identified within the company. DuPont continued to 

refine its PHM program, eventually developing professional guidance for process safety and OSHA PSM 

rulemaking (Mottle et al., 1995).

1.3.3.2 “Zero Incidents” Goal

DuPont introduced the “zero incidents” goal in the early 1900s as a management directive to drive injury 

rates down to zero through continuous improvement of safety practices. The “zero” concept became a 

core strategy as the company grew and embraced the philosophy that all injuries, occupational illnesses, 

and environmental incidents are preventable and that the goal for all is zero.

DuPont became recognized throughout industry as a safety innovator and leader. The company offers 

services as a safety resource for other corporations to evaluate and improve workplace safety, which 

include methodologies and technical training to manage and improve employee and contractor health and 

safety performance as well as process safety improvements. 

000392
E.I. DuPont de Nemours & Co. Final Report September 2011

20

1.4 DuPont Belle Plant 

Figure 1. DuPont Belle, WV, facility on the Kanawha River (EPA, 1973)

The DuPont Belle plant is located in Belle, WV, about 8 miles east of Charleston, the state capital . The 

plant occupies about 723 acres along the Kanawha River and sits in an industrial, commercial, and 

residential use area. The plant was established in the West Virginia coal country as part of a post-World 

War I effort to produce ammonia. In the early 1920s DuPont spent $27 million3

 

3

 Equivalent to $332 million in 2010, according to the Bureau of Labor Statistics Inflation Calculator. 

on a highly complex 

production facility with atmospheric compressors capable of producing 25 tons of ammonia per day. 

Belle’s high-pressure ammonia technology yielded a host of collateral benefits. Methanol was initially 

manufactured on a small scale and then rapidly expanded to 1 million gallons a year. By 1935, Belle had 

000393
E.I. DuPont de Nemours & Co. Final Report September 2011

21

become DuPont's largest facility with more than 80 different chemical products, which included the first 

synthetic urea used in fertilizers and plastics. In 1939, DuPont began producing nylon chemical 

intermediates at Belle, and by 1944 the plant was producing 30 million pounds of synthetic polymers per 

year. Expansion of nitrogen and nylon intermediate production at Belle continued after the war, and 

product lines were introduced regularly. In 1969 Belle began producing the fungicide Benlate®. Currently, 

the DuPont Belle plant produces a variety of organic chemicals and agricultural intermediates and 

products. According to company documents, the plant had the best safety record of any DuPont 

production facility prior to the incidents of January 22 and 23.

4

In January 2010, the DuPont Belle plant employed approximately 440 and had seven primary operating 

divisions occupying a 105-acre manufacturing area nearly 1 mile long. The DuPont-operated SAR unit 

was owned by Lucite International and operated by DuPont employees. The Belle facility is also the site 

of the newly constructed Kureha unit, owned by the Kureha Corp. of Japan, which is operated by Kureha 

employees on DuPont’s Belle site. The Kureha production unit uses glycolic acid produced by DuPont as 

a feedstock for polyglycolic acid, a specialty plastic.

The DuPont Belle plant holds a Resource Conservation and Recovery Act (RCRA) Part B Treatment and 

Storage Permit for onsite handling of waste materials, in addition to a RCRA-permitted drum storage 

facility onsite. The Belle plant participates in a Community Action Council (CAC), comprised of citizens 

from neighboring communities and representatives from the industrial facilities in the region,5

 

4

 www.2.dupont.com/heritage.

that aims

to address citizen concerns regarding site safety, health, and environmental performance. 

5

 DuPont Belle Plant Information Sheet.

000394
E.I. DuPont de Nemours & Co. Final Report September 2011

22

2.0 Methyl Chloride Release (January 22, 2010)

2.1 Background

The Belle plant’s F3455 unit manufactures the intermediate F3455, a chemical that is shipped to another 

DuPont facility to make the herbicide Velpar®. Due to the exothermic reaction in the first reactor, 

dissolved methyl chloride vaporizes and normally exits through the reactor vent line along with carbon 

dioxide, nitrogen, and trace amounts of dimethylamine (DMA) vapor through a process scrubber and then 

to a thermal oxidizer for emission control. To avoid damage to the scrubber6

Figure 2

if excessive pressures occur, 

a piping connection upstream of the vent line is routed to a rupture disc that will burst and allow venting 

outside on the roof of the building which contains two reactors ( ). However, due to a lack of 

safety considerations during installation, a 0.5-inch weep hole7

Unaware that the rupture disc had blown during a nitrogen purge activity before the reactor startup, plant 

personnel proceeded with the normal production run. For nearly 5 days, methyl chloride vapor passed

through the blown rupture disc and escaped into the operation building and outside atmosphere. On the 

fifth day, the methyl chloride vapors interfered with the chemical sensor configured to detect ethyl 

chloroformate (ECF), which alerted the workers.

was placed on the vent line inside the 

building; consequently, dangerous chemicals vent inside the building if the rupture disk bursts.

 

6

 A thermal oxidizer is a process unit for air pollution control in many chemical plants that decomposes hazardous 

gases at a high temperature and releases them into the atmosphere.

7 In process vent lines that lead to the atmosphere, protection must be installed to prevent ambient moisture -- from 

rain or other elements -- from collecting within the vent line. One such protection is a “weep hole,” a small hole 

drilled into a vent line that allows drainage.

000395
E.I. DuPont de Nemours & Co. Final Report September 2011

23

Figure 2. Simplified thermal oxidizer and rupture disc block flow diagram

2.1.1 Methyl Chloride

Methyl chloride, also called chloromethane or monochloromethane, is a colorless gas with a faint sweet 

odor at low concentrations.

8 The odor may not be noticeable and cannot be relied upon as warning of 

concentrations that are dangerous to health.

9

 

8 The odor threshold, or concentration, of methyl chloride detectible by most humans varies between 10 and 250 

ppm. 

Methyl chloride is extremely flammable; has a potent 

9

http://www.oxy.com/Our_Businesses/chemicals/Documents/methyl_chloride/Methyl%20Chloride%20Handbook

.pdf.(11/2009)

000396
E.I. DuPont de Nemours & Co. Final Report September 2011

24

narcotic effect similar to trichloromethane, also known as chloroform; and is listed as a Group 3 

carcinogen10

Symptoms of methyl chloride exposure include dizziness, confusion, and nausea, and at higher 

concentrations, extreme nervousness, trembling, and possible loss of consciousness. High concentrations 

or long exposure can be fatal. The gas is also heavier than air and therefore settles close to the ground. 

by the International Agency for Research on Cancer (IARC). The OSHA 8-hour timeweighted average (TWA) concentration is 100 ppm and the National Institute of Occupational Safety and 

Health (NIOSH)-designated Immediately Dangerous to Life and Health (IDLH) concentration is 2,000 

ppm.

2.2 Incident Description

The F3455 process was in the first series of batch runs following an extended maintenance outage from 

September 12, 2009, through January 17, 2010. The release is thought to have initiated on January 17 

during the first batch run in the unit and continued until discovered on January 22; the release rate may 

have been sporadic throughout this period.

On January 22, 2010, an air monitor alarm on the process control monitor alerted plant operating 

personnel of a chemical release while they were adding DMA11

 

10 Substances the IARC lists as Group 3 carcinogens are mixtures or agents for which evidence of carcinogenicity in 

humans is inadequate and limited in experimental animals.

to the reactor. The sensor for this alarm, 

located on the third floor of the F3455 building, is calibrated to activate when it detects ECF at 0.5 ppm. 

The methyl chloride vapors interfered with the ECF sensors on the third floor and activated the alarm. 

The distributed control system (DCS) recorded the alarm at 5:02 a.m., and responding operators saw a 

diffused fog and a liquid puddle near a 0.5-inch nominal pipe size (NPS) vent/drain pipe referred to as a 

11 DMA is a toxic and extremely flammable, colorless product with a fishy or ammonia-like odor. DMA attacks the 

respiratory system and irritates eyes and skin and at higher concentrations can cause pulmonary edema. The 

OSHA 8-hour TWA is 10 ppm and the NIOSH IDLH is 500 ppm. Humans can detect DMA odors at 0.34 ppm 

(Sittig, 2008). DMA is a heavier than air vapor and settles close the ground

000397
E.I. DuPont de Nemours & Co. Final Report September 2011

25

weep hole (Figure 3). This connection was associated with a thermal oxidizer “vent stack,” that vents to 

the atmosphere on the roof of the building during a process upset. Operators notified the board operator at 

5:19 a.m. when they found the source of the release.

Figure 3. 0.5-inch NPS vent/drain pipe and rupture disc

2.2.1 ECF Sensor Alarm

The ECF sensor was detecting chlorine, not ECF. The ECF sensor is responsive to chemicals composed 

of chlorine (i.e. ethyl-chloroformate [ECF] and methyl-chloride); consequently, on the fifth day, the 

chlorides in the release were of sufficient concentration near the ECF sensor to activate the alarm. 

2.2.2 Odor Detection Considerations

The methyl chloride, DMA, and hydrochloric acid (HCl) mixture is extremely odorous; however, due to 

the nature of the F3455 process, operating personnel would have had to be in the area of the 0.5-inch

weep hole at the time of the release to see or smell the leak. 

Methyl chloride liberated during this phase of the reaction would have likely taken the normal route to the 

thermal oxidizer piping, where it would have been consumed and vented to the atmosphere unnoticed.

000398
E.I. DuPont de Nemours & Co. Final Report September 2011

26

The vent releases products of the reaction into the room if a rupture disc is blown and if the pressure 

inside the pipe is greater than the pressure in the room.

The rupture disc piping was routed to the atmosphere above the roof of the building, which would have 

provided an outlet path for the methyl chloride vapor where it would have dissipated and dispersed 

without notice. 

The day before the leak was discovered, a crew performed a leak detection and repair (LDAR)12

2.2.3 Incident Response

inspection on the third floor of the building near the location of the release. The volatile organic 

compounds (VOC) electronic monitor was calibrated to detect methyl chloride, ECF, DMA, and 

methanol. Although an area within 12 inches of the weep hole was checked for leaks with the monitor, it 

did not detect any VOCs.

In response to the ECF alarm, operators using a VOC analyzer to search for the source of the vapor

immediately smelled an offensive odor on the third floor. They saw steam-like fumes near the vent pipe 

and dripping liquid puddling on the floor, both clear indications that the rupture disc had burst (Figure 4). 

They left the process area, closed all valves leading to the vent line, and cooled the reactors to stop the 

process. At about 9:30 a.m., maintenance mechanics replaced the rupture disc and burst sensor. 

After receiving confirmation of the release, the board operator notified the process supervisor who then 

calculated the estimated duration and magnitude of the release. After performing these calculations, the 

supervisor notified the plant manager, the Safety Health and Environmental (SHE) manager, the area 

manager, and the unit technology leader and told them that the release may have been ongoing for the 

 

12 The Clean Air Act requires refineries and chemical plants to develop and implement an LDAR program to control 

fugitive emissions, which occur from leaks in valves, pumps, compressors, pressure relief valves, flanges, 

connectors, and other piping components.

000399
E.I. DuPont de Nemours & Co. Final Report September 2011

27

entire run of nine batches, which occurred over 5 days. DuPont estimated that approximately 2,00013

During the initial phases of the DuPont incident investigation, employees discovered that the burst sensor 

on the rupture disc had started alarming 5 days prior to the incident. Due to its history of unreliability, 

operators likely became desensitized to this alarm. The burst sensor was the first in this sequence of 

incidents that led to a safety pause

pounds of methyl chloride were likely released to the atmosphere.

14

 

13 DuPont, in its final investigation report, determined that 2,045 pounds of methyl chloride and 25 pounds of HCl 

released to the atmosphere as a result of this incident.

at the plant.

14 A safety pause is a structured work stoppage that the plant manager initiates to engage the entire workforce with 

the objectives of increasing awareness of hazards, providing safety education, and addressing past incidents. A 

safety pause was initiated at the Belle facility on Saturday, January 23, 2010, because of the incidents at the 

F3455 and SAR units.

000400
E.I. DuPont de Nemours & Co. Final Report September 2011

28

Figure 4. Rupture disc piping and vent pipeline to atmosphere on roof

000401
E.I. DuPont de Nemours & Co. Final Report September 2011

29

Once DuPont determined that the release quantity exceeded the Comprehensive Environmental Response, 

Compensation and Liability Act (CERCLA) reportable quantity (RQ) of 100 pounds,

15

2.2.4 Community Impact

 in compliance 

with CERCLA of 1980 it reported the release of methyl chloride to the NRC and to the West Virginia

State Department of Homeland Security Emergency Operations Center, which notified the U.S. Coast 

Guard. Kanawha County Metro 9-1-1 was not informed of the release until 2:00 p.m. on January 22, 

2010, 9 hours after discovery. 

DuPont estimated that between January 17 and 22, 2010, 2,045 pounds of methyl chloride; 25 pounds of 

hydrogen chloride; and trace amounts of DMA released to the atmosphere through a vent line on the roof 

of the F3455 building. No monitoring information was available to determine the concentrations of 

chemicals released to the atmosphere through the vent line. If monitoring information had been

recorded, a more accurate estimate of chemical concentration would have provided data about when the 

release started and the potential for offsite impact. No workers at the facility reported symptoms from 

methyl chloride or any of the other toxic chemicals either during or after the release. DuPont did not 

receive any odor complaints from the community.

2.3 Incident Analysis

2.3.1 Mechanical Integrity

Rupture discs are overpressure protection devices used in processes operating above ambient pressure and 

are intended to prevent equipment damage, including catastrophic failure. Without them, a process upset 

can cause unsafe pressure levels and an overpressure incident. Since these devices activate only when a 

system has had an overpressure event, it is imperative that their activation be discovered. In this 

 

15 Under CERCLA, operators of facilities and vessels are required to immediately report releases to the NRC above 

the EPA RQ.

000402
E.I. DuPont de Nemours & Co. Final Report September 2011

30

application, the rupture disc releases hazardous chemicals to the atmosphere. One approach to help with

early detection is to evaluate the alarm management process and, where appropriate, adjust process 

parameters so that an alarm will activate prior to the disc actually bursting. Another is to evaluate the 

process and eliminate the conditions that increase the pressure that cause the disc to burst. Regardless, 

once systems have been selected, the configuration should be reviewed by a team, including process 

engineers, control engineers, and operations managers (Lees, 2005). 

Figure 5. Rupture disc burst sensor post-incident

DuPont Belle used a “burst sensor” intended to notify the board operator that the rupture disk (Figure 5) 

activated. A burst sensor is a thin plastic membrane with embedded wires installed on top of the rupture 

disc. Small electrical current passes through the wires. When the rupture disc activates, the membrane and 

embedded wires break, triggering the alarm.

The CSB learned that the rupture discs and sensors associated with this system were historically

problematic. The burst sensor involved in the January 22, 2010, incident had been replaced many times

000403
E.I. DuPont de Nemours & Co. Final Report September 2011

31

because it was unreliable. Initially the sensor was battery-operated, sending signals to a remote receiver in 

the control room rather than to the process control monitor. However, the battery life was short; 

consequently, operators received frequent false, or “nuisance,” alarms. According to Management of 

Change (MOC) documentation, “the burst sensor [was] in and out of alarm every 3 minutes” and required 

replacements almost monthly. When its batteries failed, the transmitter sent an alarm to the remote 

receiver to notify the operators. The receiver displayed the same alarm text as when the sensor detected a 

burst rupture disc. Because the batteries needed frequent replacing and because the operators had to wait 

for an electrician to change the batteries, the false alarms became a nuisance.

Battery life, however, was not the only reported shortcoming of burst sensors. Operators told the CSB 

investigators that burst sensors were so delicate that they could sometimes tear during installation and that 

liquid condensation on top of the sensors sometimes caused them to fail and trigger a false alarm.

An improved burst sensor was installed on the DCS while the unit was down for maintenance just before 

the incident. Operators indicated they were not retrained to respond to the more reliable burst sensor 

alarm and still considered it a nuisance. 

2.3.2 Design and Maintenance of Rupture Discs

The rupture disc involved in the incident was a 4-inch diameter graphite rupture disc, designed to rupture 

at 15 psig, and mounted in neoprene casing (Figure 6). While the rupture disc is on a preventive 

maintenance (PM) schedule, the annual inspection was so infrequent that the disc is replaced only when it 

has activated or is removed for certain processes. Operators told the CSB investigators that once removed,

the rupture discs, intact or compromised, are discarded and replaced with new ones. Even without a burst 

000404
E.I. DuPont de Nemours & Co. Final Report September 2011

32

sensor, all overpressure protection devices, including rupture discs, should be routinely checked on an 

effective PM schedule as a layer of protection.16

Figure 6. New rupture disc

2.3.3 Previous Incidents of Rupture Discs Bursting

From 2005 to 2010, the rupture disc on the F3455 unit vent line experienced nine recorded activations

(Table 1). On April 11, 2006, the rupture disc activated three times. DuPont determined that the disc was 

most likely experiencing thermal or hydraulic shock. Thermal shock would occur from boiling reactor 

 

16 BS&B Safety Systems, Inc, Special Applications and Preventive Maintenance, Catalog 77-1007, Section B.

000405
E.I. DuPont de Nemours & Co. Final Report September 2011

33

vapor mixing with cool liquid on the disc due to its close proximity to the reactor; hydraulic shock would 

occur from any “sloshing” in the line upstream of the disc. This recurring problem was remedied by 

moving the rupture disc farther away from these units and eventually to the third floor toward the extreme 

end of the vent line.

On May 6, 2006, a rupture disc activation at the same facility went unnoticed for 48 hours, which 

illustrates how the January 22, 2010, release could have gone undetected for 5 days. In the May incident, 

although operators complained about strong odors in the F3455 building, the rupture disc was never 

considered as the source; indeed, operators and supervisory staff identified multiple locations where 

fugitive emissions could have produced the offensive smell. Eventually, when a new batch of F3455 was 

started, an operator near the vent line saw the rupture disc fuming, indicating that it was the odor source. 

At the Belle facility, pipe blockage at the unit was the most commonly reported cause of premature 

rupture disc activation (Table 1). The F3455 process creates various solids in the vent and process lines, 

which eventually block flow, increasing the pressure in the system. Once the blockage is melted by the 

process temperature or forced through the line due to the increased pressure, the resulting pressure spike 

activates the rupture disc.

000406
E.I. DuPont de Nemours & Co. Final Report September 2011

34

Previous Rupture Disc Incidents

Date Cause

05/20/05 Unknown

05/31/05 Pressure Control Issues

04/11/06 Hydraulic/Thermal Shock17

05/06/06 Blockage18

06/16/06 Unknown

05/30/07 Ruptured during Water Cleaning

06/12/07 Blockage 

04/15/08 Blockage

02/24/09 Blockage

Table 1. Previous rupture disc events in the F3455 unit

2.3.4 Management of Change--Technology and Subtle Change

Within DuPont, MOC procedures are defined at a corporate level and adopted according to each site’s 

procedures. At the corporate level, the PSM Standard defines two types of MOC: technology (MOC-T) 

and subtle changes. MOC-T is defined as “a change in hazards of materials (including the introduction of 

chemicals), a change in equipment design basis, or a change to the process design basis.” Subtle changes 

are defined as “any change within the documented [process technology] that is not a replacement in 

kind.”19

 

17 This incident was actually three incidents over a short period. The rupture disc was discovered ruptured and 

replaced three times before the unit was shut down for further investigation.

Regarding high-hazard processes, such as the F3455 and SLM units at Belle, the corporate PSM 

Standard states, “[S]ubtle changes in the field can (and have) led to catastrophic events.” However, even 

with this knowledge the MOC team at Belle incorrectly categorized the burst sensor installation as a 

subtle change. 

18 This incident went undiscovered for 48 hours.

19 The corporate DuPont PSM Standard defines “replacement in kind” as the “replacement of an instrument or 

electrical, piping, or other process equipment component with an identical part or an approved equivalent part that 

is specified by the applicable DuPont Engineering standard.”

000407
E.I. DuPont de Nemours & Co. Final Report September 2011

35

At the Belle site the standard operating procedures (SOPs) do not distinguish between MOC subtle 

changes and MOC-T. The MOC package documentation, however, shows that subtle, often referred to as 

“minor,” changes are not subjected to the same in-depth review as a MOC-T. When the MOC is marked 

as “subtle,” the level of safety review is at the discretion of the MOC team leader.

The MOC package that first installed the rupture disc burst sensor was marked as a subtle change and

included a “What If” review that stated, “What if you get a false positive indication (indicating failed 

disc, but not actually failed)? Not a safety issue. Shut down and investigate.” 

This type of review did not go deep enough to confirm that false-positives could lead to nuisance alarms, 

which can create risk by desensitizing operators to a hazard and be more detrimental than the absence of 

the alarm. In the MOC section marked “Reason for this Type of Safety Review,” the response by the 

MOC team leader was “Minor Change.”

The MOC package that converted the burst sensor from battery-powered to a supplied power device was 

also marked as a subtle change. Again, the MOC team leader recorded in the documentation that “a ‘What 

If’ review [was] appropriate for the afore-mentioned [sic] change.” The MOC did not address the 

operators’ non-battery related concerns for the burst sensor or how to re-train the board operator to no 

longer treat the burst sensor alarm as a false-positive.

Because MOC packages deemed “subtle” are not given the same level of review as MOC-T packages, the 

subtle change MOC packages did not identify or prevent the potential causes of this incident.

2.3.5 F3455 Unit Turnaround 

On June 6, 2009, nearly 2 years after installing the battery-operated transmitter, DuPont attempted to 

eliminate the false alarms caused by low batteries by wiring the transmitter to a standard electrical circuit. 

During a unit shutdown that lasted from September 12, 2009, through January 17, 2010, there was 

significant maintenance activity, including work that, by its nature triggered alarms; however, these 

000408
E.I. DuPont de Nemours & Co. Final Report September 2011

36

alarms did not require response from the operators because there were no “live” process streams that 

would initiate an actual alarm. 

DCS data recorded during the shutdown indicated that the pressure in the reactor system increased slowly 

from December 18, 2009, to December 20, 2009, when it exceeded the rupture disc rating (Figure 7). The 

source of the pressure was a nitrogen valve on a level indicator that slowly leaked nitrogen into the 

system.20

 

20 The level instrument measures the difference between the pressure in the vapor space inside the top of the reactor 

and the pressure under the liquid at the bottom of the reactor. Based on the pressure difference, the control 

computer calculates the amount of liquid in the reactor. The nitrogen provides a chemical barrier between the 

reactor liquid and the level instrument.

The rupture disc burst, triggering an alarm, as it should have. Under normal, live operating 

conditions, the operators would have investigated to understand, acknowledge, and correct the alarm

condition. However, extensive maintenance work was still underway in the unit; thus, the operators did 

not address the alarm as they would have under normal operation.

000409
E.I. DuPont de Nemours & Co. Final Report September 2011

37

0

2

4

6

8

10

12

14

16

18

12/18/09 12:00

AM

12/18/09 12:00

PM

12/19/09 12:00

AM

12/19/09 12:00

PM

12/20/09 12:00

AM

12/20/09 12:00

PM

12/21/09 12:00

AM

12/21/09 12:00

PM

Figure 7. Process data showing sudden pressure decrease when rupture disc burst

The operators did not address the alarm when it triggered in December because they knew that work in 

the area was causing nuisance alarms; however, when the ECF alarm activated on January 22, 2010, 

operators responded. The board operator in the F3455 control room investigated and observed that the 

original alarm from December 21, 2009, was still displayed; the first item on the alarm screen had not 

been acknowledged because they had become accustomed to nuisance alarm conditions. 21

 

21 Under normal operating conditions, when an alarm point activates it will remain in an activated state until the 

alarm condition is cleared and acknowledged. 

 

Pressure

Time

000410
E.I. DuPont de Nemours & Co. Final Report September 2011

38

2.3.6 Second-Party Process Safety Management Audit

In 2007, an audit team of engineers and safety and health experts from other DuPont facilities conducted a 

4-day second-party audit22

During another review of SOPs and worksite practices, the team noted that the Crop Protection procedure 

for operating with active alarms did not effectively address alarm activations from idle equipment: “The 

current situation can lead to human factors errors such as failing to recognize an alarm and misidentifying 

an alarm.” The team recommended that Belle conduct an engineering evaluation to determine changes 

that could separate alarms on active processes from those associated with shutdown equipment so that 

operators could readily identify abnormal process conditions.

of the Crop Protection business at Belle, which included the F3455 and SLM 

units. The four-member team audited the units against PSM focus areas such as MOC-subtle change, prestartup safety reviews (PSSRs), training, PHA, mechanical integrity, and process technology. While 

auditing the F3455 unit and during a review of site and area management practices, the team noted the

many active alarms in the unit control room: “[The] control system is not engineered to eliminate alarms 

from idled and secure process equipment [and as a result] the contribution to ‘nuisance’ alarms is 

unknown.” The audit team recommended that Belle evaluate the control system and develop an 

engineered solution to reduce the number of active alarms and establish a policy reflective of 

improvements to safely manage operations with active alarms.

Both recommendations, added to a corrective action tracking plan, were completed in fourth quarter 2008, 

months beyond the original target completion dates. Despite these recommendations, F3455 unit 

personnel continued to restart the unit while the alarm was activated, failing to recognize the impact of the 

burst sensor alarm.

 

22 A second-party audit is an independent assessment of PSM systems performed against the requirements of the 

DuPont corporate PSM standard.

000411
E.I. DuPont de Nemours & Co. Final Report September 2011

39

2.4 Key Findings 

1. The rupture disc alarm system being monitored by a battery-powered transmitter, with batteries 

requiring almost monthly replacement, was designated as PSM-critical23

2. DuPont ran the equipment with an unreliable battery-powered transmitter for 18 months before 

executing a MOC package to convert to a wired power supply.

equipment by DuPont.

3. Operators expected maintenance work to trigger alarms, but planning and communication were

insufficient to distinguish which alarms needed immediate attention during the turnaround and 

after work was completed. 

4. Despite repeated incidents of rupture discs bursting, DuPont did not adequately address the cause 

to prevent recurrence.

5. The alarm from the transmitter did not distinguish between a condition that required immediate 

attention (ruptured disc burst) and a lower priority condition such as failed batteries.

6. Operators became desensitized to the rupture disc burst alarm. 

2.5 Root Causes

1. DuPont’s MOC process approved a design for the rupture disc alarm system that lacked sufficient 

reliability for minimizing the release of methyl chloride.

2. DuPont did not resolve the “nuisance alarm” condition in a timely manner despite various safety 

reviews. 

 

23 PSM-critical is defined in DuPont SHE Standards S21A and S24 A as components, equipment, or systems whose 

failure could cause, allow, or contribute to process incidents that result in death or serious injuries, significant 

property damage, or significant environmental impact.

000412
E.I. DuPont de Nemours & Co. Final Report September 2011

40

3.0 Oleum Release (January 23, 2010)

3.1 Background 

Lucite International owned the sulfuric acid recovery (SAR) unit on DuPont’s Belle plant property and 

DuPont employees operated the equipment. The SAR unit produced oleum, which is a solution of sulfur 

trioxide dissolved in sulfuric acid. As the sulfuric acid is consumed, the sulfur trioxide converts to 

sulfuric acid.

The process unit adjacent to the SAR unit used the oleum to produce methacrylic acid, an ingredient for 

acrylic polymers, and then returned the spent oleum to the SAR unit. The SAR unit burned off the 

impurities from the spent oleum and used the remaining sulfur compounds to produce clean oleum. 

As a result of an unrelated, earlier inspection, the EPA ordered the Belle facility to upgrade emissions 

monitoring equipment or improve abatement capacity in the SAR unit. As part of a consent decree with 

the EPA issued on April 24, 2009, Lucite International chose to permanently shut down the plant. The 

complete and final shutdown of the SAR was concluded in March 2010. 

3.2 Incident Description

On January 23, 2010, at about 7:40 a.m., contract personnel working near the SAR unit saw an unusual 

cloud near the oleum tower and reported a fume release to the board operator. The contractors estimated 

the release to be about midway along the length of a1-inch diameter insulated pipe between the Oleum 

Tower Pump Tank (OTPT) and a sample station (Figure 8). The board operator asked the plant operator 

to go to the area of the reported leak to determine the nature of the release. The plant operator confirmed 

that a leak had developed on the sample piping between the OTPT and the sample station and alerted

other workers in the vicinity to move to a safe area. Based on the information the plant operator provided, 

000413
E.I. DuPont de Nemours & Co. Final Report September 2011

41

at about 7:45 a.m. the board operator notified the main gate guard, who then activated a “fume alert” 24 to 

notify the facility of the release.

Figure 8. Photo of the position of the 1-inch sample line, which had not yet been replaced

 

24 Each plant in the facility has a pre-determined unique number of rings that identify it in case of a release or 

emergency.

000414
E.I. DuPont de Nemours & Co. Final Report September 2011

42

A cloud of steam and sulfuric acid mist from this release is reported to have traveled west and dissipated 

in an adjacent operating unit. A concrete dike surrounding the OTPT contained liquid from the leak. 

There were no reports of exposure to any DuPont or contract employees or the public.

3.2.1 Incident Response 

When the plant activates a fume alert, a klaxon bell notifies plant personnel of the location of the incident.

This action also initiates a response by plant fire brigade personnel who go to the facility’s fire station to 

obtain the plant fire engine and personal protective equipment (PPE) necessary to respond to the incident.

At about the same time the fume alert was sounded, the gate guard called Metro 9-1-1. The shift 

supervisor radioed the gate guard to notify the Belle Volunteer Fire Department, which then dispatched 

three engines to the plant. Two of the engines staged outside the plant’s gate while the third went into the 

plant to stand by.

DuPont fire brigade members arrived at the site of the release and set up a water fog spray from the 

DuPont fire engine and an oscillating water spray from a nearby hydrant for about an hour. After donning 

an acid suit and self-contained breathing apparatus (SCBA), one responder entered the area and closed a 

valve, which stopped the release at about 8:09 a.m. The gate guard sounded the “all clear” at about 8:27 

a.m. Calculations estimate that 22 pounds of 20 percent oleum was released during the incident.25

3.3 Incident Analysis

3.3.1 Reconstructive Analysis

The CSB investigators documented the analysis of the oleum sample line, which was conducted by an 

independent metallurgical lab, to determine the incident cause. 

 

25 20 percent oleum has an acid content that is 20 percent greater than pure sulfuric acid.

000415
E.I. DuPont de Nemours & Co. Final Report September 2011

43

Caused by an unknown defect, oleum corroded through a small section of the pipe involved in the release 

on January 23, 2010. Starting as a pitting phenomena and finishing slightly larger than a pin hole, the 

corrosion penetrated the insulated stainless steel sample pipe (Figure 9). 

Figure 9. The pitting phenomena in the small initial hole of the oleum sample line wall

Once oleum was present on the exterior of the oleum pipe, it readily corroded the insulation and steam 

tracing line and then created a leak in the steam tracing, causing the steam and oleum to mix. This

reaction created a strong solution of sulfuric acid that rapidly and effectively corroded the stainless steel 

sample line exterior, until a second larger hole developed at a location near the original small leak. The 

second hole clearly shows corrosion occurring from the outside-in (Figure 10). 

000416
E.I. DuPont de Nemours & Co. Final Report September 2011

44

Figure 10. The larger hole eroded from the outside-in on the oleum sample line26

When DuPont removed the oleum-soaked insulation and cover, a larger hole was visible; the acid had 

also corroded a large amount of the steam tracing. When the sample line was properly cleaned, inspection 

revealed that the smaller hole was only a few inches away from the larger hole, and after thorough 

examination, metallurgists concluded that the small hole in the sample line initiated the oleum release

(Figure 11). 

 

26 Because the oleum pipe was held as evidence, its decontamination was delayed; the size of the holes may have 

marginally increased from continued corrosion prior to examination.

000417
E.I. DuPont de Nemours & Co. Final Report September 2011

45

Figure 11. Photo showing the orientation of the small hole to the main hole

3.3.2 Pipe Testing and Analysis

The oleum sample line was tested using gamma ray radiography, ultrasonic thickness (UT), and 

metallographic analysis. The metallographic analysis confirmed that the sample line was fabricated from 

304L stainless steel, one of the few metals approved by the DuPont Piping Standard for this oleum 

service.

The radiographic and UT testing showed that the pipe wall had suffered general thinning from corrosion, 

which is expected in most piping applications involving corrosive materials. The thinning rate can predict 

the service life of the pipe, and in the case of pipes routing corrosive materials, the expectation is that

000418
E.I. DuPont de Nemours & Co. Final Report September 2011

46

roughly 1 to 2 mils27

Only one anomaly, later deemed the initiator of this incident, was found during the testing. During visual 

inspection a small hole was discovered 90o off and a few inches from the larger hole. Under microscopic 

examination, the small hole corrosion phenomenon could clearly be seen; however, its exact cause is 

unknown. One theory is that this small hole may have originated from some sort of manufacturing defect, 

but the size and shape of the pitting phenomenon suggest that if this were a manufacturing defect, the 

pitting would have occurred around the circumference of the pipe or along the longitudinal axis. This 

particular phenomenon does not fall into any easily defined defects. Due to the small size of this pitting, it 

is unlikely that routine non-destruction examination (NDE) techniques would have identified this defect. 

 will corrode per year. UT testing and radiography revealed that general wall 

thinning of the sample line was much less than the predicted 1 to 2 mils per year and showed much less 

thinning than expected for its lifetime. This sample line had been in place for 19 years, which is not 

unusual for this type of service.

3.3.3 Previous Incident Investigation

On January 27, 2009, almost a year to the day prior to the incident, a leak developed in the Oleum Tower 

circulation piping. Although the amount estimated to have been released was greater than the January 23, 

2010, release (40 pounds vs. 22 pounds), supervisors deemed the situation unnecessary for an emergency 

shutdown and activation of a fume alert.

The emergency response for the 2009 incident was inconsistent with that taken in 2010. Unlike in 2010, 

in 2009 a “hot line”28

 

27 A mil is a unit of measure equal to one-thousandth of an inch (i.e., 1/1000 in).

announcement informed plant personnel of the incident. In the incident 

28 A “hot line” announcement involves notification to a pre-determined list of operating and supervisory personnel 

who are all informed of an incident at the facility with one call.

000419
E.I. DuPont de Nemours & Co. Final Report September 2011

47

investigation report for the 2010 incident, no criteria is discussed that would provide guidance for the 

appropriate response or what distinguished the two events.

3.3.4 PM Program Recommendation from 2009 Incident 

The internal DuPont investigation identified the following key factor in the 2009 incident: “Pipe in acid 

service tends to have very localized areas of erosion/corrosion that can be easily missed while performing 

thickness checks. These areas are often the result of welds, the heat affected area of welds, and, 

disruptions or turbulence in the acid flow.” 

Although DuPont realized that certain wall thinning in acid service could go undetected, one 

recommendation from this investigation was to incorporate all piping in oleum service into a PM 

schedule; however, this recommendation was not completed prior to the January 2010 incident. 

Moreover, the sample line involved in the January 2010 incident was not included in the PM schedule. An 

interview with one of the engineers responsible for arranging for this equipment to be included in the PM 

schedule revealed that the oversight occurred due to poor communication between DuPont and the 

contractors hired to perform the PM inspections. 

3.3.5 Mechanical Integrity

The piping material, 304L stainless steel, is acceptable to carry this concentration of oleum. The expected 

rate of wall thinning would project the lifetime of the pipe to be approximately 40 years, and this pipe had 

been in service for only 19. While the oleum sample line was within the design specifications, DuPont did 

not address the corrosion issues associated with acid service. 

000420
E.I. DuPont de Nemours & Co. Final Report September 2011

48

3.3.6 Heat Tracing Design

The oleum sample line was heat-traced29

As described in the Analysis Section, steam tracing played a significant role in the failure of the sample 

piping. Once the oleum escaped containment, the copper tracing corroded away. The oleum and steam 

then mixed, and the resulting extremely corrosive sulfuric acid created the larger hole. If an electric 

tracing line had been used, as DuPont suggests for these conditions, the larger hole would not have 

formed, reducing the magnitude of this incident.

with a steam tracing line comprised of 1⁄4-inch copper tubing 

strapped to the outside of the sample line. The steam in the copper tracing line heats the sample line to

prevent the oleum inside from freezing. Steam tracing, however, can create hot spots and often does not 

distribute heat evenly throughout its length. A preferred method is electric tracing, which can be easily 

controlled and prevents hot spots through even heat distribution (Dillon, 1997). 

3.4 Key Findings

1. An internal DuPont investigation report from a prior oleum leak recommended including all 

piping in a PM thickness monitoring program. The CSB found no evidence that the piping in the 

January 23, 2010, incident was included in the program. 

2. The general wall thinning rate estimate for the oleum service was conservative. However, highly 

localized corrosion attack cannot be predicted by this method.

3. Corrosion caused a small leak in the oleum pipe under the insulation.

 

29 The protection of a liquid-filled pipe against freezing by installing heat tubing or heating cable around or along the 

pipe

000421
E.I. DuPont de Nemours & Co. Final Report September 2011

49

3.5 Root Causes

1. DuPont did not adhere to industry recommended practices to use electrical tracing instead of 

steam tracing.

2. A defect in the piping, undetectable by routine NDE techniques, allowed for a loss of 

containment.

4.0 Phosgene Release (January 23, 2010)

4.1 Background

4.1.1 Phosgene

Phosgene, in liquid and gaseous forms, is colorless and highly toxic and has a characteristic odor of 

freshly cut hay or grass, with a boiling point of 8° C (47° F), and is liquid in cold weather, gas in warmer

weather. At room temperature phosgene is a dense gas that is heavier than air. Phosgene is manufactured 

through the reaction of carbon monoxide and chlorine and is used widely in industry as a chemical 

intermediate for isocyanate-based insecticides, polymers, and pharmaceuticals.

Inhalation is the primary route of exposure to phosgene. The OSHA 8-hour TWA PEL for phosgene is 0.1 

ppm30; the NIOSH IDLH concentration is 2 ppm. The odor threshold31

 

30 The NIOSH- and ACGIH-recommended TWA concentrations are also 0.1 ppm for phosgene.

ranges between 0.4 and 1.0 ppm, 

which is higher than the OSHA PEL; therefore, odor is not a reliable detection method for phosgene, as 

injury may occur before the odor becomes prominent. Phosgene gas may irritate skin and eyes upon 

contact at lower concentrations. Liquid phosgene contact with skin can also cause severe chemical burns 

at higher doses.

31 An odor threshold is the lowest airborne concentration that can be detected by a population of individuals. The

range of detection varies among individuals.

000422
E.I. DuPont de Nemours & Co. Final Report September 2011

50

Phosgene inhalation can result in two mechanisms of injury to the respiratory tract, both of which can 

result in pulmonary edema32

4.1.2 Phosgene Stainless Steel Hose Transfer Operation

at high concentrations. Inhaled phosgene slowly undergoes hydrolysis and 

forms HCl, which results in upper respiratory irritation and burning sensations, cough, and chest 

oppressions. Symptoms may not appear until several hours after exposure. Phosgene also reacts with 

proteins in the pulmonary bronchioles and alveoli, disrupting the blood-air barrier in the lungs and 

resulting in increased lung fluid. Pulmonary edema can be present in victims as long as 40 hours after 

exposure and may last days depending on the concentration and duration of the exposure.

The SLM unit runs on a campaign33

Figure 12

basis and is divided into two processes: the “front end” and “back 

end.” The front end process makes five isocyanate intermediate products. Phosgene used to produce the 

five intermediate products is fed to a process from 1-ton cylinders stored in the phosgene shed at the SLM 

unit. The phosgene cylinder storage shed is a covered, partially walled structure where the phosgene 

transfer and storage operations occur ( ). All equipment used for these purposes is in or around 

the shed. The shed contains no mechanical ventilation or exhaust systems to control phosgene leaks, only 

natural ventilation flowing through the shed wall opening from the atmosphere.

 

32 Pulmonary edema, which occurs when fluid accumulates in the lungs, leads to impaired gas exchange and may 

cause respiratory failure. It is due to either failure of the heart to remove fluid from the lung circulation 

("cardiogenic pulmonary edema") or direct injury to the lung parenchyma ("noncardiogenic pulmonary edema").

33 The front end of the SLM unit manufactures several types of isocyanate intermediates on a demand-based 

schedule.

000423
E.I. DuPont de Nemours & Co. Final Report September 2011

51

Figure 12. Phosgene shed and full (F) and empty (MT) cylinder locations on day of incident (not to scale)

During normal operation, two cylinders are staged on weigh scales and each is connected to the process 

with two 0.25-inch diameter by 48-inch long PTFE-lined, 304 stainless steel overbraid hoses. One hose 

transfers liquid phosgene to a steam vaporizer and one provides 70-psig nitrogen to the cylinder. The 

scales record the weight of the in-service cylinder and when the container is nearly empty, an alarm 

notifies the board operator, who then directs operators to switch to a full cylinder. This switch is 

completed by opening valves to the full cylinder and closing valves to the empty cylinder. The hoses 

remain coupled in this operation, and plant SOPs do not require enhanced PPE such as a fully 

encapsulated suit and breathing air. Under normal operating conditions, the process consumes two to 

three cylinders of phosgene per day.

000424
E.I. DuPont de Nemours & Co. Final Report September 2011

52

The SOPs do require operators to don a fully-encapsulated suit with supplied breathing air when they 

replace an empty cylinder with a full cylinder. After clearing all phosgene from the stainless steel hose 

with a nitrogen purge under vacuum to a scrubber, the hose is isolated from the vent piping and 

disconnected from the empty cylinder. Operators then replace the empty cylinder on the scale with a full 

cylinder and connect the stainless steel hose to the new cylinder.

Maintenance mechanics replace stainless steel hoses in phosgene service when a work order is generated 

to change-out the hoses. The DuPont SOPs for the change-out frequency of the nitrogen and phosgene 

hoses directs replacement every 30 days.34

A number of manufacturers fabricate hose assemblies to DuPont’s specifications for phosgene and 

nitrogen hoses, which arrive pre-assembled and are stored in plastic bags in the maintenance shop. Prior 

to connecting the hoses to the phosgene cylinders, the maintenance mechanics install valves on either end 

of the hose. Hoses removed from service are decontaminated in a water bath and then disposed. 

4.1.2.1 VanDeMark Chemical, Inc.

VanDeMark Chemical supplies phosgene to the Belle plant in 1-ton cylinders. VanDeMark, located in 

Lockport, NY, is the only North American company that both produces and distributes phosgene. It 

distributes phosgene and phosgene derivatives in 1-ton cylinders. Each VanDeMark cylinder is 87 percent

full and contains 2,000 pounds of phosgene. Each U.S. Department of Transportation-regulated cylinder 

has two valves with a seal plug screwed in the outlet covered by a flanged and gasketed bonnet to protect 

the valves and prevent leaks during transport. The Belle plant receives phosgene cylinders via truck that 

are unloaded at the phosgene shed; empty cylinders are loaded onto the truck and returned to 

VanDeMark.

 

34 DuPont’s former maintenance management process directed that hoses be changed every 2 months.

000425
E.I. DuPont de Nemours & Co. Final Report September 2011

53

4.1.2.2 Use of Personal Protective Equipment (PPE)

DuPont safety procedures include two levels of PPE required for work in the phosgene cylinder shed on 

the SLM unit, based on the connection status of the phosgene cylinders. When the phosgene cylinders are 

connected to the process and no breaks in the phosgene lines are occurring, the standard required PPE for 

the SLM unit is a hard hat, steel-toed safety shoes, safety glasses, flame resistant clothing (FRC), and a 

phosgene indicator badge. Work with this level of protection includes

• entering the phosgene shed to check cylinder scale weights,

• opening and closing valves to switch from one cylinder to another, and

• operating the crane when loading and unloading full or empty cylinders in the phosgene shed 

The Belle Plant SOPs for disconnecting a phosgene cylinder require operators to wear a chemical suit 

(gloves, boots, and hood) with supplied breathing air in addition to the PPE listed above while performing 

the work. During all phosgene cylinder line break operations, another operator, wearing standard PPE, 

stands outside the shed to monitor the breathing air supply of the operator performing the work.

At the time of the incident, the employee fatally exposed to phosgene was wearing the standard PPE. This 

met DuPont operating standards for the task he was performing, because he was likely checking cylinder 

weights in preparation for switching to the partially filled riverside cylinder. The Belle Plant PPE 

requirements and SLM unit procedures did not require him to don a chemical suit, with supplied air, 

during this activity.

4.1.2.3 Phosgene Indicator Badge

Belle Plant safety procedures require all personnel (operators, contractors, managers) and visitors in the 

SLM unit to sign a log sheet and obtain a phosgene indicator badge from the SLM control room prior to 

entry and to wear a phosgene indicator badge in their breathing zone (Figure 13). Phosgene indicator 

000426
E.I. DuPont de Nemours & Co. Final Report September 2011

54

badges change color when exposed to phosgene, and the color indicates the concentration 1 minute after 

exposure. After 2 consecutive days of use, personnel using badges must discard and replace their 

indicator badge to ensure accurate sensitivity.35

Two types of phosgene indicator badges are available for use in the SLM unit. For work tasks not 

involving supplied air, personnel clip SafeAir® System phosgene badges (Morphix Technologies) to the 

collar or pocket of FRC near the breathing zone. The badges change from white to pink or red to indicate 

dose, concentration, or duration of exposure. In addition to badges, the SafeAir system uses a color 

comparator wheel to detect exposure dose and the presence of phosgene between 0.9 and 100 ppm-min.36

 

35 The manufacturing specifications state that the maximum recommended sampling time for each badge is 3 days. 

The Belle plant requires phosgene badges to be replaced after 2 days to ensure accurate detection and avoid 

discoloration or interference with other chemicals.

36 Parts per million-minute (ppm-min) is the concentration of a contaminant in air related to the exposure time 

through inhalation; 48 ppm-min = 480 minutes of exposure at 0.1 ppm concentration.

000427
E.I. DuPont de Nemours & Co. Final Report September 2011

55

Figure 13. SafeAir Phosgene Dosimeter Badge37

For work tasks in the SLM unit requiring supplied air, all personnel must wear a CheckAir® phosgene 

badge inside the mask of their supplied air respirator. The CheckAir detector (Morphix Technologies) 

detects exposure dose concentrations between 0.9 and 100 ppm-min. The color comparator wheel for 

detecting exposure concentrations of the CheckAir detectors differs from that of the SafeAir badges.

4.1.2.4 Alarms

The SLM unit has 12 phosgene sensors placed in and around it to continuously sample and record 

phosgene concentrations every 30 seconds; concentrations of phosgene are detected via an 

electrochemical diffusion sensor within a range of 0.05 to 1 ppm. One phosgene sensor is located in the 

phosgene shed, six are in the SLM building, and two are located outside the building. Three sensors are 

 

37 The badge in Figure12 has a range of 0.5 to 450 ppm-min. The SafeAir badge worn by the exposed employee had 

a range of 0.9 to 100 ppm-min.

000428
E.I. DuPont de Nemours & Co. Final Report September 2011

56

on the fence line of the facility along the Kanawha River, approximately 120 feet from the phosgene 

storage shed.

The analyzer readings are monitored by the DCS in the SLM control room, and concentrations in excess 

of 0.05 set off audible and visual alarms at the board operator’s work stations. Concentrations equal to or 

greater than 0.05 ppm set off a medium-high alarm and concentrations at or above 0.1 ppm set off a highhigh alarm. The CSB could find no evidence that audible or visual alarms were in service in the phosgene 

shed when the release occurred.

On the day of the incident, the phosgene release activated alarms in the control room for four of the 12 

analyzers in and around the SLM unit. The phosgene analyzer in the shed recorded concentrations ranging 

from 0.04 to 1.0 ppm for approximately 50 minutes following the initial release. Two of the three fence

line monitors triggered alarms, with the maximum recorded concentration of 0.27 ppm on a monitor 

located approximately 120 feet from the phosgene shed along the river. Another monitor, located on a 

spill tank outside the SLM unit building, also recorded a concentration of 0.04 around the time of the 

release.

All 12 phosgene analyzers have a maximum detectable concentration of 1 ppm. The analyzers do not 

record actual values for concentrations in excess of 1 ppm; therefore, if phosgene concentrations exceed 

the detection range at the analyzer sample point, the values are recorded only as 1 ppm. 

4.1.3 Phosgene Highly Toxic Material Guardian Committee

DuPont’s Phosgene Highly Toxic Material Guardian Committee focuses on the safe management of 

phosgene at applicable DuPont facilities. DuPont has several guardian committees for highly toxic 

materials (HTMs) used within the company. The committee is comprised of representatives, known as 

phosgene guardians, from all DuPont sites that produce or consume phosgene. Managers from affected 

processes, corporate health and safety representatives, engineers, and industrial hygiene specialists also 

000429
E.I. DuPont de Nemours & Co. Final Report September 2011

57

participate. The Phosgene Guardian Committee holds meetings twice a year to share learnings and discuss 

phosgene handling issues.

DuPont has an HTM manual for phosgene, a company protocol that includes requirements and guidelines 

for the safe design and operation of processes that generate or use phosgene. The primary purpose of the 

manual is to reduce the likelihood of phosgene harming employees or the public. The requirements of the 

manual are mandatory for all DuPont facilities with enough phosgene to impose a significant offsite 

hazard as determined by a chemical consequence analysis of offsite exposure. The Phosgene Committee 

conducts a second-party audit of all facilities using phosgene against the requirements and guidelines set 

forth in the phosgene HTM manual approximately every 3 years. The Phosgene HTM Committee audited 

the SLM unit at the Belle Plant in September 2006; the next audit was scheduled for January 25, 2010, 

just two days after the phosgene release incident.

4.2 Incident Description

The third incident occurred on January 23, 2010, between 1:45 and 2:00 p.m. A stainless steel braided 

transfer hose connected to a partially filled, but not in service 1-ton phosgene cylinder failed 

catastrophically in the SLM unit phosgene shed. This incident occurred in the phosgene shed. When the 

release occurred, an operator was in the phosgene shed inspecting the status of the riverside38

 

38 The cylinders are commonly referred to as “hillside” or “riverside” based on their orientation in the phosgene shed 

relative to the hills north of the building and the Kanawha River to the south. 

phosgene 

cylinder as he anticipated that the active cylinder was nearly empty and would need to be switched. He 

was sprayed across the chest and face with liquid phosgene remaining in the riverside hose from a 

previous transfer operation. 

000430
E.I. DuPont de Nemours & Co. Final Report September 2011

58

DuPont estimates that about 2 pounds of phosgene were released to the atmosphere when the hose failed. 

The CSB concurs with this estimate and further calculated that the operator would have received a lethal 

dose of phosgene in less than one-tenth of a second (Appendix D).

Immediately after the operator was sprayed, he called for assistance on the SLM unit public address 

phone in the phosgene shed. A coworker who responded to the call noticed that the victim’s phosgene 

dosimeter badge (Figure 13) was discolored, indicating an exposure. The coworker directed the exposed 

worker to a plant truck to transport him to the plant’s medical center for assessment and treatment. As 

they drove to the medical center, the two workers were met by the Shift Supervisor and the exposed 

worker was transferred to the shift supervisor’s vehicle to complete the trip. While en route to the plant’s 

medical center, the front gate guard was radioed and advised to call Metro 9-1-1 and request that an 

ambulance respond for a medical emergency. The exposed worker, while at the medical center waiting for 

the ambulance, chose to wash his face and hands, but there is no evidence or record that he was placed in

a safety shower to wash off, as instructed by the emergency procedures, or that any decontamination 

activity took place beyond the hand and face washing. He was given a change of coveralls to put on in 

exchange for the work clothes he was wearing. The gate guard called Metro 9-1-1 at 1:59 p.m., requesting 

transport for a medical emergency patient to the hospital. The 9-1-1 dispatcher asked if there was a 

chemical release; however, the gate guard, who was unaware of the situation, responded that there was no 

release and that the response was for a medical emergency. As part of the Metro 9-1-1 emergency 

response protocol, the dispatcher asks for specific information to ensure that responders are as informed 

as possible prior to arrival at the scene. At 2:03 p.m., an ambulance was dispatched from the KCEAA.

At 2:08 p.m., responding EMTs asked Metro dispatchers if more information was available about the 

victim. When Metro called DuPont to get more information, the line was busy. EMTs also wanted to 

know if there was a chemical exposure, but Metro 9-1-1 could not get that information from DuPont. Six 

minutes later, the EMTs arrived at the DuPont gates.

000431
E.I. DuPont de Nemours & Co. Final Report September 2011

59

EMTs were directed to the DuPont medical center to meet the exposed worker. As the EMTs gathered the 

worker for transport, they were given a written phosgene treatment protocol intended to be used at the 

hospital to provide treatment. While the worker was being transferred to their care, DuPont employees 

told the EMTs that the victim had been exposed to liquid phosgene.

The EMTs left the facility with the victim at 2:26 p.m., or 27 minutes after the first call to Metro 9-1-1. 

During transit and after arrival at the hospital at 2:34 p.m., the victim was lucid, conscious, and talking 

clearly to the emergency responders and attending physician. Until the attending ER physician consulted 

the company-provided phosgene treatment protocol, which advised 48-hour monitoring for suspected 

phosgene exposures, he considered sending the victim home based on his condition shortly after arriving 

at the hospital. A baseline X-ray revealed no congestion in the victim’s lungs. At about 5:30 p.m., or 

almost 4 hours after exposure, the operator’s condition began to rapidly deteriorate. Over the next 29 

hours, the victim received treatment from a variety of physicians, but his condition failed to improve and 

he died at 9:27 p.m. on Sunday, January 24, 2010.

Post-incident, KCEAA staff voiced concerns regarding the quality and timeliness of information DuPont 

provided to Metro 9-1-1 dispatchers and responding EMTs. The concerns raised address the need to 

ensure that emergency responders and their equipment are not exposed to contaminants and that the 

victims they are assisting receive optimum care in transit for medical treatment. A review of comparable 

responses by KCEAA EMTs in the region reveal that the response time to DuPont and from there to the 

hospital was not unduly delayed by the lack of information. A sampling of similar emergency responses 

reveal an average response time from the initial call to Metro 9-1-1 until arrival at the hospital to be about 

36 minutes. Total elapsed time for the response time on the day of the exposure was 35 minutes.

Although the emergency response and transport of the victim was not delayed during this incident or the 

oleum release, because of a lack of clear, accurate information regarding the material involved, response 

procedures have since been modified by Metro 9-1-1 administrators. These modifications mandate that 

000432
E.I. DuPont de Nemours & Co. Final Report September 2011

60

EMS units not report directly to the site of an incident until clear information has been provided such that 

EMS personnel will not be at risk of unknown contaminants/threats. This change in response protocol 

was incorporated after several incidents in the Kanawha Valley. The CSB considers the change in 

response protocol significant enough to define the cause and effect of the communication gap as a “nearmiss.” Several key factors that contributed to poor communication, including the absence of a process 

knowledgeable person assigned to convey information to the dispatchers and the lack of a direct line to 

the Metro 9-1-1 emergency operations center, must be recognized and addressed. 

One confirmed and one possible phosgene exposure to workers occurred after the initial release. The first 

was when a coworker responded to the call for assistance immediately after the phosgene hose ruptured. 

As he drove the victim to the facility’s medical building, the coworker’s dosimeter badge became slightly 

discolored, indicating phosgene exposure.

A possible source of this exposure was phosgene vapor in the atmosphere as recorded on one of three 

fence line monitors about 120 feet from the shed along the river. Another possible source was the victim’s 

clothing, which may have been saturated with phosgene immediately after the release. When interviewed, 

this employee said that pulmonary function tests performed afterward showed no signs of adverse effects.

A second possible exposure occurred when an employee working in the SLM unit went toward the 

phosgene shed shortly after the release. He reported in an interview that as he got closer, he noticed a 

smell that he had not encountered before or since. He recalled that the odor was not strong or offensive as 

would be expected with ammonia or chlorine, but noticeably different from any odors he had smelled in 

the past. Being unfamiliar with the characteristic fresh mown hay odor associated with phosgene, he left 

the area.

Although the phosgene shed area has flashing lights to alert against entry into the area during cylinder 

changes, there is no evidence that a fume, medical, or plant radio alert sounded at any time during this 

release episode to warn operators and maintenance personnel to avoid coming near the phosgene shed. 

000433
E.I. DuPont de Nemours & Co. Final Report September 2011

61

4.2.1 Community Impact

Two of the three fence line analyzers recorded a maximum concentration of 0.15 and 0.27 ppm39

4.3 Incident Analysis

phosgene, indicating that phosgene concentrations had traveled offsite toward the Kanawha River. 

However, no member of the public reported phosgene exposure symptoms the day of the incident nor did 

the U.S. Coast Guard restrict river traffic or conduct air monitoring as it had a day prior as a result of the 

methyl chloride release. 

4.3.1 Hose Failure Analysis

Post-incident inspections of the stainless steel hoses used for the two phosgene cylinders connected to the 

process identified comparable degradation patterns. Their failure was associated with corrosion that 

developed in approximately the same location on hoses used to transfer phosgene from the riverside and 

hillside cylinders.

Investigators found that while the majority of tags attached to the hoses to indicate the intended service 

were secured in place with plastic ties and metal clamps—as was normal—one manufacturer’s tag was 

secured with white plastic adhesive tape (this tag applied by the manufacturer also provided identification 

information). The corrosion identified on the two hoses associated with the hillside and riverside 

cylinders was localized under the area covered by the white plastic adhesive tape securing the tag.40

 

39 ERPG-2 value for phosgene is 0.20 ppm and at this concentration “all could be exposed for up to one hour 

without experiencing or developing irreversible or other serious health effects or symptoms that could impair their 

abilities to take protective action” (AIHA, 2008).

 The 

characteristics of the transfer hose, consisting of a core constructed of permeable PTFE and braided 304-

40 Witnesses could not provide an exact date that the hoses came into the facility with the tags affixed with adhesive 

tape.

000434
E.I. DuPont de Nemours & Co. Final Report September 2011

62

stainless steel, provided a suitable environment under the adhesive tape for stress corrosion cracking

(SCC41

To provide comparative data, hoses from the hillside, riverside, and exemplars of similar age and new 

assembly were sent to an analytical lab for testing and analysis. The tests established that all of the hoses 

were constructed with 304-stainless steel and the construction material for the inner core of the hoses was 

PTFE, as expected. 

) to occur.

4.3.2 Effect of Plastic Adhesive Tape

The PTFE, 304 stainless steel, and white plastic adhesive tape contributed to the incident. The PTFE inner 

core was permeable and susceptible to phosgene vapor diffusing through the hose. The adhesive tape used 

to secure the tag contributed to the retention of phosgene gas on the exterior of the stainless steel 

overbraid. The phosgene gas converted to HCl, and 304-stainless steel overbraid is subject to corrosive 

attack by HCl. Since the white plastic adhesive tag trapped the phosgene permeating through the PTFE 

inner core, the resulting concentration of HCl was much higher under the tag than elsewhere on the hose

(Figure 14). 

 

41 Stress corrosion cracking is the formation of brittle cracks in a normally sound material through the simultaneous 

action of a tensile stress and a corrosive environment.

000435
E.I. DuPont de Nemours & Co. Final Report September 2011

63

Figure 14. The distinct effect of the white plastic adhesive tag on the corrosion of the stainless steel 

overbraid

Additionally, at the time of the incident, the isolation valves on the phosgene hose on the riverside 

cylinder were closed, which retained liquid phosgene in the hose and pipe between the valves that isolated 

the cylinder from the process. The heavy corrosion of the stainless steel overbraid, coupled with the time 

the hose had been in service and thermal expansion42

 

42 Tendency for solids, liquids and gases to change in volume in response to a change in temperature.

of the isolated liquid phosgene, caused the hose to 

fail catastrophically. When this failure occurred, the worker was exposed as he walked nearby to check on 

the status of the adjacent in-service cylinder. 

000436
E.I. DuPont de Nemours & Co. Final Report September 2011

64

4.3.3 Hose Degradation Issues

Although the maintenance plan for the hillside and riverside hoses prescribed a regular change-out 

schedule of 30 days, work orders show that change-out frequency was neither systematic nor predictable. 

At least three times from 2006 to 2010, phosgene hoses were left in service from 4 to 7 months. 

4.3.4 Hose Change-out Frequency

Several times each year, the phosgene process is halted so the plant can produce a material requiring the

physical removal of phosgene, including all full or empty 1-ton cylinders, from the phosgene shed. 

Table 2 shows the change-out frequency of the phosgene hoses in the SLM unit and the periods when 

SLM did not run processes using phosgene. The most recent recorded instance where phosgene was not 

used in the process was between September and November 2009, 2 months prior to the incident. Work 

orders for changing-out the phosgene hoses indicate that the stainless steel transfer hoses connected at the 

time of the incident had been in service for more than 6 months. This included a removal of the phosgene 

system change-out in September 2009 when the hoses could have been changed-out.

000437
E.I. DuPont de Nemours & Co. Final Report September 2011

65

Hose Change-out Frequency

Month/Year Phosgene Hoses Phosgene Used

Jul-05 Changed Phosgene Used

Aug-05 Changed

Sep-05 Changed 

Oct-05 Changed

Nov-05 Changed

Dec-05

Jan-06 Phosgene Used

Feb-06 Phosgene Used

Mar-06 Changed Phosgene Used

Apr-06 Phosgene Used 

May-06 Phosgene Used

Jun-06 Changed Phosgene Used

Jul-06 Changed Phosgene Used 

Aug-06

Sep-06

Oct-06 Changed

Nov-06 Changed 

Dec-06

Jan-07 Phosgene Used

Feb-07 Phosgene Used 

Mar-07 Changed Phosgene Used

Apr-07 Phosgene Used

May-07 Changed Phosgene Used 

Jun-07 Phosgene Used

Jul-07 Phosgene Used

Aug-07

Sep-07 Changed

Oct-07

Nov-07

Dec-07 

Jan-08 Phosgene Used

Feb-08 Phosgene Used

Mar-08 Phosgene Used 

Apr-08 Changed Phosgene Used

May-08 Changed Phosgene Used

Jun-08 Phosgene Used

Jul-08 Changed Phosgene Used

Aug-08 Changed

Sep-08

Oct-08 

Nov-08

Dec-08

Jan-09 Changed Phosgene Used 

Feb-09 Phosgene Used

Mar-09 Phosgene Used

Apr-09 Phosgene Used

May-09 Phosgene Used

Jun-09 Changed Phosgene Used

Jul-09 Phosgene Used

Aug-09 

Sep-09

Oct-09

Nov-09 

Dec-09

Jan-10 Phosgene Used

Table 2. Phosgene hose change-out frequency

000438
E.I. DuPont de Nemours & Co. Final Report September 2011

66

The CSB found that change-out frequency was intended to be governed automatically by the Belle

facility’s SAP maintenance program. Some supervisors also relied on the maintenance coordinator 

remembering to initiate the change-out.

4.3.5 SAP Work Process

DuPont uses the plant maintenance module of SAP enterprise resource planning software43

In late 2006, SAP data managing the change-out frequency of the phosgene hoses at the Belle facility

were changed; consequently, SAP stopped automatically issuing work orders to change the hoses, but

plant personnel were unaware that SAP no longer automatically issued the work orders. The CSB 

requested additional information regarding the change; however, DuPont could not determine who 

changed the SAP data, why it was changed, or when the change was executed. No back-up layer of 

protection, such as a weekly critical equipment maintenance check sheet or an inspection tag, ensured that 

the hoses were changed at the pre-determined frequency. With SAP no longer automatically issuing work 

orders to change the hoses, the system did not trigger maintenance notifications to change-out the hoses at 

assigned intervals.

to schedule 

the change-out of phosgene hoses at pre-determined 30 day intervals. The SAP system is programmed to 

issue the work orders for hose replacement to prevent the release of phosgene; thus, maintaining accurate 

data in the SAP database is crucial to protect against phosgene exposure (Appendix C). 

 

43 Enterprise resource planning software is a type of database that allows data related to flows of money and other 

resources in areas such as accounting, supply chain management, sales and marketing, manufacturing, 

maintenance, and project management to be recorded and accessed.

000439
E.I. DuPont de Nemours & Co. Final Report September 2011

67

4.3.6 Near-Miss Phosgene Incident

On the morning of the phosgene incident, operators asked maintenance personnel to replace the phosgene 

hose on the hillside cylinder because of a suspected flow restriction. Although the cylinder was still about 

half full, it was removed from service and replaced with the full riverside cylinder.

The hillside phosgene supply hose and valve assembly were removed and decontaminated in a water bath. 

When the hose was removed from the water, the white adhesive ID tag had fallen off, revealing a broken 

stainless steel braid and collapsed PTFE liner, a possible cause of the flow restriction (Figure 15). 

Figure 15. Damaged hillside phosgene hose removed from phosgene cylinder. The plastic adhesive tag 

that covered the damaged section fell off during the hose decontamination procedure.

An operator stated during an interview that when he saw the physically defective section of the frayed 

hose, he told his coworkers, stressing that the hose was close to rupturing and that they were lucky to 

have found it and changed-out the hose in time. Unfortunately, this discovery was not captured as a nearmiss, since supervisors were not made aware of the issue.

000440
E.I. DuPont de Nemours & Co. Final Report September 2011

68

Operators told the CSB investigators that they had never seen a phosgene stainless steel hose braid 

corroded to the point of separation. Although they were surprised and concerned about their finding, and

since supervisory staff does not work on weekends, they planned to tell the supervisors about the 

discovery on Monday morning, about 48 hours later. Operators said that they expected that the 

supervisors would conduct a full investigation; however, since the incident occurred on a Saturday, it was 

not investigated. Had there been a system in place for operators to report near-miss incidents on 

weekends, the near-miss investigation may have been properly initiated prior to the fatal release. 

4.3.7 Mechanical Integrity

The DuPont P3H Standard lists acceptable construction materials for flexible hoses used in HTM service

and recommends three different hoses acceptable for use with phosgene: H2, H7, and H9 (Table 3). 

000441
E.I. DuPont de Nemours & Co. Final Report September 2011

69

DuPont P3H Standard Hoses for Phosgene Service

Name Specifications 

 

H2 Inner core material: Monel® 400, corrugated

 Reinforcement material: Monel® 400 overbraid 

 End fitting material: Monel® 400 SCH. 80

 Core/fitting connection method: Welded, full penetration

 

H7 Inner core material: Hastelloy® C276, corrugated

 Reinforcement material: Monel® 400 or Hastelloy® C276 overbraid 

 End fitting material: Hastelloy® C276 stub ends

 Core/fitting connection method: Welded, full penetration

 

H9 Inner core material: Teflon®44

 

PTFE, helical, corrugated, taped or extruded 

construction, unpigmented or conductive

 Reinforcement material: PVDF (Kynar®) double overbraid 

 End fitting material: 

Monel® 400, Hastelloy® C276, or Teflon® encapsulated 

SS 

 Core/fitting connection method: Crimped (or swaged)

Table 3. Flexible hoses for phosgene service as listed in the DuPont P3H Standard: Flexible Chemical 

Hose for Highly Toxic Services

The Belle facility did not use any of the P3H specified hoses and configurations; instead, it used a flexible 

hose made of a Teflon® PTFE inner core and a braided stainless steel reinforcement material, even though 

stainless steel is not recommended for phosgene service, as it is susceptible to SCC from chlorides. 

Phosgene, which can readily react with air to produce chlorides, can permeate PTFE, directly exposing

the stainless steel braid to chloride attack.

 

44 Teflon is the DuPont-registered trademark for PTFE.

000442
E.I. DuPont de Nemours & Co. Final Report September 2011

70

4.3.8 Flex Hose Materials of Construction

The Belle facility referred to corporate experts and the La Porte45

The discussions between the two plants and corporate experts about flexible hoses began in 1987, when 

corporate experts suggested the use of Monel metal for both the hose core and hose overbraid, since it 

resists chloride SCC. However, the La Porte plant asserted that its history with Monel metal was less than 

desirable; one correspondent noted, “The La Porte plant was considering testing Kynar overbraid-

 facility, where flexible hoses were 

being used for phosgene service.

46

An expert from DuPont corporate told Belle that the discoloration was not a problem: 

covered Teflon hose because of discoloration and gradual deterioration of the Monel.” 

Reports from La Porte that Monel braided hoses were corroding in phosgene 

service are not exactly true. The hoses at that time were Teflon lined, with a 

Monel outer overbraid. Due to permeation of phosgene through Teflon, the 

Monel was slightly attacked, forming a green surface film known as a ‘patina’

47

A Belle representative sent a questionnaire to La Porte in August 1987 to evaluate its hose program. The 

questionnaire revealed that La Porte had been using PTFE-lined stainless steel hoses for the previous 3 to 

4 years and that they were replaced every 3 months. It reported that the majority of the hose failures were 

due to fatigue, and that the facility was using stainless steel because it is not as susceptible to failure from 

which is common to all copper-based alloys.

 

45 DuPont uses phosgene at four of its facilities. DuPont no longer uses phosgene in La Porte, TX.

46 The Kynar hose was also not pursued due to pre-conceived flexibility limitations.

47 Patina, most easily observed on old pennies, is a green film formed naturally on the surface of copper and copperbased metals.

000443
E.I. DuPont de Nemours & Co. Final Report September 2011

71

fatigue and bending stresses as are Monel and Kynar hoses. After reading the questionnaire, the corporate 

DuPont expert wrote, 

I still believe that Monel is the best choice for material of construction for 

phosgene unloading hoses (and definitely for the fittings). I am surprised that La

Porte is using Teflon-lined hose with stainless overbraid since Teflon is known to 

be permeable and the phosgene is known to attack the stainless. 

The DuPont expert further stated, 

Admittedly, the Monel hose will cost more than its stainless counterpart. 

However, with proper construction, and design so that stresses are 

minimized...useful life should be much greater than 3 months. Costs will be less 

in the long run and safety will also be improved.

Correspondence or other records that would explain why the expert’s recommendation went unheeded at 

La Porte and why the Belle staff decided to follow the La Porte approach was not discovered during the 

CSB investigation. However, Belle decided to follow La Porte’s example, and adopted a hose design not 

recommended by its P3H Standard or by a DuPont corporate expert.

The phosgene hose replacement frequency at Belle is defined in DuPont’s Phosgene Hose Assembly 

Procedure: “Due to the extremely hazardous nature of phosgene the hose assemblies are replaced every 2 

months.” 

However, the PM schedule in SAP is actually set to a replacement frequency of 30 days. This procedure

does not effectively communicate why the hoses must be replaced so frequently: if left on too long, the 

accepted corrosion condition poses a serious risk to the facility and the community.

000444
E.I. DuPont de Nemours & Co. Final Report September 2011

72

Figure 16. Flex hose comparison photographs: (top to bottom) ruptured riverside hose, flow restricted 

hillside hose, a new hose with attached ID tag

4.3.8 Non-routine Job Planning

Operators told the CSB investigators about the difficulty maintaining the required flow of phosgene from 

one of the two cylinders on the weigh scales the day prior to the exposure incident. The phosgene flow 

from the cylinder to the process was inadequate; thus, they performed a non-routine operation to establish 

a steady flow of phosgene because they suspected a plugged hose or a malfunctioning automatic feed 

control valve. Non-routine operations are characterized by infrequent practice, can be both planned and 

scheduled, or can occur without scheduling

To minimize disruption of the phosgene flow to the process, operators switched to the riverside cylinder, 

which operated as expected and supplied the normal flow rate. Continuing throughout the day and into the 

next, operators repeated switching to the riverside cylinder as the flow from the hillside cylinder became 

low enough to begin to affect the process. When valves for each of the respective transfer hoses were 

000445
E.I. DuPont de Nemours & Co. Final Report September 2011

73

closed, liquid phosgene was not evacuated as required by the SOP for switching from one cylinder to 

another. Since the operators were not fully aware of the hazards of thermal expansion, liquid phosgene 

remained in the hoses as the cylinders were switched. 

The CSB investigators reviewed DCS flow and weight data and saw a distinct difference in the ability of 

the riverside cylinder to provide the needed flow rate of phosgene compared to the hillside cylinder in this

operation. All DCS information the operators received as a result of the non-routine cylinder switching 

indicated that their actions were successfully maintaining the smooth operation of the unit. 

The operators, however, were involved in non-routine operations by attempting to maintain steady-state 

operations, as the SOPs did not address handling flow restriction. In addition, they were unaware of the 

threat of liquid thermal expansion developing as a result of switching the cylinders and not evacuating the 

hoses after each switch-out operation. 

4.4 Process Hazard Analysis

PHAs were conducted on the phosgene cylinder feed system and vaporizer as part of the Front End SLM 

Unit assessment in 1994, 1999, 2004, and 2009. The 2009 PHA team, all DuPont employees, included a 

senior process engineer, two technical resources, a mechanic, and a front end operator; reviewed subtle

changes to the process and associated MOC documentation since the last PHA in 2004 and previous 

phosgene release incidents, and recommended corrective actions. The PHA for the phosgene system 

included the 1-ton cylinders, nitrogen pressuring system, the vaporizer, and all associated piping and 

controls. The team used a Hazard and Operability48 (HAZOP) and “What If49

 

48 A systematic method in which process hazards and potential operating problems are identified using a series of 

guidewords to investigate process deviations (CCPS, 2008).

” methodologies to review 

process hazards and deviations.

000446
E.I. DuPont de Nemours & Co. Final Report September 2011

74

The team recognized and assessed the potential for a phosgene release from the cylinder transfer hoses 

but only if the hoses were incorrectly connected or inadvertently disconnected while the cylinder feed 

valve remained open. They did not assess the potential for the hose to rupture due to thermal expansion of 

liquid phosgene even though the potential for liquid phosgene thermal expansion was evaluated in other 

process equipment during the 2009 PHA.

None of the consequence scenarios the PHA team assessed involved failure of the phosgene transfer hose

or the nitrogen flex hose. When the team evaluated the phosgene vaporizer, it considered corrosion 

potential when stainless steel is exposed to phosgene and water, but did not apply those factors to the 

cylinder transfer hoses. For the vaporizer, the probability value assigned to the phosgene leak scenario 

was decreased by reliance on the PM program to detect corrosion. The PHA team also noted that the 

slowly developing corrosion would decrease the probability of a leak because the corrosion would be 

noticeable during visual inspections. If the PHA team had assessed the thermal expansion and corrosion 

issues for the phosgene transfer hoses and had applied the same conditions to decrease the probability as 

used for the vaporizer corrosion scenario, the incident may still have occurred due to the team’s reliance 

on the PM program to reduce the hazard. Unfortunately, the slowly developing corrosion on the hose was 

not visible due to the location of the white plastic adhesive tape, and the PM program was not configured 

to ensure that the hoses were changed at the appropriate frequency.

Phosgene permeation through PTFE had resulted in leaks at Belle in the past; however, the PHA team did 

not consider this hazard for the phosgene cylinder hoses. The CSB received documentation of all SLM

PHA audits dating back to 1994. The 1999 PHA included two incidents in which phosgene likely 

permeated through PTFE-lined conveyance equipment in other parts of the phosgene process. Even with 

 

49 A technique in which a team with process knowledge and experience examines possible process deviations or 

combinations of deviations than can result in an undesired consequence (CCPS, 2008).

000447
E.I. DuPont de Nemours & Co. Final Report September 2011

75

these previous incidents considered, the PHA team still did not account for the potential of the phosgene 

cylinder hoses to result in a release under similar conditions. 

4.5 Audits

4.5.1 Unit Second-Party PSM Audit

In August 2007, a second-party audit team of engineers and health and safety experts from other DuPont 

facilities audited the SLM unit against regulatory and company PSM requirements. As in the F3455 unit

audit, the team focused on MOC-subtle change, pre-startup safety reviews (PSSRs), training, PHAs, 

mechanical integrity, and process technology. The audit contained 64 findings—27 observations, 35 

policy, and two regulatory issues—within the F3455 and SLM units at Belle.

One regulatory issue noted for the SLM and F3455 units was timely initiation of accident investigations. 

Auditors noted several instances where incident investigations were not started and communicated within 

the Belle plant 24- or the 48-hour OSHA requirements. The audit team recommended revising the Belle 

Plant Incident Investigation procedure and area practices to ensure that plant personnel initiate 

investigations within 24, and no later than 48, hours following an incident. According to the audit 

tracking plan the CSB investigators reviewed, an assigned DuPont employee completed and closed the 

recommendation as of June 2009.

However, in the case of the hillside hose near-miss prior to the phosgene exposure (Section 4.3.3), 

operators told the CSB investigators that they planned to communicate the near-miss to supervisors for 

investigation the following Monday; however, this would not have been within the Belle Plant required 

24-hour period. The OSHA PSM Standard requires the employer to “investigate each incident which 

resulted in, or could reasonably have resulted in, a catastrophic release of highly hazardous chemical in 

the workplace” (1910.119(m)(1)) and that an incident investigation “shall be initiated as promptly as 

possible” (1910.119(m)(2)). The EPA Risk Management Program also requires an investigation of an 

incident involving a regulated substance, such as phosgene, be initiated within 48 hours (40 CFR part 

000448
E.I. DuPont de Nemours & Co. Final Report September 2011

76

68.81(b)). Though supervisors are not typically at the facility on weekends, management and safety and 

health experts, including the SLM Area Manager, were at the Belle Plant the morning of Saturday, 

January 23, 2010, attending the safety pause meeting. Had the incident been reported in a timely manner, 

management onsite could have immediately initiated an investigation.

4.5.2 Onsite Phosgene Generation

In 1988, DuPont engineers considered two options for using phosgene at the Belle facility: in cylinders 

from an offsite provider or constructing a phosgene generation plant to make phosgene onsite. To better 

understand the hazards involved in each design, DuPont engineers conducted a risk assessment in which 

four cases were considered (Table 4): 

Case 1. Operating with a liquid phosgene feed from cylinders 

Case 2. Vaporizing the feed from the cylinders

Case 3. Installing a plant to make phosgene from CO and Cl2

Case 4. Enclosing the phosgene plant (in a fully contained building with an air scrubber) 

After evaluating each case, they estimated the risk of fatality as follows:

Onsite Fatalities per 10,000 years Offsite Fatalities per 10,000 years

Case 1 244 10.5

Case 2 154 0.22

Case 3 16.7 0.007

Case 4 2.3 0.006

Table 4. Preliminary risk assessment by DuPont Engineering, 1988 (Appendix E)

While Case 4 was estimated to have the least amount of risk, the assessment concluded, 

Spending $2 MM for an enclosure to get from Case 3 to Case 4 saves 14.4 lives 

per 10,000 years. (Almost all the improvement is in on-site risk. Off-site risk 

improvement is not significant.) This sets a value of life plus public outrage at 

$143 MM. It may be that in the present circumstances the business can afford $2 

MM for an enclosure; however, in the long run can we afford to take such action 

000449
E.I. DuPont de Nemours & Co. Final Report September 2011

77

which has such a small impact on safety and yet sets a precedent for all highly 

toxic material activities [?].

After the analysis, construction on Case 3, the open-to-atmosphere phosgene generation plant, began. 

However, the phosgene generation plant was abandoned mid-construction, and Case 2 is the current 

configuration at the Belle facility.

Documentation to support why the phosgene generation plant was abandoned was not provided, although 

the CSB obtained a proposal by a third-party contractor to build the plant. The proposal for a plant, as 

presented in Case 3, estimated a cost of $830,000 and stressed the contractor’s history of building 

successful phosgene generation units. DuPont did not act on this proposal; anecdotal evidence from 

interviews suggests that corporate engineers decided to use DuPont resources to construct the plant. 

However, once the project was partially complete, the effort was abandoned as it was determined that the 

DuPont-designed system would not work.

DuPont cancelled plans for the enclosed phosgene generation unit, but the potential for offsite impact still 

remained a concern and was identified in SLM unit PHAs years later. In 2004, a PHA on the SLM unit 

by Belle Plant personnel identified the need for a shed enclosure with a scrubber to mitigate or prevent the 

release of phosgene offsite. The recommendation resulted from a “What if” analysis during the PHA. 

The PHA team listed two separate scenarios that could result in a plant-wide or offsite consequence, both 

recommending a shed enclosure. The original due date for the shed enclosure was scheduled for 

December 2005 but extended to December 2006; three subsequent extensions on the enclosure 

recommendation remained incomplete the day of the fatal phosgene release (Table 5). 

000450
E.I. DuPont de Nemours & Co. Final Report September 2011

78

PHA Enclosure Recommendation Delays

2004 

Original Recommendation created in SLM 2004 PHA

Dec-04 "Provide appropriate mitigation to prevent multiple fatalities from the 

release of a 2000 lb phosgene cylinder."

Due Date: Dec-05

2005 

First Extension

May-05

"A COC12 generation system is currently being

evaluated, and if this was installed the shed enclosure may be 

designed differently to handle the appropriate chemicals."

New Due Date: Dec-06

2006 

Second Extension

Dec-06

"Work to define the scope on this item is progressing but not yet 

complete. We are evaluating potential lower cost alternatives to total 

shed enclosure."

New Due Date: Dec-08

2008 

Third Extension

Dec-08

"...the schedule indicates completion by August 2009."

"The holds on the capital project were due to uncertainty of the 

future of the facility and due to the cost of the project."

New Due Date: Nov-09

2009 

Fourth Extension

Nov-09

"... project to install a phosgene scrubber to address these 

recommendations, an error in basic data was discovered. This 

invalidated the original design basis for the scrubbing system, and 

required a halt to the project activity."

New Due Date: Nov-10

SLM 2009 PHA Completed

32 Recommendations are made, none of which capture the Dec-09

outstanding recommendation from the SLM 2004 PHA

2010 

Fatal Phosgene Incident Occurs Jan-10

Table 5.Delay for Completing the PHA Recommendation for Enclosing the Shed 

000451
E.I. DuPont de Nemours & Co. Final Report September 2011

79

Following the phosgene release incident, DuPont announced that it would idle the storage and use of 

phosgene at the Belle site for 2011 and later told the CSB that the site has permenantly discontinued all 

onsite phosgene operations. The CSB requested documentation from DuPont that defines the status of the 

PHA recommendation for the shed enclosure as of the date of this report. DuPont extended the PHA 

recommendation for the shed enclosure until November 2010; however, the work was not completed and 

was extended again until the end of 2011. 

4.5.3 2006 Phosgene Committee Audit

In 2006, the Phosgene Guardian Committee audited against the DuPont Phosgene Highly Toxic Materials

(HTM) Manual, which included a review of the phosgene cylinder storage shed, the SLM production area, 

and other areas of the Belle plant. Three audit team members from other DuPont sites visited the Belle 

facility to conduct field walkthroughs and hold discussions with process unit personnel. The audit team 

divided the findings and recommendations from the audit into two categories: policies and observations. 

The policies were related to the requirements of the HTM manual and the observations were suggestions 

or preferred, but not mandatory, practices.

The team found no regulatory compliance deficiencies in the audit, but did issue five policy 

recommendations and eight observations. The policy recommendations applied to equipment downstream 

of the phosgene cylinder feed system, including a recommendation to add inspection plans for corrosion 

detection of the Teflon-lined reactor piping. The team found, and noted as an observation, that the hoses 

used on the phosgene feed system were not one of the three types recommended for phosgene service by 

the DuPont P3H Standard, but did not require the Belle facility to use the appropriate hoses. 

The team also observed that liquid phosgene lines in the shed had moderate external corrosion and that 

significant moisture in the shed should be addressed to eliminate future corrosion potential. Because these 

items were observations, the HTM manual did not require that DuPont develop an action plan to resolve 

000452
E.I. DuPont de Nemours & Co. Final Report September 2011

80

them. Consequently, the Belle plant continued to use a hose for phosgene service that the company 

standard did not recommend.

SLM unit equipment selection practices did not align with the requirements and recommendations in the 

phosgene HTM manual. The manual states, “Materials of construction must be selected properly to 

handle phosgene safely” but only recommends against the use of nonmetals for piping, valves, and 

process equipment containing phosgene. It further states, “Where small amounts of phosgene are present, 

stainless steel lined with Teflon is commonly used” without specifically quantifying an amount of 

phosgene where Teflon is acceptable. In the SLM phosgene transfer system, phosgene was continuously 

present in the PTFE-lined hoses while the connected cylinder was feeding the process.

The HTM manual’s design information section requires that special attention be given to the “prevention 

of over pressuring those lines and vessels where liquid phosgene can be trapped between two isolation 

valves.” In the course of switching between cylinders on the morning of the phosgene incident, SLM 

operators “blocked in” (i.e., closed the valve on each end of the hose), which trapped liquid phosgene 

between the partially filled riverside cylinder and the valve to the process. The liquid phosgene trapped in 

the hose underwent thermal expansion, rupturing the hose due to the overpressure of the line that was

facilitated by the weakened and corroded stainless steel overbraid. None of the SOPs for the SLM unit 

warned against blocking in liquid phosgene to prevent hose ruptures, making operators less aware of the 

thermal expansion hazards of phosgene.

4.6 Standards and Guidelines

4.6.1 DuPont Highly Toxic Materials Phosgene Manual

The DuPont HTM manual includes mandatory criteria for the storage, handling, maintenance, and

management of phosgene in quantities with the potential to cause offsite impact if released. The 86-page 

manual also includes non-mandatory practices for new and existing units or facilities handling phosgene, 

and company requirements and procedures related to first aid and medical treatment, MOC, design 

000453
E.I. DuPont de Nemours & Co. Final Report September 2011

81

information for new and existing phosgene equipment, and PSM principles. The Phosgene Guardian 

Committee reviews and revises the manual and the committee chairperson and SHE leader authorize the 

revisions. The Responsible Care Core Team reviews and approves all changes to mandatory requirements

before issuing the revised manual. The Plant or Unit Manager must authorize any deviation from the

manual requirements before using an alternative practice. The HTM Committee conducts a safety analysis 

to ensure that the alternate practice is acceptable before implementation.

4.6.2 American Chemistry Council (ACC) Phosgene Safe Practice Guidelines

Manufacturers and users of phosgene formed the Phosgene Panel in 1972 to share information about 

practices to safely produce, handle, and use phosgene throughout industry. The Phosgene Panel is part of 

the Chemical Products and Technology Division of the ACC, an industry trade association for chemical 

companies; its Chemical Products and Technology Division supports companies through continuous 

evaluation and communication improvements related to the safe use of hazardous chemicals. Engineers, 

health and safety experts, and occupational health physicians from member companies participate on the 

panel,

50

The ACC Phosgene Panel compiles information from member companies into the Phosgene Safe Practice 

Guidelines Manual to provide general information to those that manufacture or handle phosgene. The 

manual contains nine sections of phosgene safety information such as phosgene properties, design 

which meets twice a year to share information and experiences related to handling phosgene. The 

panel sponsors engineering studies and research to prevent phosgene-related incidents and has prepared

manuals for phosgene safe practices and medical treatment information as a resource for ACC member 

companies.

 

50 In 2010, all U.S. phosgene manufacturers participated in the panel: BASF Corp.; Bayer Corp.; Chemtura; Dow 

Chemical; DuPont; Huntsman; SABIC Innovative Plastics; and VanDeMark Chemicals, Inc.

000454
E.I. DuPont de Nemours & Co. Final Report September 2011

82

information for phosgene process facilities, transportation, emergency planning, first aid and medical 

treatment, and training.

Phosgene panel members draft summaries of industry practices that they submit for review and approval 

by all members of the ACC Phosgene Panel prior to inclusion in the manual. The panel periodically 

updates the manual and adds new and relevant practices identified by industry. The ACC does not intend 

for the manual to be a training tool or be adopted as procedure; it is to be referenced for general 

information regarding safe practices for phosgene storage and use.

The “Design of Facilities” section of the manual has several subsections pertaining to construction 

materials and layout of phosgene process equipment and facilities. This section includes leak prevention 

information such as equipment inspections, monitoring, and alarms, and describes the use of engineering 

controls and multiple layers of protection or barriers between phosgene exposure hazards and personnel.

This section includes precautions with regards to piping and valves in phosgene service. The manual 

states that users should pay particular attention to

• protecting piping from over-pressurization due to liquid phosgene trapped between closed valves; 

• protecting dry51

• inspecting and testing where stainless steel materials are used to detect the presence of stress 

corrosion cracking caused by exposure to chlorides. 

 phosgene systems from the intrusion of moisture, which can react with phosgene 

and cause severe corrosion and failure; and, 

The section also states that the use of metallic and non-metallic hoses for permanent or temporary piping 

systems may increase the opportunity for phosgene leakage and advises users to give due consideration to 

 

51 Phosgene in the absence of water or moisture, sometimes referred to as “anhydrous.”

000455
E.I. DuPont de Nemours & Co. Final Report September 2011

83

the design, fabrication, and testing of all components. The manual also notes the potential permeability 

issue with PTFE liners, stating that these liners are typically used for phosgene service in well-ventilated 

areas; however, it does not specifically describe acceptable methods of ventilation.

4.6.3 National Fire Protection Association (NFPA)

NFPA 55: Compressed Gases and Cryogenic Fluids Code provides fundamental safeguards to users, 

producers, distributors, and others who handle compressed gas cylinders and includes general 

requirements for storage, occupancy, and emergency response and provisions for specific chemicals or 

hazard classes as defined by the NFPA. The current version of the CGA P-1 Standard references NFPA 

55 in the “Ventilation, Storage, and Site Criteria” section for toxic and corrosive gases.

DuPont Belle’s programs and practices related to the storage and handling of phosgene cylinders does not 

align with the provisions set forth in NFPA 55. NFPA 55 defines phosgene as a highly toxic gas because 

it contains a lethal concentration (LC50) equal to or less than 200 ppm in air when administered via 

inhalation for 1 hour.52

Figure 12

The LC50 for phosgene is 5 ppm for 1 hour of exposure (CGA P-20, 1995). NFPA 

55 includes guidelines for controls in buildings that store compressed gas cylinders, and classifies the 

phosgene shed structure as an indoor storage area because the walls comprise more than 25 percent of the 

shed perimeter ( ). Indoor storage for highly toxic gases must include a gas cabinet, exhausted 

enclosure, or a gas room, according to NFPA 55. Exhausted enclosures, gas cabinets, or gas rooms fully 

enclose cylinders and associated process equipment and are equipped with ventilation systems to capture 

and treat hazardous vapors. The phosgene shed at Belle, though considered indoor storage by NFPA, does 

not contain a ventilation system; instead, DuPont relies on natural ventilation from the outside to decrease 

concentrations of phosgene, which allows phosgene vapors to travel downwind, potentially exposing 

 

52 LC50 is the lethal concentration for 50 percent of the exposed population. 

000456
E.I. DuPont de Nemours & Co. Final Report September 2011

84

other employees working outside. Without exhausted enclosures, no barriers were present to prevent 

phosgene from exposing operators or traveling offsite. 

The standard also includes guidance for alarms to warn personnel of potential releases from compressed 

gas cylinders and associated equipment. The SLM unit at the Belle plant had alarms for phosgene releases 

that were activated manually by the control board operator upon notification from outside personnel or if 

a phosgene analyzer activated an alarm at the control board. NFPA 55 guidance states that manual 

emergency alarms should be provided in the buildings that enclose cylinders and, when activated, sound 

local alarms to alert occupants in the surrounding area. The phosgene shed at Belle contains no alarms 

that can be activated locally. Operators suspecting a release are expected to communicate verbally with 

the control operator who then sounds an alarm. In the absence of automatic alarm notifications, personnel 

in the surrounding area risk exposure, as was the case on the day of the incident.

For gas detection systems, the NFPA states that alarms should activate a local alarm that is both audible 

and visual. In the phosgene shed, the SLM building area, and on the Belle Plant fence line, the gas 

detection systems activate alarms only in the SLM control room if concentrations exceed the alarm set 

points. The gas detectors do not locally sound or visually indicate the detection of a hazardous 

concentration to alert surrounding personnel.

4.6.4 Compressed Gas Association (CGA) Standards for the Safe Handling of 

Cylinders

The industry association CGA represents manufacturers, distributors, suppliers, and transporters of gases 

and cryogenic liquids. It develops and promotes standards and practices for the industrial and medical gas 

industry, with input from over 125 member companies. Standards include technical specifications, health 

and safety practices, and training and educational materials.

The VanDeMark phosgene bulletin references the current CGA Standard, Safe Handling of Compressed 

Gases in Containers (P-1), for the training and proper handling of phosgene cylinders. The 2008 P-1 

Standard includes safe practices related to the transportation, identification, and storage of compressed 

000457
E.I. DuPont de Nemours & Co. Final Report September 2011

85

gases and specific safe handling and storage rules for chemicals defined by hazard classes. Each 

chemical has an assigned hazard class based on its physical properties: flammable, asphyxiant, oxidizer, 

toxic, corrosive, or extreme cold. The CGA lists phosgene as a primary toxic and secondary corrosive. 

The toxic and corrosive gas section includes requirements for cylinder storage and ventilation, emergency 

response, and training. OSHA adopted the 1965 version of the CGA P-1 Standard under the requirements 

of the Compressed Gas Standard (29 CFR 1910.101). Under the OSHA Standard, the in-plant handling 

and storage of compressed gas cylinders will be in accordance with CGA P-1 (1965).

The current version of the CGA P-1 Standard includes a specific reference to Chapter 7 of NFPA 55 for 

the storage and handling of compressed gas cylinders with flammables, but contains only basic 

requirements for the storage and handling of corrosives and toxics. In CGA P-1 Section 6.2.6 of 

Flammable Gases, the standard includes NFPA 55 requirements such as separation distances, flammable 

storage quantities, and fire barriers. However for toxics, the P-1 Standard states, “Storage of corrosive 

and toxic gases shall be in accordance with local and/or provincial/territorial building and fire prevention 

codes.” The standard also states that toxics “shall be filled and used only in adequately ventilated areas or 

preferably outdoors or in exhausted enclosures,” but does not contain any specific provisions to achieve 

adequately ventilated areas such as the requirements set forth in NFPA Section 7.9.

4.6.5 CGA Standards for PTFE-lined Hoses

On January 29, 2010, CGA published the fourth edition of Standard E-9, Standard for Flexible, PTFElined Pigtails53

 

53 “Pigtails” are hoses or flexible tubing used to transfer material from a compressed gas cylinder.

for Compressed Gas Service. Section 1 of E-9 states that the standard applies to hoses 

with a diameter of 0.25 inches or smaller and with a maximum allowable working pressure (MAWP) of at 

least 3,000 psi, such as those used at DuPont. Section 2 of E-9 states, “PTFE-lined pigtails are not 

suitable for use with... poisonous, toxic, or pyrophoric gases because permeation of gas through the 

000458
E.I. DuPont de Nemours & Co. Final Report September 2011

86

PTFE wall creates a potential hazard.” Since phosgene is toxic, this standard rules out using PTFE-lined 

hoses for phosgene. 

Additionally, Section 5 of Standard E-9 defines how to label hoses: rather than allow tags with adhesive 

or heat-shrink wrap, as was the case with the DuPont hoses, it states, “The markings shall be made on the 

end fitting, collar, separate band, or other permanent location.” The hose supplier’s practice of affixing 

adhesive tape on the hose itself did not align with the requirements in CGA E-9 and enhanced the 

corrosion of the metal braid on the PTFE-lined hoses at Belle. 

The CGA 2008 P-1 Standard does not specifically reference prior revisions of the E-9 standard. Section 

5.9 of P-1 includes general requirements for container connections and states that “[p]iping, regulators, 

and other apparatus should be kept air tight to prevent leakage...” The P-1 Standard does not address 

materials of construction or permeability for cylinder discharge hoses in its general or safe handling 

requirements by corrosive and toxic hazard class.

4.7 Key Findings

1. An out-of-service phosgene transfer hose failed, exposing a worker to a lethal dose of 

phosgene. 

2. DuPont did not follow its own standards for the change-out of phosgene transfer hoses.

3. DuPont engineers voiced concern regarding the materials of construction for phosgene hoses

that were not addressed. 

4. Liquid phosgene was not evacuated from the riverside hose, as the SOPs indicate, between 

transfers to the process from the 1-ton cylinders. 

5. A similar hose failure almost occurred a few hours before the exposure of the worker; 

however, this near-miss did not prompt an investigation when operators observed the near 

failure of the hose on the morning of the fatal release. 

000459
E.I. DuPont de Nemours & Co. Final Report September 2011

87

6. The SAP maintenance program was altered so that a work order to change-out the phosgene 

transfer hoses was no longer generated automatically (Appendix C). 

7. One worker was confirmed to have been exposed to phosgene after the initial exposure while 

a second is thought to have been possibly exposed. 

8. Emergency responders did not receive timely and detailed information on how to adequately 

prepare to respond to the incident.

9. No audible or visual phosgene alarm indication in or around the phosgene shed. 

10. The 2009 PHA did not address thermal expansion and corrosion potential for phosgene 

transfer hoses. 

11. Operators were unaware of the hazards of liquid phosgene thermal expansion (training and 

procedures). 

12. No plant-wide notification occurred in response to the exposure. 

4.8 Root Causes

1. DuPont relied on a maintenance software program to initiate the automatic change-out of 

phosgene hoses at the prescribed interval. 

2. DuPont did not provide a back-up method to ensure timely change-out of the hoses.

3. A maintenance software program change was not documented or reviewed in accordance 

with the MOC process. 

4. No person with process knowledge was in place and assigned to convey timely and useful 

information to Metro 9-1-1. This responsibility was consigned to the gate guard. 

000460
E.I. DuPont de Nemours & Co. Final Report September 2011

88

5. The Belle Plant did not use the construction materials recommended by a corporate expert, 

the P3H standard, CGA, or the HTM manual for phosgene hoses, even though the 2006 

second-party HTM audit recorded it as an observation. 

5.0 Three Incidents in 33 Hours 

Because two incidents occurred in a relatively short period, on Saturday, January 23, 2010, after the 

oleum release had been secured, the Plant Manager convened a meeting of supervisors and roughly 10 

managers and supervisors assigned to the Belle Plant Crisis Committee to discuss and initiate a safety 

pause, the intent of which was to evaluate what the managers had seen and “take appropriate steps to 

ensure safe operation.” Approximately 10 managers are part of the Crisis Committee and, after a 

debriefing, other supervisors and managers were advised that a safety pause would be conducted. Where 

possible, processes would be shut down to allow the discussion, and in those plants that could not be shut 

down, employees were expected to participate as best they could.

The Plant Manager assigned the Area Manager for the SLM and F3455 units (who was part of the Belle 

Plant Crisis Committee) to contact supervisors and managers and ask that they come to the plant to 

participate in planning a plant-wide safety pause. These calls went out at about 11:00 a.m., and 

supervisors and managers started arriving at the plant at about noon. At about 2:00 p.m., shortly after the 

planning for the safety pause began, the group heard a radio call advising the plant of a medical 

emergency. In response to the Plant Manager’s inquiry, it was learned a worker had been exposed to 

phosgene in the SLM unit, making it the third incident in about 33 hours at the facility. 

In a striking similarity of events and activities, after two release incidents at the Honeywell Baton Rouge 

facility in July 2003, upper management ordered the entire plant to shut down and review all facility 

000461
E.I. DuPont de Nemours & Co. Final Report September 2011

89

operations prior to re-start. During this safety stand-down, a third incident occurred where an employee 

was exposed to hydrofluoric acid during cleanup of an area in the plant.54

The objective of both shutdowns was to get the attention of the workforce, acknowledge that the 

occurrence of incidents was unacceptable, and recommit to the two companies’ core values of adhering to 

health and safety guidance. One common element was that both companies initiated safety stand-down 

activities after the string of incidents started in their respective plants. Another common theme was the

precursor or near-miss events preceding actual incidents. Despite these efforts to address the cause of the 

string of incidents at the Belle plant, a fatal incident occurred. At the Belle plant, although investigations 

were conducted, near-miss investigations were not immediately responded to on weekends, including the 

near catastrophic failure of a separate phosgene transfer hose only hours earlier. Management at all levels 

is responsible for fostering an atmosphere of trust and openness and for encouraging the reporting of nearmisses and incidents, as failure to do so could result in non-reporting of near-miss events (CCPS, 1992). 

Despite these efforts to address the cause of the string of incidents at the Belle plants, a fatal incident 

occurred. 

As part of another investigation of the BP Texas City incident in 2005,55 the CSB examined corporate 

oversight of safety management systems and corporate safety culture. As a result of an urgent 

recommendation from that same investigation, The Report of the BP U.S. Refineries Independent Safety 

Review Panel, The examination of corporate oversight of safety management systems and corporate 

safety culture has been conducted as part of another CSB investigation of the BP Texas City incident in 

200556

 

54 CSB-2003-13-I-LA (Honeywell).

, and a blue ribbon panel of experts chaired by former Secretary of State James A. Baker was 

55 CSB 2005-04-I-TX, 2007.

56 CSB 2005-04-I-TX, 2007

000462
E.I. DuPont de Nemours & Co. Final Report September 2011

90

convened. as the result of an urgent recommendation from that same investigation, The Report of the BP 

U.S. Refineries Independent Safety Review Panel. While not indicating that the work/safety culture was 

irretrievably broken at the Belle facility—and perhaps within the DuPont Corp.—the events before and 

after the string of incidents in late January 2010 suggest that the safety culture has “shifted”; is not 

operating as it has historically; and could benefit from an extensive examination of all facets of the safety 

culture, both within the facility and throughout the corporation. 

5.0.1 Additional DuPont Incidents

About 8 months after the series of incidents at the Belle plant triggered this investigation, another 

significant release occurred. At about 4:00 p.m. on September 21, 2010, DuPont Belle plant personnel 

discovered a methanol leak in a heat exchanger in the methylamines production unit while conducting 

regular sampling of the plant's water effluent stream. More than 160,000 pounds of methanol were 

estimated to have been released into the Kanawha River over a 24-hour period. This incident occurred 

when pressure on the process side of a heat exchanger was increased to a pressure greater than the steam 

condensate side of the process. After troubleshooting, operators suspected a leak on the process side of 

the heat exchanger and increased steam pressure until samples of the effluent stream confirmed that the

leak had stopped. No employee or community injuries were recorded as a result of this release.

Almost 3 months after the methanol release, on December 3, 2010, at about 2:23 a.m., a fume alert was 

sounded in the amines unit at the DuPont Belle, WV, facility announcing a release of monomethylamine 

(MMA). The release occurred while two operators—one senior operator with 34 years of experience at 

DuPont and a junior operator with a little over a year—were sampling MMA from a rail car. One 

operator received first- and second-degree chemical burns to his face, while the other inhaled some of the 

escaping MMA and received first-degree chemical burns to his face. Both were transported to Charleston 

Area Medical Center for 24-hour treatment and observation and released the following day. 

000463
E.I. DuPont de Nemours & Co. Final Report September 2011

91

The CSB investigators returned to the Belle facility to assess the MMA release incident. In examining the 

equipment, one area of concern was the design of the valves used to isolate the sampling apparatus. As 

configured during the sampling operation, only a single block valve isolated the process from the sample 

container. This contrasts with industry standards, which suggest the use of double block valves and bleed 

vents to assure that the sample piping is clear of hazardous material prior to disconnecting. About 10 

pounds of MMA are estimated to have been released during this incident; no employee or community 

injuries were recorded as a result of this release.

At DuPont’s Yerkes facility in Tonawanda, NY, the CSB assessed a hot work incident that killed a welder 

and injured his supervisor on November 9, 2010. This incident was under investigation as this report 

went to publication, but preliminary assessments indicate that pre-hot work inspections were less than 

adequate, including a failure to check the atmosphere in a tank that normally processes non-flammable 

material, but that had inter-connecting piping that could route flammable vinyl fluoride into the tank. The 

workers were assigned to repair the tank; however, prior to beginning work, there is no record of DuPont 

using a portable gas detector to ensure that the tank being worked on was free of flammable material. 

5.1 Management Systems

5.1.1 Knowledge Management

DuPont employees told the CSB investigators that many “very knowledgeable” Belle plant operations and 

maintenance workers had recently retired or are approaching retirement age. From 2005 to the end of 

2009, 82 Belle Plant employees retired and 14 resigned. The total number of employees at the Belle plant 

has dropped 13 percent (55 people) over the last 5 years. A loss of plant-specific knowledge, or 

“corporate memory fade,” has contributed several incidents in industry (CCPS, 1995), as new hires 

cannot replace years of experience; thus, companies must train and supervise new staff until they acquire 

job competencies to work safely. 

000464
E.I. DuPont de Nemours & Co. Final Report September 2011

92

Experienced maintenance mechanics and technicians have valuable hands-on experience and knowledge 

of equipment essential to the safe operation of plant processes. A worker in the Belle maintenance 

department told the CSB investigators that the maintenance staff reported to four different maintenance 

site leaders over the last 5 years prior to the January 2010 incidents. Other employees expressed concern 

that new hires spent too little time learning from veteran employees.

The CSB investigators reviewed and compiled workforce data from DuPont Belle organization 

announcements between January 2005 and June 2010, which listed all new hires, transfers, resignations, 

and retirements that affected the Belle workforce. Over the 4 years, there were 85 retirements totaling 

2,572 years of experience with an average 30 years of service per employee. Among the 85, 20 were from 

the maintenance department, contributing to a loss of 713 total years of knowledge and experience (Table 

6). 

DuPont Belle Workforce 2005 to 2009

Retirements Years Experience at Belle

Maintenance 20 713

Total 85 2,572

 

New hires Years Experience at Belle

Maintenance 10 0 

Total 101 0 

Table 6. Sum of Belle plant retirements and new hires from 2005 to 200957

In addition to the 85 retirements, there were 14 resignations and 14 transfers to other sites. The Belle plant 

hired 101 employees over the 4 years and 8 DuPont employees transferred to Belle from other sites. 

Though the overall proportion of new to departing employees has remained consistent, a significant 

 

57 This does not include interns, co-ops, special assignments, or leaves of absence. 

000465
E.I. DuPont de Nemours & Co. Final Report September 2011

93

reduction of employees with an average of 30 years of experience working on the Belle site contributes to 

a loss of institutional and plant-specific knowledge.

In the case of Belle, a significant population of employees is retiring, with a great deal of process 

knowledge that is lost if not properly maintained. This is an issue for industry in general as an entire 

generation of baby boomers approaches retirement. In January, 2011, DuPont announced plans to hire 

150 employees at Belle over the next few years to compensate for the number of retiring workers.

5.1.2 Hierarchy of Controls

The Hierarchy of Controls is a method generally recognized and used by health and safety professionals 

to control workplace hazards. The National Safety Council (NSC) developed the Hierarchy of Controls in 

the 1950s and Congress later adopted and enacted it into the Occupational Safety and Health Act of 1970. 

The Hierarchy of Controls (Figure 17) demands the use of higher-level engineering and administrative 

controls to eliminate hazards. When those operations are not feasible, a PPE program must be 

implemented.

Figure 17. Hierarchy of Controls 

000466
E.I. DuPont de Nemours & Co. Final Report September 2011

94

In the early 1900s, DuPont recognized that eliminating hazards is preferred beyond education and 

protection. However, SOPs for the SLM phosgene cylinder feed system relied primarily on work practices 

and PPE to protect operators from the exposure hazards. Other facilities within DuPont and in the 

chemical industry have engineering controls in place for similar phosgene cylinder operations.

5.1.2.1 Design and Engineering Controls for Phosgene Cylinders

In 1984, Ciba-Geigy Corp. employees published a technical paper about the safe handling of phosgene in 

chemical processing specific to the operation of 1-ton phosgene cylinders (Alspach et al., 1984). CibaGeigy, now part of BASF, had a facility in Toms River, NJ, where two 1-ton cylinders of phosgene fed a 

chemical process. Similar to DuPont, the cylinders connected to the process through PTFE-lined hoses 

with a stainless steel overbraid induced with nitrogen to drive liquid from the cylinders. At the CibaGeigy plant, a transparent isolation chamber enclosed the cylinder valve connections, and operators 

opened and closed valves while standing outside the enclosure, extending their arms though rubber arms 

and gloves that were part of enclosure. The enclosure continuously vented to a caustic scrubber and acted 

as a barrier between the operator and any potential phosgene vapors near the cylinders.

The phosgene area had phosgene analyzers to continuously monitor and alarm if concentrations exceeded 

a defined set point. At high concentrations, flashing lights and audible warnings automatically alerted the 

production building, plant guards, and adjacent roadways and buildings. At the Belle facility, phosgene 

readings on the analyzers activate alarms in the control room, but DuPont relies on the board operator to 

notify personnel in the unit and the rest of the plant. By automating the phosgene analyzer alarm system 

to activate notifications plant-wide, Ciba-Geigy eliminated reliance on administrative controls to notify 

and protect personnel.

5.1.2.2 Phosgene Handling at the DuPont Mobile, AL Plant

The DuPont Mobile plant in Mobile, AL, uses the same 1-ton phosgene cylinders as Belle for its 

agricultural chemicals’ process. The Mobile process has three cylinders on weigh scales, transferred to the 

000467
E.I. DuPont de Nemours & Co. Final Report September 2011

95

process through similar PTFE-lined flexible hoses with a stainless steel overbraid made by a different 

manufacturer. The Mobile hoses are 18 inches shorter and have a greater maximum operating temperature

and pressure than those used at Belle. A hose distributor supplies both hoses from the manufacturer to 

each site.

The phosgene cylinders and weigh scales at the Mobile plant are housed in the cylinder room, an enclosed 

room that vents to an emergency scrubber that pulls a slight negative pressure on the room and scrubs air 

before venting to the atmosphere. The scrubber is designed to capture vapors from a release of an entire 

cylinder. Operators at the Mobile plant enter the phosgene cylinder area under the same PPE requirements 

as Belle for isolating and changing cylinders (hard hat, steel-toed shoes, safety glasses, and phosgene 

dosimeter). However, at Mobile, to capture and scrub phosgene vapors in the event of a release, the 

operator turns on the emergency scrubber and pump before entering the enclosure.

Like Belle, Mobile has phosgene analyzers located in and around the unit to continuously monitor 

concentrations. At Mobile, alarms in the cylinder enclosure activate local audible alarms inside the 

enclosure and a flashing light outside to alert employees. If no operators are present in the enclosure when

the alarm activates, the emergency vent scrubber automatically starts. The Belle plant analyzer in the 

phosgene shed has no audible alarm to alert personnel in the area; instead, Belle plant procedures require 

the board operator to notify personnel of the release and only operators at the phosgene shed can activate 

the switch for the warning light.

The emergency scrub system and automated alarms at Mobile are examples of higher-level controls that

protect workers. Mobile has automated alarms where Belle relies on operator action to initiate alarms to 

warn personnel of a suspected or actual release. Mobile implemented the scrubber system, an example of 

an engineering control, to manage the concentrations of phosgene in the cylinder enclosure in the event of 

a release. The Belle plant phosgene shed design allows only for natural ventilation to carry unwashed 

000468
E.I. DuPont de Nemours & Co. Final Report September 2011

96

phosgene gases that can potentially harm personnel in or around the shed and possibly enter the 

community.

5.1.2.3 Safety in Design Issues

Safety considerations in the equipment design stage eliminate the need for companies to retrofit existing 

process equipment or implement administrative or PPE programs to protect workers and the environment. 

In addition to the SLM unit, the CSB also identified a lack of safety and health considerations during the 

design and construction phases of the F3455 and SAR units. In the F3455 unit, engineers did not design 

the control system alarms so that operators could distinguish between a failed battery and activation of a 

rupture disc burst sensor, which resulted in nuisance alarms for the rupture disc on the methyl chloride

vent line. Instead of addressing the reliability issues associated with the frequently failing sensor, 

management wired the burst sensor to electric power so that low batteries were no longer causing frequent 

and false alarms. However, since operators were not retrained to respond to the alarm, they ignored the 

alarm during the F3455 unit maintenance activity; consequently, the unit restarted with a failed rupture 

disc.

The CSB investigators also noted safety in design issues with the presence of the weep hole on the methyl 

chloride vent line upstream of the rupture disc assembly. DuPont engineering standards require that 

drainage holes be placed downstream of the relief devices on vent lines to allow for drainage and prevent 

liquid from lodging in the discharge side of the rupture disc. However, the location of the weep hole 

allowed toxic vapors from the methyl chloride vent line to enter the F3455 building where concentrations 

could accumulate to dangerous levels. DuPont could have designed the vent line so that the weep hole 

would drain to the exterior of the facility where vapors would dissipate into the atmosphere if a rupture 

disc burst. 

In the SAR unit, DuPont chose copper steam tracing to prevent the oleum sample line and other process 

lines from freezing, even though steam tracing is not the preferred method for oleum service (Dillon, 

000469
E.I. DuPont de Nemours & Co. Final Report September 2011

97

1997). Steam tracing can create hot spots that result in an uneven heat distribution in the oleum sample 

line, which can accelerate corrosion. Steam tracing in the SAR unit exacerbated the corrosion incident in 

the oleum sample line, resulting in a significant release of oleum. Had the SAR unit design engineers 

called for electric tracing or replaced the steam tracing, the larger hole in the sample line might not have 

formed. 

6.0 Regulatory Analysis

6.1 Occupational Safety and Health Administration (OSHA)

6.1.1 Process Safety Management Program

The OSHA PSM Standard (29 CFR 1910.119) requires employers to minimize or prevent the 

consequence of catastrophic incidents involving highly hazardous chemicals by applying elements of the 

PSM regulation to covered processes. PSM applies to processes using or producing any of the 137 listed 

toxic chemicals at or above threshold quantities and processes with flammable liquids or gases onsite in 

quantities of 10,000 pounds or more in one location. The PSM Standard applies to the SLM and F3455

units because they contain listed toxic chemicals in excess of the threshold quantities (TQ) specified in 

the regulation. 

A PHA is one of the 14 elements in the PSM Standard requiring the employer to assess all PSM-covered 

processes to identify, evaluate, and control hazards by using one or a combination of several 

methodologies listed in the regulation. Furthermore, the standard requires the PHA to address58

• the hazards of the process

 

58 29 CFR 1910.119(e)(3).

000470
E.I. DuPont de Nemours & Co. Final Report September 2011

98

• engineering and administrative controls applicable to the hazards and their interrelationships such 

as appropriate application of detection methodologies to provide early warning of releases

• consequences of failure of engineering and administrative controls

In the 2009 PHA for the SLM unit, the team did not assess the potential for a phosgene release from a 

failed transfer hose due to corrosion or thermal expansion but did consider these issues in process 

equipment downstream of the hoses. The team identified that engineering and administrative controls, 

such as the PM system and adherence to SOPs, would reduce the likelihood of a phosgene release from 

this equipment. However, the team did not assess the consequences caused by the PM system failing to 

initiate hose replacements at the proper frequency. In its 2009 PHA for the SLM unit, an audit team did 

not address phosgene thermal expansion in the liquid transfer hose; subsequently, in July 2010, OSHA 

issued a serious violation to DuPont.

The PSM Standard also requires employers to conduct an MOC for all modifications to process 

chemicals, technology, equipment, and procedures; and changes to facilities that affect a PSM-covered 

process. The procedures are meant to address the following prior to the change59

• The technical basis for the proposed change

: 

• Impact of change on safety and health

• Modifications to operating procedures

• Necessary time for the change

• Authorization requirements for the proposed change

The MOC also requires that the employees in operations and maintenance affected by the change be 

informed of the change and trained prior to the start-up of that process.

 

59 29 CFR 1910.119(l).

000471
E.I. DuPont de Nemours & Co. Final Report September 2011

99

Investigators found MOC program deficiencies for modifications made to critical equipment on both the 

F3455 and SLM units. On the F3455 unit, DuPont’s MOC process approved a design for the rupture disc 

alarm system that lacked sufficient reliability to minimize the release of flammable methyl chloride. The 

unit changed the rupture disc burst sensor on the methyl chloride vent line from battery power to electric 

to eliminate battery failure, but failed to assess the reliability of the burst sensors individually. The MOC 

process did not evaluate the basis of the modification to verify that it met the intended purpose of 

eliminating nuisance alarms caused by battery failure.

DuPont did not perform an MOC review for the changes to the maintenance system that handled the 

phosgene hose replacements on the SLM unit. The modification made to the phosgene hose replacement 

work orders kept the system from generating a new work order, thus extending phosgene hose use beyond 

its planned service life. DuPont stated that knowledge of the change was limited to only a few key SAP 

users, but these users lacked training necessary to recognize its impact on hose replacement frequency.

6.1.2 Compressed Gases

The OSHA Standard for Compressed Gases (29 CFR 1910.101) applies to employers that handle, store, 

and use compressed gases in cylinders, portable tanks, or tank cars. The standard includes requirements 

for cylinder inspections, safety relief devices, and storage and handling of compressed gas cylinders, and 

requires employers to handle and store cylinders in accordance with CGA pamphlet P-1 1965, “Safe 

Handling of Compressed Gases in Containers.” 

In the 41 years since OSHA adopted the reference standard as part of the Compressed Gas Regulation, 

CGA P-1 has been revised 10 times. The current 2008 version is more comprehensive than the OSHAadopted 1965 version, which does not list chemicals by hazard class and contains specific safety 

information only for flammable and poisonous gases. The current version lists 82 chemicals that fall into 

000472
E.I. DuPont de Nemours & Co. Final Report September 2011

100

the primary toxics category, while the 1965 version lists only 13 poisonous gases as defined by the 

Interstate Commerce Commission (ICC).60

6.1.3 Inspection History

The 1965 standard contains the same general information as 

the current version, but lacks detailed guidance for facility siting, emergency response, and safety 

information specific to various types of chemicals stored in compressed gas cylinders. The 1965 version 

includes obsolete and outdated references and lacks references to applicable OSHA regulations, as it was 

published prior to the establishment of OSHA. With respect to the issues identified in the phosgene 

release investigation, had OSHA adopted the 2008 version of the CGA P-1 Standard, DuPont would have 

been accountable for more phosgene storage engineering controls via the incorporation of NFPA 55 and 

other consensus standards referenced in the standard.

OSHA is authorized under the Occupational Safety and Health Act of 1970 to inspect workplaces to 

ensure that employers are providing a safe and healthy work environment by complying with OSHA 

standards. A range of inspection categories establish a system of priorities: 

• Imminent danger

• Catastrophes and fatal accidents

• Complaints and referrals

• Programmed inspections

• Follow-up inspections

 

60 A regulatory body abolished in 1995, some of whose responsibilities were transferred to the Surface 

Transportation Board, an agency within the U.S. Department of Transportation.

000473
E.I. DuPont de Nemours & Co. Final Report September 2011

101

A review of OSHA’s inspection history reveals that three planned inspections were conducted at the Belle 

facility in 1982, 1984, and 1993, in addition to one unprogrammed-related61

In a series of post-incident inspections, OSHA cited DuPont for a serious violation of Section 5(a)(1) of 

the Occupational Safety and Health Act, alleging that inspections were not conducted for all sections of 

oleum piping based on prior leak incidents at the SAR unit. Citations for numerous violations of the 

PSM

inspection in 1981. Although

no planned inspections occurred from 1993 through 2010, two inspections, one in 1995 and one in 2004, 

were the result of complaints; both were closed.

62

6.2 Environmental Protection Agency

Standard were also issued. OSHA cited DuPont for serious violations, including the company's 

failure to properly inspect piping used to transfer phosgene, perform a thorough PHA for its phosgene 

operation, and train workers on hazards associated with phosgene. Proposed penalties for all violations 

totaled $43,000.The OSHA PSM Standard (29 CFR 1910.119) requires employers to prevent or minimize 

the consequences of a catastrophic release of highly hazardous chemicals and of flammable liquids and 

gases. Phosgene and methyl chloride are listed chemicals, and the SLM and F3455 units processed more 

than the TQ, thus the PSM Standard applied. 

The EPA Risk Management Program (RMP) regulation (40 CFR 68), mandated by Section 112(r) of the 

Clean Air Act Amendments of 1990, regulates the use of highly hazardous chemicals at fixed facilities. 

Its purpose is to prevent accidental offsite releases of listed substances and ensure that a company and the 

 

61 An unprogrammed-related inspection can occur at a multi-employer worksite when an employer is being 

inspected because of a complaint, accident, or referral. Any other employer with staff on the worksite is subject to 

inspection.

62 PSM is a regulation promulgated by OSHA. A process is any activity or combination of activities including any 

use, storage, manufacturing, handling, or the onsite movement of HHCs as defined by OSHA and the EPA.

000474
E.I. DuPont de Nemours & Co. Final Report September 2011

102

community are able to respond effectively in the event of a release. The regulation applies to facilities 

using or storing regulated substances exceeding the TQ specified in the EPA regulations.

Each covered process is required to be designated as one of three “prevention program” levels based on 

offsite consequence analyses, incident history, and PSM program applicability. Program 1 is the lowest, 

simplest management program; Program 2 is an intermediate management-level program with added 

program elements and basic documentation requirements (PSM-covered processes cannot be designated 

Program 2); Program 3 is the highest-level management program. Most PSM-covered processes are

Program 3, which requires a rigorous management program with detailed record retention criteria and all 

PSM program elements. All PSM program activities and records are directly applicable to Program 3 

regulatory activities, and all RMP covered chemicals at the DuPont Belle plant fall into Program 3 

requirements (Table 7).

Toxics RMP TQ (lbs)

Anhydrous Ammonia 10,000

Phosgene 500

Sulfur Trioxide 10,000

Formaldehyde 15,000

Oleum 10,000

Methyl Chloroformate 5,000

Flammables

Dimethylamine 10,000

Methylamine 10,000

Methyl Ether 10,000

Ethylamine (70% aqueous) 10,000

Each covered process must undergo a hazard assessment (40 CFR 68, Subpart B) in which the owner is 

required to prepare a “worst case release scenario” and an “alternative release scenario” for each covered 

process. Different analysis criteria apply based on whether the covered chemical is toxic or flammable. 

The hazard assessment also requires inclusion of the “five year accident history.” The results of the 

hazard assessment, along with other pertinent information for each covered process, must be submitted to 

Table 7. DuPont Belle RMP-covered chemicals and threshold quantities 

000475
E.I. DuPont de Nemours & Co. Final Report September 2011

103

the EPA. The RMP (40 CFR 68, Subpart G) is submitted electronically and must be periodically updated. 

The DuPont RMP submission for 2010 had no accident history to report.

In November 2003, the EPA Region III Chemical Accident Prevention Program audited the Belle facility 

to ensure compliance with the EPA RMP, and covered all RMP elements and emergency response and 

site security. The EPA audited the 2-million gallon ammonia storage tank against the RMP requirements 

for Program 3 management programs and the RMP documentation DuPont submitted. The EPA audit 

report submitted to DuPont in December 2003 contained no deficiencies or recommendations for 

improvement. The November 2003 RMP audit is the only one conducted at the Belle Plant prior to the 

January 2010 incidents.

6.3 State Hazardous Chemical Release Prevention Program 

On January 20, 2011, the CSB Bayer CropScience investigation resulted in a recommendation being 

issued to the Kanawha-Charleston Health Department to establish a Hazardous Chemical Release 

Prevention Program, whose objective is to enhance the prevention of accidental releases of highly 

hazardous chemicals and optimize responses if they occur. In light of its proximity in the Kanawha 

Valley, the series of incidents at the DuPont Belle, WV, facility support the plant’s inclusion in such a 

program. 

The implementation of the new program would incorporate several key guidelines applicable to chemical 

plants operating in the Kanawha County. The Belle facility is one of 13 in the county that report EPA 

RMP-covered chemicals assigned as Program level 3 that could fall under the auspices of the new 

program. The recommendation to the Kanawha-Charleston Health Department stated:

Specifically, the Bayer report recommends that the Director of the Kanawha-Charleston 

Health Department establish a Hazardous Chemical Release Prevention Program to 

enhance the prevention of accidental releases of highly hazardous chemicals, and 

optimize responses in the event of their occurrence. In establishing the program, study 

000476
E.I. DuPont de Nemours & Co. Final Report September 2011

104

and evaluate the possible applicability of the experience of similar programs in the 

country, such as those summarized in Section 5.3 of this report. At a minimum: 

a. Ensure that the new program: 

1. Implements an effective system of independent oversight and other services to 

enhance the prevention of accidental releases of highly hazardous chemicals 

2. Facilitates the collaboration of multiple stakeholders in achieving common goals 

of chemical safety; and, 

3. Increases the confidence of the community, the workforce, and the local 

authorities in the ability of the facility owners to prevent and respond to 

accidental releases of highly hazardous chemicals

b. Define the characteristics of chemical facilities that would be covered by the 

new Program, such as the hazards and potential risks of their chemicals and 

processes, their quantities, and similar relevant factors;

c. Ensure that covered facilities develop, implement, and submit for review and 

approval: 

1. Applicable hazard and process information and evaluations.

2. Written safety plans with appropriate descriptions of hazard controls, safety 

culture and human factors programs with employee participation, and 

consideration of the adoption of inherently safer systems to reduce risks

3. Emergency response plans; and,

4. Performance indicators addressing the prevention of chemical incidents.

d. Ensure that the program has the right to evaluate the documents submitted by 

the covered facilities, and to require modifications, as necessary 

e. Ensure that the program has right-of-entry to covered facilities, and access to 

requisite information to conduct periodic audits of safety systems and 

investigations of chemical releases;

000477
E.I. DuPont de Nemours & Co. Final Report September 2011

105

f. Establish a system of fees assessed on covered facilities sufficient to cover the 

oversight and related services to be provided to the facilities including necessary 

technical and administrative personnel; and,

g. Consistent with applicable law, ensure that the program provides reasonable 

public participation with the program staff in review of facility programs and

access to:

1. The materials submitted by covered facilities (e.g., hazard evaluations, safety 

plans, emergency response plans);

2. The reviews conducted by program staff and the modifications triggered by 

those reviews;

3. Records of audits and incident investigations conducted by the program;

4. Performance indicator reports and data submitted by the facilities, and;

5. Other relevant information concerning the hazards and the control methods 

overseen by the program.

Ensure that the program will require a periodic review of the designated agency activities and 

issue a periodic public report of its activities and recommended action items.63

 

63 CSB-2008-I-WV (Bayer CropScience).

000478
E.I. DuPont de Nemours & Co. Final Report September 2011

106

7.0 Recommendations 

The CSB makes recommendations based on the findings and conclusions of its investigations. 

Recommendations are made to parties that can effect change to prevent future incidents, which may 

include the companies involved; industry organizations responsible for developing good practice 

guidelines; regulatory bodies; and/or organizations that have the ability to broadly communicate lessons 

learned from the incident, such as trade associations and labor unions. 

Phosgene Exposure

The Occupational Safety and Health Administration (OSHA)

2010-06-I-WV-R1

Revise OSHA 29 CFR 1910.101, General Industry Standard for Compressed Gases, to require 

facilities that handle toxic and highly toxic materials in compressed gas cylinders to incorporate 

provisions that are at least as effective as the 2010 edition of Section 7.9, Toxic and Highly Toxic 

Gases, in National Fire Protection Association (NFPA) 55, Compressed Gases and Cryogenic 

Fluids Code, including enclosures, ventilation and treatment systems, interlocked fail-safe 

shutdown valves, gas detection and alarm systems, piping system components, and similarly 

relevant layers of protection.

2010-06-I-WV-R2

Take sustained measures to minimize the exposure of hazards to workers handling highly toxic 

gases from cylinders and associated regulators, gages, hoses, and appliances. Ensure that OSHA 

managers, compliance officers, equivalent state OSHA plan personnel, and regulated parties 

conform, under the Process Safety Management Standard (29 CFR 1910.119) Recognized and 

Generally Accepted Good Engineering Practices (RAGAGEP) provisions, to industry practices at 

least as effective as the following:

000479
E.I. DuPont de Nemours & Co. Final Report September 2011

107

1. NFPA 55 - Compressed Gases and Cryogenic Fluids Code (2010)

2. CGA P-1 Safe Handling of Compressed Gases in Containers (2008)

3. CGA E-9 Standard for Flexible, PTFE-lined Pigtails for Compressed Gas Service (2010)

4. ASME B31.3 Process Piping (2008) 

DuPont Belle Plant

2010-06-I-WV-R3

Improve the existing maintenance management by

• Supplementing the computerized system with sufficient redundancy to ensure tracking 

and timely scheduling of preventive maintenance for all PSM-critical equipment.

• Conducting Management-of-Change (MOC) reviews for all changes to preventive 

maintenance orders for all PSM-critical equipment in the computerized maintenance 

management system.

2010-06-I-WV-R4

Revise the facility emergency response protocol to require that a responsible and accountable 

DuPont employee always be available (all shifts, all days) to provide timely and accurate 

information to the Kanawha County Emergency Ambulance Authority (KCEAA) and Metro 9-1-

1 dispatchers. 

2010-06-I-WV-R5

Revise the near-miss reporting and investigation policy and implement a program that includes 

the following at a minimum:

• Ensures employee participation in reporting, investigating, analyzing, and recommending 

corrective actions as appropriate for all near-misses and disruptions of normal 

operations. 

000480
E.I. DuPont de Nemours & Co. Final Report September 2011

 108

• Develops and encourages use of an anonymous electronic and/or hard copy near-miss 

reporting process for all DuPont Belle site employees.

• Establishes roles and responsibilities for ownership, management, execution, and 

resolution of recommendations from incident or near-miss investigations at the DuPont 

Belle facility. 

• Ensures that the near-miss investigation program requires prompt investigations, as 

appropriate, and that results are promptly circulated to well-suited recipients throughout 

the DuPont Corp. 

• Ensures that this program is operational at all times (e.g. nights, weekends, and holiday 

shifts).

E.I. DuPont de Nemours and Co., Inc.

2010-06-I-WV-R6

Revise safeguards for phosgene handling at all DuPont facilities by

• Requiring that all indoor phosgene production and storage areas, as defined in NFPA 55, 

have secondary enclosures, mechanical ventilation systems, emergency phosgene scrubbers, 

and automated audible alarms, which are, at a minimum, consistent with the standards of 

NFPA 55 for highly toxic gases.

• Prohibiting the use of hoses with permeable cores and materials susceptible to chlorides 

corrosion for phosgene transfer. 

• Conducting annual phosgene hazard awareness training for all employees who handle 

phosgene, including the hazards associated with thermal expansion of entrapped liquid 

phosgene in piping and equipment. 

000481
E.I. DuPont de Nemours & Co. Final Report September 2011

109

2010-06-I-WV-R7

Review all DuPont units that produce and handle phosgene that, at a minimum, observe and 

document site-specific practices for engineering controls, construction materials, PPE, 

procedures, maintenance, emergency response, and release detection and alarms, and use

information from external sources to develop and implement consistent company-wide policies

for the safe production and handling of phosgene. 

2010-06-I-WV-R8

For each DuPont facility that uses, but does not manufacture, phosgene onsite

• Conduct a risk assessment of manufacturing phosgene onsite against the current 

configuration. 

• Communicate the findings of each assessment to compile recommendations applicable to 

all DuPont phosgene delivery systems. 

• Implement these recommendations. 

Compressed Gas Association, Inc.

2010-06-I-WV-R9

Revise CGA P-1, Safe Handling of Compressed Gases in Containers, to include specific 

requirements for storing and handling highly toxic compressed gas, including enclosure 

ventilation and alarm requirements at least as protective as Section 7.9, Toxic and Highly Toxic 

Gases and NFPA 55, Compressed Gases and Cryogenics Fluids Code. 

2010-06-I-WV-R10

Revise CGA P-1, Safe Handling of Compressed Gases in Containers, to incorporate by reference 

CGA E-9, Standard for Flexible, PTFE-lined Pigtails for Compressed Gas Service. 

000482
E.I. DuPont de Nemours & Co. Final Report September 2011

110

American Chemistry Council Phosgene Panel

2010-06-I-WV-R11

Revise the Phosgene Safe Practice Guidelines Manual to 

• Advise against the use of hoses for phosgene transfer that are constructed of 

permeable cores and materials subject to chlorides corrosion. 

• Include guidance for the immediate reporting and prompt investigation of all 

potential (near-miss) phosgene releases.

Methyl Chloride Release

E.I. DuPont de Nemours and Co., Inc.

2010-06-I-WV-R12

Commission an audit in consultation with operations personnel to establish and identify the 

conditions that cause nuisance alarms at all DuPont facilities. Establish and implement a 

corporate alarm management program as part of the DuPont PSM Program, including measures to 

prevent nuisance alarms and other malfunctions in those systems. Include initial and refresher 

training as an integral part of this effort. 

2010-06-I-WV-R13

Revise the DuPont PSM standard to require confirmation that all safety alarms/interlocks are in 

proper working order (e.g., not in an active alarm state) prior to the start-up of all Higher-Hazard 

Process facilities. 

2010-06-I-WV-R14

Reevaluate and clarify the DuPont corporate MOC policies to ensure that staff can properly 

identify and use the distinctions between subtle and full changes and train appropriate personnel 

how to properly apply the distinctions on any changes in the policy. 

000483
E.I. DuPont de Nemours & Co. Final Report September 2011

111

By the 

U.S. Chemical Safety and Hazard Investigation Board

Dr. Rafael Moure-Eraso

Chair 

John Bresland

Member

Mark Griffon

Member

William Wark

Member

William Wright

Member

Date of Board Approval

September 20, 2011

000484
E.I. DuPont de Nemours & Co. Final Report September 2011

112

References 

Alspach, J.; Bianchi, R.J. Safe Handling of Phosgene in Chemical Processing. Plant/Operations Progress 

Jan. 1984; Vol. 3, No. 1.

American Chemistry Council Phosgene Panel. Phosgene Safe Practice Guidelines Manual; American 

Chemistry Council: Washington, DC, 2006-2009. 

Center for Chemical Process Safety (CCPS). Guidelines for Hazard Evaluation Procedures; American 

Institute of Chemical Engineers Center for Chemical Process Safety: New York, NY, 1992.

CCPS. Guidelines for Safe Process Operations and Maintenance; American Institute of Chemical 

Engineers Center for Chemical Process Safety: New York, NY, 1995. 

CCPS. Investigating Chemical Process Incidents; American Institute of Chemical Engineers Center for 

Chemical Process Safety: New York, NY, 1992. 

Collins, J.J., et al. Results From the US Industry-Wide Phosgene Surveillance: The Diller Registry;

American College of Occupational and Environmental Medicine, Article: JOM201162, Jan. 2011. 

Compressed Gas Association, Inc. (CGA). Safe Handling of Compressed Gases in Containers; P-1 11th 

ed., Compressed Gas Association, Inc.: Chantilly, VA.

CGA. Standard for Flexible, PTFE-Lined Pigtails for Compressed Gas Service, E-9; 4th ed.; Compressed 

Gas Association, Inc.: Chantilly, VA.

Dillon, C.P. Materials Selector for Hazardous Chemicals. Concentrated Sulfuric Acid and Oleum; 

Materials Technology Institute of the Chemical Process Industries, Inc. (MTI): St. Louis, MO, 

1997; Vol. 1.

Klein, J.A. Two Centuries of Process Safety at DuPont. Process Safety Progress. American Institute of 

Chemical Engineers; Mar. 2009. pp 114-122.

000485
E.I. DuPont de Nemours & Co. Final Report September 2011

113

Lees, F.P. Loss Prevention in the Process Industries; 3rd ed., Elsevier Butterworth-Heinemann: 

Burlington, MA, 2005. 

Mottle, W.J.; Long J.F.; Morrison, D.E. Industrial Safety is Good Business; John Wiley and Sons: New 

York, NY, 1995.

National Fire Protection Association. NFPA 55 – Compressed Gases and Cryogenic Fluids Code;

National Fire Protection Association: Quincy, MA, 2010.

PD-USGOV-EPA National Archives and Records Administration, Archival Research Catalog, ARC 

Identifier 5519.1 Series: DOCUMERICA: The Environmental Protection Agency's Program to 

Photographically Document Subjects of Environmental Concern, compiled 1972 - 1977. 

Sittig, M. Handbook of Toxic and Hazardous Chemicals and Carcinogens; 5th ed.; William Andrew 

Norwich: New York, NY, 2005.

U.S. Chemical Safety and Hazard Investigation Board (CSB). Investigation Report, Chlorine Release, 

July 20, 2003, Contaminated Antimony Pentachloride Exposure, July 29, 2003, Hydrogen 

Fluoride Release, August 13, 2003, Honeywell International, Inc., No. 2003-13-I-LA, 2005.

CSB. Investigation Report, Pesticide Chemical Runaway Reaction Pressure Vessel Explosion, Bayer 

CropScience, LP, August 28, 2008, No. 2008-08-I-WV, 2011. 

000486
E.I. DuPont de Nemours & Co. Final Report September 2011

114

Appendix A: Three Event Logic Tree

000487
E.I. DuPont de Nemours & Co. Final Report September 2011

115

000488
E.I. DuPont de Nemours & Co. Final Report September 2011

116

000489
E.I. DuPont de Nemours & Co. Final Report September 2011

117

000490
E.I. DuPont de Nemours & Co. Final Report September 2011

118

000491
E.I. DuPont de Nemours & Co. Final Report September 2011

119

Appendix B: Historical and Event Timeline

000492
E.I. DuPont de Nemours & Co. Final Report September 2011

120

Appendix C: SAP Program

The DuPont Belle plant uses the SAP R/3 Plant Maintenance module to schedule PM and repair work and 

track maintenance costs. Many companies use a Computerized Maintenance Management System 

(CMMS) such as SAP Plant Maintenance for this purpose. In particular, companies use the CMMS to 

schedule PM to ensure that PSM-critical equipment functions properly. This appendix gives additional 

detail on scheduling and completing PM jobs in SAP, and why SAP failed to issue work orders to change 

the hoses. 

PM keeps plant equipment functioning properly, and to minimize the likelihood of a phosgene hose 

corroding and rupturing, DuPont created a PM job in SAP to replace the hoses regularly. The SAP Plant 

Maintenance module automatically schedules the job at the frequency DuPont designates. 

In the SAP Plant Maintenance module, DuPont created a number for the physical equipment and an 

electronic document, or “maintenance plan,” to store all information about the job. The maintenance plan 

is a complex form with many fields. One field, “confirmation required,” can be clicked “on” or “off.” If 

this button is “off,” SAP schedules the first hose change job; waits the specified time indicated in the 

interval field, such as “30 days”; and then automatically schedules another hose change job. Thus, when 

the button is “off,” by default SAP schedules hose change-outs “every 30 days,” which, for critical 

equipment subject to intermittent operation, is usually the desired option (CCPS, 1995). If this button is 

“on,” SAP requires confirmation that the hoses have been changed. Thus, if the confirmation-required 

button is “on,” SAP schedules hose changes “30 days after the previous change,” but opens the possibility 

that no one will confirm the completion date in the system, creating a scenario where SAP will not 

schedule the hose change at the pre-determined interval.

000493
E.I. DuPont de Nemours & Co. Final Report September 2011

121

Despite the computer-based and administrative controls that SAP and DuPont provided, in late 2006 

someone changed the confirmation-required field for the phosgene hoses from "off" to "on"—or requiring 

confirmation. These administrative controls highlight gaps that contributed to the fatality.

When an SAP user account is created, access is provided according to the “work role” profile that DuPont 

establishes. Only certain users would have had access to change the data in the maintenance plan for the 

phosgene hoses.

Programmers are “super users” who have higher level access than normal users and can write batch 

programs to change data, forms, and other SAP computer code that affects multiple pieces of equipment 

and multiple plant sites simultaneously. As an administrative control at DuPont, programmers write 

computer code in a “development box” to prevent creating problems in the SAP “production box” that 

normal users see. When the programmer completes the code or downloads it to the “sandbox,” the process 

owners test the change to see that it performs as requested or if it creates a problem. After the process 

owners approve the change, the programmer runs the code or downloads it to the “production box” and 

makes the actual change for regular users. These computer controls help ensure the integrity of the 

“production box” for regular users, but were not enough to prevent the Belle Plant fatality.

The CSB discovered evidence relevant to the SAP change:

• The SAP work role controls allow programmers, process owners, and specific Belle Plant 

employees to access the phosgene hose maintenance plan.

• In 2005, the Belle Plant upgraded from SAP R/2 to the newer SAP R/3 partly because SAP R/3 

included the new PM module. Converting from the previous CMMS to the SAP PM module was 

a large project that involved site personnel who verified the data in spreadsheets before contract 

SAP programmers uploaded the data into SAP.

000494
E.I. DuPont de Nemours & Co. Final Report September 2011

122

Based on this evidence, the most likely scenario is that a programmer accidentally changed the 

confirmation-required field for the phosgene hoses. The change may have been an unintended effect of a

valid change that DuPont requested or may have been an accidental change that went undetected.

000495
E.I. DuPont de Nemours & Co. Final Report September 2011

123

Appendix D: Phosgene Release Calculations

DuPont initially estimated that 0.7 pounds of phosgene released from the riverside cylinder hose and 

associated valving at the time of the rupture. After more detailed calculations, DuPont revised the 

estimated release quantity to 2.0 pounds of phosgene. The CSB performed calculations and modeled the 

release to verify the phosgene release quantity. 

Process Equipment

Figure 18 shows the hose and piping dimensions and the maximum amount of phosgene present in the 

piping system associated with the hose failure.

Figure 18. The hose and piping system that supplied phosgene for the release

1) Area of a circle:

 or = 

2) Volume of a cylinder is equal to the area of the circle, multiplied by the length ( ):

000496
E.I. DuPont de Nemours & Co. Final Report September 2011

124

 = 

3) To determine weight, multiply by the density ( ):

 = = lbs 

The density of phosgene, given that the ambient temperature was 8 °C: 

Phosgene contained in the 1-inch pipe:

Thus, 

Phosgene contained in the 0.5-inch pipe: 

Thus, 

Phosgene contained in the 0.5-inch valve:

 (1/3 the full length of the valve, since it was closed)

Thus, 

000497
E.I. DuPont de Nemours & Co. Final Report September 2011

125

Phosgene contained in the 1-inch valve:

 (1/3 the full length of the valve, since it was closed)

Thus, 

Phosgene contained in the quarter inch, four foot long hose:

Thus, 

The sum of phosgene in the system:

Phosgene Dose Calculation

Using this phosgene release quantity (2.067 pounds), the CSB calculated the approximate concentration 

of phosgene the fatally injured operator was exposed to. Assuming the operator was 3 feet from the 

release and the phosgene instantly vaporized in a spherical fashion from the point of release, the operator 

would have received a lethal dose of phosgene in less than one-tenth of a second. This calculation 

assumes homogeneous concentration/mixing within the spherical phosgene gas cloud:

000498
E.I. DuPont de Nemours & Co. Final Report September 2011

126

 

000499
E.I. DuPont de Nemours & Co. Final Report September 2011

127

Vapor Cloud Dispersion Modeling

The CSB used the ALOHA® (Area Locations of Hazardous Atmospheres) 5.4.1 program to model the 

phosgene release based on the characteristics of the release and atmospheric conditions on the afternoon 

of January 23, 2010. The National Oceanic and Atmospheric Administration (NOAA) and the EPA

developed ALOHA to estimate the threat zones associated with hazardous chemical releases from toxic 

plumes, fires, and explosions. The user inputs chemical property and weather information and the 

program generates a user-defined release scenario that shows the concentration of toxic gases within a 

radius of the release source.

The following assumptions were used to model the phosgene release in ALOHA:

Atmospheric and Environmental Conditions: 

Atmospheric temperature: 50 °F 

Wind speed: calm, 1.5 m/s

Wind direction: from the north 

Humidity: 66%

Cloud cover: scattered

Surrounding terrain: urban

Chemical: Phosgene

Release conditions

Amount released: 2 pounds

Release type: instantaneous

Height of release: 4 feet

The ALOHA program generated a display of concentration “threat zones” over a distance downwind from 

the source of the release. Using the EPA MARPLOT program, threat zones are displayed over a satellite

map of the area using a GIS interface (Figure 19). 

000500
E.I. DuPont de Nemours & Co. Final Report September 2011

128

Figure 19. ALOHA estimate of phosgene concentrations with MARPLOT GIS overlay 

The ALOHA program estimated threat zones for three user selected phosgene concentrations:

• 2 ppm (IDLH) 0.2 miles from release source

• 0.5 ppm (odor threshold) 0.3 miles from release source

• 0.2 ppm (ERPG-264

 

64 ERPG-2 is the concentration to which all could be exposed for up to 1 hour without experiencing or developing 

irreversible or other serious health effects or symptoms that could impair their ability to take protective action

(AIHA, 2008).

) 0.4 miles from release source

000501
E.I. DuPont de Nemours & Co. Final Report September 2011

129

The release estimates from the ALOHA program are based on the weather conditions recorded at the 

Charleston Yeager Airport around the time of the January 23, 2010, phosgene release, but may not 

accurately represent atmospheric conditions at the plant. The ALOHA program also does not consider the 

topography or terrain surrounding the plant. The fence line monitors south and southwest of the phosgene 

shed recorded phosgene concentrations between 0 and 0.27 ppm, suggesting phosgene vapor may have 

traveled south of the DuPont Belle plant fence line toward the river. The ALOHA threat zone overlay in 

Figure 19 displays a model of the worst case release conditions indicating that IDLH concentrations of 

phosgene could have been present on the Kanawha River shortly after the release and lower 

concentrations could have traveled across the river. The community reported no odors or exposure 

symptoms the afternoon of the phosgene release incident. 

000502
E.I. DuPont de Nemours & Co. Final Report September 2011

130

Appendix E: Hazard Analysis for Phosgene Use at Belle

(Documents in this appendix are redacted for confidentiality)

List of Acronyms, Abbreviations, and Terminology

dia diameter

flashing instantly vaporizing liquid 

IHI Individual Hazard Index

LD50 50% lethal dose

MM million (old notation style)

PHI Process Hazard Index

ppm parts per million

000503
E.I. DuPont de Nemours & Co. Final Report September 2011

131

000504
E.I. DuPont de Nemours & Co. Final Report September 2011

132

000505
E.I. DuPont de Nemours & Co. Final Report September 2011

133

000506
E.I. DuPont de Nemours & Co. Final Report September 2011

134

000507
E.I. DuPont de Nemours & Co. Final Report September 2011

135

000508
E.I. DuPont de Nemours & Co. Final Report September 2011

136

000509
E.I. DuPont de Nemours & Co. Final Report September 2011

137

000510
E.I. DuPont de Nemours & Co. Final Report September 2011

138

000511
E.I. DuPont de Nemours & Co. Final Report September 2011

139

000512
E.I. DuPont de Nemours & Co. Final Report September 2011

140

000513
E.I. DuPont de Nemours & Co. Final Report September 2011

141

000514
E.I. DuPont de Nemours & Co. Final Report September 2011

142

000515
E.I. DuPont de Nemours & Co. Final Report September 2011

143

000516
E.I. DuPont de Nemours & Co. Final Report September 2011

144

000517
E.I. DuPont de Nemours & Co. Final Report September 2011

145

000518
E.I. DuPont de Nemours & Co. Final Report September 2011

146

000519
E.I. DuPont de Nemours & Co. Final Report September 2011

147

000520
E.I. DuPont de Nemours & Co. Final Report September 2011

148

000521
E.I. DuPont de Nemours & Co. Final Report September 2011

149

000522
E.I. DuPont de Nemours & Co. Final Report September 2011

150

000523
E.I. DuPont de Nemours & Co. Final Report September 2011

151

000524
E.I. DuPont de Nemours & Co. Final Report September 2011

152

000525
E.I. DuPont de Nemours & Co. Final Report September 2011

153 

000526
E.I. DuPont de Nemours & Co. Final Report September 2011

154

Appendix F: Hard Pipe to Flexible Hose Transition 

Correspondence 

(Documents in this appendix are redacted for confidentiality)

List of Acronyms, Abbreviations, and Terminology

AgProducts The Agricultural Products Department/Business of DuPont

dry phosgene liquid phosgene without any water, also called "anhydrous" phosgene

engg spec engineering specification

ESD Engineering Services Division of DuPont

SS stainless steel

000527
E.I. DuPont de Nemours & Co. Final Report September 2011

155

000528
E.I. DuPont de Nemours & Co. Final Report September 2011

156

000529
E.I. DuPont de Nemours & Co. Final Report September 2011

157

000530
E.I. DuPont de Nemours & Co. Final Report September 2011

158

000531
E.I. DuPont de Nemours & Co. Final Report September 2011

159

000532
E.I. DuPont de Nemours & Co. Final Report September 2011

160

000533
E.I. DuPont de Nemours & Co. Final Report September 2011

161

000534
E.I. DuPont de Nemours & Co. Final Report September 2011

162

000535
E.I. DuPont de Nemours & Co. Final Report September 2011

163

000536
E.I. DuPont de Nemours & Co. Final Report September 2011

164

000537
E.I. DuPont de Nemours & Co. Final Report September 2011

165

Appendix G: PHA Recommendation Delay Letter

(Documents in this appendix are redacted for confidentiality)

List of Acronyms, Abbreviations, and Terminology

COCL2 Phosgene

FEL Front-end loading

PM Preventive Maintenance

Rec Recommendation

Rx Reactor

000538
E.I. DuPont de Nemours & Co. Final Report September 2011

166

000539
E.I. DuPont de Nemours & Co. Final Report September 2011

167

000540
E.I. DuPont de Nemours & Co. Final Report September 2011

168

000541
E.I. DuPont de Nemours & Co. Final Report September 2011

169

000542
E.I. DuPont de Nemours & Co. Final Report September 2011

170

000543
E.I. DuPont de Nemours & Co. Final Report September 2011

171

000544
E.I. DuPont de Nemours & Co. Final Report September 2011

172

000545
E.I. DuPont de Nemours & Co. Final Report September 2011

173

000546
CSB s Hoeganaes Corporation Case Study 1

Hoeganaes Corporation Case Study December 2011

Case Study

U.S. Chemical Safety and Hazard Investigation Board

Hoeganaes Corporation: Gallatin, TN

Metal Dust Flash Fires and Hydrogen Explosion

January 31, 2011; March 29, 2011; May 27, 2011

5 Killed, 3 Injured

No. 2011-4-I-TN

KEY ISSUES

s Hazard recognition and training

s Engineering controls 

s Fire codes/enforcement

sRegulatory oversight

000547
CSB s Hoeganaes Corporation Case Study 2

Hoeganaes Corporation Case Study December 2011

1.0 INTRODUCTION

This case study examines multiple iron dust flash fires and a hydrogen explosion at the 

Hoeganaes facility in Gallatin, TN. The first iron dust flash fire incident killed two workers 

and the second injured an employee. The third incident, a hydrogen explosion and resulting 

iron dust flash fires, claimed three lives and injured two other workers.

1.1 HOEGANAES CORPORATION

Hoeganaes Corp. is a worldwide producer of atomized steel and iron powders. Headquartered 

in Cinnaminson, NJ, Hoeganaes has facilities in the U.S., Germany, China, and Romania. 

The Hoeganaes Corp. is a subsidiary of GKN, a multinational engineering company headquartered in the United Kingdom. GKN has businesses in addition to powder metallurgy, including 

aerospace and automotive driveline industries. GKN acquired the Hoeganaes Corp. in 1999.

The largest consumer for the powdered metal (PM1

) product is the automotive industry, 

which presses and sinters2

 the powder into small metal parts. 

1.2 FACILITY DESCRIPTION

The Hoeganaes Gallatin facility (Figure 1), located 30 miles northeast of Nashville, Tennessee, 

employs just under 200 employees. Since becoming operational in the 1980s, they have increased 

their manufacturing capability over 550 percent from 45,000 to over 300,000 tons.

TABLE OF CONTENTS

1.0 Introduction 2

2.0 Process Discussion 3

3.0 The Incidents 3

4.0 Analysis 6

5.0 Key Findings 24

6.0 Recommendations 24

 Appendix A: Determination of 

 Iron Powder Explosibility from 

 Pressure Ratio Calculations 28

 Appendix B: Determination of 

 Iron Powder Classification from 

 Explosion Severity Calculation 30

FIGURE 1

Satellite view of the 

Hoeganaes Gallatin facility.

1

PM is the accepted acronym by the powdered metals industry.

2

Sintering is the process of solidifying PM via heat and/or pressure to form a component. 

000548
CSB s Hoeganaes Corporation Case Study 3

Hoeganaes Corporation Case Study December 2011

3

Ductility is the physical property of a material where it is capable of sustaining large permanent changes in shape without breaking.

2.0 PROCESS DISCUSSION

Hoeganaes receives and melts scrap steel. Various elements are added to the molten metal 

to meet customer specifications, but the “workhorse” product, Ancorsteel 1000TM, is over 99 

percent iron. The molten iron is cooled and milled into a coarse powder that is processed 

in long annealing furnaces to make the iron more ductile.3

 The furnaces are called “band 

furnaces,” for the 100 foot conveyor belt, or band, that runs through them. A hydrogen 

atmosphere is provided in the band furnace to reduce the iron by removing oxides and 

preventing oxidation. The hydrogen is supplied to the facility by a contract provider, onsite. 

Hydrogen is conveyed to the furnaces via pipes located in a trench under the floor and 

covered by metal plates. 

 In the process of going through the furnace, the coarse powder becomes a thick sheet called 

“cake.” The cake is sent to a cake breaker and ultimately crushed into the fine PM product. 

The majority of the finished PM product has a particle diameter between 45-150 microns, 

or roughly the width of a human hair (Figure 2).

3.0 THE INCIDENTS

3.1 JANUARY 31, 2011 (TWO FATALITIES) 

PM product is transferred through the plant by various mechanisms including screw conveyors and bucket elevators. Bucket elevators have a tendency to go “off-track” when the belt 

pulling the buckets becomes misaligned. Once sufficiently off-track the strain on the motor 

increases until the torque is too great and the motor shuts down. On January 31, 2011, at 

about 5:00 am Hoeganaes plant operators suspected bucket elevator #12 of being off-track 

and a maintenance mechanic and an electrician were called to inspect the equipment.

FIGURE 2

Fine PM collected from 

the Hoeganaes plant 

(penny shown for scale).

000549
CSB s Hoeganaes Corporation Case Study 4

Hoeganaes Corporation Case Study December 2011

Based on their observations, they did not believe that the belt was off-track and requested, via radio, that the operator in the control room restart the motor (Figure 4). 

When the elevator was restarted, vibrations from the equipment dispersed fine iron 

dust into the air. During a CSB interview, one of the workers recalled being engulfed in 

flames, almost immediately after the motor was restarted. 

City of Gallatin emergency responders arrived 

with ambulances and 

transported the mechanic 

and electrician to the 

Vanderbilt Burn Center 

in Nashville, TN. Both 

employees were severely 

burned over a large 

percentage of their bodies. 

The first employee died 

from his injuries two days 

later. The second employee 

survived for nearly four 

months before succumbing to his injuries in late 

May 2011. 

3.2 MARCH 29, 2011 (ONE INJURED) 

As part of an ongoing furnace improvement project, a Hoeganaes engineer and an outside 

contractor were replacing igniters on a band furnace. The pair experienced difficulty in reconnecting a particular natural gas line after replacing an igniter. While using a hammer to 

force the gas port to reconnect, the Hoeganaes engineer inadvertently lofted large amounts 

of combustible iron dust from flat surfaces on the side of the band furnace, spanning 20 feet 

above him. As soon as the dust dispersed, the engineer recalled being engulfed in flames. He 

jumped and fell from a rolling stepladder in his attempt to escape the fireball. He received 

first- and second-degree burns to both thighs, superficial burns to his face, and scrapes from 

his fall. After seeing the initial flash of the dust igniting, the contractor took evasive action 

and escaped without injury. 

FIGURE 4 (RIGHT)

Scene of January 31, 

2011, incident area.

FIGURE 5

Computer graphic of 

January 31 iron dust 

flash fire.

FIGURE 3 (LEFT)

Computer graphic of 

maintenance workers 

inspecting bucket 

elevator #12 just prior 

to January 31 flash fire.

Elevator Enclosure

Motor

000550
CSB s Hoeganaes Corporation Case Study 5

Hoeganaes Corporation Case Study December 2011

The engineer was wearing the Hoeganaes-designated personal protective equipment, which 

included pants and a shirt that were rated as flame resistant clothing (FRC). He was also 

wearing an FRC rated jacket that provided extra shielding to his upper torso from the flash 

fire.

3.3 MAY 27, 2011 (THREE FATALITIES, TWO INJURIES)

Around 6 am on May 27, 2011, operators near band furnace #1 heard a hissing noise that 

they identified as a gas leak. The operators determined that the leak was in a trench, an area 

below the band furnaces that contains hydrogen, nitrogen, and cooling water runoff pipes, 

in addition to a vent pipe for the furnaces. The operators informed the maintenance department about the hissing, and six mechanics were dispatched to find and repair the leak. One 

annealing area operator stood by as the mechanics sought out the source of the leak. 

Although maintenance personnel knew that hydrogen piping was in the same trench, they 

presumed that the leak was nonflammable nitrogen because of a recent leak in a nitrogen 

pipe elsewhere in the plant and began to try to remove trench covers. However, the trench 

FIGURE 6 (LEFT)

Computer graphic of 

the gas line connection 

involved in the March 29 

flash fire.

FIGURE 7 (RIGHT)

The gas line connection 

involved in March 29, 2011, 

incident.

FIGURE 8

Computer graphic of 

March 29 iron dust 

flash fire.

000551
CSB s Hoeganaes Corporation Case Study 6

Hoeganaes Corporation Case Study December 2011

covers were too difficult to lift without machinery. Using an overhead crane, they were able 

to remove some of the trench covers. They determined that the leak was near the southernmost trench covers, which the crane could not reach. Shortly after 6:30 am, maintenance 

personnel acquired a forklift equipped with a chain on its forks, and were able to reach and 

begin removing the southernmost trench covers.

Interviews with eyewitnesses indicate that just as the first trench cover was wrenched from 

its position by the forklift, friction created sparks, followed by a powerful explosion. 

Several days after the explosion, CSB investigators observed a large hole (approximately 3 x 

7 inches) in a corroded section of piping that carried hydrogen and ran through the trench 

(Figure 11).

As the leaking hydrogen gas exploded, the resulting overpressure dispersed large quantities of 

iron dust from rafters and other surfaces in the upper reaches of the building. Portions of this 

dust subsequently ignited. Multiple eyewitnesses reported embers raining down and igniting 

FIGURE 9 (TOP)

Scene of the May 27 

incident before (left, taken 

during the CSB’s January 

31 incident investigation) 

and after (right). Note 

visible accumulations of 

iron powder on surfaces. 

Circled areas show trench 

cover location.

FIGURE 10 (RIGHT)

Computer graphic of 

maintenance crews 

starting to remove the 

trench covers using a 

forklift just prior to May 27 

explosion.

Feb 07 2011 May 28 2011

000552
CSB s Hoeganaes Corporation Case Study 7

Hoeganaes Corporation Case Study December 2011

multiple dust flash fires in the area. They also reported visibility so 

limited in some instances that flashlights were required; one eyewitness said that even with a flashlight, he could see only 3 to 4 feet 

ahead due to extensive dust and smoke.

The hydrogen explosion and ensuing iron dust flash fires injured four 

of the responding mechanics and the annealing operator.4

 The two 

mechanics near the forklift were transported to a local hospital where 

they were treated for smoke inhalation and released shortly thereafter.

Two other mechanics and the operator who stood by during the 

operation were rushed to Vanderbilt Burn Center. Less than a week 

after the incident, two employees succumbed to their injuries. The 

third seriously injured employee died from his injuries almost seven 

weeks after the incident.

Due to the extensive nature of the injuries, and the abundance of both hydrogen and combustible dust present at the time of the incident, it is difficult to specifically determine which 

fuel, if not both, caused the fatal injuries to the victims. 

3.4 EMERGENCY RESPONSE

The Gallatin Fire Department (GFD) has responded to 30 incidents of various types over 

the past 12 years at the Hoeganaes Corp., including the January 31, March 29, and May 27 

incidents. In June 1999, the GFD responded to a fire caused by iron dust that ignited in a 

baghouse. One person suffered smoke inhalation injuries as a result of the incident. 

Before the GFD arrived at each of the 2011 incidents, Hoeganaes volunteer first responders cared for the injured. Hoeganaes volunteers participate in annual training that covers 

first response, CPR, and first aid. They are instructed to provide care until GFD and EMS 

responders arrive. 

Immediately following each incident, the volunteers provided first aid and comfort to the 

injured by applying water to cool the burns and covering the victims with a burn blanket 

to keep them comfortable. EMS arrived within minutes of the initial 9-1-1 call and transported the injured personnel to hospitals. 

4At the time of incident, two of the mechanics and the operator were standing near the trench while the other two mechanics were positioned and 

possibly shielded by the forklift when the explosion occurred.

FIGURE 11 (TOP LEFT)

Hole in 4-inch piping after 

the May 27, 2011, incident.

FIGURE 12 (TOP RIGHT)

Computer graphic of the 

May 27, 2011, hydrogen 

explosion.

FIGURE 13 (BOTTOM)

Upward disturbance of 

trench covers caused by 

the hydrogen explosion in 

the May 27, 2011, incident.

000553
CSB s Hoeganaes Corporation Case Study 8

Hoeganaes Corporation Case Study December 2011

4.0 ANALYSIS

4.1 COMBUSTIBLE DUST TESTING

According to National Fire Protection Association (NFPA) 484, Standard for Combustible 

Metals, a facility that handles metal dust should commission one of two screening tests to 

determine if a metal dust is combustible and the provisions of the standard apply (Section 

4.4.1). If results from either of the two tests show that the dust is combustible or explosible, 

NFPA 484 would apply to the facility either as a matter of voluntary good practice or as a 

requirement by a relevant regulatory body. 

The first screening test for the determination of combustibility, also known as the “train test,” 

measures the burning rate of a dust layer over the length of a sample.5

 If there is propagation 

beyond the ignition point or heated zone, then the sample is considered combustible.6

The second test, for explosibility determination, serves as a basis to determine if a metal 

powder or dust is capable of initiating an explosion when suspended in a dust cloud. This 

test, performed in a Hartmann apparatus, determines the minimum ignition energy of a 

dust cloud in air by a high voltage spark.7

If either of the screening tests produces a positive result for combustibility or explosibility, NFPA 

484 requires further explosibility testing be conducted in a 20-L sphere. Several values (below) 

from the explosibility test results can be used to characterize the severity of a dust explosion. 

4.1.1 CSB COMBUSTIBLE DUST TESTING

4.1.1.1 Combustibility Demonstration

In order to visually demonstrate the combustibility of the Hoeganaes iron samples, a modified 

“Go/No-Go” test was performed by the CSB. Generally, this test is performed in a closed 

vessel, but the CSB was interested in directly observing any flames the dust may produce.8

EXPLOSIVITY VALUES

KSt: calculated value that compares the relative explosion severity and consequence to 

other dusts (bar m/s). The higher the KSt number, the more energetic the explosion. 

Pmax: maximum explosion overpressure generated in the test vessel (bar)

܎P/܎t: maximum rate of pressure rise, predicts violence of the explosion (bar/s)

Explosion Severity (ES): Index to determine if Class II electrical equipment is required 

as an OSHA requirement.

ES > 0.5, Class II Combustible

ES < 0.4, Combustible but not Class II

5

UN Recommendations on the Transport of Dangerous Goods: Model Regulations – Manual of Tests and Criteria, Part III, Subsection 33.2.1

6

NFPA 484 defines a combustible metal dust as a particulate metal that presents a fire or explosion hazard when suspended in air or the process specific 

oxidizing medium over a range of concentrations, regardless of particle size or shape. 

7

ASTM E2019, Standard Test Method for Minimum Ignition Energy of a Dust Cloud in Air

8

The “Go/No-Go” test is typically performed in a modified one-liter Hartmann tube; also known as the explosibility screening test as described in NFPA 484.

000554
CSB s Hoeganaes Corporation Case Study 9

Hoeganaes Corporation Case Study December 2011

This test dispersed about 30 grams of iron dust—sampled from the baghouse9 associated with 

the bucket elevator from the January 31, 2011, incident—above an 8 inch burner. Upon being 

released, the dust auto-ignites in air due to the heat given off from the burner below (Figure 

14). An intense white flame was produced that reached a peak diameter of 18 inches.

4.1.1.2 20-Liter (20-L) Test Method

CSB investigators collected iron powder samples from various locations in the Hoeganaes 

facility and commissioned testing to characterize its combustibility using two different 

test methods, the 20-liter (20-L) and one-meter cubed (1-m3

) test chambers. The 20-L test 

laboratory used the standard test method, ASTM E1226, Pressure and Rate of Pressure 

Rise for Combustible Dusts, for the selected iron powder samples. Each dust sample was 

injected and ignited in a 20-L spherical test vessel equipped with transducers to record a 

pressure-versus-time profile of the dust deflagration in the sphere.

Table 1 shows data from the CSB’s combustibility tests of the Hoeganaes dust and a comparison to dust testing the CSB commissioned for previous dust incidents at other companies. 

The CSB test data indicate that the iron powder is combustible and is covered by the 

requirements of NFPA 484 (Section 4.4.1). Although values indicate that the dust produces 

a weak explosion relative to other dusts, the dust is considered combustible by the OSHA 

definition10 and can result in a flash fire capable of causing injuries and fatalities. 

FIGURE 14

CSB iron dust 

combustibility 

demonstration, see 

Section 4.1.1.1.

9

Ventilation equipment that removes airborne particulate by forcing air through a specially designed filtration bag. 

10 OSHA 3371-08 2009: “a solid material composed of distinct particles or pieces, regardless of size, shape, or chemical composition, which presents a 

fire or deflagration hazard when suspended in air or some other oxidizing medium over a range of concentrations.”

000555
CSB s Hoeganaes Corporation Case Study 10

Hoeganaes Corporation Case Study December 2011

20-L COMBUSTIBLE DUST TEST DATA FROM CSB INVESTIGATIONS11

Hoeganaes 

Iron Dust 

20L test12

Granulated 

Sugar

Aluminum 

Dust

Polyethylene 

Dust

Phenolic 

Resin

Pmax (bar) 3.5 5.2 9.4 8.34 7.58

܎P/܎t(bar/s) 68 129 357 515 586

KSt (bar m/s) 19 35 103 140 165

Explosion 

Severity (ES)

0.077 0.22 1.08 1.38 1.43

Classification Combustible Combustible Combustible, 

Class II

Combustible, 

Class II

Combustible, 

Class II

Frequently, the hazards of different combustible dusts are evaluated by their potential 

explosive capabilities. However, the hazards of combustible dusts are not limited to explosions. The Hoeganaes iron powder propagates an explosion less rapidly compared to other 

dusts, so there is less overpressure damage, consistent with observations by CSB investigators. Dust testing results from Hoeganaes and prior CSB investigations illustrate that dusts 

with low KSt values can cause flash fires that result in deaths and serious injuries. Although 

combustible dusts can lead to explosions, combustible dust flash fires also pose a risk that 

must be addressed in industry.

According to the 20-L standard test method, E1226, a dust sample can be defined as 

combustible or explosible based on a calculated pressure ratio (PR) using the pressure data 

recorded in the 20-L test chamber. For sample concentrations of 1,000 and 2,000 g/m3

, a 

pressure ratio value greater than or equal to 2 is considered explosible. If the pressure ratio 

is less than 2, the sample is considered non-explosible. However, the test method cautions 

that the dust can still burn and a dust cloud may experience a deflagration depending upon 

conditions such as the temperature and particle size.13 The iron dust sample from baghouse 

#4 had a PR of 4.0 and 4.7 at concentrations of 1,000 and 2,000 g/m3 respectively, indicating that the dust sample is explosible. 

4.1.1.3 One-Meter Cubed (1-m3) Test Method

The CSB collected a subsequent sample14 from baghouse #4 and subjected it to combustibility testing using the one-meter cubed (1-m3

) method, ISO 6184-1 Explosion Protection 

Systems: Determination of Explosion Indices of Combustible Dusts in Air. The 1-m3

test vessel is larger than the 20-L vessel, and the dust, along with air and a fuel source, is 

injected into the system differently. 

The iron powder from baghouse #4 underwent an explosibility screening test in the 1-m3

vessel in an attempt to ignite the sample. At several dust concentrations, none of the tests 

produced significant pressure which exceeded the test qualifications for ignition and therefore the dust sample was considered non-explosible according to this method.

TABLE 1

Combustibility data for 

selected materials.

11For a more detailed discussion on characteristic combustible dust values, see CSB 2006-H-1 Combustible Dust Hazard Study.

12CSB investigators collected this iron dust sample from baghouse #4 at the Hoeganaes Gallatin facility after the January 31, 2011, incident. 

13American Society for Testing and Materials (ASTM), E1226-10, Pressure and Rate of Pressure Rise for Combustible Dust, ASTM International, 2010.

14At the time this sample was taken in August 2011, the Gallatin facility had not been fully operational for about three months. As such, the sample 

collected did not contain fines representative of the environment at the time of the 2011 flash fire incidents.

000556
CSB s Hoeganaes Corporation Case Study 11

Hoeganaes Corporation Case Study December 2011

4.1.1.4 Comparing Dust Testing Methods

Both the 20-L and 1-m3 tests are accepted methods that can characterize dust explosibility; 

however results from the two tests may differ. There are several factors that can contribute 

to varying results among the dust test methods. Dust characteristics, such as particle size, 

moisture content, and degree of oxidation (for metals) can affect the ignitability of the 

sample in the test chamber. 

The 20-L and 1-m3

 test chambers were designed to simulate dust explosions in facility 

settings, but each test has limitations. The main difference between the two tests is the 

chamber size and the dust dispersion mechanism. Since the 1-m3

 test is larger, theoretically 

it can better simulate an open-space dust cloud explosion. However, that larger volume also 

makes it harder to create a uniform distribution of dust within the testing chamber. In the 

smaller 20-L test chamber it is easier to create a uniform distribution; however, it is possible 

that the smaller chamber also creates an “overdriving” effect. Since the 20-L chamber is 

smaller, the energy exerted by the igniters15 may combust enough dust creating the appearance of ignition16 — a situation that would not occur in a facility setting.

NFPA revised the 2012 edition of NFPA 484 to state that explosibility screening tests shall 

be performed in accordance to the 20-L test standard, E1226. However, NFPA added to 

the standard annex that the results of the 20-L test can be conservative and an owner or 

operator of a facility may elect to use a 1-m3

 test for dust explosibility testing as the 20-L 

test may result in false positives for dusts with lower KSt values.

Despite the discrepancies between the two test methods, the empirical evidence from the 

flash fire incidents at Hoeganaes shows that dusts with lower KSt values are capable of 

fueling flash fires with severe consequences. This further suggests that facilities should not 

rely on the 1-m3

 test as a sole determination of dust combustibility hazards. Dusts with 

lower KSt values and characteristics similar to the iron powder at Hoeganaes may not ignite 

in the 1-m3

 chamber but still have the ability to result in fatal flash fires. 

It should be noted that both tests are for explosibility screening, and alone may not convey 

the full combustibility hazard.

4.1.2 HOEGANAES COMBUSTIBLE DUST TESTING 

4.1.2.1 Minimum Ignition Energy (MIE) 

In 2010, Hoeganaes contracted to test iron dust samples from the plant for combustibility 

as a result of an insurance audit recommendation. The test had one sample that was similar 

in particle size, moisture content, and location to the dust involved in the 2011 incidents. 

That sample gave the results seen in Table 2. 

The minimum ignition energy (MIE) testing determined that a continuous arc did ignite the 

representative samples from 2010, but a 500 mJ source did not. The conclusion from the 

testing was that the minimum ignition energy was greater than 500 mJ. This information is 

valuable in determining potential ignition sources for each of the incidents. 

15The igniter may increase the temperature in the smaller 20-L chamber, raising the overall temperature of the system and allowing a non-explosive 

system to appear explosive.

16Going, J et al., “Flammability limit measurements for dust in 20-L and 1-m3

 vessels.” Journal of Loss Prevention in the Process Industries. May 2003 

000557
CSB s Hoeganaes Corporation Case Study 12

Hoeganaes Corporation Case Study December 2011

4.2 IGNITION SOURCES

Witnesses indicated that the May 27, 2011, hydrogen explosion was ignited by sparks generated 

during the lifting of the trench cover. This is reasonable considering that the MIE of hydrogen is 

0.02 mJ, and the energy of mechanical sparks from metal to metal contact can be several mJ.20

The testing contracted by Hoeganaes in 2010 determined that the minimum ignition energy 

for representative iron dust samples was greater than 500 mJ, and that a continuous arc 

would ignite the samples. One witness at ground level reported hearing an “electric sound” 

at the time of the incident. The motor operating bucket elevator #12 was a likely source of 

ignition since it had exposed wiring, was not properly grounded, and was within a few feet 

of the dust cloud source. The wiring was exposed because the electrical conduit supplying 

power to this motor was not securely connected to the motor’s junction box.

HOEGANAES MINIMUM IGNITION ENERGY (MIE) TEST RESULTS

Sample Iron Dust

Particle size (%<75 μm) 99%

Pmax(bar) 3.3

(܎P/܎t)max (bar/s) 51

KSt (bar*m/s) 15

MIE (mJ17, Cloud) >500

MIT18 (°C,Cloud) 560-580

MEC19 (g/m3

) 200-250

TABLE 2

Combustible dust test 

results commissioned by 

Hoeganaes in 2010.

FIGURE 15

Exposed electrical 

wiring on elevator motor 

near January 2011 

incident site (motor 

panel cover was rotated 

post incident by fire 

department).

Motor

Exposed wires

17mJ is an abbreviation for millijoules, which is a unit of energy. One Joule is equal to 1000 millijoules or approximately 0.24 calorie.

18Minimum Ignition Temperature.

19Minimum Explosible Concentration. 

20V. Babrauskas, Ignition Handbook, Fire Science Publishers, Issaquah, WA, 2003.

000558
CSB s Hoeganaes Corporation Case Study 13

Hoeganaes Corporation Case Study December 2011

Prior to the CSB notifying Hoeganaes that evidence from the incident area needed to be preserved, the company removed and modified evidence from the scene, including the elevator 

motor, wiring, and conduit. However, on examination, there were spots that appeared to be arc 

marks both inside the junction box, and on the outside of the motor housing.

4.3 HOEGANAES

4.3.1 HAZARD RECOGNITION

In general industry the combustibility of metal dust is a well-established hazard, but metal 

dust fires and explosions continue to claim lives and destroy property. The CSB reviewed three 

publications dating back to the 1940s and 1950s that addressed metal dust (including iron dust) 

hazards and explosion protection methods. The National Fire Protection Association (NFPA) 

code for the Prevention of Dust Explosions, published in 1946,21 lists general precautions for all 

types of dusts, including metal powder, and specific provisions for certain types of dusts.

The Building Construction section of the code states, “Avoid beams, ledges or other places 

where dust may settle, particularly overhead.” The Gallatin facility, built in the 1980s, was not 

designed to avoid significant overhead accumulations of dust. The code calls for designing and 

maintaining dust-tight equipment to avoid leaks and, where this is not possible, to enforce good 

housekeeping procedures. 

The code also cautions against sources of ignition in areas containing dust and recommends 

locating dust collectors outdoors or in separate rooms equipped with explosion venting. 

In 1957, the NFPA published the Report of Important Dust Explosions which included a 

summary of over 1,000 dust explosions between 1860 and 1956 in the U.S. and Canada.22 The 

report listed 80 metal dust fires and explosions, including one iron dust incident that resulted in 

a fatality in 1951. 

A 1958 article in an American Chemical Society publication states, “Powdered metals dispersed 

in oxygen or air form explosive mixtures... their flammability and explosibility have been 

reported in considerable detail...”23

FIGURE 16

Mounds of iron dust 

along elevated surfaces 

at the Gallatin plant, 

February 3, 2011.

21National Fire Codes, Vol. II. The Prevention of Dust Explosions 1946. National Fire Protection Association, Boston, MA., 1946.

22National Fire Protection Association, Report of Important Dust Explosions, NFPA, Boston, MA, 1950.

23Grosse, A.V., and J.B. Conway. “Combustion of Metals in Oxygen.” Industrial & Engineering Chemistry 50.4 (1958): 663-72.

000559
CSB s Hoeganaes Corporation Case Study 14

Hoeganaes Corporation Case Study December 2011

In the 1990s and 2000s, the Pittsburgh Research Laboratory of the National Institute for 

Occupational Safety and Health (NIOSH) conducted a study of the explosibility of various 

metals, including iron. The results of these experiments, published in scientific journals,24

showed the explosibility characteristics of iron powder to aid hazard evaluation in metal processing industries. However, management within the Hoeganaes Corp. and GKN Corp. did 

not commission an analysis of its own potentially combustible PM products and constituents 

until January 2009, as a result of an insurance audit conducted in 2008. This combustible 

dust testing concluded that all three iron powder samples collected from various locations in 

the plant were explosible (Section 4.3.6.1). However, these results did not trigger an effective 

overhaul of the dust containment and housekeeping procedures at the Gallatin facility. 

Representatives from Hoeganaes told the CSB that the dust analysis results did trigger 

an operator training program for the recognition of combustible dust hazards. However, 

Hoeganaes did not mitigate the dust hazard. Since Hoeganaes did not control the combustible 

dust hazard, operators were forced to tolerate the conditions at the facility. Over time, these 

flash fires became normalized, since they did not result in any serious injuries prior to the fatal 

incident on January 31, 2011. 

Operators and mechanics reported being involved in multiple flash fires during their employment at the Gallatin facility. At the time of the incidents, many were aware that the iron dust 

could burn or smolder. However, they were not trained to understand the potentially severe 

hazard when accumulated dust is dispersed in air. Rarely would operators report the minor 

flash fires and near-misses that periodically occurred. 

4.3.2 ENGINEERING CONTROLS

4.3.2.1 Combustible Dust

Thorough hazard recognition is key to effectively managing the risk from combustible dust. 

Once the hazard is recognized, applying the “hierarchy of controls” for fire and explosion 

prevention helps address the fugitive dust issue at the source: the material itself, the processing equipment, and the work procedures. The hierarchy of controls is a safety concept in 

which a hierarchal ordering of control mechanisms is applied to reduce risk. It covers the 

spectrum from elimination at the source, at the top of the hierarchy, through engineering 

and administrative (procedural) controls to personal protective equipment (PPE), at the 

bottom of the hierarchy.25

Installing and maintaining engineering controls to eliminate fugitive dust accumulation 

is the most effective method to prevent dust fires and explosions. Conveyance systems 

and appropriately sized dust collection equipment are examples of engineering controls 

that eliminate or mitigate fugitive dust generation at the source. Engineering controls are 

preferred over housekeeping, but a robust housekeeping program is important to manage fugitive dust accumulations in areas where engineering controls need maintenance or 

improvement. Additionally, administrative controls, such as worker training and operating 

procedures, complement robust engineering controls.

Significant quantities of iron dust escaped from equipment throughout the Hoeganaes facility. 

Enclosures on the conveyance equipment leaked fugitive emissions of iron dust.. In addition, 

the dust collection systems were historically unreliable and did not prevent large amounts 

of combustible iron dust from becoming airborne and accumulating on elevated surfaces 

throughout the processing areas.

24Cashdollar, K., Flammability of Metals and Other Elemental Dust Clouds. Loss Prevention Symposium. AICHE 1994.

 Cashdollar, K., Zlochower, I., Explosion Temperatures and Pressures of Metals and other Elemental Dust Clouds. Journal of Loss 

Prevention in the Process Industries 20 (337-348) 2007.

25Kletz, T., Amyotte, P., Process Plants: A Handbook for Inherently Safer Design. CRC Press, 2010.

000560
CSB s Hoeganaes Corporation Case Study 15

Hoeganaes Corporation Case Study December 2011

4.3.2.2 Hydrogen

The trench involved on the May 27, 2011, incident contains many pipes including nitrogen 

and hydrogen supply and vent pipes for the band furnaces. In addition to housing pipes, the 

trench also acts as a drain for the cooling water used in the band furnaces. At the time of 

the incident this water came out of the furnaces hot and drained directly onto the pipes and 

into the trench (Figure 17).

According to ASME B31.3, design concerns about ambient conditions around process pipes 

focus on environments and changes that can create physical stresses in the piping. Section 

10.5.3 of NFPA 55 requires annual maintenance including inspection for physical damage 

and leak tightness. CGA G-5.4 similarly requires regular inspection for physical damage 

and leak tightness. However, Hoeganaes did not regularly inspect the pipes in the trench. 

The design and maintenance of this trench, should have addressed the issue of slow corrosion over time caused by the hot water runoff and solids accumulation. 

Both NFPA 55 and NFPA 2 state, “Provisions shall be made for controlling and mitigating unauthorized discharges.” NFPA 2 further requires that “the storage, use, or handling 

of [hydrogen] in a building or facility shall be accomplished in a manner that provides a 

reasonable level of safety... from illness, injury or death...” However, the CSB found no 

evidence of a Hoeganaes procedure to inspect piping within the trench to ensure that corrosion had not compromised the piping systems which would allow an uncontrolled release 

of hydrogen. Moreover, Hoeganaes had no written procedure or protocol to mitigate gas 

leaks, and maintenance crews were allowed to begin investigating a suspected leak without 

testing the atmosphere for concentrations of explosive gas.

4.3.3 ADMINISTRATIVE CONTROLS

4.3.3.1 Housekeeping

Observations by CSB investigators at the Gallatin facility shortly after the first incident 

indicated that combustible dust was leaking from equipment and that housekeeping was 

ineffective (see Figures 16, 18, 19, 20 and 21). Combustible iron dust coated almost every 

STANDARDS THAT ADDRESS THE 

HYDROGEN SUPPLY AND VENT PIPES IN 

THE TRENCH INCLUDE: 

s !3-%26 B31.3, Process Piping 

s #'!27 G-5.4-2010, Standard for Hydrogen 

 Piping Systems at User Locations 

s .&0!  (YDROGEN 4ECHNOLOGIES #ODE

s .&0!  #OMPRESSED 'ASES AND #RYOGENIC

 Fluids Code.

FIGURE 17

Water flow (upper left 

of photo) and externally 

corroded pipes in the 

trench involved in the 

May 27, 2011, incident.

26The American Society of Mechanical Engineers (ASME) is a professional body focused on mechanical engineering. The organization is known for setting codes and standards for mechanical devices. The ASME conducts one of the world’s largest technical 

publishing operations through the ASME Press. The organization holds numerous technical conferences and hundreds of professional development courses each year, and sponsors numerous outreach and educational programs.

27The Compressed Gas Association (CGA) develops and publishes technical information, standards, and recommendations for the 

manufacture, storage, transportation, distribution, and use of industrial gases.

000561
CSB s Hoeganaes Corporation Case Study 16

Hoeganaes Corporation Case Study December 2011

surface up to 4 inches deep and was visible in the air. Mitigation of the combustible dust hazard by Hoeganaes was limited to a less-than-adequate vacuuming service, sparsely enclosed 

conveyance equipment, and an inadequate baghouse filtration system. 

Although bucket elevators and some conveyance equipment were enclosed, fugitive dust 

emissions were evident throughout the facility. Moreover, the CSB investigators observed 

leaks of fugitive dust to the atmosphere when the bags used in the baghouse filtration system were pulsed, which allowed dust to escape into the work areas many times each hour. 

The baghouse filters are designed to collect the smallest, and consequently most dangerous, 

dust particles. Yet, the CSB found that the baghouses were often out of service. Employees 

reported that the baghouse associated with bucket elevator #12 was out of service sporadically for the 7 days leading up to the fatal incident on January 31, 2011, allowing fine 

combustible iron dust to remain in the area, from which it was dispersed when the elevator 

was restarted during maintenance. 

4.3.4 PERSONAL PROTECTIVE EQUIPMENT

4.3.4.1 Flame Resistant Clothing (FRC)

Workers in production-related operations wear flame resistant clothing 

(FRC) to reduce risk of thermal injury 

from flash fire incidents. As part of the 

Personal Protective Equipment (PPE) 

Standard (29 CFR 1910.132), OSHA 

requires employers to provide workers 

with FRC in workplaces when flash fire 

or explosion hazards are present. 

FRC can reduce the severity of burn injuries sustained during a flash fire when engineering 

and administrative controls fail. FRC, usually worn as coveralls, is made of treated natural or 

synthetic fibers that resist burning and withstand heat. 

There are two NFPA standards that provide guidance on the design and use of FRC. NFPA 

2112, Standard on Flame-Resistant Garments for Protection of Industrial Personnel Against 

Flash Fire, provides the minimum requirements for the design, testing, and certification of 

FRC. NFPA 2113, Standard on Selection, Care, Use, and Maintenance of Flame-Resistant 

Garments for the Protection of Industrial Personnel Against Flash Fire, provides guidance 

for the selection, use, and maintenance of FRC. The 2009 edition of NFPA 484 included a 

requirement for workers to wear FRC if working in metal dust-handling operations, but it did 

FIGURE 20

Iron dust on structural 

supports, February 3, 2011.

FIGURE 18 (LEFT)

Iron dust on rafters, 

February 3, 2011.

FIGURE 19 (RIGHT)

Iron dust on overhead 

surfaces, February 3, 2011.

000562
CSB s Hoeganaes Corporation Case Study 17

Hoeganaes Corporation Case Study December 2011

not specifically reference NFPA 2112 or 2113 in the standard. The 2012 edition of NFPA 484 

requires that new and existing facilities covered by the standard adhere to the requirements of 

NFPA 2113 for FRC.

Hoeganaes employees were required to wear FRC, and the injured and fatally injured 

employees were wearing the Hoeganaes-designated FRC at the time of the 2011 flash fire 

incidents. Though FRC is intended to reduce the severity of thermal injuries, five severely 

burned employees died following the January and May incidents. The specific FRC worn did 

not provide any significant protection against the combustible iron dust flash fires and the 

hydrogen explosion at Hoeganaes.

4.3.5 1992 INCIDENT

On May 13, 1992, a hydrogen explosion and iron dust flash fire similar to the May 2011 

incident in Gallatin severely burned an employee working at the Hoeganaes facility in 

Cinnaminson, NJ. CSB investigators interviewed the injured employee from the 1992 incident 

and learned that a hydrogen explosion event in a furnace dispersed and ignited significant 

accumulations of iron dust which resulted in thermal burns over 90% of his body. The injured 

worker spent a year in a burn unit and is still recovering from his burn injuries.

4.3.6 INSURANCE INSPECTIONS

4.3.6.1 Allianz

In November 2008, Allianz, a German-based risk insurer, conducted a routine audit of the 

Hoeganaes facility. The audit report noted that improved housekeeping was needed in several 

areas of the facility. In the list of risk improvement proposals, the Allianz report stated, “The 

potential for explosions caused when clouds of powdered metal are aroused in equipment... 

should be analyzed by an independent consultant.” The proposal recommended an independent 

dust hazard analysis and a subsequent hazard study to identify suitable mitigation techniques, 

should the iron dust in the facility be found to be explosible.

In January 2009, Hoeganaes collected samples of base iron dust, furnace-feed dust, and 

baghouse dust and commissioned explosibility testing as Allianz recommended (Table 3). In 

September 2010, Hoeganaes requested another test of various powdered metals. Test results 

showed that 5 of the 9 iron samples had KSt values greater than 1. 

The Allianz audit findings initiated several action items as part of the Hoeganaes Combustible 

Dust Program at the Gallatin facility. The scope of the program was to understand and align 

company practices with the OSHA Combustible Dust National Emphasis Program (NEP) 

(Section 4.5.1). Action items included combustible dust training for employees and understanding relevant NFPA codes at the facility. Although the majority of the Hoeganaes Combustible 

Dust Program action items had planned completion dates prior to the 2011 flash fire incidents, 

the program did not effectively mitigate the combustible dust hazards at the facility. 

HOEGANAES IRON DUST EXPLOSIBILITY TESTING

(20-L)

Sample Base Iron Furnace Feed Baghouse Dust

Pmax(bar) 1.9 2.8 3.8

܎P/܎t(bar/s) 273 63 80

KSt (bar m/s) 74 17 22

TABLE 3

Dust explosibility test 

results commissioned by 

Hoeganaes in 2009.

000563
CSB s Hoeganaes Corporation Case Study 18

Hoeganaes Corporation Case Study December 2011

4.4 FIRE CODES

4.4.1 NFPA 484

NFPA 484, Standard for Combustible Metals, an industry consensus standard, applies to 

facilities that produce, process, finish, handle, recycle, and store metals and alloys in a form 

capable of combustion or explosion. NFPA codes involving combustible metal dusts have 

evolved several times since the 1946 The Prevention of Dust Explosions (Section 4.3.1). In the 

1950s, the NFPA divided the 1946 document into several codes for specific materials, such 

as magnesium and titanium. In 2002, all of the NFPA combustible metal dust standards were 

combined into NFPA 484. NFPA 484 describes the tests and methods for determining metal 

dust combustibility and provides guidelines for preventing dust explosions and flash fires for 

all types of metal dusts. 

The CSB commissioned testing similar to the 2009 edition of NFPA 484 explosibility determination test requirements (Section 4.1). The testing concluded that the Hoeganaes metal 

dust sample is explosible and therefore NFPA 484 applies. 

Had Hoeganaes voluntarily followed, or been required to follow, NFPA 484 by the GFD 

(authority having jurisdiction28) the January and March incidents may have been prevented, 

and the effects of the May accident could have been reduced. As with many NFPA standards, 

NFPA 484 has a retroactivity clause for certain 

chapters, stating that requirements for all 

existing equipment, installed prior to the current edition of the code, are not enforceable by 

the authority having jurisdiction, unless it is 

determined that the existing situation presents an 

unacceptable safety and health hazard. 

Neither the City of Gallatin nor the GFD identified combustible metal dust as a concern or 

hazard during previous inspections conducted 

prior to the 2011 incidents (Section 4.4.3).

Chapter 12 of NFPA 484, “Requirements for 

Combustible Metals” includes provisions to control or eliminate dust fires and explosions. 

It requires engineering controls for dust-producing processes such as enclosures and capture 

devices connected to dust collection systems. The standard describes recommended housekeeping practices and frequencies, and how to control ignition sources. 

Practices at Hoeganaes did not conform to the safety recommendations set forth in NFPA 

484. Under “Building Construction,” NFPA 484 requires that floors, elevated platforms, and 

gratings where dust can accumulate be designed to minimize dust accumulations and facilitate 

cleaning.29 The Hoeganaes facility has numerous flat surfaces overhead upon which the CSB 

investigators observed significant accumulations of combustible iron dust. Since Hoeganaes has 

an iron powder-producing operation, specific engineering controls outlined in NFPA 484 apply 

to the machines that manufacture and convey the PM. All machines that produce fine particles 

of iron should be connected to a dust collection system that has the appropriate velocity to 

capture all dust. The CSB investigators observed that some of the PM conveyance equipment at 

FIGURE 21

Photo of equipment 

obscured by airborne dust, 

taken by CSB investigators, 

February 7, 2011.

28The organization, office, or individual responsible for approving equipment, materials, an installation, or a procedure.

29Chapter 12 is not retroactive to existing facilities.

000564
CSB s Hoeganaes Corporation Case Study 19

Hoeganaes Corporation Case Study December 2011

Hoeganaes’s was not enclosed; as such, it was not designed to control significant dust emissions, 

and employees further reported that baghouse dust collectors were often down for maintenance. 

This section of the standard also requires that dust collection systems be located outdoors; at 

Hoeganaes, the baghouses are located inside, posing a serious fire and explosion hazard. 

Chapter 13 of NFPA 484 includes provisions for housekeeping and applies to all new and existing facilities. It requires that accumulations of excessive dust on any portions of buildings or 

machinery not regularly cleaned in daily operations be minimized and that fugitive dust not be 

allowed to accumulate. Hoeganaes used a vacuuming service to reduce quantities of dust that 

had accumulated. However, inadequate dust collection systems and dust leakages from equipment produced accumulations beyond what could be controlled by the limited housekeeping 

service that was being provided. 

4.4.2 ELECTRICAL CLASSIFICATION

The classification of combustible dust hazardous locations is based on the criteria established 

by article 500 of NFPA 70, National Electric Code (NEC). The NEC defines hazardous locations as areas “where fire or explosion hazards may exist due to flammable gases or vapors, 

flammable liquids, combustible dust, or ignitable fibers or flyings.” The classifications are 

broken down into three hazardous material classes:

UÊ
>ÃÃÊÊqÊy>>LiÊ}>ÃÊÀÊÛ>«À

UÊ
>ÃÃÊÊqÊVLÕÃÌLiÊ`ÕÃÌ

UÊ
>ÃÃÊÊqÊwLiÀÃÊ>`ÊyÞ}Ã

Each class is further categorized into one of two divisions, based on operating conditions: 

UÊÛÃÊ£ÊqÊ À>\Ê>Ài>ÃÊÜiÀiÊÌiÊV>ÃÃwi`Ê>â>À`ÕÃÊ>ÌiÀ>ÊÃÊiÞÊÌÊLiÊ

 present under normal operating conditions

UÊÛÃÊÓÊqÊLÀ>\Ê>Ài>ÃÊÜiÀiÊÌiÊV>ÃÃwi`Ê>â>À`ÕÃÊ>ÌiÀ>ÊÃÊiÞÊÌÊLiÊ

 contained and present only through accidental release

With the proper evaluation of electrically classified areas in an operating facility, appropriately 

rated equipment can be installed.

4.4.2.1 Combustible Dust

NFPA 499, Classification of Combustible Dusts and of Hazardous (Classified) Locations for 

Electrical Installation in Chemical Process Areas, specifies the type of electrical equipment acceptable in atmospheres containing combustible dust. It applies to locations where combustible 

dusts are produced, processed, and handled, or where surface accumulations of dust could be 

ignited by electrical equipment. Based on the requirements of NFPA 499 and the NEC, classified electric services and equipment would be required in a facility where combustible metal 

dust was present. Specifically, NFPA 499 states that Division 1 electrical equipment should be 

used in areas where combustible dust can accumulate to 1/8 of an inch (3 mm).

OSHA 1910 Subpart S includes definitions and requirements for hazardous or electrically classified locations. To determine whether classified electrical equipment is needed for a combustible dust, a Class II combustibility test is conducted with dust samples from the facility and 

the explosion severity (ES) ratio calculated. An ES of greater than 0.5 signifies an appreciable 

explosion hazard, which means either that Class II electrical equipment must be installed or 

dust accumulations near electrical equipment must be prevented. ES values less than 0.5 are 

generally considered to be lower explosion hazards, and non-rated electrical equipment in 

those atmospheres is acceptable.

000565
CSB s Hoeganaes Corporation Case Study 20

Hoeganaes Corporation Case Study December 2011

In January 2009, Hoeganaes submitted samples for explosibility testing. Although several 

samples were determined to be explosible, the ES values were low, precluding the need for 

classified electrical installations in the Hoeganaes facility. The CSB tested iron dust samples 

and found an explosion severity ratio of 0.01 to 0.1, significantly less than the ratio that 

would require classified equipment under existing codes. 

4.4.2.2 Flammable Gases

Test results on the iron samples in the vicinity of the Hoeganaes incidents did not require 

the installation of classified electrical services. However, the flammable hydrogen in the 

band furnaces did. NFPA 497, Recommended Practice for the Classification of Flammable 

Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations 

in Chemical Process Areas, lists hydrogen as a Class I flammable gas. Areas with Class I 

materials are further classified as Division 2 if the material is normally contained inside the 

equipment, or Division 1 if the material is normally present in flammable concentrations 

outside the equipment, such as during maintenance. Because hydrogen normally vents into the 

work area at one end of the annealing furnace, the area around the annealing furnace should 

have been designated as Class I Division 1, and the electrical equipment in that area designed, 

installed, and maintained to meet those recommendations. 

Moreover, the standard states that if no physical boundary surrounds a Division 1 area, the 

transitional area between Division 1 and an unclassified area is designated as Division 2. In 

addition, because the hydrogen piping system includes potential leak points, such as valves 

and flanges, these areas should have been designated as Class I Division 2. As such, large 

areas in the annealing building would be required to have Class I Division 1 or Class I 

Division 2 electrical service installed. 

Despite these classifications and their recommendations, the CSB observed inappropriate electrical installations, including large electrical cabinets that were open to the atmosphere and that 

had significant iron dust accumulations, incomplete conduit, and regular 110-volt cord-plug 

outlets instead of ignition-proof electrical devices approved by the NEC for Class I atmospheres.

4.4.3 INTERNATIONAL FIRE CODE

The International Fire Code (IFC) establishes minimum requirements for fire protection 

and prevention systems. The International Code Council (ICC), a membership association 

responsible for developing safety codes in residential and commercial buildings, publishes 

the IFC. Chapter 13 of the IFC, “Combustible Dust-Producing Operations,” (2006 edition) 

briefly addresses the prevention of ignition sources and housekeeping for areas where combustible dust is generated, stored, manufactured, or handled.30 The IFC also references several 

NFPA standards, such as NFPA 484, but language in section 1304 is vague as to whether the 

compliance with the listed NFPA standards is mandatory or voluntary. The IFC authorizes the 

authority having jurisdiction, such as the fire department or municipality, to enforce “applicable provisions” of these NFPA standards; the word “authorizes” does not carry the same 

weight as “shall enforce” and might be interpreted as a discretionary rather than mandatory 

code requirement. 

Companies are required to comply with the IFC only if promulgated through local, state, or 

federal regulations.31 The State of Tennessee Division of Fire Prevention and the City of Gallatin 

both adopted the 2006 version of the IFC into their codes. Though the general precautions for 

housekeeping and ignition sources are required through code adoption of the IFC, the noted 

30Combustible Dust-Producing Operations” is located in Chapter 22 of the IFC 2012 edition.

31In a previous investigation of a serious dust explosion at West Pharmaceutical Services in North Carolina in 2003, the CSB recommended that the state require mandatory compliance with the detailed provisions of the relevant NFPA dust standard (NFPA 654) 

rather than the much briefer and less prescriptive requirements of IFC Chapter 13.

000566
CSB s Hoeganaes Corporation Case Study 21

Hoeganaes Corporation Case Study December 2011

NFPA standards could be interpreted as voluntary. The Tennessee Fire Code specifically declares 

that the state does not enforce “optional or recommended” standards or practices. 

Practices at the Hoeganaes facility did not conform with the requirements set forth in Chapter 

13 of the IFC. The code prohibits devices using an open flame and the use of spark-producing 

equipment in areas with combustible dust. It also states that accumulated combustible dust 

will be kept to a minimum inside buildings. However, adhering to the much more detailed 

design and engineering requirements of NFPA 484 would have further reduced the likelihood 

that the three serious incidents would have occurred.

At the time of the 2011 flash fire incidents, the Hoeganaes facility was operating under the 

provisions of the 2006 IFC. The GFD has the authority to inspect facilities against the IFC, issue 

violations, and stop-work orders if buildings or operations are declared unsafe based on the 

code’s provisions. All construction and design provisions apply to new or existing structures if, 

in the opinion of the code official, a distinct hazard to life or property exists. All administrative, 

operational, and maintenance provisions apply to new and existing conditions and operations. 

For the City of Gallatin, the fire chief is responsible for enforcement of the IFC. CSB investigators reviewed the GFD’s inspection history at the Hoeganaes facility. The fire department 

conducted three inspections in the previous 12 years, in 1999, 2002, and 2011. The 2011 

inspection was performed just two weeks prior to the May 27, 2011, incident. The report for 

this inspection documented observations at the facility related to fire suppression and emergency egress, but did not mention combustible dust hazards even after the January and March 

2011 incidents. The CSB found no evidence that the GFD inspected Hoeganaes against the 

provisions of the 2006 IFC for the hazards associated with combustible metal dust, electrical 

installation, and operations that use flammable gases.

4.5 REGULATORY OVERSIGHT

4.5.1 OSHA

4.5.1.1 Combustible Dust

In 2006, following three catastrophic dust explosions that claimed 14 lives in 2003, the CSB 

issued its Combustible Dust Hazard Study. The study identified 281 dust fires and explosions in 

the U.S. between 1980 and 2005 that resulted in 119 fatalities and 718 injures. 

The absence of an OSHA comprehensive combustible dust standard was a key finding in the 

2006 study and resulted in a CSB recommendation to OSHA to initiate rulemaking for a 

general industry combustible dust standard. The recommendation remains “open-acceptable”32 

as of the publication of this report. 

A significant reduction in grain dust incidents resulted from a prior dust regulation enacted by 

OSHA for grain handling facilities. In 1987, OSHA promulgated a grain facilities standard 

in response to a series of major grain dust explosions. A 2003 OSHA analysis of grain dust 

incidents showed that fatalities dropped 60 percent after the regulation was enacted.

Another recommendation from the 2006 CSB Combustible Dust Study was for OSHA to 

develop a national special emphasis program33 (SEP) to address dust in industry while the 

comprehensive standard was being developed. In October 2007, OSHA initiated a Combustible 

Dust National Emphasis Program (NEP) to target industries that generate, store, or handle 

combustible dusts. The program provides guidance to OSHA inspectors about how to apply 

32In 2009, the CSB voted to change the status of the OSHA recommendation to “open-acceptable” after OSHA initiated an advance 

notice of proposed rulemaking (ANPR) for the combustible dust regulation.

33SEPs and NEPs are not regulations but rather are enforcement tools that allow OSHA to focus resources on inspections.

000567
CSB s Hoeganaes Corporation Case Study 22

Hoeganaes Corporation Case Study December 2011

existing safety statutes or standards, such as the General Duty Clause (OSH Act 5(a)(1)) and the 

Walking-Working Surfaces standard (29 CFR 1910.22), to facilities with combustible dust. 

Although the scope of the NEP applies to various types of combustible dusts including metal 

dusts at Hoeganaes, only those facilities assigned to particular North American Industry 

Classification System (NAICS) codes are specifically targeted for inspections by OSHA under 

the NEP. These NAICS codes classify facilities by primary business activity. If a facility that 

handles combustible dust is not included in the NAICS code list, OSHA can initiate an NEP 

inspection only as a result of a complaint, referral, or occupational injury. The NAICS code 

for the Hoeganaes Gallatin facility (331111, Iron and Steel Mills) is not included in the list of 

industries targeted by the NEP, although similar industries that handle metals are. According 

to the U.S. Census Bureau 2007 Economic Census, there were 352 facilities in the Iron and 

Steel Mills industry code (331111) employing over 106,000 workers. 

The CSB 2006 dust study found that 20 percent of documented dust incidents from 1980 to 

2005 occurred in the metals industry. During that period, the CSB documented three iron dust 

incidents that resulted in three fatalities and four injuries. One of those documented incidents 

occurred at the Hoeganaes Gallatin facility in 1996 when iron powder caught fire in a dust 

collector and one worker received a smoke inhalation injury.

In February 2008, a catastrophic sugar dust explosion at Imperial Sugar killed 14 and injured 

36. A month later, OSHA revised and reissued the Combustible Dust NEP to include facilities 

that handle sugar. As a result, OSHA notified all facilities covered by the sugar industry codes 

that they were subject to inspection.

The Combustible Dust NEP is the only national OSHA program to specifically promote effective combustible dust hazard management. OSHA did not initiate rulemaking on combustible 

dust, as the CSB had recommended in November 2006, until April 2009. In its final report on 

the Imperial Sugar disaster in September 2009, the CSB recommended that OSHA “proceed 

expeditiously” with the new dust standard. Although OSHA issued an advance notice of 

proposed rulemaking (ANPR) for combustible dust in October 2009 and has since convened 

various stakeholder meetings, no proposed or final rule has been published. 

Combustible dust fires and explosions have continued to occur at industrial facilities across the 

country; since issuing the 2006 CSB Combustible Dust Study, the CSB has recorded a number 

of significant combustible dust incidents. Until a combustible dust standard is enacted, the NEP 

remains OSHA’s primary tool for addressing combustible dust in the workplace.

4.5.1.2 Process Safety Management

The Process Safety Management Standard, 29 CFR 1910.119 (PSM), is an OSHA regulation 

for processes that contain highly hazardous materials or significant quantities of flammables. 

The intent of PSM, as stated in the standard, is “preventing or minimizing the consequences 

of catastrophic releases of toxic, reactive, flammable, or explosive chemicals.” PSM applies 

to processes using or producing any of 137 listed highly hazardous chemicals at or above 

threshold quantities and processes with flammable liquids or gases onsite in quantities of 

10,000 pounds or more in one location. If applied to Hoeganaes, elements of PSM would 

have required practices and procedures that could have prevented or lessened the severity of 

the May 27, 2011 incident.

In the May 2011 incident, there was a hydrogen leak and subsequent hydrogen explosion and 

dust flash fires that ultimately killed three workers. The hydrogen provided to the Hoeganaes 

facility originates from an onsite generation and storage unit, owned and operated by a 

000568
CSB s Hoeganaes Corporation Case Study 23

Hoeganaes Corporation Case Study December 2011

contractor on land leased from Hoeganaes. Since the hydrogen generation facility’s total 

intended operational capacity exceeds 10,000 pounds of hydrogen, it is covered by PSM.

4.5.2 TOSHA

Tennessee is one of 24 states with a state-specific occupational safety and health plan. It 

develops and operates its own safety and health programs with approval from federal OSHA.

In November 2011, TOSHA issued citations to the Hoeganaes Gallatin Facility for the May 27, 

2011, incident. Hoeganaes received 15 OSHA PSM Standard violations related to the hydrogen 

system. OSHA concluded that the company lacked appropriate procedures to ensure mechanical integrity of the hydrogen piping, failed to develop an emergency response plan for leak 

detection and response, and did not perform a hazard assessment on the hydrogen process.

Although the Combustible Dust NEP encourages but does not require state plans to adopt the 

NEP, Tennessee OSHA adopted the dust NEP in March 2008.

The NEP allows OSHA Area Offices to add NAICS codes to the list of facilities targeted by 

the NEP. However, TOSHA has not added the NAICS code that includes Hoeganaes as of the 

issuance of this study. 

4.5.3 METAL DUST AWARENESS

Since Hoeganaes has been in operation, several opportunities have arisen to increase awareness and address metal dust issues at the facility through technical literature, audits, inspections, and regulatory oversight. These resources have not been effectively used by Hoeganaes. 

Gaps in codes and regulations, inadequate inspections, and poor hazard recognition all 

contributed to the three incidents at the Gallatin facility. 

Table 4 lists a timeline of events from 1956 to the present related to combustible metal dust 

and the lack of effective controls at Hoeganaes until the third incident in May 2011.

000569
CSB s Hoeganaes Corporation Case Study 24

Hoeganaes Corporation Case Study December 2011

4.6 METAL POWDER PRODUCERS ASSOCIATION

The Metal Powder Producers Association (MPPA) is one of six trade associations that make up 

the Metal Powder Industries Federation (MPIF). MPPA membership is open to manufacturers of 

metal powders, metal flakes, metal fibers, or non-metallic powder additives used with these materials. The stated objective of the MPPA is to “arrange for the collection and dissemination of 

information pertaining to the metal powder producing industries; provide technical facts, data, 

and standards, fundamental to metal powders and to the applications of metal powders...”36

TABLE 4

Timeline of metal dust 

publications, oversight, 

and opportunities to 

address metal dust 

hazards in industry and at 

Hoeganaes.

34OSHA Office of Program Evaluation, Regulatory Review of OSHA’s Grain Handling Facilities Standard (29 CFR 1910.272). 

February 2003.

35OSHA regulated program to prevent noise induced hearing loss (29 CFR 1910.35).

36http://www.mpif.org/aboutmpif/mppa.asp.

KEY MILESTONES FOR COMBUSTIBLE METAL DUST CONTROL IN INDUSTRY AND AT HOEGANAES

Year Action

1946 NFPA publishes Code for the Prevention of Dust Explosions that includes general requirements for metal dusts

1958 American Chemical Society publication discusses powdered metals and iron dust 

explosibility

1980 Hoeganaes Gallatin facility established

1987 OSHA promulgates Grain Dust Standard, which decreases the number of explosions 44% 

and fatalities 60%34

1992 Hydrogen explosion and iron dust flash fire severely burns employee at the Hoeganaes 

facility in Cinnaminson, NJ

1996 Employee of Hoeganes Gallatin facility suffers smoke inhalation in dust collector fire. 

Metal dust ignites inside dust collector (ignited during a cutting operation)

1999 Gallatin FD inspects Hoeganaes; no mention of dust accumulations

2002 Gallatin FD inspects Hoeganaes; no mention of dust accumulations

2002 NFPA 484 is issued which addresses additional combustible metals that would include 

iron dust

2006 The CSB issues recommendation to OSHA to promulgate a comprehensive combustible 

dust standard

2006 City of Gallatin adopts International Building and Fire Codes

2007 OSHA issues Combustible Dust National Emphasis Program (NEP)

2008 Tennessee OSHA adopts federal Combustible Dust NEP (March)

2008 Tennessee OSHA inspects Hoeganaes facility. Conducts respirable metal dust sampling. 

Cites Hoeganaes for hearing conservation35 (Oct.) No observation of a combustible dust 

hazard

2008 Allianz conducts insurance audit at Hoeganaes, recommends combustible dust testing 

and independent consultant (Nov.)

2009 Hoeganaes conducts combustible dust testing of three iron powder samples as recommended by 2008 Allianz audit; all three samples found to be combustible.

2010 Hoeganaes conducts combustible dust testing of 23 powdered metals; 5 of 9 iron samples 

found to be combustible. No substantial actions to mitigate combustible dust hazard

2011 January 31 incident; fatal combustible dust flash fire at Hoeganaes Gallatin facility

2011 March 29 incident; combustible dust flash fire at Hoeganaes Gallatin facility

2011 Gallatin FD inspects Hoeganaes, no mention of dust accumulations (May 11)

2011 May 27 incident; fatal hydrogen explosion/combustible dust flash fire at Hoeganaes 

Gallatin facility

000570
CSB s Hoeganaes Corporation Case Study 25

Hoeganaes Corporation Case Study December 2011

To achieve this, the MPPA offers a monthly newsletter and bi-annual meetings (fall and spring) 

to promote shared learning within the PM industry. In recent years, the spring meeting, which 

spotlights many safety topics, has begun focusing on the issue of combustible dust hazards in 

the PM industry. The MPPA has sought out external combustible dust expertise and OSHA has 

presented and participated in its safety meetings. 

5.0 KEY FINDINGS

Over the course of investigating the events at the Hoeganaes facility, the CSB made the following key findings:

1. Significant accumulations of combustible iron powder at the Hoeganaes facility fueled 

 fatal flash fires when lofted near an ignition source.

2. Hoeganaes facility management were aware of the iron powder combustibility hazard 

two years prior to the fatal flash fire incidents but did not take necessary action to 

mitigate the hazard through engineering controls and housekeeping. 

Î°Êi}>>iÃÊ``ÊÌÊÃÌÌÕÌiÊ«ÀVi`ÕÀiÃÊqÊÃÕVÊ>ÃÊVLÕÃÌLiÊ}>ÃÊÌÀ}ÊqÊÀÊÌÀ>-

ing for employees to avoid flammable gas fires and explosions. 

4. OSHA did not include iron and steel mills (NAICS code 331111), the industry classification code for Hoeganaes, in its Combustible Dust National Emphasis Program when it 

was first issued in 2007 or when it was re-issued in 2008. 

5. The 2006 International Fire Code Chapter 13, Combustible Dusts, which was adopted 

by the City of Gallatin at the time of the incidents, does not clearly require jurisdictions to 

enforce the more comprehensive and rigorous NFPA standards for the prevention of dust 

fires and explosions.

6. The Tennessee Fire Code and the City of Gallatin do not enforce “optional or recommended” standards or practices of the IFC.

7. The Gallatin Fire Department inspected the Hoeganaes facility after the first two iron 

powder flash fires but did not cite or otherwise address combustible dust hazards present 

at the facility just weeks before the third fatal hydrogen explosion and dust flash fire.

8. The flame-resistant clothing (FRC) supplied by Hoeganaes to its employees did not 

provide any significant protection against the combustible iron dust flash fires and the 

hydrogen explosion that caused the fatalities.

9. GKN and Hoeganaes did not provide corporate oversight to ensure the Hoeganaes 

Gallatin facility was adequately managing combustible dusts prior to and throughout the 

succession of serious incidents at the Gallatin facility.

6.0 RECOMMENDATIONS

6.1 OSHA 

2011-4-I-TN-R1

Ensure that the forthcoming OSHA Combustible Dust Standard includes coverage for combustible metal dusts including iron and steel powders.

000571
CSB s Hoeganaes Corporation Case Study 26

Hoeganaes Corporation Case Study December 2011

2011-4-I-TN-R2 

Develop and publish a proposed combustible dust standard for general industry within one year of the approval of this case study. 

2011-4-I-TN-R3 

Revise the Combustible Dust National Emphasis Program (NEP) to add industry codes for

facilities that generate metal dusts (e.g., North American Industrial Classification System,

NAICS, code 331111 Iron and Steel Mills, and other applicable codes not currently listed).

Send notification letters to all facilities nationwide under these codes to inform them of the

hazards of combustible metal dusts and NEP coverage.

6.2 INTERNATIONAL CODE COUNCIL

2011-4-I-TN-R4 

Revise IFC Chapter 2237 Combustible Dust Producing Operations; Section 2204.1 Standards, 

to require mandatory compliance and enforcement with the detailed requirements of the 

NFPA standards cited in the chapter, including NFPA 484.

6.3 TOSHA

2011-4-I-TN-R5 

Revise the state-adopted Dust National Emphasis Program (NEP) to add industry codes for

facilities that generate metal dusts (e.g., North American Industrial Classification System,

NAICS, code 331111 Iron and Steel Mills, and other applicable codes not currently listed).

Send notification letters to all facilities statewide under these codes to inform them of the

hazards of combustible metal dusts and NEP coverage.

6.4 HOEGANAES

2011-4-I-TN-R6 

Conduct periodic independent audits of the Hoeganaes Gallatin facility for compliance with 

the following NFPA standards, using knowledgeable experts, and implement all recommended corrective actions:

UÊÊ *Ê{n{]ÊStandard for Combustible Metals, Metal Powders, and Metal Dusts

UÊÊ *Ê{]ÊRecommended Practice for the Classification of Combustible Dusts and of 

Hazardous Locations for Electrical Installations in Chemical Process Areas

UÊÊ *Ê{Ç]ÊRecommended Practice for the Classification of Flammable Liquids, 

Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in 

Chemical Process Areas

UÊÊ *ÊÓ]ÊHydrogen Technologies Code

UÊÊ *ÊÓ££Î]ÊStandard on Selection, Care, Use, and Maintenance of Flame-Resistant 

Garments for Protection of Industrial Personnel Against Flash Fire

37Combustible Dust Producing Operations, Chapter 13 of the IFC, was moved to Chapter 22 in later editions.

000572
CSB s Hoeganaes Corporation Case Study 27

Hoeganaes Corporation Case Study December 2011

2011-4-I-TN-R7 

Develop training materials that address combustible dust and plant-specific metal dust hazards 

and train all employees and contractors. Require periodic (e.g., annual) refresher training for all 

employees and contractors. 

2011-4-I-TN-R8 

Implement a preventive maintenance program and leak detection and leak mitigation 

procedures for all flammable gas piping and gas processing equipment.

2011-4-I-TN-R9 

Develop and implement a near-miss reporting and investigation policy that includes the 

following at a minimum:

UÊ Ensure facility-wide worker participation in reporting all near-miss events and operational disruptions (such as significant iron powder accumulations, smoldering fires, or 

unsafe conditions or practices) that could result in worker injury.

UÊÊ
ÃÕÀiÊÌ>ÌÊÌiÊi>ÀÃÃÊÀi«ÀÌ}Ê«À}À>ÊÀiμÕÀiÃÊ«À«ÌÊÛiÃÌ}>ÌÃ]Ê>ÃÊ>««À«À-

ate, and that results are promptly circulated throughout the Hoeganaes Corporation.

UÊÊ
ÃÌ>LÃÊÀiÃÊ>`ÊÀiÃ«ÃLÌiÃÊvÀÊÌiÊ>>}iiÌ]ÊiÝiVÕÌ]Ê>`ÊÀiÃÕÌÊvÊ>Ê

recommendations from near-miss investigations

UÊÊ
ÃÕÀiÊÌiÊi>ÀÃÃÊ«À}À>ÊÃÊ«iÀ>Ì>Ê>ÌÊ>ÊÌiÃÊ­i°}°Ê}ÌÃ]ÊÜiii`Ã]Ê

holiday shifts).

6.5 METAL POWDER PRODUCERS ASSOCIATION (MPPA)

2011-4-I-TN-R10 

Communicate the findings of this report to all your members, e.g. through a safety article in 

an upcoming monthly newsletter. 

6.6 CITY OF GALLATIN, TN

2011-4-I-TN-R11 

Require all facilities covered by IFC Chapter 13 (2006 edition) to conform to NFPA standards 

for combustible dusts including NFPA 484.

6.7 GALLATIN FIRE DEPARTMENT

2011-4-I-TN-R12 

Ensure that all industrial facilities in the City of Gallatin are inspected periodically against the 

International Fire Code. All facility inspections shall be documented.

2011-4-I-TN-R13 

Implement a program to ensure that fire inspectors and response personnel are trained to 

recognize and address combustible dust hazards.

000573
CSB s Hoeganaes Corporation Case Study 28

Hoeganaes Corporation Case Study December 2011

APPENDIX A: DETERMINATION OF IRON POWDER

EXPLOSIBILITY FROM PRESSURE RATIO CALCULATIONS

BACKGROUND

The CSB commissioned testing of four Hoeganaes iron dust samples in a 20-L Test Chamber 

(ASTM Standard E1226-10, Standard Test Method for Explosibility of Dust Clouds). The 

test method states that dust explosibility can also be characterized through the calculation of 

a pressure ratio (PR). The pressure ratio calculation is also known as the explosibility screening test (Section 13). The 20-L test chamber records the maximum explosion pressure reached 

during a single deflagration test at a dust concentration of 1,000 and 2,000 g/m3 . 

If PR > 2, the dust is considered explosible

If PR < 2, it is classified as “not explosible” under those test conditions and the standard 

goes on to caution that it is not necessarily “not combustible” and still may be capable of 

deflagrative combustion.

CALCULATIONS

The CSB calculated the pressure ratio based on the 20-L test results from the baghouse dust.

According to E1226-10:

Pressure ratio = PR = (Pex,a − 6Pignitor) / Pignition

Where:

Pex,a = maximum explosion pressure (bar absolute)

6Pignitor = maximum pressure rise in chamber due to igniter = 2.5 (bar absolute)

Pignition = absolute pressure at the time of ignition = 0 bar gauge = 1.0123 (bar absolute)

The test value Pmax,a already corrects for the igniter pressure:

Pmax,a = (Pex,a − 6Pignitor)

Pmax,a values obtained from 20L testing of Hoeganaes dust:

Convert bar gauge to bar absolute:

0 bar gauge = 1.0125 bar absolute

3.1 bar gauge + 1.01325 = 4.1 bar absolute

3.8 bar gauge + 1.0125 = 4.8 bar absolute

Pmax, a DUST CONCENTRATION

3.1 bar gauge 1,000 g/m3

3.8 bar gauge 2,000 g/m3

000574
CSB s Hoeganaes Corporation Case Study 29

Hoeganaes Corporation Case Study December 2011

The equation reduces to:

PR = Pmax,a / Pignition

Thus:

PR1,000 = 4.1/1.01325

PR1,000 = 4.0

PR2,000 = 4.8/1.01325

PR2,000 = 4.7

The pressure ratios at 1,000 and 2,000 g/m3

 are both greater than 2 and the iron dust sample 

is considered explosible based on ASTM E1226.

000575
CSB s Hoeganaes Corporation Case Study 30

Hoeganaes Corporation Case Study December 2011

APPENDIX B: DETERMINATION OF IRON POWDER

CLASSIFICATION FROM EXPLOSION SEVERITY

CALCULATION

BACKGROUND

The CSB commissioned testing of four Hoeganaes iron dust samples in a 20-L Test 

Chamber (ASTM Standard E1226-10, Standard Test Method for Explosibility of 

Dust Clouds). OSHA cites the National Materials Advisory Board (NMAB) 353-3-80, 

Classification of Combustible Dusts in Accordance with the National Electric Code, for 

the determination of a Class II combustible dust location. The NMAB 353-3-80 states that 

Class II dusts can be characterized through the calculation of an explosion severity (ES). 

According to the NMAB 353-3-80: 

If ES > 0.5, the dust is considered an appreciable explosion hazard that requires suitable 

electrical equipment for Class II locations.

CALCULATIONS

The CSB calculated the pressure ratio based on the 20-L test results from the baghouse dust. 

According to NMAB 353-3-80: 

Explosion Severity = ES = 

Where:

Pmax = maximum explosion pressure, (bar gauge)

 = maximum rate of pressure rise, (bar gauge per second)

Reference dust = Pittsburgh coal dust

Pmax values obtained from 20L testing of Hoeganaes dust:

DUST SAMPLE Pmax ,P/,t

max

Hoeganaes Baghouse 3.5 bar gauge 68 bar gauge per second

Pittsburgh Coal 7.3 bar gauge 426 bar gauge per second

Pmax (sample) x

Pmax (reference dust) x

t܎

max (sample)

t܎

max (reference dust)

P܎

P܎

t܎

max (reference dust)

P܎

000576
CSB s Hoeganaes Corporation Case Study 31

Hoeganaes Corporation Case Study December 2011

Thus:

The explosion severity of the baghouse dust is less than 0.5 and the iron dust sample is not 

considered a Class II combustible dust.

238

3,110

ES = 

ES = 0.077

(3.5 bar gauge) x (68 ) s

bar gauge

ES = 

(7.3 bar gauge) x (426 )

s

bar gauge

000577
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

VOLUME 2 

EXPLOSION AND FIRE AT THE MACONDO WELL

(11 Fatalities, 17 Injured, and Serious Environmental Damage) 

DEEPWATER HORIZON RIG

MISSISSIPPI CANYON BLOCK #252, GULF OF MEXICO

KEY ISSUES IN VOLUME 2 APRIL 20, 2010

• BOP TECHNICAL FAILURE ANALYSIS 

• BARRIER MANAGEMENT AT MACONDO 

• SAFETY CRITICAL ELEMENTS

REPORT NO. 2010-10-I-OS

6/5/2014

000578
Macondo Investigation Report Volume 2 June 5, 2014

[This page left intentionally blank.]

2 

000579
Macondo Investigation Report Volume 2 June 5, 2014

Volume 2

Technical findings on the 

Deepwater Horizon blowout 

preventer (BOP) with an 

emphasis on the effective 

management of safety critical 

elements

3 

000580
Macondo Investigation Report Volume 2 June 5, 2014

[This page left intentionally blank.]

4 

000581
Macondo Investigation Report Volume 2 June 5, 2014

Contents

VOLUME 2 .................................................................................................................................................. 3

ACRONYMS AND ABBREVIATIONS ................................................................................................... 10

1.1 Volume 2 Synopsis ........................................................................................................................ 13

1.2 Key Findings .................................................................................................................................. 14

2.0 CONTROLLING FORMATION PRESSURES WITH THE DEEPWATER HORIZON 

BLOWOUT PREVENTER ........................................................................................................... 17

2.1 BOP Sealing Elements ................................................................................................................... 19

2.2 The BOP as a Physical Barrier ....................................................................................................... 21

2.3 Functioning the Deepwater Horizon BOP ..................................................................................... 23

2.3.1 BOP Control System ......................................................................................................... 23

2.3.1.1 Functioning Solenoid Operated Valves ......................................................... 25

2.3.2 BOP: Closing the Blind Shear Ram .................................................................................. 27

2.3.3 Initiating the AMF/Deadman Sequence ............................................................................ 27

2.4 Condition of the Well on April 20, 2010—Data Used to Recreate the Incident Events ................ 28

2.5 The Macondo Well Kicks—Incident Analysis of Well Control Response .................................... 28

3.0 THE BLOWOUT PREVENTER – FAILURE OF A BARRIER .................................................. 31

3.1 Correlating Physical Evidence from Macondo with the Events of April 20, 2010 ........................ 32

3.2 Failure Analysis of the Deepwater Horizon BOP .......................................................................... 34

3.2.1.1 Blue Pod: Disconnected Wires and the Drained Battery ............................... 36

3.2.1.2 Yellow Pod: Miswired High-Pressure Shear Closes Solenoid ...................... 37

3.2.1.3 Successful AMF/Deadman Tests on the Yellow Pod .................................... 38

3.2.1.4 Independent CSB Exemplar Solenoid Testing .............................................. 38

3.2.2 The AMF/deadman Successfully Fires on April 20, 2010 ................................................ 39

3.2.3 The AMF/deadman Fails to Seal the Well: Buckled Drillpipe ......................................... 43

3.3 Conclusion ..................................................................................................................................... 45

4.0 ESTABLISHING AND MAINTAINING EFFECTIVE BARRIERS .......................................... 47

4.1 Defining the Role of a Barrier: Major Accident Events ................................................................ 47

4.2 Barriers to Prevent or Mitigate MAEs ........................................................................................... 49

4.2.1 Visualizing Barriers using a Bowtie Diagram .................................................................. 52

4.2.2 Determining the Type and Number of Barriers to Reduce Risk ....................................... 55

5 

000582
Macondo Investigation Report Volume 2 June 5, 2014

4.2.3 Maintaining Effective Barriers ......................................................................................... 57

4.2.3.1 Barriers as Safety Critical Elements (SCEs) ................................................. 58

4.3 Conclusion ..................................................................................................................................... 61

5.0 DEEPWATER HORIZON BOP NOT TREATED AS A SAFETY CRITICAL ELEMENT ...... 62

5.1 Identification of a SCE................................................................................................................... 64

5.1.1 BOP Component Failure Identified in DWH Hazard Analysis ........................................ 64

5.1.2 DWH Hazard Analysis Did Not Address BOP Design Capabilities ................................ 65

5.2 Defining Performance Requirements of a SCE ............................................................................. 66

5.2.1 Drillpipe Exceeded Shearing Capabilities of DWH Blowout Preventer .......................... 66

5.2.2 Prescribing Minimum Reliability Requirements of a BOP .............................................. 68

5.3 Performance Assurance of an SCE ................................................................................................ 70

5.3.1 No Assurance Activities for the Critical AMF/Deadman Solenoid Valve ....................... 71

5.3.2 Current Deadman System Function Tests Are Inadequate ............................................... 72

5.3.3 Assurance Activities of Human Actions ........................................................................... 76

5.4 Gap Closure ................................................................................................................................... 77

5.5 Verification Activities—The Independent Competent Person ...................................................... 78

5.6 Conclusion ..................................................................................................................................... 79

6.0 ANALYSIS OF RECOMMENDED PRACTICES AND REGULATIONS REGARDING THE 

BOP AND OTHER SAFETY CRITICAL DEVICES .................................................................. 81

6.1 Lifecycle of SCEs under BSEE ..................................................................................................... 82

6.1.1 Hazard Analysis not Focused on Targeted Risk Reduction of Major Accident Events ... 82

6.1.1.1 Lack of Targeted Risk Reduction Requirements: Parallel Findings between 

the CSB Investigations ...................................................................................................... 84

6.1.2 Lack of Defined Performance Standards for all SCEs ...................................................... 85

6.1.3 Performance Assurance and Verification Needed for all SCEs ........................................ 86

6.1.4 Gap Closure Important for Continuous Improvement of SCE Effectiveness ................... 87

6.2 Regulatory Responses Post-Macondo: Prescriptive Change versus Continuous Improvement .... 88

6.2.1 BOP Shearing Capability—An Illustrative Example of Diverse Regulatory Responses . 89

6.2.2 Proposed Regulatory Changes Suggest US Recognition of the Importance of Lifecycle 

Management of Safety Critical Equipment ......................................................................................... 92

7.0 VOLUME 2 CONCLUSIONS: TECHNICAL SAFETY FAILURES REVEAL BROADER

REGULATORY GAPS ................................................................................................................. 93

6

000583
Macondo Investigation Report Volume 2 June 5, 2014

8.0 RECOMMENDATIONS ............................................................................................................... 95

APPENDIX 2-A: DEEPWATER HORIZON BLOWOUT PREVENTER FAILURE ANALYSIS ......... 98

APPENDIX 2-B: DEEPWATER HORIZON RBS 8D BOP MUX CONTROL SYSTEM REPORT ...... 99

APPENDIX 2-C: SCENARIOS WHEN TWO BSRS WOULD NOT BE OPTIMAL ............................ 100

REFERENCES ......................................................................................................................................... 101

7 

000584
Macondo Investigation Report Volume 2 June 5, 2014

Figures and Tables

Figures

Figure 2-1. The DWH BOP stack ............................................................................................................... 18

Figure 2-2. An annular preventer can seal the annular space around a drillpipe or an open hole. Pistons 

press up on the rubber component which pushes it inward to seal around the pipe or open 

hole. ......................................................................................................................................... 19

Figure 2-3. A pipe ram can seal the annular space around a drillpipe, but not an open hole without 

drillpipe present. ...................................................................................................................... 20

Figure 2-4.Control panel (left) and partial closeup of control panel on the Deepwater Horizon found in the 

driller’s cabin and on the bridge of the rig. These controls are used to activate the BOP. ...... 23

Figure 2-5. Pressing a pushbutton on a BOP control panel sent an electronic signal through the MUX 

cable down to the yellow and blue BOP control pods located in the LMRP. Accumulators on 

the BOP stack supplied hydraulic power to the control pods during emergencies. ................ 24

Figure 2-6. The top image depicts a solenoid with no current running through it. The plunger is down, and 

no fluid can flow through the solenoid. When actuated, current running through the solenoid 

produces a magnetic field which creates a force that pulls the plunger up, allowing fluid to 

flow. ......................................................................................................................................... 25

Figure 2-7. Simplified schematic of the control pod battery arrangement. ................................................. 26

Figure 2-8. Key operation events after reservoir flow began. ..................................................................... 29

Figure 3-1. (Left) Photograph of Y103 wire arrangement from Phase II testing with pins 1 and 4 

connected to white wires and 2 and 3 connected to black wires. (Right) Schematic of correct 

arrangement of wires, with pins 1 and 3 connected to white wires and 2 and 4 connected to 

black wires. .............................................................................................................................. 37

Figure 3-2. Miswiring in the blue pod caused the critical 27-volt battery to drain, rendering the pod 

inoperable during the incident. A drained 9-volt battery in the yellow pod left one of the coils 

in the miswired Y103 solenoid valve inoperable, allowing the other coil to activate 

unopposed and initiate closure of the blind shear ram. ........................................................... 40

Figure 3-3. The events that led to the likely partial closure of the BSR after the emergency AMF/deadman 

system activated on April 20. .................................................................................................. 42

Figure 3-4. The Deepwater Horizon BOP was designed to shear centered drillpipe (left) in the BSR and 

then seal the well. During the Phase I examination of the BOP, the drillpipe was found offcenter (right), causing the BSR to close only partially, leaving the well unsealed. ................ 43

Figure 3-5: Theoretically straight pipe with equal inside and outside pressure (left); real pipe with a curve 

imperfection with equal internal and external pressure (center); pipe buckling as a result of 

increased internal pressure (right). The black wedges show the relative change in length and 

area of the two sides of the pipe. ............................................................................................. 45

8 

000585
Macondo Investigation Report Volume 2 June 5, 2014

Figure 4-1. Hierarchy of Controls. .............................................................................................................. 51

Figure 4-2. Bowtie diagram depicting the relationships between hazards, barriers, and the major accident 

events they are intended to prevent. ........................................................................................ 53

Figure 4-3. Bowtie diagram showing potential decay mechanisms of the technical barriers intended to 

prevent a fault during temporary abandonment activities. ...................................................... 54

Figure 5-1. Simplified representation of the management system for the lifecycle of a safety critical 

element .................................................................................................................................... 63

Figure 5-2. Simplified schematic of the Cameron FAT procedure to test the AMF/deadman. .................. 75

Tables

Table 2-1. Various components of a BOP and their uses, (See Appendix 2-A for model numbers and 

capabilities of the DWH BOP elements) .................................................................................. 21

Table 3-1. In addition to the three phases of DWH BOP testing from May 2010 to April 2011, the CSB 

completed independent exemplar solenoid valve testing in September 2012. .......................... 35

Table 4-1. Excerpts from offshore regulations from the UK, Norway, and Australia that specifically 

require Major Accident Events be addressed; they are juxtaposed with US regulations that 

promote safety and environmental protection, but without a focus on MAEs. ......................... 49

Table 4-2. Recreated excerpts of Transocean's Risk Assessment for the DWH ......................................... 50

Table 5-1. Recreated excerpt of Transocean's MAHRA for the Deepwater Horizon ................................. 65

Table 5-2. Summary of emails sent between Transocean personnel regarding BSR shearing capability. . 68

Table 6-1. Excerpts from offshore regulations from the UK, Norway, and Australia concerning a required 

analysis.,

 .................................................................................................................................... 83

9 

000586
Macondo Investigation Report Volume 2 June 5, 2014

Acronyms and Abbreviations

ALARP As Low As Reasonably Practicable

AMF Automatic Mode Function

API American Petroleum Institute

BOEM Bureau of Ocean Energy Management (United States)

BOEMRE Bureau of Ocean Energy Management, Regulation, and Enforcement (United States); the 

US offshore safety regulator between June 18 and October 1, 2011a

BOP Blowout Preventer 

BSEE Bureau of Safety and Environmental Enforcement (United States); US offshore safety 

regulator since October 1, 2011b

BSR Blind Shear Ram 

CCPS Center for Chemical Process Safety

CSB U.S. Chemical Safety Board 

CSR Casing Shear Ram

DNV Det Norske Veritas

DOI Department of Interior (United States)

DOSH Division of Occupational Safety and Health 

DWH Deepwater Horizon

EDS Emergency Disconnect System

GoM Gulf of Mexico 

HSE Health Safety Executive (United Kingdom) 

LCM Loss Circulation Material

LMRP Lower Marine Riser Package

LOWC Loss of Well Containment 

MAHRA Major Accident Hazard Risk Assessment

a

 Department of Interior, Order No. 3302, Change of the Name of the Minerals Management Service to the Bureau 

of Ocean Energy Management, Regulation, and Enforcement (June 18, 2011), 

http://www.doi.gov/deepwaterhorizon/loader.cfm?csModule=security/getfile&PageID=35872. Accessed 

February 19, 2014. 

b The Reorganization of the former MMS, http://www.bsee.gov/About-BSEE/BSEEHistory/Reorganization/Reorganization/. Accessed February 19, 2014.

10 

 

000587
Macondo Investigation Report Volume 2 June 5, 2014

MGS Mud-Gas Separator

MAE Major Accident Event

MMS Minerals Management Service (United States); US offshore safety regulator at the time of 

the Macondo accident until June 18, 2011a

MODU Mobile Offshore Drilling Unit 

NOPSA National Offshore Petroleum Safety Authority (Australia) 

NOPSEMA National Offshore Petroleum Safety and Environmental Management Authority 

(Australia, successor to NOPSA) 

NTL Notice to Lessee

OCS Outer Continental Shelf

POSC Presidential Oil Spill Commission 

PSM Process Safety Management

PETU portable electronic test unit 

PLC programmable logic controllers

ppg pounds per gallon 

PSA Petroleum Safety Authority (Norway)

psi pounds per square inch

SCE safety critical element

SEM subsea electronic module 

SEMS Safety and Environmental Management System

SPPE Safety and Pollution Protection Equipment 

UK United Kingdom 

US United States

USCG United States Coast Guard

VBR Variable Bore Ram 

a Department of Interior, Order No. 3302, Change of the Name of the Minerals Management Service to the Bureau 

of Ocean Energy Management, Regulation, and Enforcement (June 18, 2011), 

http://www.doi.gov/deepwaterhorizon/loader.cfm?csModule=security/getfile&PageID=35872. Accessed 

February 19, 2014.

11 

 

000588
Macondo Investigation Report Volume 2 June 5, 2014

Volume 2 – Approach to Analysis

Macondo is an international problem whose lessons extend 

beyond the United States. The global business of offshore 

exploration and production continues to advance in 

complexity. Meanwhile, the catastrophic consequences of 

another incident on par with Macondo threaten not only the 

welfare of the workforce, public, and environment, but the 

industry’s long-term viability. The international nature of 

this business allows for all stakeholders to learn from each 

other—many companies operating offshore do so on a 

global level. Companies can bring their individual best 

practices wherever they go; the equipment, facilities, and 

people used to conduct offshore operations travel between 

regions as needed; and regulators worldwide have 

recognized the need to disseminate knowledge through 

information sharing forums.a

 

No one offshore region operates within a framework that 

provides an undisputed panacea to prevent all accidents. 

Challenges and undiscovered hazards exist in every offshore 

location. For example, within this volume, the CSB has 

identified a key weakness in BOP function testing 

promulgated in internationally accepted industry guidance. 

Regulatory regimes can only provide the foundation for 

effective major accident hazard management, and failures by 

any one company to carry out the intent of the regulatory 

requirements may occur in any offshore region. Yet a 

foundation is essential for ensuring that all those operating 

offshore are reducing risk to a level acceptable to 

themselves, the regulator, and society as a whole. Examining the strengths and weakness of the various 

major accident prevention approaches used by industry and the regulator—both in the US and 

elsewhere—can identify and improve attributes that provide for more effective safety management. This 

is a primary aim of the CSB’s overall investigation into the Macondo incident and the focus of this 

volume. 

a Some examples include the International Regulators’ Forum (http://www.irfoffshoresafety.com/) and the North Sea 

Offshore Authorities Forum (http://www.ptil.no/nsoaf/category999.html; http://www.ens.dk/en/oil-gas/healthsafety/international-cooperation-2/north-sea-offshore-authorities-forum). 

Volume 2 Overview

Chapter 1 – The focus of this volume and 

the key investigation findings that support 

the CSB analysis. 

Chapter 2 – The sealing capabilities of a 

BOP as a physical barrier and the incident 

events pertaining to the DWH BOP’s 

integrity at the time of the incident. 

Chapter 3 –The CSB failure analysis of the 

DWH BOP, and the implications for BOPs 

used offshore.

Chapter 4 – Concepts underlying technical, 

organizational and operational barriers for 

major accident prevention.

Chapter 5 – The lifecycle of a safety 

critical element and deficiencies in the 

treatment of Deepwater Horizon BOP 

emergencies systems. 

Chapter 6 – Recommended practices and 

regulations pre- and post-incident for the 

BOP and other safety critical elements. 

Chapter 7 –Major conclusions to illustrate 

important lessons for industry and the US 

regulator.

Chapter 8 – Recommendations for industry 

and the US regulator.

12 

 

000589
Macondo Investigation Report Volume 2 June 5, 2014

The CSB provides its failure analysis of the BOP to spark a global reexamination of how industry is 

managing safety critical elementsa as well as regulatory requirements and approaches used to ensure that 

these management practices are effective. 

1.1 Volume 2 Synopsisb

The Macondo well blowout began when the Deepwater Horizon (DWH) crew was in the final stages of 

temporarily abandoning the well so that a production facility could return later to extract oil and gas. BP’s 

temporary abandonment planc called for removing the upper portion of the drilling mud in the well before 

installing a surface cement plug.d The decision proved fateful because both BP and Transocean personnel 

on the DWH rig had misinterpreted test results e

 concerning the cement integrity at the bottom of the well. 

This error led the personnel to believe that the hydrocarbon bearing zone at the bottom of the well had 

been sealed when it was not. Ultimately, the blowout preventer (BOP) was the only physical barrier that 

could have potentially contained well fluids, but only if the crew or emergency systems could have 

successfully engaged it. f

 As the events of April 20, 2010 indicate, the BOP did not seal the well. 

In analyzing the BOP failure to seal the well during the incident, Volume 2 of the CSB Macondo Incident 

Investigation report has five objectives: 

1. To discuss key preventable hardware shortcomings affecting the reliability of the Deepwater 

Horizon BOP throughout the drilling activities at Macondo. 

2. To account for all conditions that can cause drillpipe to buckle in a well, leaving it off-center in a 

BOP and potentially interfering with the BOP’s ability to seal a well. These conditions include 

having buckled drillpipe even when a rig crew has successfully shut in a well.

3. To explore safeguards, or barriers, that help prevent major accidents, recognizing they extend 

beyond physical equipment into operational and organizational elements. 

4. To describe the necessity for effective identification and management of safety critical 

elements—technical, organizational, and operational—for preventing Macondo-like events.

a

 Safety critical elements are controls (hardware, people systems, or software) or tasks whose failure could cause or 

contribute to a major accident event or whose purpose is to prevent or limit the effects of a major accident event.

(See Section 4.2.3.1) 

b See Volume 1 for a basic introduction to deepwater drilling and physical barriers that can prevent a blowout.

c A well may be sealed temporarily with cement or mechanical plugs to allow removal of the blowout preventer and 

departure from the drilling rig.

d Cement plugs are portions of cement put into a wellbore to seal it. “Surface” is typically used to refer to the most 

shallow cement plug used in a well.

e A number of human and organizational factors contributed to how the events unfolded leading to accepting the test 

results. The CSB plans to address these factors in Volume 4 of the CSB’s Macondo Investigation Report.

f Well integrity also includes the casing lining the wellbore, float valves (check valves) placed at the bottom of the 

casing, and crossovers where casing of different sizes are connected to one another. Analysis in Appendix 2-A 

indicates the major source of hydrocarbons during the incident did not come from casing or crossover failures. 

While check valves can act as a physical barrier, they are unreliable and cannot be independently tested. For the 

analysis in this report, they are not considered a barrier because at Macondo they were either not converted or had 

to have failed.

13 

 

000590
Macondo Investigation Report Volume 2 June 5, 2014

5. To identify additional opportunities for improvement in the US offshore safety regulations that do 

not include clear and systematic requirements to ensure the successful performance of all safety 

critical elements (SCE) for reducing major accident events. 

1.2 Key Findings

The redundant controls of Deepwater Horizon BOP should have increased the reliability of the BOP to 

seal the Macondo well during normal drilling operations and emergency situations. Two rounds of postincident testing, including one non-public, court-ordered round and additional CSB testing, reveal new 

failure mechanisms in which these redundant controls can be compromised and go on undetected. From 

this analysis and an examination of how the BOP, was managed and regulated as a safety critical element, 

the following key findings demonstrate the need for further offshore safety improvements: 

BOP Failure in Loss of Well Control

1. The BOP is subject to design capability limitations. A BOP can act as a barrier only if it is closed

manually by the drilling crew or automatically as a result of a catastrophic event, such as a fire 

and explosion, which can trigger emergency backup systems. In manual operations, successful 

closure of the BOP depends on several human decisions that must be made before a well kick can 

develop into a blowout. Otherwise, well pressures and well flow can exceed the design 

capabilities of the BOP elements, leaving them unable to prevent or stop an active blowout 

(Sections 2.1 and 2.3).

2. No effective testing or monitoring was in place to verify the availability of the redundant systems

in the emergency Automatic Mode Function (AMF)/deadman system.a (Sections 2.3.1, 5.3.1, and 

5.4). This emergency system was programmed to activate a blind shear ram (BSR) within the 

BOP to shear drillpipe and seal the well (Sections 2.3.3). 

The AMF/deadman uses two redundant control systems, the yellow pod and the blue pod, to 

initiate closure of the blind shear ram. This redundancy is intended to increase the AMF/deadman 

reliability, but on the day of the incident only one of the two pods was functioning: 

a. The blue pod was miswired, causing a critical battery to drain and rendering the pod 

inoperable on the day of the incident (Section 3.2.1.1). 

b. A critical solenoidb valve in the yellow pod had also been miswired. Redundant coils 

were designed to work in parallel to open the solenoid valve, but the miswiring caused 

them to oppose one another. Had both coils been successfully energized during the 

incident, the solenoid valve would have remained closed and unable to initiate closure of 

a “Deadman” is defined by API Specification 16D 2nd Ed, Specification for Control Systems for Drilling Well 

Control Equipment and Control Systems for Diverter Equipment 2nd Edition: a blowout preventer safety system 

“designed to automatically close [and seal] the wellbore in the event of a simultaneous absence of hydraulic 

supply and signal transmission capacity in both subsea control pods.” Activation can occur as the result of a 

catastrophic event such as a fire and explosion on the rig. AMF (Automatic Mode Function) is Cameron’s version 

of a deadman system. 

b Solenoid valve: A valve that opens and closes as the result of an electrically initiated magnetic switching device to 

control the flow of liquid or gas.

14 

 

000591
Macondo Investigation Report Volume 2 June 5, 2014

the BSR. However, a drained battery likely rendered one of these coils inoperable. This 

would have allowed the other coil to activate alone and initiate closure of the BSR, but 

buckled off-center drillpipe in the BOP prohibited the BSR from fully closing and sealing 

the well. (Section 3.2.1.2, 3.2.1.3, and 3.2.2). 

3. Large pressure differences were established between the inside and outside of the drillpipe when 

well control actions by the crew sealed the well shortly after oil and gas were released onto the 

rig. This likely caused drillpipe in the BOP to buckle due to a phenomenon known as “effective 

compression”a

 (Section 3.2.3). 

BOP Safety Management Deficiencies

4. The BOP systems responsible for shearing drillpipe in emergency situations are vulnerable to 

failures in rarely or inadequately tested equipment. Transocean and BP conducted routine 

inspection and weekly function testing of operational BOP components necessary for daily 

drilling operations, but these were insufficient to identify latent failures of the emergency systems 

that existed in the Deepwater Horizon BOP; thus, the safety critical systems responsible for 

shearing drillpipe in emergency situations had performance deficiencies even before the BOP was 

deployed to the Macondo wellhead. (Chapter 5.0). 

5. The blind shear ramb in the Deepwater Horizon BOP did not meet the manufacturer’s published 

design shearing capabilities for the diameter of drillpipe used during all of the DWH drilling 

operations except on April 20; thus, for an extended time during the drilling process, the DWH 

BOP could not have reliably sheared the drillpipe during an emergency situation. (Section 5.2.1). 

6. The miswired solenoid valve in the yellow pod and the deficient wiring in the blue pod could not 

have passed the manufacturer’s factory acceptance testing procedures (Sections 5.3.1and 5.3.2). 

Regulatory Gaps 

7. While US offshore regulations have undergone important changes since Macondo, more can be 

done to ensure a focus on preventing major accident events and to drive continuous safety 

improvement. The primary US offshore safety management regulation, Safety and Environmental 

Management Systems, 

a. Is not risk-based nor does it have an explicit focus on major accident events (Chapter 

4.0); 

b. does not require demonstration by industry that process safety concepts for hazard 

assessment and management, such as layers of protectionc

 and hierarchy of controls, have 

been used in managing major accident hazardsa (Chapter 4.0); 

a Effective compression: Pipe buckling resulting from the combined effect of 1) large pressure differences inside and 

outside of a drillpipe and 2) axial forces. Even in the absence of axial forces, pipe can buckle as a result of the 

pressure differences alone.

b Blind shear rams are a part of the BOP that can shear drillpipe and seal a wellbore.

c Layers of protection are preventions, safeguard, barriers, or lines of defense that are designed to eliminate, prevent, 

reduce, or mitigate a hazardous scenario.

15 

 

000592
Macondo Investigation Report Volume 2 June 5, 2014

c. does not require demonstration that barriers to prevent major accidents are effectively 

implemented to a targeted risk reduction level (Section 4.1). 

d. does not require industry to identify and manage all safety critical elements and tasks

through defined performance standards,b nor does it require assurance and verification 

activities to ensure a safety critical element is appropriate, available, and effective 

throughout its life cycle. (Chapter 5.0). 

8. At the time of the incident, neither recommended industry practices nor US regulations required 

testing of the AMF/deadman system. Despite post-incident changes that call for function testing 

the AMF/deadman, deficiencies identified during the failure analysis of the Deepwater Horizon 

BOP could still remain undetected in BOPs currently being deployed to wellheads (Section

5.3.2). 

a Hierarchy of controls is an effectiveness ranking used to mitigate hazards and risks. The higher up the hierarchy, 

the more effective the control is in reducing risk.

b A defined performance standard is a qualitative or quantitative statement that describes the required performance 

of a safety critical element or task. (See Section 5.2.)

16 

 

000593
Macondo Investigation Report Volume 2 June 5, 2014

2.0 Controlling Formation Pressures with the Deepwater 

Horizon Blowout Preventer

Drilling crews depend on blowout prevention equipment to 

confine kicks, circulate or inject well kill materials,a

 and 

allow for safe removal of hydrocarbons from the wellbore.b

Activating a subsea blowout preventer (BOP) creates a 

barrier designed to protect against blowouts by sealing the 

well at the seafloor, preventing hydrocarbons from entering

and traveling up the riserc to the rig.

While subsea BOPs share general physical characteristics, 

such as the style and construction of components, their actual 

configuration, control system, and performance requirements 

depend on well conditions, a rig owner’s technical standards, and 

the date of construction because newer models may have 

upgraded technologies. The Deepwater Horizon’s BOP was built 

by Cameron and had been used on the DWH since the rig began 

its service in 2001.1 As depicted in Figure 2-1, the BOP 

consisted of two sections, the lower marine riser package 

(LMRP) and the lower BOP.

a In the event of a kick, heavy well kill materials are circulated under pressure or injected into a wellbore to increase 

the hydrostatic pressure of column of fluid that fills the wellbore and riser. This activity reestablishes an 

overbalanced condition and prevents the well from flowing. (See Section 2.1 in Volume 1.)

b API Recommended Practice 53, 4th ed. Blowout Prevention Equipment Systems for Drilling Wells, defines 

blowout prevention equipment systems to include blowout preventers, choke and kill lines, choke manifold 

control systems, and auxiliary equipment. The primary function of these systems is “to confine well fluids to the 

wellbore, provide means to add fluid to the wellbore, and allow controlled columns to be removed from the 

wellbore.”

c The riser is a large diameter pipe which connects a drilling rig to the wellhead.

Chapter 2 Overview

This chapter describes the DWH 

BOP’s components, the BOP’s role in 

controlling formation pressures, the 

manual and automated systems 

designed to close the DWH BOP, and 

the events leading to the failure to 

shut in and seal the Macondo well on 

April 20, 2010. 

17 

 

000594
Macondo Investigation Report Volume 2 June 5, 2014

Figure 2-1. The DWH BOP stack 

18 

000595
Macondo Investigation Report Volume 2 June 5, 2014

2.1 BOP Sealing Elements

During a kick, a BOP has multiple rubber components that the crew 

can close to seal the well (Table 2-1).a

 Annular preventers and pipe 

rams are designed to seal the annularb space around a drillpipe or tool 

passing through the BOP, but each has unique strengths.2

 For example, 

annular preventers are designed to seal around virtually any object that 

passes through them as well as an open hole when no drillpipe is 

present (Figure 2-2). Due to the BOP’s capability to seal around a

broad range of objects, typically a rig crew’s initial priority during well 

control response is to close an annular preventer. The lower marine 

riser package (LMRP) illustrated (Figure 2-1) of the DWH BOP stack 

contained two annular preventers (referred to as the upper and lower 

annulars). 

Some pipe rams seal only around one size of pipe, but variable bore 

rams (VBRs) seal a range of pipe sizes.

c Pipe rams cannot seal an open 

hole if no drillpipe is present (Figure 2-3). The lower BOP of the DWH 

had an upper pipe ram, middle pipe ram, and lower pipe ramd

 (Figure 

2-1). The pipe rams were VBRs capable of sealing around pipes with 

outside diameters from 31⁄2" to 65⁄8". 

A subsea BOP can also have a blind shear ram (BSR) and a casing 

shear ram (CSR). A blind shear ram consists of specially designed 

blades that extend from opposite sides of the blowout preventer to cut 

(or shear) drillpipe. After cutting the drillpipe, the blades extend across 

the blowout preventer to form a seal that stops the flow of oil and gas 

from leaving a well and reaching the surface. Regarded as emergency 

response devices, blind shear rams can seal a well without first 

removing the drillpipe, but they also can seal an open wellbore when no 

drillpipe is present. BSRs are limited in the size and type of drillpipe 

they can cut, determined, in part, by the model of BSR, the wellbore 

a Pipe rams are backed by metal supports while annular preventers are not.

b The annular space is located between the BOP and the drillpipe. 

c Pipe rams are capable of holding back more pressure than an annular, but they fit only one size of pipe. VBRs 

mitigate that limitation to some extent.

d Pipe rams are designed to hold pressure from one direction, usually below. The lower pipe ram on the Deepwater 

Horizon BOP was intentionally installed upside down to hold pressure from above, and it was designated as a test 

ram. This arrangement saves time in conducting periodic subsea pressure tests of the BOP stack. In this role, it 

serves no purpose in dealing with a well control event.

Figure 2-2. An annular preventer 

can seal the annular space 

around a drillpipe or an open 

hole. Pistons press up on the 

rubber component which pushes 

it inward to seal around the pipe 

or open hole.

19 

 

000596
Macondo Investigation Report Volume 2 June 5, 2014

pressure, and the hydraulic control systema used to power the BSR closure.

b

 CSRs, which are stronger 

than BSRs, do not seal but can cut thicker drillpipe and even more difficult-to-cut casing. Subsequent 

sealing of a well after using a CSR would occur by allowing any remaining pipe or casing to drop into the 

well or to be lifted and clear the BSR before closing the BSR. The Deepwater Horizon BOP had both a 

BSR and a CSR located above the pipe rams in the lower BOP (Figure 2-1). 

Figure 2-3. A pipe ram can seal the annular space around a drillpipe, but not an open hole without

drillpipe present.

a A hydraulic control system uses pressurized fluid to open or close mechanical devices.

b BOP manufacturers specify the shearing capabilities of their BSRs. See Oil & Gas UK, Guidelines on the subsea 

BOP systems, Issue 1 (July 2012), p. 74.

20 

 

000597
Macondo Investigation Report Volume 2 June 5, 2014

In general, blind shear rams are not designed to cut threaded, thick-walled ends of drillpipe, called tool 

joints, though casing shear rams sometimes can. To minimize the risk of this situation, well control 

procedures involve clearly defined steps for spacing the drillpipe in the BOP stack to ensure tool joints 

are clear of the BSR.

3 Table 2-1 summarizes the various BOP components.

Table 2-1. Various components of a BOP and their usesa, b (See Appendix 2-A for model numbers and 

capabilities of the DWH BOP elements) 

2.2 The BOP as a Physical Barrier 

At the time of the Macondo incident, US regulations did not address the number or effectiveness of 

physical barriers required to prevent the flow of hydrocarbons during drilling and abandonment 

operations. Current regulations require a description of the number and types of independent barriers used 

during drillingc,4

 and a minimum of two independent barriers during completion or abandonment 

activities.5

a Oil & Gas UK, Guidelines on the subsea BOP systems, Issue 1 (July 2012), p. 51; A recent BSR model can shear 

and seal on a tool joint (GE/Hydril http://www.genewscenter.com/Press-Releases/GE-Introduces-Deepwater-BOPBlind-Shear-Rams-with-Advanced-Capabilities-3826.aspx. Retrieved March 7, 2014. 

b Pipe rams are designed to hold pressure from one direction, usually below. The lower pipe ram on the Deepwater 

Horizon BOP was intentionally installed upside down to hold pressure from above, and it was designated as a test 

ram. This arrangement saves time in conducting periodic subsea pressure tests of the BOP stack. In this role, it 

serves no purpose in dealing with a well control event.

c Of the two barriers required during completion activities, one of them must be a mechanical barrier as defined in 

API RP 65–Part 2, Isolating Potential Flow Zones During Well Construction which has been incorporated by 

reference in 30 C.F.R. § 250.198.

21 

 

000598
Macondo Investigation Report Volume 2 June 5, 2014

Internal Transocean6 and BP7 standards in place at the time of the Macondo incident also required two 

barriers during various phases of drilling and completion activities. In terms of the two-barrier policy, an 

open BOP was perceived as an acceptable barrier because it was assumed the BOP could either be closed 

manually to control the well during an influx of formation fluids, or automatically by backup emergency 

systems in the event of loss of well control. 

On detection of an influx, well control response by the crew should result in the manual activation of 

BOP annular preventers, pipe rams, or blind shear ram through push-button panels on the rig. (See 

Sections 2.3.1.) Manual or automated emergency systems to seal the well might be initiated if a well 

control situation were to progress. On the Deepwater Horizon, the following secondary intervention 

control systems were designed to ensure access to BOP functions as a last line of defense against a 

significant unplanned event, such as a fire, riser failure, explosion, or accidental detachment of the LMRP 

from the BOP stack: 

• The Emergency Disconnect System (EDS), manually initiated by someone onboard the rig, 

activated the blind shear ram and then disconnected the LMRP and riser from the wellhead; 

• The Automatic Mode Function (AMF)/deadman automatically activated the blind shear ram to

cut drillpipe and then seal the well in the event of a riser failure or a major explosion or fire 

severed communications from the rig to the BOP (the AMF/deadman did not disconnect the 

LMRP and riser from the wellhead);

• The autoshear system automatically closed the blind shear ram if the LMRP accidentally 

detached from the lower stack; 

• Remotely operated vehicles (ROVs) could have been deployed to seafloor and manual activation

of certain BOP functions. For example, closing the blind shear ram could have been initiated

robotically.8

 

A BOP can act as a barrier only if it can be closed, and manual closure of a BOP by a rig crew depends on 

additional human and process controls, sometimes referred to as operational barriers,9

 which must: 

• Detect an influx into the well;

• Recognize the need to respond;

• Respond appropriately (i.e., activate the various mechanisms of the BOP to successfully seal or 

shear the well quickly);

• Ensure proper design and functioning of the BOP components (i.e., ensure the sealing elements 

and valves function as designed). 

These decisions must be made before a well kick develops into a blowout, as well flow may exceed the 

capabilities of the BOP elements, leaving them unable to close and stop an active blowout. The first two 

bullets identify the reliance on drilling crew vigilance and response, suggesting that human performance 

is both a necessity and a threat to the effectiveness of the BOP barrier as currently designed. Volume 4 of 

the CSB Macondo Investigation Report details the factors that affect human response and the tools people 

need to complete their critical tasks effectively. 

22 

000599
Macondo Investigation Report Volume 2 June 5, 2014

2.3 Functioning the Deepwater Horizon BOP

2.3.1 BOP Control System 

To operate the BOP, the Deepwater Horizon had a control system that included multiple, rig-mounted 

control panels and two redundant subsea control pods located on the LMRP (designated as blue and 

yellow). Each contained two computer systems sealed in a subsea electronics module (SEM) vessel that 

shielded the electronics from high subsea ambient pressures.10 The yellow and blue pods worked 

independently of each other and contained identical sets of solenoid valves. Manually activated push 

buttons on the control panels sent electronic signals from the rig through armored cablesa

 to the yellow

and blue pods that the SEMs used to open and close the solenoid valves. (See Figure 2-4.) This process 

allowed hydraulic fluid11 to flow through the valve, triggering the BOP functions, such as opening or 

closing the various rams and annular preventers.

Figure 2-4.Control panel (left) and partial closeup of control panel on the Deepwater Horizon found in the 

driller’s cabin and on the bridge of the rig. These controls are used to activate the BOP.12

During normal operations, or if the Emergency Disconnect System were initiated, the rig supplied the 

solenoid valves with electrical power and hydraulic fluid. Loss of this power and hydraulic supplies 

would have triggered the emergency AMF/deadman. In that case, the yellow and blue control pods each 

had an emergency backup 27-volt battery to power their respective solenoid valves and hydraulic fluid 

from backup accumulators, pressurized storage bottles, on the BOP stack (Figure 2-5).

a Armored cables: Multiplexed (MUX) cables that could send multiple simultaneous signals over a single 

communications cable.

23 

 

000600
Macondo Investigation Report Volume 2 June 5, 2014

Figure 2-5. Pressing a pushbutton on a BOP control panel sent an electronic signal through the MUX cable 

down to the yellow and blue BOP control pods located in the LMRP. Accumulators on the BOP stack 

supplied hydraulic power to the control pods during emergencies. 

24 

000601
Macondo Investigation Report Volume 2 June 5, 2014

2.3.1.1 Functioning Solenoid Operated Valves 

A critical solenoid valve in the yellow pod of 

the Deepwater Horizon BOP was miswired, 

which could have prevented it from opening 

during the AMF/deadman sequence. (See 

Section 3.2.1.2.) A solenoid-operated valve, 

such as the one that was miswired, opens and 

closes as the result of an electric/magnetic 

action (Figure 2-6). The solenoid valve has a 

spring which pushes a plunger down, 

blocking the flow of fluid through the valve. 

Surrounding the spring is a tightly wound 

wire coil that produces a magnetic field when

current runs through it. To move the plunger, 

the coil is energized and a resulting magnetic 

field attracts the iron plunger, which then 

pulls it up, thus allowing fluid to pass 

through.a

 

The Cameron solenoid valves on the DWH 

contained two separate wire coils that could 

be energized independently to open the 

valve. The solenoid valves were designed to 

open from the magnetic field generated by 

just a single coil, so the design provided 

redundancy to the system in case one of the 

coils failed. 

Each coil was controlled independently by 

one of the two digital computers (SEM A and 

SEM B) contained in the SEM enclosure. 

During activation of the emergency 

AMF/deadman system, SEM A and SEM B 

were powered by separate 9-volt backup 

batteries located in the SEM enclosure. SEM 

A and SEM B were designed to 

simultaneously initiate the command to power 

their respective coils. Once the command was 

sent, the solenoid valves drew power from the 

shared 27-volt battery to open (Figure 2-7). If 

a The converse is true as well. When power to the solenoid valve is stopped, the magnetic field disappears, and the 

spring pushes the plunger back to its original, closed position. 

Figure 2-6. The top image depicts a solenoid with no 

current running through it. The plunger is down, and no 

fluid can flow through the solenoid. When actuated, 

current running through the solenoid produces a

magnetic field which creates a force that pulls the plunger 

up, allowing fluid to flow.

25 

 

000602
Macondo Investigation Report Volume 2 June 5, 2014

either the SEM A or SEM B 9-volt battery were to fail, the initiating command would not be sent; thus, 

the remaining SEM would send its command, and the solenoid valve would open from one coil. If both 9-

volt batteries were operable but the shared 27-volt battery failed, neither coil would receive power, and 

the solenoid valve would remain closed. (See Appendix 2-B for more details.) 

Figure 2-7. Simplified schematic of the control pod battery arrangement.

26 

000603
Macondo Investigation Report Volume 2 June 5, 2014

2.3.2 BOP: Closing the Blind Shear Ram 

Closure of the blind shear ram in a BOP may be initiated both during normal drilling operations and in 

emergencies. When the blind shear ram is closed and no drillpipe is in the BOP, much less force is 

required than when the BSR is activated to shear drillpipe. Accordingly, the DWH’s BOP had two 

different functions to close the BSR: the low-pressure blind shear ram close function (LP) when the BOP 

was free of drillpipe, and the high-pressure shear close function (HP) when shearing drillpipe was 

anticipated. These LP and HP functions were controlled by different solenoid valves. The EDS and 

AMF/deadman systems both used the HP close function, as it was necessary to account for the possibility 

of drillpipe in the BOP during an emergency. 

The distinction between the high- and low-pressure BSR functions is highlighted here because postincident examination of the Deepwater Horizon BSR revealed latent defects in the yellow pod HP 

solenoid valve responsible for closing the BSR. 

2.3.3 Initiating the AMF/Deadman Sequence

On the Deepwater Horizon, the AMF/deadman had to be manually armed from one of the two control 

panels on the rig. Once armed,a

 SEM A and SEM B in each of the two control pods monitored for three 

conditions: 

1. loss of surface electrical power and communication coming from the rig; 

2. loss of communication between the yellow and blue pods; 

3. loss of hydraulic fluid pressure from the rig.13

If all three conditions were met, the AMF/deadman sequence initiated. A fire and explosion like the one 

on the DWH could damage power and communication cables and the conduit line carrying hydraulic fluid 

from the rig, thus establishing the conditions necessary to trigger the AMF/deadman sequence. Once this 

occurred, all four SEMs would power themselves by their internal batteries and initiate solenoid valves to 

execute BOP functions, including closing the blind shear ram by using hydraulic fluid from the subsea 

accumulators. All four AMF control systems—yellow SEM A, yellow SEM B, blue SEM A, or blue SEM 

B—would simultaneously respond, but by design any one of the SEMs should have been able to complete 

the AMF/deadman sequence independently. 

a Screen shots of the computer used to first examine the blue pod upon its retrieval indicate the Deadman/AMF 

system was still active on SEM B (BP-HZN-BLY00061078). Transocean stated a photo taken during a rig 

assessment on April 10 (Appendix N) shows that the Deadman/AMF on the yellow pod was also active, but upon 

reviewing the rig assessment report referenced by Transocean, the CSB could not confirm the photograph 

Transocean referenced.

27 

 

000604
Macondo Investigation Report Volume 2 June 5, 2014

2.4 Condition of the Well on April 20, 2010—Data Used to Recreate 

the Incident Events

Drillpipe pressure on the Deepwater Horizon was measured at the rig’s surface, but it was also captured in 

data transmissions recorded onshore.

14 This data has been correlated with witness accounts to determine 

the actions on the rig in the hours prior to the blowout.a

 The following chronology focuses on the period

just after the final negative pressure test was declared a “pass,” and it proceeds to the explosion at the 

well. (See Volume 1 for the incident description and Appendix 2-A for details of the negative pressure 

tests.) 

The CSB also generated a computer simulationb of the Macondo well flow for the time beginning with 

the displacement of the drilling mud, about 4 p.m., up to the blowout that occurred near 10 p.m. (See 

Appendix 2-A for details concerning the simulation.) The simulation provides the basis for statements 

made concerning the flow of hydrocarbons from the well and inferences about the BOP’s integrity during 

the incident. 

2.5 The Macondo Well Kicks—Incident Analysis of Well Control 

Response

At 8:00 p.m., after the BP wellsite leadersc and Transocean personnel completing the negative pressure 

test declared the test successful, displacement of the remaining drill mud with seawater began. Soon, as 

planned, the well became underbalanced and the hydrostatic pressure exerted on the bottom of the well 

went below the formation pressure. The CSB computer simulation indicates this occurred around 8:51 

p.m.d The failure of the bottom hole cement job to seal the well allowed the reservoir fluids to flow into 

the wellbore at this time (Figure 2-8). 

a While various investigating parties have reported differences in the timestamps for certain activities, these are not 

materially significant to understanding the sequence of events. Notes from interviews conducted by BP, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-37031.pdf, pp. BP-HZNBLY00377487 - 489 (Accessed August 9, 2013), just following the incident and a written statement by BP 

wellsite leaders, http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-51133.pdf, have 

been correlated with the real-time data to generate the time stamps found in this section.

b The CSB contracted with Engineering Services to complete the simulation using proprietary software. BP and 

Transocean completed their own simulations as well. 

c Wellsite leader: The drilling supervisor overseeing all activities including heath and safety, operations, and 

logistics at the well, http://www.bp.com/en/global/corporate/careers/career-areas/wells/wells-operations.html. 

Accessed May 16, 2014.

d Others have also generated the computer model to simulate when the influx of hydrocarbons from the well began. 

Transocean estimated the well became underbalanced between 8:38 p.m. and 8:52 p.m. (Transocean investigation 

report, Volume II, June 2011, Appendix G, p. 98).The BP account was 8:52 p.m. (BP plc, Deepwater Horizon 

accident investigation report, September 8, 2010, p. 25.) 

28 

 

000605
Macondo Investigation Report Volume 2 June 5, 2014

Figure 2-8. Key operation events after reservoir flow began. 

Synthetic, hydrocarbon-based drilling mud is expensive, and regulations do not allow for its discharge 

into the Gulf;

15 therefore, it is typically retained when displaced from a well and transferred to another

vessel for transportation to another drilling rig, reprocessing, or proper disposal. The DWH rig had such a 

vessel, the Damon Bankston, available to offload the drilling mud used in the well. At 9:08 p.m., the crew 

believed it had finished displacing the drilling mud and prepared for a sheen testa

 by shutting down the 

pumps used to displace the drilling mud. The sheen test was used to verify that the fluids returning from 

the well onto the rig, referred to as “returns,” no longer contained the hydrocarbon-based mud and, thus, 

could be discharged overboard into the Gulf. This occurred at 9:09 p.m., when the crew declared the 

returns mud free and diverted their flow overboard, but the CSB computer simulation indicates that at this 

time the influx rate into the wellbore was sufficient to produce strong flow indicators.b

At 9:31 p.m., the driller investigated noticed an anomalous pressure difference.16 Shortly thereafter, oil 

and gas that had flowed into the wellbore from the reservoir pushed a mixture of seawater, drilling mud, 

and hydrocarbons onto the drilling rig. 

In response, the drilling crew closed the upper annular (UA) at ~9:43 p.m., which should have sealed the 

space around the drillpipe and prevented further hydrocarbons from rising above the BOP into the riser.

c

 

a Sheen test: A sample is added to water and a visual determination made if it causes a sheen, indicating 

unacceptable oil content for disposal into the sea.

b The computer simulation found in Appendix 2-A indicates about 9 bpm (barrels/minute) were flowing into the 

well, and the pit gain on the rig was about 60 barrels over 16 minutes.

c Witness statements said that the bridge remote control panel indicated that the lower annular was closed. Hearing 

before the Deepwater Horizon Joint Investigation, May 28, 2010, p. 145. However, upon recovery the lower 

29 

 

000606
Macondo Investigation Report Volume 2 June 5, 2014

However, well data indicates that the UA failed to seal,

a likely caused by erosion of the preventer rubber. 

Later a pipe ram with a similar rubber component and finger design successfully sealed the flow, but the 

pipe ram closes more rapidly than an annular, which reduces erosion potential.b

 As a result, not only did 

the riser fluids that already passed above the BOP continue to travel up the riser and release onto the 

drilling rig, but the riser was also being replenished by the flow of even more hydrocarbons through the 

leaking upper annular. 

Immediately after shutting the annular, the rig crew also activated a diverter at the top of the riser to route 

the well fluids away from the rig floor.

17 When the diverter shut, flow up the riser exiting onto the drilling 

rig was redirected to the diverter piping. The two potential piping destinations were overboard into Gulf 

waters or to a mud-gas separator (MGS).

c

 On the day of the incident, when the crew activated the 

diverter, it had been preset to flow directly to the MGS.d

 Due to the magnitude of well fluids coming up 

the drillpipe, the MGS was overwhelmed moments after the diverter was activated, and hydrocarbons 

began blowing out of exit points onto the rig. 

Pressure data indicates that at ~9:47 p.m., the crew most likely closed the middle pipe rams (MPR) and 

possibly the upper pipe rams (UPR), successfully shutting in the well but also causing the pressure in the 

drillpipe to build substantially. Riser fluids above the BOP continued to unload onto the drilling rig, but 

their replenishment was temporarily halted by the closed pipe ram. At ~9:49 p.m., the first explosions 

occurred on the rig, and data transmission from the rig to shore ceased. 

Between 9:52 p.m. and 9:56 p.m., a crew member pressed the Emergency Disconnect System (EDS) 

button on the bridge BOP remote control panel.18 This maneuver should have closed the BOP blind shear 

ram and disconnected the rig and riser from the BOP, thus allowing the DWH to move away safely from 

the wellhead. However, there was no indication of EDS actuation. The explosion likely satisfied the 

criteria for automatic activation of the emergency AMF/deadman backup system by severing power, 

communication, and hydraulic lines to the BOP, which should have closed the blind shear ram (See

Section 3.2.2), but as evident from the major oil spill that ensued, the well remained unsealed. 

annular was found open [Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), March 

11, 2011. Forensic Examination of Deepwater Horizon Blowout Preventer, Report No. EP030842.] 

http://www.uscg.mil/hq/cg5/cg545/dw/exhib/DNV%20Report%20EP030842%20for%20BOEMRE%20Volume%

20I.pdf, p. 27. Accessed August 14, 2013. 

a If the annular had sealed, the drillpipe pressure at the surface would have rapidly increased to 5,000+ psig, as when 

the upper pipe ram sealed at 9:47 p.m. Rather, the drillpipe pressure fluctuated between 1,800 and 400 psig in this 

time period. 

b See Appendix 2-A for more details.

c When gas contamination of mud returning to the rig is suspected, well fluids can be routed to this mud-gas 

separating system to safely separate and remove the flammable gas from the drilling mud. The MGS is limited in 

the amount of flow it can handle.

d The default lineup of the diverter was routed through the MGS for several potential reasons, including: 1) diverting 

through the MGS is a normal procedure while drilling; 2) discharging oil-based drilling mud overboard could be a 

violation of environmental regulations; and 3) diverting through the overboard lines is considered an emergency 

procedure, a last resort to a large influx of gas above the BOP.

30 

 

000607
Macondo Investigation Report Volume 2 June 5, 2014

3.0 The Blowout Preventer – Failure of a Barrier 

On the day of the incident, the Deepwater Horizon BOP 

experienced failures that affected its ability to prevent and 

mitigate the Macondo blowout. The initial failure occurred 

approximately 6 minutes prior to the first explosion, when 

the drilling crew attempted to close the upper annular. If the 

upper annular had sealed, less gas and oil would have entered 

the riser and then exited onto the drilling rig, likely reducing 

the severity of the ensuing explosion and duration of the fire. 

The second failure occurred just after the explosion, when the

automated emergency AMF/deadman system would have 

been triggered, but the blind shear ram did not close and seal 

the well as designed. Instead, the surviving crew had to 

evacuate amid an active blowout and major fire.

If either the bottom hole cement job had been successful or 

the BOP had functioned that day, the blowout could have 

been avoided. Chapter 4.3 of the Chief Counsel’s Report19 by 

the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling details the 

cementing process in deepwater drilling and specifically the procedures the Deepwater Horizon crew used 

at the Macondo well. The National Commission conducted stability studies on foamed cement20 similar to 

Macondo’s to further investigate a probable failure mechanism. While BP, Transocean, and Halliburton 

have speculated about why the cement failed, the Chief Counsel’s Report states that limitations in 

available data prevented determining a precise failure mechanism. Yet the report indentified several 

technical and management challenges that increased the risk for failure of the cement at the bottom of the 

Macondo well.a

 

Due to the National Commission’s thorough documentation of the cementing practices at Macondo in the 

Chief Counsel’s Report, the CSB chose to focus on the less understood failure of the BOP, which was 

retrieved from the wellhead and brought onshore for analysis that was not completed until after the Chief 

Counsel’s Report was published. 

a The Chief Counsel’s Report reviewed the actions of the cement provider, Halliburton, and BP as part of its 

investigation. It asserts that some Halliburton personnel were aware of potential problems with the cement used at 

Macondo, but they did not inform BP of the issues. The National Commission attributes the lack of communication 

and other technical issues with the cement to management problems within the company. The National Commission 

was unable to specify the management problems because Halliburton did not provide any documents or testimony to 

indicate if the actions taken by Halliburton personnel were prohibited by the company. Beyond Halliburton, the 

National Commission asserts that BP’s management process did not require identifying and evaluating all the 

cementing risks at Macondo, which subsequently led to inadequate mitigation of them. This includes identifying 

risks inherent due to conditions of the Macondo well and others resulting from BP and Halliburton well design and 

cementing decisions.

Chapter 3 Overview

This chapter covers the CSB’s 

independent analysis of DWH BOP 

failure data, much of which was 

collected after other Macondo 

investigation reports were published, 

and the CSB’s additional testing. It 

describes latent failures found in the 

BOP and their effect on the 

emergency AMF/deadman system. 

The chapter also describes how large 

pressure differences in the Macondo 

well likely caused drillpipe to buckle 

within the BOP due to a phenomenon 

known as “effective compression.” 

31 

 

000608
Macondo Investigation Report Volume 2 June 5, 2014

3.1 Correlating Physical Evidence from Macondo with the Events of 

April 20, 2010

Once the Deepwater Horizon blowout preventer was retrieved from the wellhead and examined, it was 

revealed that the drillpipe was not centered in the BOP when the BSR was activated. This off-center 

position of the drillpipe inhibited the BSR from fully closing and sealing the well.a

 Consequently, the 

CSB pursued three major lines of inquiry to determine the most likely cause of the bending, or buckling, 

of the drillpipe to its off-center position. 

• Weight of equipment and drillpipe above the BOP pushing down after the support holding the top 

of the pipe at the Deepwater Horizon failed due to the explosion and fire; 

• A combination of drag forces from high flow of well fluid up the drillpipe and from well pressure 

pushing up on the bottom of the drillpipe deep in the well; 

• Bending forces created from the combined effects of 1) large pressure differences inside and 

outside of a drillpipe and 2) vertical forces applied to the face of a pipe end, a buckling 

mechanism referred to as effective compression, which has been previously identified in other 

contexts in the oil and gas industry.

b

The CSB attempted to obtain BOP performance data from Cameron and BP to assess the viability of the 

weight theory, but neither company provided the needed information.c, d

 For reasons discussed in 

Appendix 2-A, the CSB finds the weight theory unlikelye

 but cannot definitively rule it out. CSB 

modeling indicates that if a sufficient well flow is assumed, the drillpipe may buckle, but the force from 

fluid flow alone is insufficient to buckle the drillpipe. Bending forces created by effective compression 

must be considered to calculate sufficient forces to buckle the drillpipe. The CSB concludes the most 

likely buckling scenario occurred just after the rig crew activated the pipe ram and temporarily sealed the 

a The Deepwater Horizon BOP was not designed to cut off-center drillpipe. Post-incident modeling of the forces 

required to cut off-center drillpipe indicated that the DWH BOP was incapable of cutting the off-center drillpipe 

and subsequently sealing the well. See Appendix 2-A for details.

b See Section 3.2.3 for details.

c To resolve this theory, it is necessary to quantify the force required to overcome the friction generated against 

drillpipe being held by closed VBRs under high well pressure. See Appendix 2-A for details. The information could 

be obtained from stripping performance tests or from an in-field test conducted on a drilling rig.

d The CSB did not request this information from Transocean because it refused to acknowledge the Agency’s 

jurisdiction and failed to respond fully to subpoena requests for documents and interviews. The CSB has pursued 

enforcement actions in federal court. Ultimately, a federal district court ordered Transocean to comply with the CSB 

subpoenas. United States v. Transocean Deepwater Drilling, Inc., 2013 WL 1345246 (S.D. Tex. Mar. 30, 2013). 

Transocean has appealed this decision, and at the time of publication of this report, a court decision on the appeal is 

pending.

e In summary, the closed VBRs would need to be able to support the net weight of the drill string, about 178,000 lbs. 

Undocumented anecdotal field experiences indicate this friction is low (10,000 to 30,000 lbs). If VBR friction were

high (e.g., 100,000 to 200,000 lbs.), it could have an adverse implication for offshore drilling. An important situation 

occurs when deciding to hang-off drillpipe on a closed VBR. This is a well control procedure used by both BP and 

Transocean, and likely by other operators and contractors. If high VBR friction exceeds the weight of the drill string, 

lowering the drill pipe onto the rams would be impossible, potentially leaving the tool joint opposite a blind shear 

ram. See Appendix 2-A for more details.

32 

 

000609
Macondo Investigation Report Volume 2 June 5, 2014

well. This closure of the pipe ram created the pressure difference necessary for effective compression to 

buckle the drillpipe. (See Section 3.2.3 for details.) 

Any drillpipe buckling scenario at Macondo has to be correlated with closure of the blind shear ram. 

Two clear opportunities arose for the BSR to have been activated:

• in the moments just after the first explosions on the DWH when the well was shut in and the 

AMF/deadman emergency system was likely triggered; 

• on April 22 when the well was actively flowing and the emergency autoshear function was 

triggered by ROV intervention efforts. 

Video evidence supports the activation of the autoshear function on April 22,21 but it does not preclude 

previous closure of the BSR as a result of AMF/deadman activation on April 20. BP, Transocean, the 

regulator,a

 the National Academy of Engineers, and the National Commission have speculated whether 

the AMF/deadman functioned on the day of the incident.22 The reports from these various authors were 

limited to the diagnostic information available on their publication date; besides the CSB, only 

Transocean released its report after of all phases of the Deepwater Horizon BOP failure analysis was 

completed. 

Using the full set of BOP testing data and additional independent CSB testing, the CSB determined 

sufficient evidence supports closure of the BSR during the AMF/deadman activation as the most likely 

scenario. While this finding contradicts previously published theories, it does not negate the importance 

of those possible scenarios, in part because a lack of data and evidence prevents an outright rejection of 

some of them. Instead, in an accident as complex and devastating as Macondo, each scenario provides an 

important opportunity to explore previously unconsidered pipe buckling mechanisms, failures of the BOP 

to seal the well, and opportunities for regulations to improve safety in offshore drilling and production 

activities. 

The CSB’s conclusion that the Macondo drillpipe likely buckled due to effective compression reveals an 

unrecognized potential for drillpipe to buckle even when timely well control actions initially shut in a 

well. Better understanding of this buckling phenomenon can lead to improvements in equipment design, 

well control procedures, training, and adoption of more rigorous management methods, each of which 

could ultimately lessen the likelihood of buckled drillpipe across the BSR of a BOP, as occurred at 

Macondo. 

The complete set of Deepwater Horizon BOP data and additional CSB analysis extend beyond the actions 

on April 20 and provide new insight for safety improvements in deepwater drilling. This analysis has led 

to the key technical findings from the day of the incident (Chapters 3.0) and during previous drilling 

operations (Chapter 5.0) that address why the BOP failed to shear the drillpipe and seal the well during 

the incident and how post-incident regulatory and industry response has left gaps that could allow for a 

BOP with similar deficiencies found at Macondo to be put into service:

a At the time, the US offshore regulator was the Bureau of Ocean Energy Management Regulations and Enforcement 

(BOEMRE).

33 

 

000610
Macondo Investigation Report Volume 2 June 5, 2014

• The AMF/deadman uses two redundant control systems, the yellow pod and the blue pod, to 

initiate closure of the blind shear ram. This redundancy is intended to increase the AMF/deadman 

reliability, but on the day of the incident only one of the two pods was functioning. 

o The blue pod was miswired, causing a critical battery to drain and rendering the pod 

inoperable (Section 3.2.1.1). 

o A critical solenoid in the yellow pod had also been miswired. Redundant coils were 

designed to work in parallel to open the solenoid valve, but the miswiring caused them

oppose one another. Had both coils been successfully energized on the day of the 

incident, the solenoid valve would have remained closed and unable to initiate closure of 

the BSR. However, a drained battery likely rendered one of these coils inoperable. This 

would have allowed the other coil to activate alone and initiate closure of the BSR, but 

drillpipe buckled off-center in the BOP prohibited the BSR from fully closing and sealing 

the well (Section 3.2.1.2, 3.2.1.3, and 3.2.2). 

• The AMF/deadman system likely actuated, but buckled, off-center pipe in the BOP prohibited the 

blind shear ram from fully closing and sealing the well. The BSR punctured and partially severed

the pressurized drillpipe, causing flow to resume rapidly. Flow had been temporarily stopped 

several minutes earlier by a successful sealing with a closed BOP pipe ram (Section 3.2.2).

• The drillpipe within the BOP buckled off-center due to effective compression, a buckling 

mechanism not yet identified by other investigative reports on the Macondo incidenta

 (Section 

3.2.3).

• The BSR installed on the DWH was not suitable for the Macondo drilling operation, as it could 

not reliably shear the 65⁄8" drillpipe used during all of the DWH drilling operations except on 

April 20 (See Section 5.2.1). 

• The miswired solenoid valve in the yellow pod and the deficient wiring in the blue pod could not 

have passed the manufacturer’s factory acceptance testing procedures (Sections 5.3.1and 5.3.2). 

• At the time of the incident, neither recommended industry practices nor US regulations required 

testing of the AMF/deadman system. Despite post-incident changes that call for function testing 

the AMF/deadman, deficiencies identified during the failure analysis of the Deepwater Horizon 

BOP could still remain undetected in BOPs currently being deployed to wellheads (Section

5.3.2). 

3.2 Failure Analysis of the Deepwater Horizon BOP

a Stress Engineering Services (SES), serving under contract with Transocean, suggests effective compression to 

explain the pipe buckling. (Transocean, Macondo Well Incident - Transocean Investigation Report, Volume 1, 

2011, Appendix M.) However, Transocean did not use the SES explanation in their investigation report. The 

National Academy of Engineering report notes the differences between the results of Transocean and its

contractor SES, but NAE does not acknowledge that SES presents effective compression values, which include 

the effects of a pressure differential between the inside and outside of the pipe and account for the weight of the 

drill string and buoyancy forces. (National Academy of Engineering and National Research Council. Macondo

Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety. Washington, DC: National 

Academies Press, 2011, p.50.) 

34 

 

000611
Macondo Investigation Report Volume 2 June 5, 2014

The failure analysis of the Deepwater Horizon BOP was completed in a three-part process that began just 

weeks after the incident and concluded almost 14 months later 

(Table 3-1). The yellow and blue pods of the DWH were 

individually brought to the surface, and preliminary 

examinations were completed on May 4, 201023 and July 5, 

2010,24 respectively. The solenoid valves of each pod were 

function tested, and the integrity of pipe, tubing, hoses, and 

hydraulic lines were verified.25 Additionally, execution of the 

AMF/deadman sequence was conducted.

26 

During this initial testing, neither the yellow pod nor the blue 

pod completed the AMF/deadman sequence correctly. The 

solenoid valve on the yellow pod (Y103) responsible for the 

high-pressure BSR shear close function would not open. All 

the solenoid valves on the blue pod functioned, but a critical 

27-volt battery showed insufficient charge to power the 

solenoid valves during the AMF/deadman sequence.27 After repairs and modificationsa had been made to 

the pods, they were redeployed to the BOP subsea to aid intervention efforts to stop the continuing 

blowout using the BOP.28

Table 3-1. In addition to the three phases of DWH BOP testing from May 2010 to April 2011, the CSB 

completed independent exemplar solenoid valve testing in September 2012. 

The Deepwater Horizon’s blowout preventer, including the yellow and blue pods, was recovered from the 

wellhead on September 4, 2010, and ultimately was transferred to the NASA-Michoud facility in New 

a Repairs and modifications included removing the original Y103 and installing a replacement in the yellow pod. 

During the forensic testing of the BOP, the original Y103 was reinstalled on the yellow pod. The batteries in the 

blue pod were not modified during these repairs.

Results of Phase II testing are 

essential to understand that wiring 

problems in the blue pod likely 

caused a critical battery in 

AMF/deadman system to drain, which 

rendered it inoperable during the 

incident. Results also revealed that 

the yellow pod contained two 

miswired solenoid valves, one being 

responsible for closing the blind 

shear ram, which also could have 

rendered the AMF/deadman system in 

the yellow pod inoperable.

35 

 

000612
Macondo Investigation Report Volume 2 June 5, 2014

Orleans, Louisiana. The Joint Investigation Team (JIT) a awarded Det Norske Veritas (DNV) a contract to 

conduct a forensic investigation of the Deepwater Horizon BOP.29 The CSB was present for Phase I 

testing, and the results from this phase were made public.30

A Court Order on March 25, 2011 granted BP a motion for access to the Deepwater Horizon blowout 

preventer for further forensic inspection. The Court considered proposed protocols and hearings on the 

matter, which resulted in a Court-ordered Phase II testing protocol to be performed by DNVb under the 

Court’s auspices.31 The CSB was excluded from Phase II testing by the Court, but obtained the testing 

results and interviews to document the activities. 

Complete results from Phase II testing have not previously been made public, but they are essential to 

understand that wiring problems in the blue pod caused a critical battery in AMF/deadman system to 

drain, rendering the blue pod AMF/deadman inoperable during the incident. Phase II results also revealed 

that the yellow pod contained two miswired solenoid valves,c

 one being Y103—the high-pressure shear 

close function solenoid—which also could have rendered inoperable the AMF/deadman system in the 

yellow pod. 

To understand results from Phase I and II testing, the CSB also sponsored testing of an exemplar solenoid 

valve that determined the effect of a miswired solenoid valve. The CSB determined that despite the 

miswiring of Y103, a coincident failure of a battery in the yellow pod likely allowed Y103 to function on 

only one coil and actuate the AMF/deadman on the day of the Macondo incident. Nevertheless, the 

Macondo well remained unsealed because drillpipe buckled off-center in the BOP which impeded closure 

of the BSR. These findings are briefly summarized in this chapter with details of the full analysis 

provided in the supplemental technical reports on the BOP Failure Analysis in Appendices 2-A and 2-B. 

3.2.1.1 Blue Pod: Disconnected Wires and the Drained Battery

Part of Phase II testing included tracing the circuitry within the SEMs to verify it matched the original 

Cameron drawings. The results indicate several wires from the blue pod SEM were missing, broken, 

disconnected, or miswired. No tests were completed to examine how, why, or when the wires came to 

a The Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) and the United States Coast 

Guard (USCG) formed a joint investigation team (JIT) to investigate the Deepwater Horizon incident. BOEMRE 

contracted Det Norske Veritas (DNV) to conduct a physical examination of the BOP. At the request of the US 

House Committee on Energy and Commerce and in accordance with its statutes, the CSB initiated an independent 

investigation into the incident. The CSB, JIT, and other parties agreed to participate in the BOP examination. 

During the examination of the BOP, the CSB participated as part of the technical working group (TWG), which 

reviewed testing protocols and provided feedback during testing. 

b During this phase of the testing, by Court order, DNV was to run the testing, produce the data, and disseminate the 

results to the various parties. DNV and its subcontractors were not allowed to interpret the results, provide an 

opinion on further testing, or write a report based on the results. 

c A second solenoid, 3A in the yellow pod, was also found miswired similar to Y103. Since solenoid valve 3A 

controlled the upper annular regulator pressure, it was used during normal drilling operations to close off the 

annular space around the drillpipe. A review of the daily drilling reports from the Deepwater Horizon did not 

reveal any reported problems with closing pressure of the upper annular. An underlying question, then, is how 

could miswired solenoid 3A not have been discovered during normal drill operations when tests show neither 

Y103 nor 3A could have functioned normally? See How a Miswired Solenoid Valve Operates in Appendix 2-B 

for one possible explanation.

36 

 

000613
Macondo Investigation Report Volume 2 June 5, 2014

their deficient condition, but the discovery supports an alternative explanation of why a critical 27-volt 

battery in the blue pod was found drained. a

 

The CSB believes that once the AMF/deadman was armed from the rig, missing or disconnected wires in 

the blue pod erroneously indicated that power and communications from the rig to the pod had failed. 

This likelihood established one of the three conditions necessary to initiate the AMF/deadman (Section

2.3.3). As a result, the blue pod, powered by the 27-volt battery, began to monitor for loss of hydraulic 

pressure until the battery was drained before the day of the incident. Subsequently, the blue pod was 

incapable of initiating the AMF/deadman sequence during the incident due to the inability of 27-volt 

battery to power the opening of the solenoid valves. (See Appendix 2-B for more details.) 

3.2.1.2 Yellow Pod: Miswired High-Pressure Shear Closes Solenoid 

Phase II analysis of the Y103 solenoid valve from the yellow pod revealed that it had been miswired. 

Figure 3-1 shows where pins 1 and 3 should be attached to the white wires and pins 2 and 4 to black 

wires, which was not the case with Y103. As a result, when both solenoid coils were energized during 

bench testing, the miswiring produced opposing magnetic fields, which canceled out each other and 

caused the solenoid valve to remain closed.

Figure 3-1. (Left) Photograph of Y103 wire arrangement from Phase II testing with pins 1 and 4 

connected to white wires and 2 and 3 connected to black wires. (Right) Schematic of correct arrangement 

of wires, with pins 1 and 3 connected to white wires and 2 and 4 connected to black wires.

Previously published investigation reports assert that attempts to actuate the miswired Y103 solenoid 

were successful even when both coils were simultaneously energized,

32 but Phase II testing revealed

a Transocean presented a theory (Transocean, Macondo Well Incident - Transocean Investigation Report, Volume 1, 

2011, Appendix N, p. 6) asserting the 27-volt battery drained in the blue pod after the AMF/deadman had 

successfully fired on April 20, 2010. The CSB does not accept this theory, nor does it support that the blue pod 

successfully actuated the AMF/deadman system on the day of the incident.

37 

 

000614
Macondo Investigation Report Volume 2 June 5, 2014

incorrect assumptions made during Phase I. DNV believed switches on test equipment used during Phase 

I could control whether to energize one or two coils of a solenoid valve.33 Phase II characterization of the 

test equipment discovered that during an attempt to activate just one coil, both coils were energized, and 

vice versa. In light of Phase II information, Phase I test results needed reinterpretation. Ultimately, with 

just one exception, Y103 did not open when both coils were energized and always opened when just one 

coil was energized. (See Appendix 2-B for full details.) 

3.2.1.3 Successful AMF/Deadman Tests on the Yellow Pod

The AMF/deadman was designed to simultaneously energize both coils of the solenoids it activated, 

yet—despite the miswiring of Y103 in the yellow pod—the system successfully completed the 

AMF/deadman sequence each of the three times it was initiated during Phase I testing. Although all three 

tests resulted in closure of the BSR, the closure was delayed during the first test. 

SEM A and SEM B were powered by separate 9-volt batteries (Section 2.3.1.1). Failure of SEM A or 

SEM B due to a dying or dead battery would enable the miswired solenoid to function because it would 

prevent sending a command to the associated coil to energize. As a result, the remaining coil would 

function unopposed and open the solenoid valve. 

Battery testing conducted during Phase II clearly shows that the SEM B yellow pod 9-volt battery failed.a

Accordingly, the successful AMF/deadman test results on the yellow pod from Phase I indicate that 

during the first AMF/deadman test, the BSR initially failed to open until the SEM B battery died during 

testing operations, upon which Y103 opened. After this initial delayed response, the BSR opened without 

delay in all the subsequent AMF/deadman tests because the battery had been spent during the first test. 

3.2.1.4 Independent CSB Exemplar Solenoid Testing 

To further understand Phase I AMF/deadman results, the CSB obtained an exemplar solenoid valve and 

simulated the miswiring found in Y103. The CSB also simulated the effect of a battery dying while 

powering one of the SEMs during actuation of the AMF/deadman sequence. The CSB testing 

demonstrates that when both coils in a miswired solenoid are initially fired, the valve fails to open, but if 

the power source for one of the SEMs is cut off (i.e., a battery dies), the solenoid valve subsequently 

opens. (See Appendix 2-B for more details.) 

For solenoid valve bench tests conducted in Phase I, a constant power source was utilized and each coil 

was energized separately.

34 During a normal AMF/deadman sequence, both coils would be energized and 

the power would be pulsed to minimize heat buildup in the solenoid valve. CSB testing on the exemplar 

solenoid valve simulated the AMF/deadman power conditions. This testing indicates that a miswired 

solenoid valve could intermittently open if the two coils were activated with a small time lag to each 

a The BOP battery has a very flat discharge curve over its lifecycle. The voltage will remain in operating range 

unless the battery is put under some type of demand (or load) by connecting it to a system that draws current from 

the battery. When not under load, the battery can recover some voltage after a load has been removed. No load was 

used during battery testing on the Q4000 and a non-representative load was used during the subsequent Phase I 

testing. During Phase II testing, a load that represented the normal operating condition of the 9-volt battery was 

used. This is when it was observed that the battery had failed. See Appendix 2-B for more details.

38 

 

000615
Macondo Investigation Report Volume 2 June 5, 2014

other, but this probably would only partially close the BSR.

a Without evidence of intermittent opening 

behavior of Y103 on April 20, the CSB finds it unlikely that the miswired Y103 solenoid valve would 

have closed the blind shear ram during an actuation of the AMF/deadman system if both SEM A and 

SEM B were functioning. (See Appendix 2-B for more details.) 

3.2.2 The AMF/deadman Successfully Fires on April 20, 2010 

Because the miswiring in the blue pod would have caused the critical 27-volt battery to drain, rendering 

the pod inoperable during the incident (see Figure 3-2), the AMF/deadman sequence could actuate only if 

the yellow pod was able to function. 

Temperature affects a battery’s performance.35 Consider a common problem automobile owners 

experience when they try to start a car during very cold weather. A battery does not produce as much 

power at lower temperatures; as a result, it can become incapable of starting a car engine. The batteries of 

a BOP are subject to the same limitations. Before the Macondo incident, Cameron, the manufacturer of 

the DWH BOP, completed AMF/deadman simulation tests that demonstrate the AMF/deadman batteries 

produce less completed sequences at colder temperatures.

36 

a The design of the BSR has a connecting rod exposed to the subsea pressure on one side and the well pressure on 

the other. After power to the BOP was lost due to the explosion, the pressure difference between the seawater and 

wellbore pressure above the closed pipe ram would have generated a closing force on the BSR. This would have 

pushed the BSR up to the drillpipe before the AMF/deadman sequence began. Once the AMF/deadman sequence 

began, further closure of the BSR to shear the drillpipe could have occurred if Y103 did open intermittently. The 

CSB has no evidence to support any intermittent opening behavior of Y103 on April 20, but at this time the CSB 

cannot definitively rule out the possibility either.

39 

 

000616
Macondo Investigation Report Volume 2 June 5, 2014

Figure 3-2. Miswiring in the blue pod caused the critical 27-volt battery to drain, rendering the pod 

inoperable during the incident. A drained 9-volt battery in the yellow pod left one of the coils in the 

miswired Y103 solenoid valve inoperable, allowing the other coil to activate unopposed and initiate 

closure of the blind shear ram.

40 

000617
Macondo Investigation Report Volume 2 June 5, 2014

The failure of the SEM B battery during the yellow pod AMF/deadman tests in Phase I occurred when the 

SEM was operating in an ambient temperature near 21o

C (70oF). Borrowing from the car analogy, an

SEM battery that barely produced sufficient power when operating in ambient temperatures might not 

have functioned when operating in subsea temperatures near 2o

C (36oF).

a

 Therefore, on the day of the 

incident, SEM B in the yellow pod was likely not operational, allowing the SEM A coil of Y103 to 

function unopposed and successfully execute the AMF/deadman sequence. (See Figure 3-2 and Figure 

3-3.) 

The likely actuation of the AMF/deadman and closing of the BSR might have been successful during the 

incident had the drillpipe been centered in the BOP. However, post-incident examination of the drillpipe 

reveals this was not the case37 (Figure 3-4). Instead, a portion of the drillpipe was found outside of the 

blind shear ram blades, so it was not cut but rather squeezed between the non-blade segments of the BSR. 

As a result, the drillpipe was not completely severed, and the BSR did not fully close and seal the well. 

The partial closure of the blind shear rams punctured the drillpipe and caused flow from the well to the 

environment to reestablish. This reopening of the well took place minutes after closure of the pipe rams 

had actually sealed around the drillpipe. 

a The actual temperature of the vessel containing the SEM would have been greater than the surrounding 

environment because of heat produced by all the electronics. Accordingly, the temperature of the SEM vessel was 

greater than 21o

C (70oF) during Phase I and greater than 2oC (36oF) when operating subsea. Testimony given in 

the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation docket MDL No. 

2179, see Coronado Designations Vol. 1, p. 45, indicates the operating temperature subsea might be 16o

C (60oF). 

Calculations in Appendix 2-B demonstrate this temperature is sufficient to affect AMF/deadman battery 

performance.

41 

 

000618
Macondo Investigation Report Volume 2 June 5, 2014

Figure 3-3. The events that led to the likely partial closure of the BSR after the emergency AMF/deadman 

system activated on April 20.

42 

000619
Macondo Investigation Report Volume 2 June 5, 2014

Figure 3-4. The Deepwater Horizon BOP was designed to shear centered drillpipe (left) in the BSR and 

then seal the well. During the Phase I examination of the BOP, the drillpipe was found off-center (right), 

causing the BSR to close only partially, leaving the well unsealed.

3.2.3 The AMF/deadman Fails to Seal the Well: Buckled Drillpipe 

Previous incident investigation reports have concluded that the drillpipe moved off-center as a result of 

forces acting to compress the pipe from the ends (axial compression) or forces created from high well 

flow.38 The reports did not recognize that buckling can also be caused by significant differences in 

pressure inside and outside of the drillpipe (differential pressure). The concept effective compression can 

be used to describe the combined effect of differential pressure and axial forces on pipe buckling. a

a The rigorous mathematical proofs involve either vector calculus or differential equations and may be found in one 

of several references: A. Lubinski, W.S. Althouse, and J.L. Logan, “Helical Buckling of Tubing Sealed in 

Packers,” Journal of Petroleum Technology, 14:6, (1962): pp. 655-670; S. A. Christman, “Casing Stresses Caused 

by Buckling of Concentric Pipes,” paper presented at Society of Petroleum Engineers Annual Fall Technical 

Conference and Exhibition: Paper Number SPE 6059, New Orleans, Louisiana, 1976; R.F.Mitchell, “Casing 

Design with Flowing Fluids, SPE Drilling and Completion, 26:3 (2011): pp. 432-435.

43 

 

000620
Macondo Investigation Report Volume 2 June 5, 2014

Effective compression has been well understood as a potential hazard in other oil and gas industry 

applications, including the design and operation of pipelines,39 well casing and well tubing,40 and of 

marine risers in deepwater drilling service such as those on the Deepwater Horizon.41 By incorporating 

effective compression, the CSB calculations show the DWH drillpipe could have been buckled at the time 

the AMF/deadman actuated. (See Appendix 2-A for more details on the concept presented in this section.) 

Significant differential pressures leading to buckling were likely between the inside and outside of the 

drillpipe within the BOP. Real-time pressure data from the Deepwater Horizon indicates that the crew had 

successfully shut in the well just before the first explosion on the rig by closing a pipe ram. Pressure from 

the wellbore was contained below the pipe ram but also transmitted through the drillpipe extending 

through the closed ram. Above the pipe ram, the pressure outside the drillpipe was limited to just the 

hydrostatic pressure of the fluid in the space between the drillpipe and the riser. This pressure would have 

continued to drop as hydrocarbons, drilling mud, and seawater unloaded onto the rig. 

Figure 3-5 illustrates conceptually the effect on a pipe when the inside pressure is much higher than 

outside, and how this differential pressure can cause buckling. On the left side of the figure is an ideally 

straight pipe. It is shown with equal pressure (represented by the arrows) acting on both the inside and 

outside walls. In reality, no pipe is perfectly straight, as shown in an exaggerated manner in the figure. 

The result of this minor inherent curvature is that the wall of the pipe on the right side is slightly longer 

than the left side.

42 With the same pressure acting on the unequal areas of the walls, the right side of the 

pipe, having a larger area, actually experiences a greater net force.a If the pressure inside the pipe is 

increased further, the force imbalance (as a bending moment) also increases and eventually overcomes the 

bending resistance of the pipe, causing it to buckle. 

Well pressures and forces on the drillpipe during most of the Macondo well-control event are not fully 

known due to the uncertainties of blowout flow rates and physical properties of the well fluids. However, 

a critical period occurred shortly before the initial explosion, when the well was essentially static with no 

new flow from the well into the riser. Computer modeling of this period presented in Appendix 2-A 

demonstrates that effective compression of drillpipe would have resulted in buckled, off-center drillpipe 

in the well as a pipe ram was closed. The subsequent explosions then likely triggered the AMF/deadman 

emergency system. 

a Force = pressure × area

44 

 

000621
Macondo Investigation Report Volume 2 June 5, 2014

Figure 3-5: Theoretically straight pipe with equal inside and outside pressure (left); real pipe with a curve 

imperfection with equal internal and external pressure (center); pipe buckling as a result of increased 

internal pressure (right). The black wedges show the relative change in length and area of the two sides 

of the pipe.

3.3 Conclusion

Both the manual intervention and emergency systems within the BOP were activated to shut in the 

Macondo well. The annular preventer activated by the crew failed to seal the well, but subsequent closure 

of a pipe ram did seal it. Yet, shortly thereafter an explosion on the rig likely triggered the AMF/deadman 

and led to the blind shear ram partially closing and puncturing the drillpipe, which reestablished flow 

from the well.

Both redundant control pods responsible for initiating the AMF/deadman had latent failures that could 

have inhibited closure of the blind shear ram. The blue pod was miswired, resulting in the draining of 

critical the 27-volt battery that was needed for powering the solenoid valves during the AMF/deadman 

sequence. A critical miswired solenoid valve in the yellow pod should have left the AMF/deadman 

45 

000622
Macondo Investigation Report Volume 2 June 5, 2014

sequence unable to close the blind shear ram. The miswiring should have caused the redundant coils to 

oppose one another, but a drained 9-volt battery resulted in one of the coils not energizing. This left the 

remaining coil to activate unopposed and to initiate closure of the blind shear ram as part of the 

AMF/deadman sequence. Despite activation of the AMF/deadman sequence, effective compression of the 

drillpipe caused it to buckle off-center within the well. The blind shear ram within the BOP partially 

sheared this off-center pipe, but it did not seal the well. As a result, flow from the well was reestablished 

and the personnel on board had to evacuate amid an active blowout.

46 

000623
Macondo Investigation Report Volume 2 June 5, 2014

4.0 Establishing and Maintaining Effective Barriers 

BSEE requires the management of offshore hazards,

43 but it 

does not distinguish between hazards that could lead to a 

major accident like Macondo from hazards associated with 

day-to-day offshore operations. Barriers intended to prevent 

a Macondo-like accident require a different approach and go 

beyond the basic barrier definition, which covers a physical 

barrier to prevent the flow of hydrocarbons in a well. The 

Petroleum Safety Authority (PSA) of Norway describes

barriers as “technical, operational and/or organizational 

elements which individually or collectively reduce 

opportunities for specific error, hazard or accident to occur, 

or which limits its harm/drawbacks.”44 This expanded 

definition is important because ensuring a physical barrier

like a BOP can prevent or mitigate a Macondo-like accident 

requires additional organizational and operational elements 

to determine the barrier is appropriate and effective

throughout its lifecycle. This concept is explored in the next 

two chapters. 

This chapter compares the UK, Norwegian, and Australian definitions for major accidents as they relate 

to offshore activities and the management approaches these countries require for major accident hazards. 

This comparison highlights opportunities for BSEE to enhance offshore safety in US drilling operations if 

BSEE were to establish similar features within its safety regulations. Currently, BSEE requires an 

evaluation of the potential safety, health, and environmental effects that may occur if a technical barrier 

fails,45 but not an assessment of a barrier’s effectiveness before drilling operations begin. Furthermore, 

BSEE has not set forth minimum barrier performance expectations, nor does it address concepts like

multiple layers of protection, the hierarchy of controls, or targeted risk reduction. As such, BSEE’s 

approach contrasts with international regulatory approaches to offshore safety and best practices 

identified for the onshore oil and gas processing facilities in the US.

46 

4.1 Defining the Role of a Barrier: Major Accident Events

Major accidents, also referred to as major accident events (MAEs), have been defined for offshore drilling 

operations by governing regulations in the UK, Norway, and Australia. In the UK, offshore MAEs are 

defined as one of five general scenarios: 47

1. A fire, explosion or the release of a dangerous substance involving death or serious personal 

injury to persons on the Installation or engaged in an activity on or in connection with it;

2. Any event involving major damage to the structure at the Installation or plant affixed thereto 

or any loss in the stability of the Installation;

3. A collision of a helicopter with the Installation;

Chapter 4.0 Overview

This chapter examines barriers to 

prevent major accidents. It introduces 

differences between the US offshore 

regulatory regime and its 

international counterparts in how 

they define major accident events and 

safety critical elements. Also 

discussed are process safety concepts, 

including the hierarchy of controls, 

defense-in-depth, and Layers of 

Protection Analysis as tools to 

determine the type and number of 

barriers necessary to minimize the 

risk of a major accident event. 

47 

000624
Macondo Investigation Report Volume 2 June 5, 2014

4. The failure of the life support systems for diving operations in connection with the 

Installation, the detachment of a diving bell used for such operations or the trapping of a diver 

in a diving bell or other subsea chamber used for such operations; or 

5. Any other event arising from a work activity involving death or serious personal injury to five 

or more persons on the Installation or engaged in an activity in connection with it.a

Norway regulations have a definition that includes environmental and financial effects: “Major accident 

means an acute incident such as a major spill, fire or explosion that immediately or subsequently entails 

multiple serious personal injuries and/or loss of human lives, serious harm to the environment and/or loss 

of major financial assets.”48 Australia’s offshore petroleum safety regulations define an MAE as “an event 

connected with a facility, including a natural event, having the potential to cause multiple fatalities of 

persons at or near the facility.”49 BSEE offshore regulations in the US do not define major accident 

events.b

The risk associated with a major accident event is a combination of consequence and probability, but the 

rarity of MAEs can lend a perception of low risk. A Guidance Note provided by Australia’s National 

Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) highlights the 

neglect that high-consequence, low-probability events may receive: “The relative rarity of events with 

catastrophic consequences may give rise to the situation where potential MAEs receive little attention, as 

compared with day-to-day operational issues.”

50 Regulations in the UK, Norway, and Australia focus on 

MAEs by requiring offshore oil and gas operations not only to manage high-probability personal health 

and safety issues, but specifically to require that MAEs be addressed. Consequently, companies operating 

in those offshore regions are required to establish safety management systems that explicitly address 

MAEs. Table 4-1 juxtaposes this approach against US regulations, which require operatorsc

 to have a 

safety management system with a goal to promote safety and environmental protection, but without a 

corresponding MAE requirement.d

a In this discussion references to MAE (given the jurisdiction of the CSB) concern chemical releases that could have 

catastrophic consequence, as opposed to ship collisions, major environmental oil spills, etc.

b US Coast Guard regulations also govern some offshore activities and do define serious marine incidents using 

several characteristics, including one or more deaths, injuries to crew members, and discharges of oil in excess of 

10,000 gallons into navigable waters of the US, 46 C.F.R. § 4.03 (2) (2012).

c BSEE defines an operator as “the person the lessee(s) designate as having control of management of operations on 

the leased area or a portion thereof. An operator may be a lessee, the BSEE-approved or BOEM-approved 

designated agent of the lessee(s) or the holder of operating rights under a BOEM-approved operating rights 

assignment.” 30 C.F.R. § 250.105 (2012)

d BSEE requires the reporting of many incidents that would fall under the definition of an MAE to the District 

Manager immediately after their occurrence, but regulations do not require the driller or operator to take any 

action as a result of the incident [30 C.F.R. § 250.188 (2012)].

48 

 

000625
Macondo Investigation Report Volume 2 June 5, 2014

Table 4-1. Excerpts from offshore regulations from the UK, Norway, and Australia that specifically require 

Major Accident Events be addressed; they are juxtaposed with US regulations that promote safety and 

environmental protection, but without a focus on MAEs.

4.2 Barriers to Prevent or Mitigate MAEs

In 2003, Transocean conducted a high-level generic risk assessment for the Deepwater Horizon to 

identify potential major accident events. The review was not well specific.

a

 While not required for 

operation in the Gulf of Mexico, this assessment aimed to ensure barriers were in place to prevent MAEs 

or to mitigate the consequences if they did occur.51 Transocean identified and assessed several potential 

scenarios, two of which referenced Macondo-like events, “gas in the riser” and a “reservoir blowout.” The 

team completing the assessment created a table to compile the MAEs and their potential consequences as 

well as preventive and mitigating barriers. Table 4-2 is a sample of the one produced by Transocean.

a An analysis of Transocean’s risk assessment appears in a subsequent volume of the CSB Macondo Investigation 

Report.

49 

 

000626
Macondo Investigation Report Volume 2 June 5, 2014

Table 4-2. Recreated excerpts of Transocean's Risk Assessment for the DWH52

The “preventions” and “mitigations” listed in the table represent the safeguards designed to eliminate, 

prevent, reduce, or mitigate the scenario; they are also referred to as barriers, layers of protection, lines of 

defense, or control measures.

53 

BP’s Exploration and Production Operating Management System Manual identifies that barriers “are 

more than just mechanical or instrumented devices” but also include process and people.54, a These 

categories of barriers—technical, organizational, and operational—are all represented in Table 4-2. 

a BP and Transocean’s implementation of risk and barrier management at Macondo is discussed in Volume 4.

50 

 

000627
Macondo Investigation Report Volume 2 June 5, 2014

Technical barriers include the redundant BOP controls, explosion-rated equipment, a and the 

hydrocarbon/combustible gas detection system. Pre-defined company routines that embrace “good 

drilling practices” and effective “maintenance and testing” procedures are examples of organizational 

barriers while “training of drill crew in well control” seeks to improve the operational barriers the crew 

provides when assessing and then initiating a response to a particular scenario on a drilling rig. 

In its Exploration and Production Operating Management System Manual, BP warns that all barriers are 

prone to failure:

Even the best barrier will not achieve perfect reliability. It will have holes. The 

holes can be latent or actively opened or enlarged by the action or inaction of 

people. The robustness of the barriers changes with time, and depends on factors 

related to people, process and plant.55

The quote explains that barriers are vulnerable and their variable robustness affects risk by increasing the 

probability that a major accident event can happen. As a result, hazards should be controlled by multiple, 

independent layers of protection. BP indicates the best opportunity for reducing hazards is during the 

design stage, when inherently saferb

 design processes can be incorporated into the installation. The next 

best opportunity is in engineered safety in the form of passive or active controls,c

 and finally procedural 

safety. An effectiveness ranking of safeguards used to mitigate hazards and risks like those described by 

BP has also been called a hierarchy of controls. One example appears in Figure 4-1.

56

Figure 4-1. Hierarchy of Controls.

Relying on multiple layers of protection to safeguard against major accident events has also been referred 

to as defense in depth.57 The key to defense in depth is “creating multiple independent and redundant 

layers of defense to compensate for potential human and mechanical failures so that no single layer, no 

matter how robust, is exclusively relied upon.”58 As both the concept of the hierarchy of controls and 

a

 Explosion-rated equipment: Electrical equipment designed and constructed to be used in flammable atmospheres 

(e.g., flammable vapors or dusts).

b According to the Center for Chemical Process Safety (CCPS), “inherently safer design solutions eliminate or 

mitigate the hazard by using materials and process conditions that are less hazardous.” Center for Chemical 

Process Safety (CCPS), Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed., Section 5.1.1

(2009).

c Passive controls do not require a person or system to detect an event or take action to provide protection. Active 

controls respond to a situation to activate devices or systems intended to interrupt a sequence of events or mitigate 

a consequence.

51 

 

000628
Macondo Investigation Report Volume 2 June 5, 2014

BP’s written programs highlight, for companies to achieve this goal,59 they must start with sound designs. 

If a hazard cannot be eliminated or substituted for a less hazardous one, then equipment should be built 

according to quality standards to avoid errors and malfunctions during operations. Equipment should have 

a high tolerance for malfunctions if they occur and should employ redundant systems to ensure reliability 

and availability. Since a defense-in-depth approach assumes mechanical and human failures will occur, 

layers of protection should include detection and protection systems to maintain safe operations or to shut 

down an operation safely when failures do occur. Finally, companies need to incorporate layers of 

protection that mitigate and minimize the effects of a major accident event. For example, they can plan to 

physically contain the release of toxic chemicals or rely on emergency response activities to minimize 

damage or loss of life. 

4.2.1 Visualizing Barriers using a Bowtie Diagram

Many plausible scenarios around a particular hazard could result in a major accident event.60 By using a 

visual tool known as a bowtie diagram, one can logically follow how a major accident event could evolve 

during these scenarios while contemplating a series of technical, organizational, and operational barrier 

failures. 

As Macondo has demonstrated, the presence of hydrocarbons in the riser is a serious hazard. Once oil and 

gas pass above the BOP, no robust barrier exists to stop them from reaching the rig floor. The drilling 

crew must, after detection, try to divert them to a safer location, but the capabilities of the diversion 

equipment cannot handle a large volume of unloading riser gas. Ultimately, the hazard posed by 

expanding gas in the riser could progress to an ignited or unignited blowout if the release subsequently 

causes loss of drillpipe or BOP integrity. 

A kick that results in hydrocarbons in the riser may be initiated by one of several threats, including the 

following examples: 

• Fault during the temporary abandonment process (Volume 1, Chapter 2) 

• Insufficient drilling mud properties (Volume 1, Section 2.1) 

• Lost circulation event (Volume 1, Section 2.1) 

• Unexpected high pressure formation (Volume 1, Section 2.1) 

These threats have been listed at the left hand side of the bowtie diagram in Figure 4-2. 

52 

000629
Macondo Investigation Report Volume 2 June 5, 2014

Figure 4-2. Bowtie diagram depicting the relationships between hazards, barriers, and the major accident 

events they are intended to prevent.

a

In this figure, technical barriers are represented along the lines connecting the threat and hazard, but only 

the barriers related to a “faulty temporary abandonment process” have been identified. Other

circumstances could compromise the technical barriers, and, as indicated in Figure 4-3 organizational and 

operational barriers are in place to avoid these potential barrier decay mechanisms. b

 

Often different threats require different barriers. For example, the threat of “insufficient mud properties” 

is mitigated or avoided by having a robust well program (organizational barrier), whereas the threat of a 

“lost circulation” event is mitigated or prevented by the drilling crew monitoring and comparing the 

volume of mud leaving and returning to the rig (operational barrier). Once any of the threats in Figure 4-2 

a This is not a comprehensive bowtie diagram but rather a sample of some threats, barriers, and consequences.

b These are referred to as “barrier decay mechanisms” by DNV GL, 

http://www.dnv.com/industry/oil_gas/publications/updates/oil_and_gas_update/2013/01_2013/more_control__bett

er_safety_integrated_barrier_risk_management.asp ) or “escalation factors” by S. Lewis and K. Smith, Lessons 

Learned From Real World Application of the Bow-tie Method, presentation at the American Institute of Chemical 

Engineers 2010 Spring Meeting 6th Global Congress of Process Safety, San Antonio, TX, March 2010.

53 

 

000630
Macondo Investigation Report Volume 2 June 5, 2014

results in the presence of hydrocarbons in the riser, shared potential consequences arise. The bowtie lists 

several barriers intended to prevent the hazard from progressing to an ignited or unignited blowout. 

Fault during 

temporary 

abandonment

Kick resulting 

in 

hydrocarbons 

in the riser

Ignited 

blowout:

Fires/

explosions/

loss of life

Unignited 

blowout: 

hydrocarbon 

release into 

Gulf

Bottom hole 

cement

Drilling fluid 

column

Drilling crew 

vigilance and 

response

Emergency well 

control response

Diverter 

system

Ignition 

controls

Emergency 

BOP systems

Emergency well 

control response

Diverter 

system 

Integrity 

tests Manual activation 

of BOP

Emergency 

evacuation

Emergency 

BOP systems

Inspection and 

maintenance

Cement fails to 

seal

Correct mud 

density

Correct 

formulation

Well control 

procedures

BOP fails when 

needed

Inadequate fluid 

column 

Design limitations 

identified in a 

hazard analysis

Figure 4-3. Bowtie diagram showing potential decay mechanisms of the technical barriers intended to 

prevent a fault during temporary abandonment activities.

By tracing the lines leading from a threat to a consequence, and any barrier decay mechanisms listed, one

can follow how the scenario would evolve. In the case of a fault during the temporary abandonment 

process, Figure 4-3 demonstrates that the following must occur: 

• The bottom hole cement barrier has to fail as do the tests to detect that failure; 

• The drilling fluid column has to either be removed or inadequately formulated; 

• Well control actions by the crew have to result in failure to detect changes in density, volume, 

and flow rate of the circulating (or displaced) drilling fluid column, which would indicate a kick 

has occurred;a

 

a The Transocean Well Control Handbook definition of well control principles includes “continuously monitor 

active pit volumes” and “immediately detecting changes in the density, volumes and flow rate of the drilling fluids 

from the wellbore and taking the appropriate action.” Transocean - Well Control Handbook - Level: L1B, Issue 

#3, Revision #1 - HQS-OPS-HP-01. Publicly accessed at 

54 

 

000631
Macondo Investigation Report Volume 2 June 5, 2014

• The drilling crew has to then fail to activate the BOP, or the BOP fails to shut in the well upon 

manual activation due to inadequate design, inspection, or maintenance. 

Once hydrocarbons have entered the riser, a blowout (ignited or unignited) can result if the diverter 

system is unsuccessful and/or ignition controls fail and an explosion occurs. The degree of fire and loss of 

life will escalate if the emergency well control response, BOP emergency systems, or abandonment 

activities do not successfully shut in the well or the crew cannot (or fails to) safely and efficiently 

evacuate the rig. 

The BOP is the only barrier to appear on both sides of the bowtie diagram in Figure 4-2, because the BOP 

is a collection of well control devices and emergency systems. As described in Section 2.2, well control 

actions by the crew should result in manual activation of the BOP, but automated emergency shear 

functions may also be initiated. 

4.2.2 Determining the Type and Number of Barriers to Reduce Risk

The process complexity and potential severity of an event will dictate the type and number of barriers 

needed to demonstrate that the risk of an MAE is reduced to a targeted level, such as “as low as 

reasonably practicableˮ (ALARP). Higher risk situations will require either more barriers or barriers with 

better reliability, and when striving for ALARP, efforts for risk reduction are instituted until the effort to 

reduce risk further becomes grossly disproportionate to 

the level of actual risk reduction.

61

In general, the UK and Australian offshore regulatory 

regimes accept proof of adherence to codes, standards and 

relevant good practice as ALARP for broadly recognized

risks.62 For more complex situations, when an operator is 

proposing a new technology or where high-hazard 

scenarios affect a large population, there may not be good 

practice for the operator to follow or the regulator may 

decide industry standards are sufficient to constitute 

ALARP. In these situations, the regulator may consider 

risk assessment tools, possibly in conjunction with a costbenefit analysis in determining if the risk of an operation 

has been reduced to an ALARP level. The CSB has 

explored concepts related to ALARP as a result of onshore 

investigations63 and returns to the offshore implications in 

Volume 3. 

A company might use several tools to assess risk, including, but not limited to,

• Risk Matrix

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf, Section 2 (Well Control 

Principles), Subsection 1 (Definition).

The Principle of ALARP

“As low as reasonably practicable” was 

first defined legally in English courts in 

1949.a

 Lord Justice Asquith suggested 

that “physically possible” is distinct 

from “reasonably practicable.” 

“Reasonably” should be determined by 

comparing the time, money or effort 

necessary to reduce risk. If one can 

show that “the risk [is] insignificant in 

relation to the sacrifice,” then the onus 

of further expenditure is dismissed. This 

concept is explored more fully in the 

CSB’s Macondo Investigation Report, 

Volume 3. 

55 

 

000632
Macondo Investigation Report Volume 2 June 5, 2014

• What-if Checklist

• Hazard and Operability Study (HAZOP) 

• Facility Siting study

• Qualitative Risk Assessment (QRA)

• Layers of Protection Analysis (LOPA).

64

As part of LOPA, independent layers of protection (IPLs) are analyzed for their effectiveness, and their 

combined protection is measured against risk tolerance acceptance criteria.a,65 This approach is explored 

in depth here more than the others because, as discussed in Section 5.2.2, a movement is afoot toward 

using the technique to define BOP performance requirements. 

IPLs are devices, systems, or actions capable of preventing an initiating event from progressing to an 

undesired consequence. The LOPA method uses event severity, initiating event frequency, and likelihood 

of failure of the IPLs to calculate a level of risk. If the calculated risk level as determined by LOPA is not 

considered acceptable, then additional IPLs can be added to a scenario, and the analysis can be repeated. 

As a result, LOPA is used to evaluate the value of 

implementing additional protection layers with the goal of 

reducing risk to below a maximum acceptable threshold.

Applying LOPA requires clearly defining the initiating 

event, and each IPL must be: 1) independent of the 

initiating event and each other, 2) effective in preventing 

the consequence when it functions as designed, and 3) 

auditable so that its performance can be validated.66 These 

factors imply that not all barriers, or safeguards, can be 

IPLs for calculating a risk level during LOPA. For 

example, training and procedures are important safeguards 

for preventing an accident, but their failure may cause the 

initiating event, in which case they could not be considered 

independent layers of protection in the LOPA context.67

LOPA can be used to describe IPL performance by 

calculating the average probability the IPL will perform its 

required safety functions under stated conditions and 

within a stated time period.68 An industry benchmark contextualizes this performance for instruments or 

equipment by assigning them a discrete value called the safety integrity level (SIL).

69 An SIL ranges from 

one, the lowest performance level to four, the highest. The higher the SIL, the greater the probability the 

instrument or equipment will function to successfully prevent an undesired consequence. Each integer 

a BP has a group practice that describes the LOPA methodology, GP 48-03 Layers of Protection Analysis (LOPA): 

Groups Practice – BP Group Engineering Technical Practices (ETP), 5 June 2008 [BP-HZN-CSB00181723]. GP 48-

03 also includes references to hazard and operability studies (HAZOP) and inherently safer design options. The ETP 

was expressly approved “for implementation across the BP Group,” which included drilling, but was acknowledged 

in BP Board records [BP-HZN-BLY00204248] not to have been applied to contractor MODUs in the Gulf of 

Mexico at the time of the Macondo incident. Volume 4 of the CSB Macondo investigation report analyzes risk 

assessment at Macondo in greater depth.

Defining the Initiating Event 

Identifying all well control situations 

that could progress to a blowout is 

critical to avoid calculating an 

artificially low level of risk.

In 2009, Transocean reported six 

kicks that resulted in uncontrolled 

release of mud and gas onto a rig 

after well fluids passed above a BOP. 

Any kick has the potential to develop 

into a blowout. The number of well 

control incidents per rig increases 

from 0.05 to 0.6 when considering the 

total number of kicks (71).†

†

Transocean Annual Report 2009, Well 

Control Events & Statistics 2005 to 2009, 

TRN-INV-01143142.

56 

 

000633
Macondo Investigation Report Volume 2 June 5, 2014

increase in SIL corresponds to a ten-fold reduction in the risk frequency that an initiating event will result 

in the corresponding event consequence. Assigning an SIL to an instrument or piece of equipment 

accounts not just the initial design; it considers the complete lifecycle, including maintenance and testing. 

This judgment requires verification of the actual performance of the IPL throughout its lifetime to ensure 

the availability of the safety integrity action is maintained.

70

4.2.3 Maintaining Effective Barriers 

LOPA and SIL assignments offer one approach to help demonstrate ALARP, but characteristics of 

effective barriers also can be summarized more generally. NOPSEMA contends that clear linkages 

between the barriers and the specific hazards they are designed to prevent and mitigate will aid drilling 

operators in effectively determining if those barriers:

• have been selected in accordance with the hierarchy of controls (order of preference); 

• are distributed appropriately with representation of the types of control, namely, engineering, 

procedural, and administrative; 

• have adequate layers of protection; 

• cover the full range of operating and emergency circumstances; 

• consider common mode failures; 

• are effective; 

• are reasonably practicable; 

• reduce the risk to a level that is ALARP.

71

Continuously monitoring a barrier’s effectiveness throughout its lifecycle is a prominent requirement for 

international regulatory regimes governing offshore drilling operations.72 In Norway, regulations require 

performance standards to continuously monitor threats to barriers: “the operator or the party responsible 

for operation of an offshore or onshore facility, shall stipulate the strategies and principles that form the 

basis for design, use and maintenance of barriers, so that the barriers’ function is safeguarded throughout 

the offshore or onshore facility’s life.”73 These strategies and principles are often embedded within a 

company’s safety management systems (SMSs). 

In part, a company’s SMSs ensure the barriers are available, reliable, independent, and effective. Success 

of an SMS program requires implementing several organizational process assurances, including a 

mechanical integrity program for the equipment functions as expected; a training program for the human 

control to have the skills and aptitude to handle the potential hazards/risks of the work, particularly for 

safety critical tasks, such as responding correctly to an emergency event; and a management of change 

program for not detrimentally affecting the barriers in place during changes to the drilling plan, 

equipment, crew, or management. The relationship among these barriers is interdependent. If a piece of 

equipment fails unexpectedly despite following the planned preventive maintenance inspection schedule, 

the reliability of the barrier should be reassessed and the mechanical integrity program adjusted to ensure 

that such a failure cannot recur. Otherwise, the reliability of the barrier does not match performance and 

the risk levels increase. Ideally, the company would not wait until a failure occurs to assess the health of a 

barrier, but rather incorporate indicators to measure the ongoing health of the barrier and communicate 

regularly to the regulators, workforce, and management.

57 

000634
Macondo Investigation Report Volume 2 June 5, 2014

4.2.3.1 Barriers as Safety Critical Elements (SCEs)

The role of SMS is particularly important when the barrier being monitored is equipment or a human 

action whose: 

• failure could cause or contribute to a major accident event;

• purpose is to prevent or limit the effects of a major accident event. 

Offshore regulations in the UK refer to such barriers as safety critical elements (SCEs)74 or, in the case of 

human actions, safety critical tasks.

a One author described SCEs in these simple terms: “These are the 

safety controls (hardware, people systems, or software) that deliver a disproportionate improvement in 

safety (and conversely, when not functional lead to a disproportionate increase in risk).”75

Companies operating offshore in UK,76 Norway,77 and Australia78 must identify safety critical elements

and establish performance standards, which are qualitative or quantitative statements that describe the 

required performance of the SCE. Performance standards can be based on nationally and internationally 

recognized industry standards, but they may also comprise methods or technical solutions developed by 

the company.79

In 2005, the Energy Institute published revised guidanceb

 to provide good practice for offshore 

installations to follow in managing safety critical elements.

The guidance defines performance standards in terms of: 

1. Functionality — What is it required to do?

2. Availability — What will be its performance duration?

3. Reliability — How likely is it to perform on demand? 

4. Survivability — What post-event role must it survive to perform? 

5. Interactions — What other systems must be functional for it to operate? 

Compliance with an appropriate performance standard is the basis for assuring an SCE will act as a 

barrier to an MAE. In the UK, a written verification scheme, based on the SCE’s performance standard, is 

required to ensure every SCE is appropriate, available, and effective throughout its service.80

a UK Safety Case regulations do not specifically require naming safety critical tasks, but UK HSE Safety Case 

guidance states, “Human performance problems should be systematically evaluated. This should involve 

evaluating the feasibility of tasks, identifying control measures and providing an input to the design of procedures 

and personnel training, and of the interfaces between personnel and plant. The depth of analysis should be 

appropriate to the severity of the consequences of failure of the task.” UK HSE, Assessment Principles for 

Offshore Safety Cases, 

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&sqi=2&ved=0CDUQFjAA&u

rl=http%3A%2F%2Fwww.hse.gov.uk%2Foffshore%2Faposc190306.pdf&ei=jg6OUuTzHaPhygHI7YE4&usg=A

FQjCNG9jDdqxIdUGguRCSNxT6GUoIozCg&sig2=6n2lF5b6kPPIzyXlEZA0cA&bvm=bv.56988011,d.eW0. 

Retrieved November 21, 2013.

b After the UK Safety Case regulations were instituted in 1996, Oil and Gas UK (formally the UK Offshore 

Operators Association) created guidance for the management of safety critical elements. This original guidance 

was revised by the Energy Institute, Guidelines for the Management of Safety Critical Elements, 2nd ed.

58 

 

000635
Macondo Investigation Report Volume 2 June 5, 2014

While Norway and Australia do not cite verification 

schemes by name, each country has regulatory language or 

guidance that mirrors the verification scheme requirement 

in the UK.

81 

In the absence of a verification scheme, a risk assessment 

could result in an activity that identifies an MAE and then 

simply assigns what are assumed to be SCEs, but which do 

not actually reduce the probability or consequence of the 

MAE. As the UK Health Safety Executive (HSE) states, 

“Risk assessment alone does little or nothing to reduce 

risks, particularly if the risk assessment is seen as an end in 

itself. Rather, risks are reduced by employing the risk 

assessment process in an active and intelligent way, as a 

tool to help focus the process on continuous improvement 

within the safety management system.”82 

In any regulatory regime, there is the potential for 

performance standards and verification schemes to be 

generated, but then put on a shelf and do little to actually 

increase the safety offshore operations. In this manner the 

regulatory requirements could become a documentation 

exercise rather than an integrated part of a normal work 

process. Continuous improvement to reduce the risk of a 

major accident event requires looking beyond current good 

practice and naturally implies that ALARP, or any risk 

reduction target, is a constantly evolving concept. In some 

instances companies will initiate the push for improvement 

and in other instances the regulator can lead the way, but 

only if the regulatory framework is in place to facilitate the 

process for all parties. The following callout box describes 

one such example.

The written verification scheme 

Also called an assurance scheme, the 

written verification scheme should 

ensure the SCE performance is met 

by:

(1) Identifying those assurance 

activities, such as maintenance, 

inspection, and testing, which are 

required to sustain the SCE in a 

suitable condition; 

(2) Ensuring that these activities are 

carried out at the appropriate time by 

competent people; 

(3) Maintaining a record of these 

activities and any findings that arise; 

and 

(4) Addressing any deficiencies 

arising from assurance activities as 

soon as possible and taking any 

temporary measure that may be 

necessary to maintain risk ALARP 

until deficiencies have been 

recertified. Any temporary measures 

should be subject to review and 

comment by an independent 

competent person. †

† Guidelines for the Management of 

Safety Critical Elements, 2nd ed. 

published by the Energy Institute.

59 

000636
Macondo Investigation Report Volume 2 June 5, 2014

The Power of Risk Reduction Targets 

Norway’s offshore safety regulator, the Petroleum Safety Authority (PSA), 

continuously drives improvements in safety by requiring responsible parties to 

ensure that risks are “reduced beyond the established minimum level ... if this can 

take place without unreasonable cost or drawback.” For instance, in 1992 PSA 

sought to introduce regulations to require the use of remote-operated pipe handling 

technologies to reduce work-related injuries associated with handling heavy-duty 

piping. Numerous complaints were lodged against the regulations; however, PSA 

enacted the requirements because the social benefits outweighed the cost of 

compliance. Through a collaborative partnership, industry and regulator worked 

together to develop technologies capable of improving safety. The result has been a 

marked improvement in pipe handling safety. Furthermore, due to the global nature 

of the industry, pipe handling safety improvements have been adopted worldwide. 

Thus, regulatory initiatives to redefine what is “practicable” or “beyond the minimal 

level” can result in significant safety change.

Sources: Petroleum Safety Authority Norway, unless noted otherwise, from the following publications, 

last visited February 7, 2013:

• Guidelines Regarding the Framework Regulations, Re Section 11 Risk Reduction Principles,

http://www.ptil.no/framework-hse/category408.html#p11; 

• 081 – Norwegian Oil and Gas Recommended Guidelines for Remote Pipe Handling Operations, 

http://www.norskoljeoggass.no/Documents/Retningslinjer/081-100/081%20-

%20Recommended%20guidelines%20for%20remote%20pipe%20handling%20operations%20r

ev.4,%2011.06.12.pdf?epslanguage=no;

• Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at 

Certain Onshore Facilities (The Framework Regulations), Section 11 Risk Reduction 

Principles. http://www.ptil.no/framework-hse/category403.html#_Toc282603288;

• Mechanical Pipe Handling: Reviled Requirements Paid Off (2011) , 

http://www.ptil.no/news/mechanical-pipe-handling-reviled-requirements-paid-off-article7666-

79.html?lang=en_US 

• Invented Safety, Reaped Values (2007), http://www.ptil.no/news/invented-safety-reaped-valuesarticle3341-79.html;

• Kevin Roche, Noble Pipe Handling Incident Review – Gulf of Mexico, 

http://www.ptil.no/getfile.php/z%20Konvertert/Helse%2C%20milj%C3%B8%20og%20sikkerh

et/Sikkerhet%20og%20arbeidsmilj%C3%B8/Dokumenter/presentation%2B%2528noble%2B-

%2Bpipe%2Bhandling%2Bincident%2Brev.pdf.

60 

000637
Macondo Investigation Report Volume 2 June 5, 2014

4.3 Conclusion

A natural tendency is to focus on technical barriers because they are physical in nature, and in deepwater 

drilling they clearly show how they stop the flow of hydrocarbons from the well. Yet all barriers, whether 

technical, operational, or organizational, are prone to failure; therefore, multiple barriers of sufficient 

robustness are required to avoid a major accident event. The number of barriers needed to reduce the risk 

of an MAE may simply require following good guidance practices established by the industry, or they 

may require additional risk assessment tools to evaluate whether risk has been reduced to some targeted 

level, such as ALARP.

61 

000638
Macondo Investigation Report Volume 2 June 5, 2014

5.0 Deepwater Horizon BOP not Treated as a Safety Critical 

Element 

A blowout preventer contains multiple well control devices, 

and it satisfies both definitions of a safety critical element 

given in Section 4.2.3.1: it is a device intended to prevent a 

kick from progressing to a blowout and to mitigate potential 

consequences of a blowout—fatalities, major oil spill, and 

loss of rig. While Transocean and BP conducted routine 

inspections and weekly functioning of various operational 

components necessary for daily drilling operations, they 

failed to implement inspection and testing activities that 

would have identified latent BOP failures of the emergency 

systems components of the Deepwater Horizon BOP. As a 

result, the safety critical BOP systems responsible for 

shearing drillpipe in emergency situations were 

compromised before the BOP was even deployed to the 

Macondo wellhead. 

While this chapter uses the BOP as the vehicle to explore effective management of safety critical 

elements, the other barriers listed in the bowtie diagram from Section 4.2.1 could be subjected to the same 

analysis. The bowtie diagram demonstrates that failure of a technical barrier, such as the BOP, is rooted in 

inadequate operational and organizational barriers. The links between these barriers—technical, 

operational, and organizational—and major accident events provide a means to identify the systems that 

operators and regulators should monitor for opportunities to improve risk reduction.83

Organizations maintaining effective safety critical elements (SECs), such as the BOP, implement 

management activities to ensure they meet safety objectives throughout the lifetime of the SCE.84 These 

measures appear in the simplified representation of the management system for the lifecycle of an SCE in 

Figure 5-1. 

Chapter 5.0 Overview

This chapter discusses the BOP as a 

safety critical element and provides 

evidence to support that BP and 

Transocean did not treat it as such. 

Also reviewed is the lifecycle of a 

safety critical element, which includes 

identification, development of 

performance standards, assurance 

and verification activities, and gap 

closure. 

62 

000639
Macondo Investigation Report Volume 2 June 5, 2014

Figure 5-1. Simplified representation of the management system for the lifecycle of a safety critical 

element 

While Transocean identified the Deepwater Horizon BOP as safety critical in a hazard analysis, it

operated the BOP beyond its design limits for reliable drillpipe shearing and did not track modifications 

to individual components that ultimately affected the reliability of the emergency systems. As required by 

regulations,85 regular testing of some BOP functions was performed, but this testing did not assess the 

emergency systems and were could not detect the latent failures presented in Chapter 3.0. The CSB 

concludes that post-incident testing changes now required in the United States are not sufficient to ensure 

industry will detect deficiencies like those found in the 

Deepwater Horizon BOP.

Using the Deepwater Horizon BOP as a model, this chapter 

highlights opportunities throughout the SCE lifecycle to use 

or improve effective identification, performance standards, 

and assurance and verification activities to guarantee a BOP

is effective throughout its use. This information culminates 

with a discussion on gap closure intended not only to 

maintain the performance of a BOP and the operational and 

organizational barriers that support it, but to improve them over time. 

The CSB concludes that post-incident 

BOP testing changes now required in 

the United States are not sufficient to 

ensure industry will detect 

deficiencies like those found in the 

Deepwater Horizon BOP 

63 

000640
Macondo Investigation Report Volume 2 June 5, 2014

5.1 Identification of a SCE

Failure of safety critical elements and tasks could cause or contribute to major accident events. (See 

Section 4.1.)86 Operators and drilling contractors should clearly document SCEs to distinguish them from 

other equipment and tasks.

a

 The first step in identifying them depends on determining potential major 

accident events through a hazard analysis (Figure 5-1),87 which should identify the sequence of events 

that could lead to a major accident and the factors that can contribute to it, including human errors.88

Companies will typically use internal equipment lists as a starting point for identifying safety critical 

elements, but the depth to which they should define the SCEs depends on their direct link to the major 

accident event.89 For example, while a BOP as a whole is safety critical, not every component of a BOP 

necessarily is. 

5.1.1 BOP Component Failure Identified in DWH Hazard Analysis 

In the 2003 Major Accident Hazard Risk Assessment conducted by Transocean,90 a Statement of 

Approval that accompanied the MAHRA reads:

91

The [MAHRA] performed for the Deepwater Horizon identified reasonably foreseeable hazards 

that might lead to a major accident. It has been demonstrated that adequate controls are in place 

so that HSE [health, safety, and environmental] risks on the Deepwater Horizon can be 

considered both tolerable and ALARP (As Low As Reasonably Practicable). This assessment has 

been reviewed and recommendations which were developed have been followed up. 

The MAHRA identified the BOP system as “critical” and recorded hazards specific to the BOP system 

that could lead to a major accident. The MAHRA also documented the preventions and mitigations 

related to the BOP system. One of the hazards listed for the BOP system was “a component failure,” 

which, in light of the evidence presented in Section 3.0, is appropriate since the failure of a solenoid or 

battery in a BOP could be sufficient to inhibit the emergency AMF/deadman system. The accompanying 

consequences, preventions, and mitigations associated with a component failure, as identified by 

Transocean, are listed in Table 5-1. 

a The term “safety critical element” is akin to American National Standards Institute’s use of “process safety 

safeguardˮ when addressing risk management in the process industry in the ANSI/ISA-84.91.03-2012, 

Identification and Mechanical Integrity of Safety Controls, Alarms, and Interlocks in the Process Industry, 

September 20, 2012, p. 12.

64 

 

000641
Macondo Investigation Report Volume 2 June 5, 2014

Table 5-1. Recreated excerpt of Transocean's MAHRA for the Deepwater Horizon92

Completing the MAHRA was only the first step toward identifying the safety critical elements. A second 

step would be to identify which components of the BOP were actually safety critical and could be directly 

linked to major accident events. As is discussed in subsequent sections, those components deemed safety 

critical should have been subjected to the remaining steps in the lifecycle of an SCE as represented in 

Figure 5-1. 

5.1.2 DWH Hazard Analysis Did Not Address BOP Design Capabilities 

Transocean’s MAHRA missed the opportunity pre-incident to identify that the BOP system could fail to 

seal a well because BOP design capabilities had been exceeded. The CSB identified two such scenarios 

existed during the drilling operations at Macondo. First, throughout the drilling operation, drillpipe was 

used that exceeded the BOP manufacturer’s recommendations for the Deepwater Horizon’s blind shear 

ram (Section 5.2). Second, while the Deepwater Horizon BOP was rated by the manufacturer to shear 

centered 51⁄2" drillpipe, the ability to do so was affected by the shut-in well conditions. Under likely

conditions at Macondo, the Deepwater Horizon BSR would not have been able to shear a centered 51⁄2" 

drillpipe if the annular preventer in the BOP had sealed. 

A design limitation of a BOP is the wellbore pressure 

that the BSR will have to close against. At the time of 

the incident, offshore US regulations did not specify a 

minimum design pressure, but a practice was to assume 

that the annular preventers would be open, and the 

pressure in the BOP would be the hydrostatic head of the 

drilling mud in the well and riser.a A more conservative 

a Pre-Macondo, no industry guidance covered this issue. Conversations with individuals in the drilling industry 

indicated an assumption that one would not shear drillpipe until after it was hung off on a closed pipe ram and the 

annular had been reopened. In that scenario, the design wellbore pressers for shearing would have been the 

Under likely shut in well conditions at 

Macondo, the Deepwater Horizon 

BSR would not have been able to 

shear a centered 51⁄2" drillpipe if the 

annular preventer in the BOP had 

sealed.

65 

 

000642
Macondo Investigation Report Volume 2 June 5, 2014

approach would have been to assume that an annular preventer was closed and the BSR would have to 

close against the maximum anticipated surface pressure (MASP)a for the well. (See Appendix 2-A for 

more details.) The Deepwater Horizon accumulator system was not designed to overcome the increased 

wellbore pressure that would have occurred at Macondo if the DWH annular preventer had been closed. 

BSEE regulations now require that the blind shear ram be able to shear against maximum anticipated 

surface pressure (MASP).93

5.2 Defining Performance Requirements of a SCE

Ultimately, the performance standard is the basis for how an SCE will reduce the risk of a major accident 

event.b, 94 Operators and drilling contractors can use a performance standard to define the safety critical 

element’s requirements during all phases of an operation and to address the hazards or potential MAEs 

that could occur during operational activities.95 

The performance requirements for an SCE should include all the aspects described in Section 4.2.3.1—

the functionality, availability, reliability, survivability, and interactions with other systems that may affect 

its ability to function properly. The performance requirements should also be verifiable to ensure the 

SCEs are suitable for the hazards identified in the hazard analysis. Verification may include clarifying the 

relationship between the hazard analysis and the role of the SCE. For example, a BOP is not designed to 

stop an active blowout, so ideally it will be activated before oil and gas pass above the BOP.96 The 

performance standard may identify safe operating limits, setpoints, or criteria for action to place an 

operation in a safe state.97 By implication, the performance standard will include measures to compensate 

for out-of-service periods.98 Performance requirements should cover both normal and abnormal situations, 

including when to respond manually, what actions to take, and in what state to leave the process. 

Determining the reliability of an SCE will require an accurate estimate of the demand rate on the 

equipment, as an increased rate could affect reliability predictions.

99 Equipment should meet these 

requirements, and its approval might be based upon manufacturer’s information and historical in-house 

performance within the organization.100

5.2.1 Drillpipe Exceeded Shearing Capabilities of DWH Blowout Preventer 

The Transocean well control manual, in effect at the time of the incident, states minimum acceptable 

requirements for BOPs on all company installations. It does not address all of the performance 

requirements listed in the preceding paragraph, but the manual does include the following performance 

statements: 

• There must be at least one set of blind/shear type rams; 

• The blind/shear rams must be capable of shearing the highest grade and heaviest drillpipe used on 

the rig ... and sealing the well in one operation.101

hydrostatic pressure of the mud column. The Macondo incident demonstrated that this assumption was not 

adequate. The BP and Transocean well control manuals state that the blind shear rams should be capable of sealing 

the well in one operation [BP-HZN-2179MDL00327390], that the limitation of the shear capacity should be 

understood, and that plans should be in place to address any limitations [BP-HZN-CSB00079397].

a MASP: Maximum anticipated surface pressure, the maximum pressure that may occur in a well.

b Section 4.2.3.1 introduces performance requirements in the form of a performance standard.

66 

 

000643
Macondo Investigation Report Volume 2 June 5, 2014

The Deepwater Horizon’s BOP met the first performance requirement—but the blind shear ram did not 

meet the second requirement. At the time of the incident, the DWH had 51⁄2" drillpipe in the BOP, but for 

most of the drilling at Macondo, 65⁄8" drillpipe was used.102 The Deepwater Horizon BOP was not capable 

of reliably shearing 65⁄8" drillpipe. 

In 2007, Cameron published a product advisory “to assist Cameron equipment users in defining the 

shearing requirements for drilling operations.”103 Cameron provides a “method that can be used as a guide 

to predicting if a tubular [e.g., drillpipe] is shearable or not.” The formulas given in the method are based 

upon empirical data Cameron has collected over the years to validate the ability of a BOP to shear 

drillpipe. Calculated results based on the method provided in the product advisory demonstrate that the 

Deepwater Horizon’s BSRa did not meet the manufacturer’s most recent published design shearing 

capabilities for 65⁄8" drillpipe.b

 

Emails exchanged (Table 5-2) indicate that at least one of the DWH senior subsea supervisors was aware 

the rig BSR was not rated to shear 65⁄8" drillpipe.104 As a result, Transocean had a multistep workaround 

for the larger pipe,

105 but the procedure contradicted the “one operation” performance requirement 

Transocean set in its well control manual. The workaround was to first shear the 65⁄8" pipe with the casing 

shear rams, which can shear the heavier pipe but not seal the well, and then close the BSR with no pipe in 

it. This method could be accomplished manually by the driller or by setting the Emergency Disconnect 

System into a mode designed to complete this type of two-step operation.c However, the AMF/deadman 

system was not programmed to perform this two-step operation. This protocol increased the risk of a 

major accident event, because activating the AMF/deadman with the 65⁄8" drillpipe would have exceeded 

the BOP design capabilities, immediately leading to a well blowout.d Best practice recommends 

identifying the interactions of an SCE with other systems because a change to a system may negatively 

affect the SCE. The two-step operation is an example of a negative impact to an SCE, highlighting the 

need for establishing management of change procedures for safety critical equipment.e (See Appendix 2-

A for more details.) 

a The Deepwater Horizon BSR was a Cameron model TL 18 3/4" (15,000 psi WP) with a type-SBR shear packer.

b When the DWH was completed in 2001, its BOP manual (using then-current Cameron ratings) listed the BSR as 

capable of shearing 65⁄8" pipe (Deepwater Horizon TL BOP Stack Operation and Maintenance Manual; Cameron 

Engineering Bulletin 702D (August 1991, Rev. B1), p. 6; CAM-CSB 000005989). Also, a well control equipment 

commissioning report to BP stated the BSR was sufficient for 65⁄8" pipe, apparently also based on the then-current 

Cameron bulletin (Report of Well Control Equipment Commissioning, by In-Spec Inc. (March 2001); BP-HZNBLY00058800, BP-HZN-BLY00058786. 

c The EDS can be set to operate in Mode 1 or Mode 2. Mode 1 just closes the BSR. Mode 2 was intended for use 

when casing was being transferred into the well. Mode 2 closed the CSR first and then the BSR.

d Another automated emergency system, the autoshear function, could not access the CSR either, so it would have 

had the same limitations as the AMF/deadman system in shearing 65⁄8" drillpipe. The autoshear function is 

triggered from a valve sensor installed in the BOP to detect an accidental disconnect of the LMRP, at which time 

it initiates closure of the blind shear ram. 

e As defined by the Center for Chemical Process Safety, “Management of change is the process for evaluating and 

controlling modifications to facility design, operation, organization, or activities—prior to implementation—to 

make certain that no new hazards are introduced and that the risk of existing hazard to employees, the public, or 

the environment is not unknowingly increased.” Guidelines for Management of Change for Process Safety. Center 

for Chemical Process safety/AIChE, 2008.

67 

 

000644
Macondo Investigation Report Volume 2 June 5, 2014

At the time of the incident, BP covered the treatment of the BOP in an engineering technical practice 

(ETP) for well control,

106 which includes, “the essential systems, practices, and training requirements that 

comprise the BP well control standard.” The ETP lists several prescriptive requirements for the BOP, 

including the configuration of preventers (e.g., annular preventers, pipe rams, shear rams). The ETP 

states, “The limitations of its [the BSR’s] shearing capacity should be known and understood, and a 

documented risk assessment shall be in place to address any such limitation.” The CSB did not find any 

documented risk assessment by Transocean or BP to address operating the Deepwater Horizon BOP 

outside of the manufacturer’s recommended shearing capacity. The ETP also does not require users to 

operate within the shearing capacity of the BSR or to ensure temporary measures that maintain safety 

and/or reduce risk.

Table 5-2. Summary of emails sent between Transocean personnel regarding BSR shearing capability.

Contrary to Cameron’s advice in its shearing guide, the DWH BSR did successfully shear 65⁄8" drillpipe 

when an EDS function was executed in June 2003.107 This experience shows that the BSR employed by 

the Deepwater Horizon could sometimes shear the larger sized drillpipe, but it does not establish that the

action is reliable. 

5.2.2 Prescribing Minimum Reliability Requirements of a BOP 

Safety Integrity Level is a discrete measurement that indicates the reliability of a barrier.

a the greater the 

SIL, the greater the probability a barrier will perform its required function upon demand. Establishing an 

SIL involves making assumptions about the barrier’s availability. For example, shearing the 65⁄8" drillpipe 

required a two-step process not available to the AMF/deadman sequence; thus, it would clearly affect the 

emergency system’s reliability even if all the individual components of the system (e.g., batteries, 

solenoid valves) were fully functioning. Some effort to define the SIL for BOP functions has intended to 

reduce risk to a targeted level, such as ALARP. But uncertainty remains about establishing an SIL for the 

BOP shearing function; as a result, a recommended practice is to rely upon the published BOP 

manufacturer’s guidance. 

a Section 4.2.2 introduces the concept of Safety Integrity Level.

68 

 

000645
Macondo Investigation Report Volume 2 June 5, 2014

The BOP can be analyzed as a safety instrumented system that,a after being actuated manually or 

automatically, reestablishes a safe condition by sealing a well with annular preventers, pipe rams, or a 

blind shear ram. The international standard IEC 61511 has been accepted as the basis for specification, 

design, and operations of safety instrumented systems (SIS) in the process sector.

108 The risk-based 

approach described in IEC 61511 would require employing one of several suggested methods to 

determine the SIL of a BOP. All of these methods would depend upon the user making assumptions about 

the reliability of various components of the BOP.109 Ultimately, the different methodologies and 

assumptions could lead companies to identify inconsistent SIL requirements for a BOP.110

In an effort to encourage standardization across the industry, Norwegian Oil and Gas Guideline 070 

proposes the use of a predefined minimum SIL to ensure a minimum level of safety for the most common 

safety functions on petroleum installations.111 PSA management regulations in Norway specifically cite 

the Norwegian Oil and Gas Guideline 070 as the basis for barrier performance, meaning the guidance and 

the minimum SIL it contains are enforceable on the Norwegian Continental Shelf. b

 Guideline 070 

addresses three standard BOP functions: 

1. sealing around drillpipe; 

2. sealing an open hole; 

3. shearing drillpipe and sealing a well.112

After detection of a kick, one of these three BOP functions may require activation to prevent a blowout.c

For functions one and two, Guideline 070 establishes a minimum required SIL of 2, which implies the 

probability of the BOP function failing when activated after kick detection is less than 1 in 100 

actuations.

d

 Ensuring an SIL of 2 is maintained for the BOP functions will require companies to validate 

the performance of the BOP actively. (See Section 5.3.) 

For function three, Guideline 070 does not establish an SIL for shearing drillpipe and sealing a well. 

Instead, the guideline reports, data exists that may demonstrate that an SIL of 2 might be achieved for this 

a As defined by IEC 61511, a safety instrumented system is used to implement one or more safety instrumented 

functions. An SIS is composed of any combination of sensor, logic-solver, and final elements.

b These regulations relate to management and the duty to provide information in the petroleum activities and at 

certain onshore facilities (the management regulations), Section 5: Barriers 

(http://www.ptil.no/management/category401.html). The regulations specify IEC 61508, which is a generic 

standard applicable to several industries, but the process industry created a sector-specific standard, IEC 61511. 

As defined in IEC 61511, “[IEC 61511] applies when equipment that meets the requirements of IEC 61508, or of 

11.5 of IEC 61511-1, is integrated into an overall system that is to be used for a process sector application but 

does not apply to manufacturers wishing to claim that devices are suitable for use in safety instrumented systems 

for the process sector (see IEC 61508-2 and IEC 61508-3.” c More generally, this concept is referred to as functional safety, and has been defined for the International 

Electrotechnical Commission (IEC) as “the detection of a potentially dangerous condition resulting in the 

activation of a protective or corrective device or mechanism to prevent hazardous events arising or providing 

mitigation to reduce the fight consequence of the hazardous event.”

(http://www.iec.ch/functionalsafety/explained/) 

d The function is described as follows: “operator pushes the button to close the well and ends when the BOP closes 

and seals off the well.” The approach in 070 is to assign SIL for given functions in a BOP rather than the entire 

safety loop, which would include the person pushing a button to initiate the BOP function. In practice, it is very 

difficult to ascribe a safety level to a human because he or she is can subjected to many changing demands. 

69 

 

000646
Macondo Investigation Report Volume 2 June 5, 2014

function. But successful operation of the blind shear ram assumes that an unshearable tool joint is not 

positioned within the blind shear ram, which cannot be guaranteed, and that the blind shear ram is 

properly sized to cut the pipe in the well. While unshearable tool joints are not a hazard that can be 

mitigated by BOPs currently in use in the Gulf of Mexico, using properly sized drillpipe can be achieved 

by ensuring the safety critical blind shear ram is suitable and reliable for the entire drilling operation. 

Guideline 070 highlights that it is not industry practice to regularly test a BOP’s ability to shear drillpipe 

because the act of shearing drillpipe can damage the blind shear rams113, a

 and one successful actuation of 

a blind shear ram does not establish reliability. Instead, factory acceptance testing and manufacturer 

recommendations are relied upon to assess a BOP’s ability to shear drillpipe.

b Both factors should be 

considered during the next phase of a BOP’s safety critical element lifecycle—performance assurance and 

validation.

5.3 Performance Assurance of an SCE

Ensuring an SCE meets its performance standard requires assurance activitiesc by the companies relying 

on the SCE throughout its design, procurement, construction, and performance lifecycle (e.g., startup, 

normal operating mode, emergency mode, shutdown mode).114 Additional verification activities by an 

independent third party may also ensure the SCE design is adequately specified, fit for the intended use, 

and maintained to meet the performance standard115 (Section 5.5). 

Safety critical elements should be included in a company’s mechanical integrity program,116 which uses 

inspection, testing, preventive maintenance, and any other identified activities to ensure SCE integrity. 

Many offshore regimes require demonstration that SCE integrity reaches a targeted risk level, like 

ALARP. Assuring the continued reliability of a safety critical element may also include, but not be 

limited to, reviewing:

• original equipment manufacturer recommendations; 

• out-of-service time; 

• work orders; 

• audits; 

• process upsets; 

• human factors; 

• external events (e.g. extreme weather); 

• mechanical integrity failures; 

• near miss or incident investigation reports; 

• management of change; 

a BSEE regulations require that if the blind shear rams are activated during a well control situation in which pipe is 

sheared, the BOP stack to be retrieved after the situation is fully controlled to physically inspect the BOP and to 

conduct a full pressure test of the stack. 30 CFR §250.451(i) (2012). 

b The destructive effect that shearing drillpipe can have on blind shear rams is one reason functional testing of blind 

shear rams is performed on an open hole.

c Assurance activities are referred to as a validation plan in IEC 61511:2003 1st ed. Functional Safety – Safety 

Instrumented Systems for the Process Industry Sector.

70 

 

000647
Macondo Investigation Report Volume 2 June 5, 2014

• training. 

This review will require a schedule for assurance activities and their documentation, which may 

include:117

• date of inspection or test;

• name of person who performed the inspection or test; 

• serial number or other unique identifier of the equipment on which the inspection or test was 

performed; 

• description of the inspection or test performance; 

• results of the inspection or test as compared to the user-defined acceptance criteria; 

• required actions to address the findings. 

Actively monitoring assurance activities needs to be a part of managerial and supervisory duties from 

front line staff up through senior management. Ensuring that safety critical equipment, such as a BOP, 

will function effectively requires operational and organizational support.118 While a front line manager is 

responsible for ensuring that a BOP is properly maintained so it can respond when activated, as the 

bowtie diagram from Section 4.2.1 demonstrates, organizational and operational practices strongly 

influence the successful operation of a BOP.

a Accordingly, all levels of management need to continuously 

monitor work activities, organizational and operational practices, and safety systems that impact safety 

critical elements. Monitoring is not auditing, which implies an activity that is carried out independent of 

line managers to verify their actions. Rather it is the formal and informal inquiries into the health of an 

organization’s technical, organization, and operational barriers against a major accident event.

119 A health 

check like that described here can also provide insight into actual operational practices compared with 

organizational goals. 

5.3.1 No Assurance Activities for the Critical AMF/Deadman Solenoid Valve

The CSB was unable to identify any assurance documentation showing that testing of the miswired 

solenoid valves found on the Deepwater Horizon BOP ever occurred. Procedures published by both 

Cameron120 and Transocean121 describe tests to be completed on refurbished solenoid valves. The intent 

of the Cameron procedure is to “ensure they [the solenoid valves] are assembled properly and are free of 

manufacturing defects.” The procedure directs the user to function the solenoid by using each coil 

individually and then by activating both coils simultaneously.122The miswired solenoid valves from the 

yellow pod would have opened when the individual coils were activated, but then remained closed with 

both coils were activated. 

Internal Transocean emails indicate that Y103b was likely rebuilt on the Deepwater Horizon rather than 

by Cameron, but Transocean was unable to find assurance documentation to confirm this.c

 Transocean 

a While the AMF/deadman emergency system is automated, the emergency disconnect systems is a manual 

emergency systems available to the rig crew. 

b This also applies for the other miswired solenoid valve found in the yellow pod, 3A.

c The sender of the email wrote, “We could not match the SIN’s to the D&D rebuilds. They must have come from 

the Rig inventory of rebuilt solenoids.” TRN-INV-01300201. 

71 

 

000648
Macondo Investigation Report Volume 2 June 5, 2014

had published a technical information bulletin in 2002, Instructions for Rebuilding Cameron Controls 

Solenoid Valve, to instruct employees rebuilding Cameron solenoids on the rig.123 Included in the 

instructions is a test that will indicate if a “[solenoid] coil is not correctly wired to the cable.”124 Similar to

Cameron’s procedure, the Transocean test instructed the user to verify the solenoid valve shifted after 

simultaneously energizing both A and B coils. If the instructions had been followed, the miswired 

solenoids would have remained closed when both A and B coils were energized together. 

Another missed opportunity occurred for catching the 

miswiring of Y103. For the BSR in Deepwater Horizon’s 

BOP to close during an AMF/deadman sequence, the highpressure close function controlled by Y103 had to actuate. 

(See Section 2.3.2.) Current US regulations, and those in 

place at the time of the Macondo incident, do not require 

testing of the high-pressure BSR close function either 

before or while the BOP is in service. This safety limitation is in contrast to the weekly testing required

for other BOP functions including the low-pressure BSR close function. US regulations reference the 

third edition of API RP 53,125 which states “All operational components of the BOP equipment systems 

should be functioned at least once a week to verify the component’s intended operations.” The definition 

of “component” is commonly taken to be the various preventers (annulars, pipe rams, blind shear ram, 

etc.).a

 Thus, a test using the low-pressure BSR close function would have been in compliance with the 

American Petroleum Institute (API) recommendation and the US regulatory requirements. While repeated 

testing of the high-pressure close function might cause excessive wear on the BSR, subsea testing of the 

HP close function from each pod at the appropriate frequency could ensure the reliability of the function. 

5.3.2 Current Deadman System Function Tests Are Inadequate

Prior to the Macondo incident, dynamically positioned (DP) rigs,b like the Deepwater Horizon, were not 

required to have a deadman system.c,d Regardless, the Minerals Management Service (MMS), the US 

a See ANSI/API Specification 16A, 3rd ed. Specification for Drill-through Equipment, which refers to the blind 

shear ram, blind ram, pipe ram, and variable bore ram, as “components.” This specification also describes tests for 

the components but does not mention using the HP function to close the BSR. 

b Dynamically positioned (DP) rigs use global satellite technology and thrusters to maintain position over the well 

rather than holding them in place using cables and anchors, such as for a moored rig. 

c 30 CFR §250.442(b-d) (2010), the requirements for a BOP, included 1) remote controlled, hydraulically operated 

annular, rams, and blind-shear rams, 2) an accumulator closing system to provide fast closure of a BOP, and 3) a 

dual-pod control system. Notably, the regulations did not require an AMF/Deadman system. A 2003 report by 

West Engineering Services and commissioned by MMS, Evaluation of Secondary Intervention Methods in Well 

Control, recommends that a deadman system be the secondary intervention system for a DP rig with a multiplex 

BOP control system. In the report, West Engineering documents DP rigs with a multiplex BOP control system 

that did not have a deadman system. After the incident, regulations were changed to require a deadman system 

with the introduction of the Interim Final rule 30 CFR §250.442 (f) (2010, Interim Final Rule). d Post-Macondo, BSEE required all DP rigs operating on the Outer Continental Shelf to have a deadman system and 

stated it believed all DP rigs were already equipped with a deadman system. 30 CFR §250.442(e) (2010, Interim 

Final Rule), also see BOEMRE comments at Oil and Gas and Sulphur Operations in the Outer Continental 

Shelf—Increased Safety Measures for Energy Development on the Outer Continental Shelf, Docket ID BOEM–

2010–0034, 75 Federal Register 198 (14 October 2010), p. 63,348. 

Current US regulations, and those in 

place at the time of the Macondo 

incident, do not require testing of the 

high-pressure BSR close function 

used during emergencies either 

before or while the BOP is in service.

72 

 

000649
Macondo Investigation Report Volume 2 June 5, 2014

offshore safety regulator at the time of the Macondo, commissioned a 2003 study to evaluate secondary 

intervention control systems for BOPs. The study identifies a major shortcoming of the AMF/deadman: 

“System diagnostics are essentially nonexistent. Deadman systems operate openloop. There are no means 

to verify functionality of the deadman system. If the sensors, batteries, or electronics fail, the only (and 

first) indication of unavailability is failure to operate when needed.”126 This was certainly true for the 

Deepwater Horizon BOP, where the blue pod SEM had been miswired, causing a critical battery required 

by the AMF/deadman system to drain (see Section 3.2.1.1). 

Since the Macondo incident, US regulations require a deadman system on DP rigs.127The deadman

system is to be function tested on the rig and again after initial installation of the BOP on the wellhead.

128

The procedure for testing the system is not prescribed, but BSEE has stated that may change.129 BSEE has 

further asserted it will review the latest edition of API’s Blowout Preventer Equipment System for 

Drilling Wells (API Standard-53, 4th edition) to determine whether to incorporate it into regulations, as 

the third edition had done previously.

The third edition of API RP 53 does not mention deadman systems, but the latest (fourth) edition states “a

deadman system shall be installed on all subsea BOP stacks” and that it shall be function tested before the 

BOP is deployed to the wellhead.130 In contrast with BSEE regulations, the fourth edition recommends 

testing only subsea at commissioning or within five years of a previous test.131 To test the deadman 

system, API Std 53, fourth edition states the test should be completed by removing electrical power and 

hydraulic supply to the BOP,132 presumably to simulate the conditions necessary to trigger the deadman 

system. Post-incident, BP required rig and subsea testing of the deadman system on the Development 

Driller III (DDIII), a rig that aided intervention efforts at Macondo post-incident by drilling a relief well 

to intersect the Macondo well. The DDIII AMF/deadman procedure also required removal of the 

hydraulic supply and electrical power. a

 

The testing approach in API Std 53 or that used by BP for the DDIII presents a problem. If the blue pod 

batteries in the DWH blowout preventer were good prior to deployment, the AMF/deadman system could 

have passed such a test before it was deployed to the Macondo wellhead despite the miswiring problems 

in the blue SEM and solenoid valve Y103. Successful completion of the AMF/deadman sequence only 

required either the yellow or the blue pod to function. So, whether all the SEMs in the respective yellow 

and blue pods successfully actuated, or if only one SEM was functional, the crew would have observed 

the same successful result—the completion of the AMF/deadman sequence—with no indication of any 

deficiencies. Proving functionality of the AMF/deadman sequence from each SEM would require the 

crew to test the four SEMS independently. This requirement is not in API Std 53. 

a Procedures were developed to test the AMF/deadman on the rig and then the Emergency Disconnect System with 

the BOP subsea. Development Drill III Dead man (Auto shear) Test Procedure, attached to Application for Permit 

to Drill a New Well Approval, Lease G32306, Area/Block MC 252, Well 0003. BP-HZN-BLY00074845 - BPHZN- BLY00074846.

73 

 

000650
Macondo Investigation Report Volume 2 June 5, 2014

Determining the most effective means to verify a BOP’s performance may lie, in part, with factory 

acceptance testing developed by BOP manufacturers. The deficient wiring found in the blue pod and 

solenoid Y103 could not have passed Cameron factory 

acceptance testing (FAT) procedures. In contrast with the 

testing recommended by API Std 53 and BP, Cameron’s FAT 

procedure for the AMF/deadman system is completed through

SEM A and SEM B of each control pod separately. Two tests

are completed for each SEM (A and B) to verify that each can 

independently complete the AMF/deadman sequence (Figure 

5-2):a

Test 1 

a. Turn off power and communications via the PETU and confirm for 30 seconds that the 

AMF/deadman does not activate. 

b. Turn off hydraulic pressure and confirm the AMF sequence activates within 15 seconds. 

Test 2 

a. Turn off hydraulic pressure and confirm for 30 seconds that the AMF/deadman does not 

activate. 

b. Turn off power and communications via the PETU and confirm the AMF/deadman sequence 

activates within 15 seconds.

Important to highlight is that the user is instructed to switch the sequence in which the power and 

hydraulics are being disconnected from the SEM. By testing the SEMs in this way, if the wire 

deficiencies in the blue pod existed at the time of testing, the AMF/deadman system would have initiated 

after step (a) in Test 1, a result which should have indicated a problem to the user. (See Appendix 2-B.) 

a Various versions of this test were identified, but the most current version and the one used for testing the 

Deepwater Horizon BOP post-incident was Factory Acceptance Test procedure for Subsea Electronic module 

(Horizon AMF/Deadman in Current Situation – Test Procedure, May 11, 2010, Rev. 2 Document No. X-065449-

05-03, CAM-CSB-000008041/BP-HZN-BLY00090641. 

Proving functionality of the 

AMF/deadman sequence from each 

subsystem requires the crew to test 

the subsystems independently. This 

requirement is not in API Std 53. 

74 

 

000651
Macondo Investigation Report Volume 2 June 5, 2014

Figure 5-2. Simplified schematic of the Cameron FAT procedure to test the AMF/deadman.

75 

000652
Macondo Investigation Report Volume 2 June 5, 2014

5.3.3 Assurance Activities of Human Actions 

The miswiring of the solenoid valves found in the yellow pod highlights the need to consider human 

factors during the design phase of the valve, and then the importance of subsequent testing. The American 

Petroleum Institute has published a tool to help operating crews identify human tasks that can introduce 

latent conditions in equipment.133 The tool describes human factors as being “about making it easy for 

people to do things right and hard to do things wrong.” In the case of the Cameron solenoids used in the 

Deepwater Horizon BOP, simple color coding plugs and receptacles might have helped avoid the 

miswiring. An even more effective approach would be to design an inherently safer wiring system that 

would make it impossible to assemble the solenoid valves incorrectly. If potential human error cannot be 

engineered out of a task, then assurance activities must be completed to detect and respond to any 

mistakes. 

Beyond the physical components of the BOP, one of the major challenges of BOP performance 

verification is the human action required for most of the BOP functions. Even though 070 has offered 

minimum SIL requirements for BOP functions (see Section 5.2.2), the SIL requirements do not take into 

account that the system still relies on manual initiation by the crew. In the critical early stages of loss of 

well control, the BOP has to be initiated by a person, making a human element part of the complete chain 

of responses required to have the BOP effectively act as a barrier. Having people part of the safety loop 

makes it very difficult to ascribe an SIL, because people are subjected to many real-time demands that can 

Function Testing of Safety Critical Equipment: Parallel Findings between 

the CSB Investigations 

Inadequate testing of safety critical equipment was also a finding of the CSB’s 

investigation of the 2005 BP Texas City refinery explosion. In this incident, a 

process unit and its relief system was overfilled with hydrocarbon during a 

startup. The relief system drum had a high level alarm that should have sounded 

to alert the board operator of the overfilled process unit, yet it did not sound on 

the day of the incident. Post-incident testing revealed a defect in the displacer 

float for the alarm that likely prevented proper alarm operation (p.139). 

The high-level alarm was designated by the company as a critical alarm; thus, it 

was tested by instrument technicians every six months. However, the site did 

not have testing procedures for the blowdown drum high-level alarm (p.197). 

The technicians typically used a metal rod to push the float up to test the alarm 

(“rodding”). This testing method actually obscured the float defect. The 

technicians did not follow the verification method recommended by the alarm 

manufacturer and industry guidance to test the functionality of the float, which 

called for manually raising the chamber liquid level to check the alarm setpoint 

(pp. 324-325). 

(CSB Investigation Report, BP Texas City, TX, Refinery Fire and Explosion, 2007, 

http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf)

76 

000653
Macondo Investigation Report Volume 2 June 5, 2014

affect their performances. In fact, achieving an SIL of 1 or 2 is a struggle if the required human response 

is considered, meaning it is difficult to expect a failure rate of less than 1 in 100 BOP actuations.134

Like every other safety critical element or task, the human component must ensure they will “do things 

right” when summoned. These could include robust well planning activities and effective bridging of 

company well control and safety management systems, 

processes, and policies, auditing to ensure accurate and 

timely well data interface displays and alarms, scenario 

training on abnormal and high-consequence situations, and 

use of automated systems as a backup to human actions, 

among others. The critical role of the human in offshore 

drilling operations makes the lack of human factors 

guidance for offshore drilling operations an area that needs to be addressed.The CSB revisits human 

factors related to offshore drilling in Volumes 3 and 4 of its Macondo Investigation Report. 

5.4 Gap Closure

Gap closure, the final component of the SCE lifecycle, is a necessary process for both maintaining and 

improving the SCE’s performance. Monitoring safety critical equipment through assurance and 

verification activities will generate opportunities to reduce gaps in desired performance by creating 

awareness of needed improvements. For example, requiring an SIL 2 for specific BOP functions does not 

mean a BOP can be designed with an SIL 2, deployed to a wellhead, and then assumed to maintain an SIL 

2 rating for the duration of its use. To claim an SIL 2, the BOP’s reliability must be continuously verified 

and documented, as does its demand rate, which means it requires continuous evaluation.

135 If and when 

the performance degrades below the desired level, improvements must be made to reestablish the target 

performance.a

Beyond specifying an SIL, knowledge gained during the post-incident assessment of the Deepwater 

Horizon BOP demonstrates that not monitoring a BOP’s reliability for both normal operations and 

emergency situations can result in preventable BOP failures. On the Deepwater Horizon, there were no 

means to monitor the state of AMF/deadman batteries, and no processes to verify the high-pressure shear 

close function was functioning or to prevent using improperly sized drillpipe for the BOP. 

Real-time data monitoring, including reviewing lessons learned from a near miss or accident, can ensure 

safety critical elements are continuously maintained and improved. The Macondo incident illuminates 

several potential gap closure opportunities concerning how BOPs are tested. 

Another important opportunity for gap closure exists. Since the off-center drillpipe contributed to the 

failure of the Deepwater Horizon BOP from sealing the well, a rig crew must account for the complete set 

of conditions that can cause buckling. This includes having buckled drillpipe across the BSR even when a 

crew has successfully shut in a well if the pressure differential inside and outside of the pipe is great 

enough. If the crew does not recognize a buckling condition, they could continue operating under the false 

a IEC 61508 describes steps necessary to ensure that once SIL requirements are established for a safety system, they 

are maintained for the complete lifecycle of the system; Guideline 070 simplifies the description of those steps.

The critical role of the human in 

offshore drilling operations demands 

that industry address the lack of 

human factors guidance. 

77 

 

000654
Macondo Investigation Report Volume 2 June 5, 2014

assumption that the manual operation of the BSR and all the 

emergency backup systems (EDS and AMF/deadman) are

not at risk of failing due to an off-center drillpipe. 

Both BP and Transocean well control procedures 

recommended closing an annular preventer as an early step in 

response to a possible well control event. This procedure can 

result in a large pressure differential in the riser above the 

BOP, increasing the tendency for the drillpipe to buckle in 

the riser. However, if a rig crew were to switch from using an annular preventer to a pipe ram in response 

to the well control event, buckling could progress across the BSR, just as it did in the Macondo event.a

Both the BP and Transocean well control manuals recommend switching from an annular to a pipe 

ram;

136 thus, they encourage the crew take an action that may actually encourage the likelihood of pipe 

buckling. 

Some of the failures that occurred in the BOP at Macondo were specific to the make and model of the 

Deepwater Horizon BOP. For example, not all BOPs use the same solenoid design, so not all BOPs are 

subject to the same miswiring mistake. Yet pipe buckling due to effective compression effects can happen 

at any well where large pressures inside the drillpipe can develop. Gap closure in BOP performance postMacondo then will require all operators to assess BOP arrangements and well control procedures that can 

minimize the threat of pipe buckling due to effective compression in their wells. 

5.5 Verification Activities—The Independent Competent Person

The verification process provides additional confidence that the SCEs remain in compliance with the 

performance standards and the company’s assurance plan is satisfactorily implemented.137 In this way, 

verification is an additional layer of confirmation that the identified SCEs are managed effectively 

throughout their lifecycle. 

Verification is typically conducted by an independent third party, appointed by the company. Offshore 

regulations in the UK,138 Norway,139 and Australia140 all require independent third-party verification to 

document that SCEs are appropriate and will protect against major accident events. These independent 

competent persons (ICPs) shall be sufficiently independent and impartial so that they can maintain 

objectivity, and thus 1) are likely required to be independent of the management system under which the 

SCE operates and 2) not be responsible for the performance standard or assurance plan governing the 

SCE they evaluate. In the UK, a written verification scheme defines the activities and frequencies in 

which verification will be performed and, as such, forms the basis for how the ICP determines and 

confirms that the SCEs and corresponding performance standards are appropriate throughout their 

lifecycle.141 The verification activities conducted by the ICP confirm that the important assurance 

activities have been taken and the SCEs are maintained in adequate condition to meet the specifications in 

a As indicated in the Incident Description sections, the DWH crew initially chose to close the upper annular but, 

when that failed, activated a pipe ram. In the scenario described in this paragraph, the assumption is that closing 

the annular resulted in effectively shutting in the well and the crew choosing to switch to a pipe ram in a 

controlled, non-emergency manner.

Both the BP and Transocean well 

control manuals recommend 

switching from an annular to a pipe 

ram; thus, they encourage the crew 

take an action that may actually 

hasten the likelihood of pipe buckling.

78 

 

000655
Macondo Investigation Report Volume 2 June 5, 2014

the performance standards.142 The findings of the ICP are shared with the company and remedial actions 

are recommended.143The regulator typically documents ICP verification activities, including the scheme 

itself, any resulting ICP report of findings and recommendations, and the company responses/corrective 

actions.144

The CSB notes that while independent verification can be an important mechanism for achieving safety, it 

also has some challenges. There may be pressure felt by the company or ICP to accept SCEs performance 

rather than recommend changes to the SCEs or corresponding performance standards; this is particularly a 

problem for existing facilities and equipment as opposed to new designs.145 And, while the ICP plays a 

critical role in confirming effective management of the SCEs that the regulator often cannot perform due 

to limited resources, it cannot be a substitute for the role of the regulator to ensure companies are using 

adequate and appropriate safeguards to prevent MAEs. The role of the regulator in the verification 

process is important; otherwise, there is a risk the verification activities could devolve into a useless 

requirement where a company pays another company to tell them they are operating safely. The CSB 

addresses these issues more fully in Volume 3 of its Macondo Investigation Report. 

A written verification scheme can clarify the role of an ICP and establish the activities that assure SCEs 

are being effectively monitored. Good practice guidance recommends a scheme describing: 

• standards used to select the ICP to review to the plan; 

• the nature and frequency of the SCE examination; 

• record keeping for tests and their results including recommended actions based upon the findings; 

• communications between the company and the ICP; 

• arrangements for reviewing and revising the scheme.146

At the time of the Macondo incident, verification activities conducted by ICPs were not required by US 

regulations. Transocean did contract a one-time, third-party assessment of the Deepwater Horizon in the 

weeks leading up the incident focusing on the condition of the drilling equipment, mud system, well 

control equipment, marine equipment, hull, structure, power plan, electrical equipment and safety 

equipment.147 Resulting observations and recommendations from the assessment included the following 

tasks:

• Apply protective coating/paint; 

• Address corrosion; 

• Refit missing valve handles; 

• Recertify BOP annulars.

The rig condition assessment contracted by Transocean did not have the focus of the verification activities 

highlighted in a verification scheme description for SCEs. More importantly, it was a one-time activity. 

Continuous monitoring and verification of safety critical equipment are important roles in the lifecycle of 

an SCE. 

5.6 Conclusion

Latent equipment failures related to the Deepwater Horizon’s AMF/deadman system could have been 

detected before deploying the BOP. The miswring of a critical AMF/deadman system solenoid valve 

79 

000656
Macondo Investigation Report Volume 2 June 5, 2014

demonstrates a lack of assurance or verification activities to monitor inspections and testing of BOP 

components. A detailed performance standard and verification scheme should have established testing of 

BOP components and not just a system integration test. Instead, miswiring in the solenoid valve and the 

blue pod implies an overreliance on the redundant design of a BOP. Rather than test each deadman 

control systems independently, current industry best practice is to perform an integrated system function 

test. Such a test can result in failures within individual controls systems being masked by the successful 

operation of the other control system. This finding requires a reexamination of current function testing of 

deadman emergency systems, because a BOP with the same latent failures as those on the Deepwater 

Horizon could conceivably pass new BSEE and API recommended deadman system testing procedures.

Reliability and availability requirements should be developed into a performance standard that becomes 

the basis for how an SCE like the BOP will be treated to reduce the risk of a major accident event. 

Reliance on a BOP to effectively function when activated requires monitoring of the BOP throughout its 

design, procurement, construction, and performance during normal operations, emergencies, and shut-ins. 

Such monitoring can identify degradation of performance, which could then be corrected immediately. 

While Transocean did state that blind shear rams must be capable of shearing drillpipe used on a rig, it did 

not define the reliability or availability requirements of the BSR. Much of the drillpipe used at Macondo 

could not be reliably sheared by the Deepwater Horizon’s BSR during an emergency situation; as a result, 

the risk of a major accident event was increased throughout the drilling operations. Crew members were

aware of the limitations of the Deepwater Horizon blind shear ram, but they developed a manual 

operational workaround that was not available to automated emergency systems. 

This action highlights the need to actively monitor not only the technical barrier but also the associated 

organizational and operational barriers, as their performance is also subject to failure, negatively affecting 

the technical barrier’s functionality, availability, and reliability. Furthermore, independent verification can 

also provide an additional layer of review and assurance that the SCEs are being effectively managed 

throughout their lifecycle. Finally, Macondo continues to present opportunities for industry-wide BOP 

performance gap closure as new lessons have emerged concerning the vulnerability of a BOP and 

conditions that can lead to buckled drillpipe. 

80 

000657
Macondo Investigation Report Volume 2 June 5, 2014

6.0 Analysis of Recommended Practices and Regulations 

Regarding the BOP and Other Safety Critical Devices

At the time of the Macondo incident, US offshore safety 

regulations did not define “safety critical,” lacking specific 

language in regulations requiring additional safety 

management levels for safety critical elements. In the weeks 

following the Macondo incident, the President of the United 

States directed the Secretary of the Interior to report on 

“what, if any, additional precautions and technologies should 

be required to improve the safety of oil and gas exploration 

and production operations on the outer continental shelf.”148

Recommendations from the resulting report were used as a 

basis for new offshore regulations first promulgated in an 

Interim Final Rule149 and then in a final rule that became 

effective October 22, 2012.150

BSEE has enacted significant changes in regulations 

governing offshore operations, including requiring operators 

to implement a Safety and Environmental Management 

System (SEMS)151 that establishes a new Assurance of 

Quality and Mechanical Integrity of Critical Equipment152

requirement. New and revised standards and guidance 

documents have also been published.a Yet the changes to the 

offshore safety regulations and guidance post-Macondo have 

yet to address the broad issue of safety critical elements and 

their management for major accident prevention. 

As Chapter 4.0 shows, SEMS lacks specific language 

focusing the responsible party on both major accident prevention (Table 4-1) as well as explicit 

requirements for the identification and effective management of all safety critical elements (technical, 

operational, or organizational) that could cause or contribute to a major accident if they fail or whose 

purpose is to prevent or limit the effects of a major accident (Sections 4.1 and 4.2.3.1). The lack of 

specific regulatory language requiring overall management of safety critical elements allows for those 

a In the wake of Macondo, the American Petroleum Institute created and/or revised a number of their standards, 

recommended practices (RPs), and other guidance to advance offshore safety, including Bulletin 97, Well 

Construction Interface Document Guidelines; RP 96, Deepwater Well Design and Construction; RP 64, Diverter 

Systems Equipment and Operations; Q1 Specification for Quality Management System Requirements for 

Manufacturing Organizations for the Petroleum and Natural Gas Industry; Q2, Specification for Quality 

Management System Requirements for Service Supply Organizations for the Petroleum and Natural Gas 

industries;16D, Control Systems for Drilling Well Control Equipment and Control Systems for Diverter 

Equipment; Technical Report 1PER15K-1, Protocol for Verification and Validation of High-pressure Hightemperature Equipment; and Standard 53, Blowout Prevention Equipment Systems for Drilling Wells. 

Section 6.0 Overview

This chapter reviews applicable 

regulations and good practice 

guidance for the management of 

BOPs and other safety critical 

devices, particularly those 

regulations and guidance that have 

been updated or created in light of 

Macondo. The technical findings from 

the BOP failure analysis, in 

conjunction with this review, give 

support to the need for greater

adaptability that drives continuous 

improvement through risk reduction 

targets, not just prescriptive 

improvements. All safety critical 

technical, organizational and 

operational elements require effective 

management, including defined 

performance standards and 

independent verification to ensure 

they will function when summoned to 

prevent a major accident.

81 

 

000658
Macondo Investigation Report Volume 2 June 5, 2014

companies with less robust safety management systems or those with inadequate safety cultures to 

insufficiently address the major accident hazards they face. 

Building on the lifecycle of a safety critical element first presented in Figure 5-1, this chapter identifies 

areas where the new SEMS requirements take positive steps toward safer offshore operations and 

highlights gaps that hinder a more robust management of safety critical elements for preventing major 

accident events. 

6.1 Lifecycle of SCEs under BSEE

6.1.1 Hazard Analysis not Focused on Targeted Risk Reduction of Major 

Accident Events 

A hazard analysis is the first step toward identifying safety critical elements and establishing their 

performance requirements (Sections 5.1.1 and 5.1.2). Before Macondo, US offshore regulations addressed 

only hazard analyses for production facilities by incorporating regulations in API’s 14J, Recommended 

Practices for Design and Hazards Analysis for Offshore Production Facilities.

153 Since Macondo, BSEE 

has implemented the new Safety and Environmental Systems (SEMS) Rule requiring a hazard analysis for 

all operators’ offshore structures, not just production facilities.154 

The hazard analysis requirement stipulates the analysis must be appropriate for the complexity of the 

operation, and the hazards identified from the analysis must then be managed.

155 The SEMS regulation 

does not require that companies control hazards or implement a risk reduction target, such as ALARP, nor 

does it require the operators to document recognized methodologies, rationale, and conclusions to claim 

that safeguards to control hazards will be effective. Since terms such as “manage hazards” or “resolve 

recommendations” are activity-based, they do not include a performance-based requirement to control 

hazards or prevent major accidents. Thus, companies may conduct a weak or inadequate hazard analysis 

and not identify the appropriate safety critical equipment or the operating conditions of the SCE yet still 

be in compliance with the regulation. As a result, the regulations do not drive safety performance 

improvements during all stages of the SCE lifecycle. In contrast, frameworks established by other 

regulatory regimes, either in their respective regulations or other good practice guidance documents 

produced by the regulator, require more detailed descriptions of the intent of the hazard analysis 

requirement and targeted goals for accident prevention (Table 6-1).

82 

000659
Macondo Investigation Report Volume 2 June 5, 2014

Table 6-1. Excerpts from offshore regulations from the UK, Norway, and Australia concerning a required

analysis.

156,a

A general SEMS Rule requirement is that the operator be responsible for establishing goals and 

performance measures to carry out an effective SEMS program,157 yet no risk-reduction target is set 

requiring the operator to demonstrate to the regulator that major accident risk is adequately managed.

a

 

a The Offshore Installations (Safety Case) Regulations 2005 state, “all major accident risks have been evaluated and 

measures have been, or will be, take to control those risks to ensure the relevant statutory provisions will be 

complied with.” The quoted document cited in Table 6-1states, “This document sets out the principles against which 

HSE’s Offshore Division (OSD) assesses safety cases; it represents the distilled experience on which OSD draws 

when assessing safety cases. The principles should be widely known by industry managers, technical experts and 

employees, enabling a common understanding of the process.” (UK HSE, Assessment Principles for Offshore Safety 

Cases, p. 10)

83 

 

000660
Macondo Investigation Report Volume 2 June 5, 2014

There is US offshore guidance, developed post-Macondo, that supports a risk reduction target. The API 

produced a voluntary guidance document on the information to be shared between the operator and the 

drilling contractor regarding well construction and rig-specific operating guidelines, API Bulletin 97.

158

The Bulletin suggests that, as part of the well plan interface document, the risks associated with 

implementation of the planned well construction activities be identified and that prevention and 

mitigation plans be established for those identified risks in order to “reduce the possibility as low as 

reasonably practical.” These identified risks and prevention/mitigation plans are to be “communicated to 

all affected personnel.” 

6.1.1.1 Lack of Targeted Risk Reduction Requirements: Parallel Findings between the 

CSB Investigations

The absence of targeted risk reduction parallels findings in two CSB incident investigations of onshore 

facilities: the Chevron Refinery in Richmond, California, and the Tesoro Anacortes Refinery in 

Anacortes, Washington. While these onshore sites are regulated by agencies other than BSEE,b

 the 

regulations parallel the SEMS Rule.c

Both incidents demonstrate that hazard identification activities, such as a process hazard analysis, can 

meet regulatory requirements but not adequately identify major hazards or mitigate major accident 

events, in part, because the regulatory requirement lacks targeted risk-reduction goal setting 

requirements. A brief review of both incidents159 provides regulatory lessons that BSEE could apply to 

offshore activities. 

On August 6, 2012, a pipe containing flammable hydrocarbon process fluids at the Chevron Refinery 

ruptured, resulting in a large vapor cloud engulfing 19 employees and subsequently igniting and sending 

a large, uncharacterized plume across the Richmond, California area. The 19 employees escaped injury, 

but approximately 15,000 people in the vicinity sought medical treatment as a result of the release. The 

a Some US offshore voluntary guidance developed post-Macondo support a risk reduction target. API Bulletin 97

provides guidance on the information to be shared between the operator and the drilling contractor regarding well 

construction and rig-specific operating guidelines. The Bulletin suggests that, as part of the well plan interface 

document, the risks associated with implementation of the planned well construction activities be identified and 

that prevention and mitigation plans be established for those identified risks in order to “reduce the possibility as

low as reasonably practical.” These identified risks and prevention/mitigation plans are to be “communicated to all 

affected personnel.” (API Bulletin 97, Well Construction Interface Document Guidelines (1st Edition), November 

2013, Section 5.7.1 and 5.7.2.)

b For occupational safety and health, the Chevron Refinery in Richmond, California, is regulated by Cal/OSHA 

(California Division of Occupational Safety and Health), and the Tesoro Anacortes Refinery is regulated by the 

Washington State Department of labor and Industries.

c SEMS and PSM share similar origins. While the SEMS Rule was not incorporated into regulation until 2011, it 

existed as the American Petroleum Institute (API) voluntary guidance document, Recommended Practice 75, 

Development of a Safety and Environmental Management Program for Offshore Operations and Facilities. The 

development of API 75 was largely base upon an existing 1990 API onshore process safety recommended practice, 

API 750, Management of Process Hazards, which was developed for oil refineries and petrochemical facilities. 

API 750 had ten management system elements; API 75 contained the same elements and included an eleventh, 

records and documentation. With similar roots, in 1992 the Occupational Safety and Health Administration 

(OSHA) promulgated a chemical accident prevention process safety standard (CFR 1910.119) with 14 

management system elements most of which were similar to API 750. The parallels between PSM and SEMS is 

discussed in detail in the CSB Macondo Incident Investigation Report Volume 3.

84 

 

000661
Macondo Investigation Report Volume 2 June 5, 2014

CSB discovered that Chevron voluntarily used an inherently safer design checklist during its hazard 

analysis but generated only permissively worded recommendations as a result of the exercise. None of 

the recommendations addressed the hazards that led to the pipe failure, despite Chevron’s knowledge of 

the hazard. Essentially, the process was reduced to a check-the-box activity to meet regulatory 

requirements without resulting in effective management of corrosion hazards at the refinery. The CSB 

recommended that the California State Legislature require California petroleum refineries to achieve the 

goal of driving risk of major accident events to as low as reasonably practicable by documenting 1) their 

recognized methodologies, rationales, and conclusions to claim that safeguards (safety critical elements) 

to control hazards will be effective, and 2) their inherently safer systems analysis and the hierarchy of 

controls in establishing safeguards for process hazards.

On April 2, 2010, a heat exchanger catastrophically ruptured at the Tesoro Refinery due to a damage 

mechanism called High Temperature Hydrogen Attack (HTHA), whereby the carbon steel material of 

the exchanger was exposed to hydrogen at high temperatures and pressures over time, causing fissures 

and cracking that weakened the steel. When it ruptured, highly flammable hydrogen and naphtha at 

more than 500 degrees Fahrenheit released and ignited, fatally injuring seven employees. The CSB 

noted that a 1996 process hazard analysis conducted of the unit cited ineffective, non-specific, 

judgment-based, qualitative safeguards to prevent equipment failure from HTHA. The effectiveness of 

these safeguards was neither assessed nor documented; instead, the process hazard analysis only listed 

general safeguards. Subsequent hazard reviews in 2001 and 2006 did not modify the original process 

hazard analysis, and a 2010 process hazard analysis conducted the year of the incident did not identify 

HTHA as a hazard for the specific exchangers involved in the incident. The teams conducting these 

hazard assessments used a number of assumptions, which contributed to ineffective hazard identification 

and safeguards. 

Despite these inadequate hazard assessments, the Washington Division of Occupational Safety and 

Health (DOSH) did not issue citations after the April 2 incident related to Tesoro’s failure to evaluate 

the effectiveness of the safeguards. The Washington Process Safety Management (PSM) standard does 

not require such an evaluation and documentation of safeguard effectiveness, nor does the regulation 

require companies to address the effectiveness of the controls or use the hierarchy of controls. 

Therefore, a process hazard analysis can satisfy the regulatory requirements even though it might 

inadequately identify or control the major hazards. 

6.1.2 Lack of Defined Performance Standards for all SCEs 

Neither Transocean nor BP sufficiently focused on the safety critical emergency systems of the BOP, nor 

were they specifically required to identify these SCEs and provide defined performance requirements for 

each by the offshore regulator. (See Chapter 5.0.) Currently, BSEE does not have specific regulations that

address the performance requirements of all identified safety critical elements. 

Since Macondo, BSEE has implemented more requirements for operating procedures that “provide 

instructions for conducting safe and environmentally sound activities involved in each operation 

addressed in your SEMs program.”160 They include specifying actions and personnel roles for various 

phases of an operation, such as routine startup, normal and emergency operations, shutdowns, and 

startups after a process upset.161 BSEE requires that the procedures identify consequences of deviations

85 

000662
Macondo Investigation Report Volume 2 June 5, 2014

from operating limits and steps to avoid and correct such deviations.162 To that end, the procedures should 

indicate potential impacts to people and the environment, and operators must implement sound work 

practices for dealing with the hazards identified in those procedures.163 Operating procedures should also 

reflect current work practices.164

While operating procedures are an important aspect of maintaining safe operations, they fall short of the 

expectations required for performance standards described in Sections and 4.2.3.1 and 5.2. The SEMS 

Rule pertaining to operating procedures165 does not require companies to address the SCEs relied upon 

during the operation being undertaken, the underlying conditions that may compromise an SCE, an 

explanation of how each SCE will function, or the identification of interactions the SCE has with other 

systems. Interactions are important to recognize so that operators can implement effective management of 

change procedures if safety critical equipment will be affected by a change to another system. 

US regulatory requirements do not hold companies to focus safety management activities on safety

critical elements. Nevertheless, well written operating procedures could clarify the roles of those safety 

critical elements and identify setpoints for actions to avoid compromising the SCE. As Chapter 5.0

indicates, neither Transocean nor BP sufficiently focused on safety critical elements voluntarily, even 

though both companies operate globally within offshore regulatory regimes that require them.a

 Consider, 

for example, the workaround Transocean employed while drilling the Macondo well with 65⁄8" drillpipe, 

which the Deepwater Horizon BOP could not reliably shear. (See Section 5.2). The two-step operating 

procedure the crew developed in this case was potentially ineffective but arguably adequate for normal 

operating procedures. Only in a major accident event, such as a blowout or a power loss resulting in the 

rig drifting away from the wellhead, would the procedure not have functioned because two of the 

available emergency systems were incapable of employing the two-step process. The probability of a 

blowout on the scale of Macondo is low, but the consequences are obviously high. If, at a minimum, an 

operating procedure has not been developed to focus on the goal of driving risk to a targeted level, such as 

ALARP, then that operating procedure may unintentionally incapacitate a BOP’s last lines of defense 

against an MAE. This was, in fact, the case on the Deepwater Horizon for most of the drilling operation at 

Macondo. 

6.1.3 Performance Assurance and Verification Needed for all SCEs

Performance assurance and verification as presented in Chapter 5.0 are intended to be ongoing 

evaluations of a safety critical element throughout its life. These objectives are achieved through process 

safety systems, including but not limited to inspection, active monitoring of performance, testing, and 

overall mechanical integrity.

b

 

a This issue is explored in greater detail in the CSB Macondo Investigation Report Volume 3.

b As defined by the Center for Chemical Process Safety, “Mechanical Integrity is the programmatic implementation 

of activities necessary to ensure that important equipment will be suitable for its intended application throughout 

the life of an operation.” Guidelines for Mechanical Integrity Systems. Center for Chemical Process 

Safety/AIChE, 2006. In a booklet published by the US Occupational Health and Safety Authority (OSHA), 

mechanical integrity requirements were defined to apply to pressure vessels and storage tanks, piping systems 

(including pipe components such as valves), relief and vest systems and devices, emergency shutdown systems, 

86 

 

000663
Macondo Investigation Report Volume 2 June 5, 2014

The Macondo incident prompted new offshore mechanical integrity program requirements in the United 

States that pertain to assurance activities:

166

[P]rovide instructions to ensure the mechanical integrity and safe operation of equipment 

through inspection, testing, and quality assurance. The purpose of mechanical integrity is 

to ensure that equipment is fit for service. Your mechanical integrity program must 

encompass all equipment and systems used to prevent or mitigate uncontrolled releases of 

hydrocarbons, toxic substances, or other materials that may cause environmental or safety 

consequences. 

The mechanical integrity program must address design and maintenance of equipment, inspections, and 

documentation of testing. Specific references require refraining from operating outside of manufacturers’ 

recommended limits and following manufacturer’s recommendations for testing. 

Post-Macondo regulations also include some requirements for independent third-party verification. As it 

pertains to the BOP, BSEE requires third-party verification of blind shear ram capabilities proving that a 

BOP is designed for the rig and well and that a BOP will operate in the necessary conditions.167, a

 The 

focus by BSEE on new BOP requirements appears to be in direct response to the conditions that led to the 

Macondo incident. However, the regulator can make additional safety advances, as the mechanical 

integrity requirements are only part of a rigorous SCE management system, and the BOP is not the only 

important safety critical element during offshore drilling and completion activities. Indeed, the explicit 

focus on the BOP will likely improve how it is being managed as a safety critical barrier; however, other 

important safety critical elements are necessary to prevent major accidents: pressure relief valves, diverter 

systems, process containment systems, emergency shutdown systems, fire and gas detection, escape and 

evacuation systems, etc. All safety critical elements would benefit from similar company assurance and 

third-party verification requirements now established for the BOP to help prevent future major accidents 

resulting from their failures. 

6.1.4 Gap Closure Important for Continuous Improvement of SCE 

Effectiveness 

Gap closure addresses monitoring the performance of technical, operational, and organizational 

safety critical elements for opportunities to improve them and to reduce the risk of a major 

accident event to a targeted level.168 BSEE identifies SEMS as a “performance-focused tool” with 

four principal objectives:

1. focus attention on the influences that human error and poor organization have on accidents; 

2. establish continuous improvement in the offshore industry’s safety and environmental records; 

3. encourage the use of performance-based operating practices; and

controls (including monitoring devices and sensor, alarms and interlocks), and pumps. Process Safety 

Management, OSHA 3132, 2000 (reprinted).

a This third-party verification is significantly different from the one discussed in Section 5.5. Issues related to the 

independence of the third-party verifier are addressed in Volume 3.

87 

 

000664
Macondo Investigation Report Volume 2 June 5, 2014

4. collaborate with industry in efforts that promote the public interests of offshore worker safety and 

environmental protection.169

To evaluate the effectiveness of continued safety and environmental management improvement, 

BSEE requires performance data on the number of injuries, illnesses, oil spills, and EPA National 

Pollutant Disharge Elemenation System (NPDES)a permits, but it does not set a targeted goal for 

reducing risk.170 This type of data results in a void between BSEE’s stated objectives and its 

requirements for performance measurement because its metrics: 

• do not identify which safety system or safety critical element needs improvement; 

• focus on lagging indicators monitored only after an incident has occured; 

• do not demonstrate any specific target for reducing risk; 

• do not clearly address organizational and operational performance. 

BSEE also requires that operators learn from incidents and that SEMS programs establish 

investigation procedues for all incidents resulting in serious safety or envirnmental consequences, 

or if facility management or BSEE finds an incident had the potential for serious consequences. 

But “serious” is not defined by the regulations.171 From the investigation, a corrective action plan 

is required that identifies human and other factors and recommends changes. Yet again, the 

regulation does not state a safety target, such as ALARP.172 

BSEE would be better able to attain the objectives of the SEMS program if it clearly focused on 

major accident events and required operators to identify the technical, operational, and 

organizational elements necessary to reduce the risk of an MAE. These elements would then 

require appropriate leading and lagging performance metrics to extend beyond the injuries, 

illnesses, and oil discharges that BSEE currently requires operators to monitor. This information, 

along with real-time diagnostics, could generate key performance indicators (KPI) to help a 

company determine when it needs to reduce the risks of an operation.173 KPIs should trigger 

modifications that will close the gap between defined performance standards and the actual 

operating conditions. Safety performance indicators, whether in the form of KPIs, metrics, or 

some other formulation, are detailed in the CSB Macondo Investigation Report Volume 3. 

6.2 Regulatory Responses Post-Macondo: Prescriptive Change 

versus Continuous Improvement

The Macondo incident prompted international review of offshore regulations and practices. 

Australia was already grappling with a significant offshore blowout from the Montara well when 

Macondo occurred.174 In describing its history, NOPSEMA states, “The two events [Montara and 

Deepwater Horizon], occurring within eight months of each other and drawing intense media and public 

scrutiny, provided an impetus for change within the Australian petroleum industry, and sparked moves for 

a National Pollutant Disharge Elemenation System (NPDES): An EPA permitting program for facilities that 

discharge pollutants in US waters. See http://cfpub.epa.gov/npdes/home.cfm?program_id=45. Accessed March 9, 

2014.

88 

 

000665
Macondo Investigation Report Volume 2 June 5, 2014

regulatory reform.”175 The reform created a single, independent regulatory body that focused not only on 

the health and safety of offshore workers, but also on compliance with offshore safety, well integrity, and 

environmental management.176 This change did not include prescriptive requirements for BOPs.177

The UK178 and Norwegian179 regimes decided not to make further prescriptive requirements or major 

changes, because their regulatory frameworks allowed for continuous advancements toward reducing risk 

to ALARPa without new rule-making or revisions to their goal-setting regulations. As Volume 3 of this

CSB report further explores, embedding the ALARP principle in the regulations allows for changes in 

processes and procedures as new technology and safety advances are developed, maximizing industry 

flexibility and driving for continuous improvement even in the absence of major accident events.

ALARP does not necessarily equate to identical solutions for every drilling situation, because the unique

properties of a well and the BOP equipment will affect risk analyses that justify the drilling plans. 

Correspondingly, reports produced in response to the Macondo incident by both the UK180 and Norway181

regulators highlight risk assessments, reliability requirements, and written verification schemes to ensure 

the robustness of the BOP as an effective safety critical element. While Australia did not publish a formal 

response to Macondo, its regulations permit a licensee to drill only if a company has fully assessed the 

risks involved in a drilling operation, explicitly taking into account lessons learned from significant 

events in the industry, which would include Macondo. As such, NOPSEMA required BP to describe how 

it would be managing its wells based on lessons learned from Macondo.

182

The US established new regulations and many new prescriptive requirements for many aspects of a 

drilling operation, specifically BOPs. However, US regulations do not contain explicit requirements for

incorporating lessons learned from major accidents.

6.2.1 BOP Shearing Capability—An Illustrative Example of Diverse 

Regulatory Responses

As part of the Interim Final Rule, BOEMRE responded to the recommendation to “establish new blind 

shear ram redundancy requirements” by stating that most rigs under its jurisdiction would require 

modifications to their BOPs to comply with the recommendation and that the change could take 12 to 18 

months for companies to meet.

183 BOEMRE asserted that such a recommendation was inappropriate for 

an interim rule intended to take effect immediately.184 In the Final Drilling Rule, BSEE returned to the 

two-blind shear ram issue by stating, 

we need to consider all the impacts of such a requirement [two blind shear rams] before requiring 

it by regulation. BSEE has concluded that the requirements of the IFR [Interim Final Rule], as 

a Australia uses the actual ALARP phrase in its regulations 

(http://www.comlaw.gov.au/Details/F2010C00422/Html/Text#param5). UK regulations do not use the exact 

ALARP phrase, but rather state “that risks with the potential to cause a major accident are reduced to the lowest 

level that is reasonably practicable” http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf; 

and Norway regulations state, “In reducing the risk, the responsible party shall choose the technical, operational or 

organisational solutions that, according to an individual and overall evaluation of the potential harm and present 

and future use, offer the best results, provided the costs are not significantly disproportionate to the risk reduction 

achieved.” http://www.ptil.no/framework-hse/category403.html#p11. Accessed September 26, 2013.

89 

 

000666
Macondo Investigation Report Volume 2 June 5, 2014

modified by this Final Rule, have enhanced operational safety sufficiently until such time that 

BSEE determines whether to add a requirement for additional blind-shear rams.185

Macondo clearly highlights the importance of having a BSR perform successfully, hence the incentive to 

have a backup, but BSEE’s response illustrates the difficulty that can arise from trying to find a single 

prescriptive requirement to cover all operations. Yet, BSEE does not have alternative mechanisms within 

its framework to require industry to improve its BSR functionality. 

Consider the commitment BP made in the US OCS, both in a letter from the BP Regional President of the 

Gulf of Mexico to the director of BSEE in July 2011186 and as part of a guilty plea agreement between BP 

and the US Department of Justice in November 2012.187 BP stated it would require “subsea blowout 

preventers (BOPs) equipped with no fewer than two blind shear rams and a casing shear ram” for all 

dynamically positioned drilling rigs, but that moored rigs would be equipped with either two blind shear 

rams or one blind shear ram and one casing shear ram. 

The Macondo well was drilled with both a moored rig (the Marianas) and a dynamically positioned rig 

(the Deepwater Horizon), so it is worthwhile to examine the basis for the approach toward the two types 

of rigs. Dynamically positioned rigs have the potential to drift offsite as a result of environmental forces 

(e.g., a storm), or they can be driven offsite accidentally by the dynamically positioning equipment (e.g., 

equipment malfunction). While moored rigs may also drift offsite, it is much more probable with 

dynamically positioned rigs.188 Rationale provided in internal BP guidance stated that these driftoff/drive-off scenarios could result in a tool joint being pulled through the BOP and positioned opposite a 

blind shear ram.

189 Since most blind shear rams are not designed to cut through tool joints, an unhindered 

second blind shear ram could mitigate risk introduced by the tool joint. 

Two blind shear rams could also help mitigate the risk of a BSR failing because of drillpipe buckling off 

center and out of the cutting region of the blind shear ram’s blades,

a as happened at Macondo. This risk is 

present in both moored and dynamically positioned drilling rigs and not addressed by BP’s guidance. 

While a second BSR may be the best choice for common well scenarios, in cases beyond Macondo: 

1. a second shear ram might fail for the same reason that the first does;

2. a second blind shear ram may not be available during an emergency because emergency systems 

such as the AMF/deadman may not be designed to fire two blind shear rams; 

3. a second blind shear ram in place of a pipe ram on BOPs with fewer than five ram cavities could 

reduce risk for some hazards but increase it for others

These scenarios, as well as additional situations and accompanying considerations presented in Appendix 

2-C, illustrate that having two sets of shear rams does not necessarily by itself effectively reduce risk of 

an MAE to ALARP. Additional measures may be required.

a If effective compression is the cause of the drillpipe buckling, the location of closed pipe rams determines how far 

off-center the drillpipe will buckle and the final position of the drillpipe in the BOP. If pipe rams closer to a BSR 

are closed, drillpipe will be substantially less off center, so a BSR might be able to seal the well. (See appendix 2-

A for more details.)

90 

 

000667
Macondo Investigation Report Volume 2 June 5, 2014

The UK offshore industry association, Oil and Gas UK, offers post-Macondo guidance on subsea BOPs, 

detailing a variety of situations when two BSRs might not be optimal, including those offered in 

Appendix 2-C.190 As evident from the Macondo findings, much more than adding an additional blind 

shear ram may be needed to ensure a high degree of performance when the BOP is activated. These 

possibilities illuminate why a prescriptive requirement to have two sets of shear rams may not result in 

the most effective means to reduce the risk of a blowout to ALARP, and it may be counterproductive 

when not considering consequences, intended as well as unintended. 

The issue of two sets of blind shear rams has received the attention of a review panel from the UK that 

included three independent appointees and senior representatives from the three national regulatory 

bodies with responsibilities for the UK offshore oil and gas sector. The panel observed:191

On the specific issue of whether there should be additional prescriptive standards 

(and more specifically two blind shear rams) the Panel believes that the key issue 

is that the system can be demonstrably relied upon to work on demand. 

The Panel’s view is that specific decisions on the appropriate number of shear 

rams must be based on the risks presented by the particular circumstances at each 

well and the range of controls available to deal with them. This consideration will 

be reflected in the well plan notified to the regulator. If the balance of the 

evidence suggests that one set of shear rams is adequate, and their operation can 

be assured, then one set would be sufficient. If there is uncertainty, then the risk 

controls for the well should be reconsidered as a whole, including the option to 

use more than one set of shear rams. The Panel emphasizes that a BOP is a 

secondary means of controlling a well, usually relied upon after problems begin. 

Thus, the Panel believes priority should be given to ensuring the primary 

methods of well control are sufficiently robust to avoid circumstances that 

necessitate unplanned operation of the BOP. The decision to include more than 

one set of shear rams may be appropriate where a risk assessment concludes that 

specific well and geological factors make the risk of failure of these primary 

methods unacceptably high. 

Consequently, while the Panel does not propose further prescriptive requirements 

for the number of well control devices, it does affirm the critical importance of 

testing and maintenance to defined manufacturers’ requirements as is proposed 

by HSE, and the subsequent monitoring of adherence to these by the operators of 

offshore installations.

The focus of the panel’s report, therefore, is not on adding prescriptive requirements for the number of 

blind shear rams, but on conducting effective risk assessmentsa

 and ensuring that monitoring of the BOP’s

a The panel does not mention it, but a risk assessment of the ram configuration of a BOP should also entail 

examining placement of a casing shear ram in relation to a blind shear ram. Casing can become stuck in a well 

(See Appendix 2-C for an example). If a casing shear ram is located above the BSR, cut casing may not fall into 

the well far enough to clear the BSR, which cannot cut the casing. The converse is to have a crew member raise 

the casing out of the way before closing the BSR, but this adds to the number of actions the crew member must 

take in a potentially stressful emergency situation.

91 

 

000668
Macondo Investigation Report Volume 2 June 5, 2014

functionality verifies that it will be reliable and available when needed. The proposed requirements by 

HSE arise from an internal (formally Offshore Division) group established to review the Macondo 

incident, the Deepwater Horizon Incident Review Group (DHIRG).192 

In response to a DHIRG review of findings published in various public reports on the Macondo incident, 

the HSE is developing criteria for an effective BOP safety management system that will cover the 

working life of the BOP. The HSE suggests:

1. involving the BOP manufacturer to provide guidance in testing and maintenance of a BOP; 

2. reviewing effectiveness of maintenance activities in the context of practical experience; 

3. ensuring that acceptance criteria defined by maintenance routines for SCEs reflect 

performance standards;

4. creating performance indicators that should be reported to senior management and a thirdparty auditor for enhanced oversight.193

Identification, performance standards, assurance and verification activities, and gap closure all play 

important roles in ensuring functionality of the safety critical elements necessary to avert an uncontrolled 

blowout. Without them, it is difficult, if not impossible, to effectively manage the major accident hazards 

and to reduce the risks inherent in offshore operations. 

6.2.2 Proposed Regulatory Changes Suggest US Recognition of the 

Importance of Lifecycle Management of Safety Critical Equipment

In August 2013 BSEE proposed to amend and update regulations pertaining to offshore oil and gas 

production operations194 in recognition that “much of the oil and gas production on the OCS has moved 

into deeper waters and the regulations have not kept pace with technological advancements.”195 BSEE 

asserts that the changes proposed are “necessary to bolster human safety, environmental protection, and 

regulatory oversight of critical equipment involving production safety systems,” and specifically 

identifies the importance of conducting and documenting a lifecycle analysis of specific safety and

pollution protection equipment (SPPE).196 Improvements to the required lifecycle analysis are necessary, 

according to BSEE, “in order to increase the overall level of certainty that this equipment would perform 

as intended including in emergency situations...[and it] involves vigilance throughout the entire lifespan 

of the SPPE, including design, manufacture, operational use, maintenance, and eventual decommissioning 

of the equipment.” The proposed rule adds that “a major component of the lifecycle analysis involves the 

proper documentation of the entire process...[allowing] an avenue for continual improvement throughout 

the life of the equipment...”197 The proposed rule is explicitly for operator production installations, not 

contracted drilling facilities like the Deepwater Horizon, and the lifecycle analysis requirements are for 

only specified equipment types, which does not include the BOPa

; however, placing these limitations 

aside, this proposed rule demonstrates recognition by the regulator of the vital need for more robust 

management of the complete lifecycle of safety critical equipment. Such advancements need expansion to 

all identified safety critical elements.

a BSEE explicitly requests comment within the Federal Register notice on the possibility of requiring similar 

lifecycle analysis of the BOP, but this safety critical device is currently not included in the proposed rule language 

(78 Federal Register 163 (August 22, 2013), p. 52251). 

92 

 

000669
Macondo Investigation Report Volume 2 June 5, 2014

7.0 Volume 2 Conclusions: Technical Safety Failures Reveal 

Broader Regulatory Gaps

A discussion of Macondo-related barriers and safety critical equipment is merely the starting point for an 

analysis of the broader systemic, organizational, and regulatory factors that influenced safety on April 20, 

2010. Some of these broader issues are introduced in this volume. Despite positive steps in the United 

States toward improved management of BOPs, gaps still exist in contrast with the regulatory frameworks 

of other global regimes for identifying and managing safety critical devices. Furthermore, the regulator 

does not require that deepwater drilling owners and operators to maintain and improve performance by 

identifying and managing all safety critical elements through defined performance standards, assurance 

and third-party verification activities, and gap closure. Drilling and completion activities in the Gulf of 

Mexico may still be occurring without adequate barriers in place to prevent major accident events. In 

sum, the CSB makes several conclusions. 

The BOP, a significant barrier to prevent or minimize loss of well control had multiple deficiencies 

that demonstrate Transocean and BP did not treat or manage it as a safety-critical device. Proof of 

this assertion includes: 

a. A miswired SEM in a control pod (Section 3.2.1.1);

b. Drained emergency batteries responsible for powering the AMF/deadman sequence (Sections 

3.2.1.1 and 3.2.1.3);

c. Miswired solenoid responsible for closing the blind shear ram during the AMF/deadman 

sequence (Section 3.2.1.2);

d. A documented inability to reliably shear the drillpipe used for an extended period during the 

drilling process (Section 5.2.1);

e. A planned emergency situation 2-step workaround that would have high likelihood of failure 

in the event of AMF/deadman or autoshear activation (Section 5.2.1);

f. Undocumented and inadequate maintenance and inspection (Section 5.3.1);

g. Inadequate AFM/deadman testing procedures to detect the deficiencies found on the 

Deepwater Horizon BOP (Section 5.3.2).

The numerous shortcomings in the hardware of the BOP extended to the management systems. No

effective maintenance and testing programs were in place to ensure effectiveness and availability of the 

BOP emergency systems. This weakness left the BOP vulnerable to failure (Section 5.3). Additional 

details regarding safety management system deficiencies at Macondo are explored further in Volumes 3 

and 4 of the CSB Macondo Investigation Report. 

US regulations do not require management of all safety critical elements throughout their lifecycle, 

including identification through a hazard analysis, performance standards, verification/validation, 

and gap closure activities. SEMS lacks specific language focusing the responsible party on effective

lifecycle management of safety critical elements (technical, operational, or organizational) that could 

cause or contribute to a major accident (Chapters 4.0-6.0). The lack of specific regulatory language 

requiring overall management of safety critical elements allows for those companies with less robust 

93 

000670
Macondo Investigation Report Volume 2 June 5, 2014

safety management systems or those with inadequate safety cultures to insufficiently address the major 

accident hazards they face. 

US regulations and industry guidance do not require hazard and risk analyses to include 

identification and assessment of situations during a drilling operation that could lead to a buckled 

off-center pipe. Developing new BOP designs that can cut and seal off-center pipe takes time. Therefore, 

rigs are more vulnerable to a blowout for several reasons, including 1) inadequate assessment of the 

conditions when effective compression could be an issue during offshore operations; 2) incomplete or 

outdated well control procedures and training that do not include assessments of the shut-in conditions 

which may buckle the drillpipe in the BOP and the actions of the drill team and crews to prevent or 

address the situation. The critical need for incorporating human factors in safety management and hazard 

assessments is discussed further in Volume 3 (Section 5.4).

Existing US regulations do not require demonstration of barrier effectiveness for adequate MAE

risk mitigation. In a dynamic work environment where the operational challenges and available 

technology are in flux, it can be difficult for a regulator to implement sufficient rules in real-time to 

sufficiently address the risks of each drilling operation. The US regulator employs a weakened offshore 

approach because it does not require industry 1) to reduce risk of MAEs to a target such as ALARP and 2) 

to demonstrate effective barrier safety management through continuous improvement based upon 

performance standards, assurance schemes and third-party verification, and gap closure for all SCEs. 

These and other attributes are explored in detail in Volume 3 (Sections 5.0 and 6.0) 

Deficiencies identified during the failure analysis of the Deepwater Horizon BOP could still remain 

undetected in BOPs currently being deployed to wellheads. At the time of the incident, neither 

recommended industry practices nor US regulations required testing of the AMF/deadman system’s 

functionality. Post-incident changes that call for function testing the AMF/deadman have not addressed 

this issue (Section 5.3.2). 

94 

000671
Macondo Investigation Report Volume 2 June 5, 2014

8.0 Recommendations

Although the CSB raises several BOP functionality issues in this report, the Agency will not make 

recommendations for specific improvements to BOP design. The Deepwater Horizon BOP is just one of 

various BOP models available to owners and operators conducting drilling and completions activities 

both on and offshore. The CSB sees opportunities for greater safety impacts through improvements to 

regulatory-required management of safety critical elements (SCEs) rather than a strict focus on 

prescriptive changes that may improve only one SCE (the BOP) identical to the one used on the DWH. 

The regulatory gaps identified in the analysis of the BOP as a barrier yield opportunities for broad safety 

improvements. Therefore, the CSB recommends the following preventive measures.

CSB-2010-10-I-OS-R1

Bureau of Safety and Environmental Enforcement, United States Department of Interior

Augment 30 C.F.R § 250 Subpart S to require the responsible parties, including the lessee, operator, and 

drilling contractor, to effectively manage all safety critical elements (SCEs)—technical, operational, and 

organizational—thereby ensuring their effective operation and reducing major accident risk to As Low As 

Reasonably Practicable (ALARP). At a minimum, require the following improvements: 

a. Written identification of all safety critical elements for offshore operations through hazard 

analysis. This list will be made available for audits and inspections performed by the 

responsible parties, external entities (e.g., independent competent parties, third-party 

auditors), and the regulator, and it will be shared among the lessee, operator, and drilling 

contractor. Identifying all safety critical elements shall ensure the establishment and 

maintenance of effective safety barriers to prevent major accidents; 

b. Documented performance standards (as defined in Section 5.2 of the CSB Macondo 

Investigation Report Volume 2) describing the required performance of each SCE, including 

its functionality, availability, reliability, survivability, and interactions with other systems;

c. Augmentation of 30 C.F.R § 250.1916 to include requirements for all responsible parties, 

including contractors, to conduct monitoring for continuous active assurance of all identified 

SCEs through each SCE’s lifecycle (as described in Section 5.0 of the CSB Macondo 

Investigation Report Volume 2); 

d. Documented independent verification scheme for the identified SCEs reported to and subject

to review by the regulator (as described in Section 5.5 of the CSB Macondo Investigation 

Report Volume 2), where: 

1. the independent party meets BSEE criteria that guarantee its competence and 

independence from the company or facility for which it is providing verification;

2. the independent verification occurs prior to commencement of the offshore drilling or 

production activity and periodically, as defined by BSEE; 

95 

000672
Macondo Investigation Report Volume 2 June 5, 2014

3. all resulting assessments of the independent verification activities will be tracked in a 

formal records management system; and

4. Corrective action shall be taken to address negative verification findings and noncompliance. Verified noncompliance shall be tracked by the responsible party as a 

process safety key performance indicator and be used to drive continuous 

improvement. 

CSB-2010-10-I-OS-R2

Bureau of Safety, Environment and Enforcement, United States Department of Interior

Publish safety guidance to assist the responsible parties in fulfillment of regulatory obligations stipulated 

in R1 for the identification and effective management of safety critical elements (SCEs)—technical, 

operational, and organizational—with the goal of reducing major accident risk to As Low As Reasonably 

Practicable (ALARP), including but not limited to each of the identified minimum requirements (See R1, 

items a-d). 

CSB-2010-10-I-OS-R3

American Petroleum Institute

Publish an offshore exploration and production safety standard for the identification and effective 

management of safety critical elements (SCEs)—technical, operational, and organizational—with the goal 

of reducing major accident risk to As Low As Reasonably Practicable (ALARP), including but not 

limited to:

a. development and implementation of an SCE management system that includes the minimum 

necessary “shall” requirements in the standard to establish and maintain effective safety 

barriers to prevent major accidents; 

b. methodologies for (1) the identification of SCEs and (2) the development of performance 

standards of each SCE, including its functionality, availability, reliability, survivability, and 

interactions with other systems; 

c. establishment of assurance schemes for continuous active monitoring of all identified SCEs 

throughout each SCE’s lifecycle; 

d. fulfillment of independent verification requirements and use of those verification activities to 

demonstrate robustness of the SCE management process; 

e. development of process safety key performance indicators pertaining to the effective 

management of SCEs to drive continuous improvement. 

96 

000673
Macondo Investigation Report Volume 2 June 5, 2014

CSB-2010-10-I-OS-R4

American Petroleum Institute

Revise Blowout Preventer Equipment System for Drilling Wells (API Standard-53, 4th edition) to establish 

additional testing or monitoring requirements that verify the reliability of those individual redundant 

blowout prevention systems that are separate from the integrated system tests currently recommended.

97 

000674
Macondo Investigation Report Volume 2 June 5, 2014

Appendix 2-A: Deepwater Horizon Blowout Preventer Failure 

Analysis

This appendix is a separate pdf file available on the CSB Macondo Investigation webpage: 

http://www.csb.gov/macondo-blowout-and-explosion/.

98 

000675
Macondo Investigation Report Volume 2 June 5, 2014

Appendix 2-B: Deepwater Horizon RBS 8D BOP MUX Control 

System Report

This appendix is a separate pdf file available on the CSB Macondo Investigation webpage: 

http://www.csb.gov/macondo-blowout-and-explosion/.

99 

000676
Macondo Investigation Report Volume 2 June 5, 2014

Appendix 2-C: Scenarios When Two BSRs Would Not be 

Optimal

Scenario Considerations

1 Well control actions result in a shut-in well 

with high drillpipe pressures leading to 

buckled drillpipe across the blind shear 

ram(s). Crew decides to manually shear 

drillpipe.

Activation of the first blind shear ram could trap the drillpipe 

on the side of the BOP, leading to off-center drillpipe in the 

second shear ram.a

2 Rig crew determines it should shear the 

drillpipe, but the control system fails.

Neither shear ram would initially activate. Secondary 

activation through remotely operated vehicle (ROV) 

intervention or other means would be necessary.198

3 The circumstances necessary to trigger the 

AMF/deadman system are established.

Volumetric accumulator constraintsb may inhibit the 

AMF/deadman from closing two sets of blind shear rams.

b

 For 

example, the DWH had two sets of shear rams (blind shear 

ram and a casing shear ram), but the AMF/deadman system 

was capable of closing only one of them due to accumulator 

limitations.

4 A pipe ram in a BOP is replaced with a 

blind shear ram. In a four-ram cavity BOP, 

this would result in two blind shear rams, 

but only two pipe rams.b

“Moored rigs without a riser marginc should assess the need 

for two shear rams.”199

For moored rigs with a riser margin, “The main function of a 

BOP is well control-i.e. returning a well to primary well control 

after a kick. Three pipe rams, backed up by at least one 

annular, provide the required flexibility, functionality and 

redundancy for this and avoid the last resort of shearing 

pipe...The workgroup concluded that this reduction in the 

number of pipe rams would result in risks in well operations 

not being ALARP.”200

a Rotating two sets of blind shear rams 90 degrees from one another could lead to the drillpipe being positioned 

between the shearing blades of the second set of blind shear rams, thus enabling the second set to shear the 

drillpipe.

b During normal operations, pressurized hydraulic fluid for solenoids is supplied from the rig through the rigid 

conduit line, but in AMF/deadman operations, the fluid comes from pressurized storage bottles called 

accumulators located on the BOP.

c A “riser marginˮ is additional weight added to the mud column in the riser so that if a riser is lost, the weight of the 

mud in the well below the seafloor is sufficient to control well pressure. The walls of a deepwater well have a 

tendency to fracture, creating difficulties in keeping a riser margin. For shallow wells, a riser margin is not as 

difficult to achieve.

100 

 

000677
Macondo Investigation Report Volume 2 June 5, 2014

References 

1 Transocean, Macondo Well Incident: Transocean Investigation Report Volume II, June 2011, Appendix H.

2 California Department of Conservation, Blowout Prevention in California: Equipment Descriptions, Operating 

Characteristics, and Requirements, ftp://ftp.consrv.ca.gov/pub/oil/publications/M07_p2.pdf. Accessed October 

28, 2013.

3 Transocean – Well Control Handbook – Level L1B, Issue #3, Revision #1 – HQS-OPS-HP-01. Publicly accessed 

at http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf , pp. BP-HZN2179MDL00330909; BP Well Control Manual BPA-D-002 Issue 3; Volume 2 Fundamentals of Well Control. 

Publicly accessed at http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-02390.pdf, pp. 

BP-HZN-2179MDL00336665.

4 30 C.F.R § 250.415(f), § 250.456(j) (1), § 250.1721(h).

5 30 C.F.R § 250.420(a) (3), § 250.1712 (g), § 250.1721 (h). 

6 Transocean – Well Control Handbook – Level L1B, Issue #3, Revision #1 – HQS-OPS-HP-01. Publicly accessed 

at http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf, pp. BP-HZN2179MDL00330777.

7 GP 10-60 Zonal Isolation Requirements During Drilling Operations and Well Abandonment and Suspension: 

Groups Practice – BP Group Engineering Technical Practices. Publicly accessed at 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-00184.pdf, pp BP-HZN2179MDL00269660.

8 Vastar Resources, Inc. DWH Technical Position Paper. Publicly accessed at 

http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-04114.pdf. Vastar, which was later 

acquired by BP, originally contracted the DWH and provided specifications for the BOP, see Drilling Contract, 

RBS-8D Semisubmersible Drilling Unit Vastar Resources, Inc. and R&B Falcon Drilling Co. Publicly accessed 

at http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-04112.pdf. 

9 API 65 Standard 65—Part 2, 2nd ed., Isolating Potential Flow Zones During Well Construction, December 2010, 

p. 1.

10 RBS8D Multiplex BOP Control System – Volumes 1-8, CAM-CSB 000004070. 

11 BP-HZN-BLY-00056465.

12 BP-HZN-BLY-00056465.

13 Cameron, Deadman/AMF System Surface Testing, Rev-A1, 12-06-99, CAM-CSB 000000209.

14 Previous incident investigation reports have provided this information: Transocean Investigation Report II, June 

2011, Appendix G, pg 98; BP Deepwater Horizon accident investigation report, September 8, 2010, p. 105. 

15 40 C.F.R. § 435.13, see discussion in “Effluent Limitations Guidelines and New Source Performance Standards 

for the Oil and Gas Extraction Point Source Category; OMB Approval Under the Paperwork Reduction Act: 

Technical Amendment,” 66 Federal Register 14 (January 22, 2001), p. 6,866. 

16 Hearing before the Deepwater Horizon Joint Investigation, May 27, 2010, pp. 258-259; Interview notes compiled 

by the National Commission’s investigation of the Macondo incident (National Commission on the BP 

Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water: The Gulf Oil Disaster and the Future of 

Offshore Drilling, Washington, DC: US Government Printing Office, January 2011).

17 Hearing before the Deepwater Horizon Joint Investigation, May 29, 2010, p. 10, 

(http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-37031.pdf, pp BP-HZNBLY00377488 – 489, Accessed August 9, 2013. The interview notes state “gas buster,” which is another name 

used for the MGS.

18 Hearing before the Deepwater Horizon Joint Investigation, May 28, 2010, p. 145; Hearing before the Deepwater 

Horizon Joint Investigation, May 27, 2010, pp. 11 and 190. 

101 

 

000678
Macondo Investigation Report Volume 2 June 5, 2014

19 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (Commission). Chief 

Counsel’s Report: The Gulf Oil Disaster, February 17, 2011.

20 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (Commission). Chief 

Counsel’s Report: The Gulf Oil Disaster, February 17, 2011, Chapter 4.4.

21 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011, p. 142.

22 BP p.l.c. (BP), Deepwater Horizon Accident Investigation Report, September 8, 2010; Bureau of Ocean Energy 

Management Regulation and Enforcement (BOEMRE), March 11, 2011. Forensic Examination of Deepwater 

Horizon Blowout Preventer, Report No. EP030842; National Academy of Engineering and National Research 

Council of the National Academies (NAE). Macondo Well – Deepwater Horizon Blowout: Lessons for 

Improving Offshore Drilling Safety. Washington, D.C.: The National Academies Press, 2011; Transocean 

(Transocean), Macondo Well Incident: Transocean Investigation Report Volumes I and II, June 2011; National 

Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (Commission). Deep Water: The Gulf 

Oil Disaster and the Future of Offshore Drilling, January 11, 2011. 

23 Cameron Controls Daily Report Sheet. Publicly accessed at

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-03602.pdf, CAM_CIV_0046703.

24 Internal BP Recovery Logs [BP-HZN-BLY00061061].

25 Deck Test Procedure for Mark-II Control Pod “Deepwater Horizon” [BP-HZN-BLY00060707 - BP-HZNBLY000060728] and [BP-HZN-BLY00061094 - BP-HZN-BLY000061115].

26 Yellow Pod: Cameron Controls Daily Report Sheet. Publicly accessed at

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-03602.pdf; CAM_CIV_0046705. 

Blue Pod: Cameron Factory Acceptance Test Procedures for Subsea Electron Module (Horizon AMF/Deadman 

In Current Situation) [BP-HZN-BLY00061082 - BP-HZN-BLY00061093].

27 Cameron Controls Daily Report Sheet. Publicly accessed at

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-03602.pdf; CAM_CIV_0046705., 

Internal BP documents, Blue Pod: Cameron Factory Acceptance Test Procedures for Subsea Electron Module 

(Horizon AMF/Deadman In Current Situation) [BP-HZN-BLY00061082 - BP-HZN-BLY00061093]; Yellow 

Pod: Deck Test Procedure for Mark-II Control Pod [BP-HZN-BLY00060707 - BP-HZN-BLY000060728].

28 (Author?) Top Kill Procedures Manual for MC252-1 Re-run & Function Test Yellow Pod [BP-HZNBLY00060869 - BP-HZN-BLY000060905].

29 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011, p. 10.

30 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE),. Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011. 

31 2011-04-19 Court Order Approving DNV-BP BOP Testing contract.

32 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011, pp. 44-51; Transocean 

(Transocean), Macondo Well Incident: Transocean Investigation Report Volume I, June 2011, p. 158.

33 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011, pp. 49-50.

34 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011. p. 41.

35 D. Linden, and T. Reddy, Handbook of Batteries, 3rd ed.; McGraw-Hill Companies, Inc: USA, 2002; Chapter 14.

36 Cameron Engineering Report #2768. Deadman System Battery Life, November 28, 2000 [TRN-INV-00326599].

37 Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE), Forensic Examination of 

Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 2011, p. 154.

102 

 

000679
Macondo Investigation Report Volume 2 June 5, 2014

38 BOEMRE, Forensic Examination of Deepwater Horizon Blowout Preventer, Report No. EP030842, March 11, 

2011, p. 153; Transocean, Macondo Well Incident: Transocean Investigation Report Volumes I, June 2011, pp.

11, 157, 164; NAE. Macondo Well – Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling 

Safety. Washington, D.C.: The National Academies Press, 2011, p. 50. 

39 O. Fyrileiv and L. Collberg, “Influence of Pressure in Pipeline Design – Effective Axial Force,” paper presented 

at 24th International Conference on Offshore Mechanics and Arctic Engineering: Document ID OMAE2005-

67502, Halkidiki, Greece, 2005; A.C. Palmer and J.A.S. Baldry, “Lateral Buckling of Axially Constrained 

Pipelines, Journal of Petroleum Technology (26.11), 1974; pp. 1283-1284.

40 A.J. Chesney, Jr. and J. Garcia, “Load and Stability Analysis of Tubular Strings,” paper presented at ASME 

Petroleum Mechanical Engineering Conference, Tulsa, OK, 1969; S. A. Christman, Casing stresses caused by 

buckling of concentric pipes, paper presented at Society of Petroleum Engineers Annual Fall Technical 

Conference and Exhibition: Paper Number SPE 6059, New Orleans, Louisiana, 1976; A. Lubinski, W.S.

Althouse, and J.L. Logan, “Helical Buckling of Tubing Sealed in Packers,” Journal of Petroleum Technology

(14.6) , 1962, pp. 655-670; R. F. Mitchell, “Casing Design with Flowing Fluids,” SPE Drilling and 

Completion, (26.3), 2011; pp. 432-435; R.F. Mitchell, “Fluid Momentum Balance Defines the Effective Force,” 

paper presented at SPE/IADC Drilling Conference and Exhibition: Document ID 119954, Amsterdam, 

Netherlands, 2009; R. F. Mitchell and S.Z. Miska, Fundamentals of Drilling Engineering. Texas: Society of 

Petroleum Engineers 2011: pp. 422-425 and 436-441.

41C.P. Sparks, “The Influence of Tension, Pressure and Weight on Pipe and Riser Deformations and Stresses,” 

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCQQFjAA&url=http%3A%

2F%2Fwww.ivt.ntnu.no%2Fimt%2Fcourses%2Ftmr4195%2Fexercises%2Fex5%2FEx5-

App.pdf&ei=_KhoT7r_DInksQLOqeWJCQ&usg=AFQjCNFTv7pd2rt6er__maMKzQI9--x18g. Accessed

March 12, 2012; C.P. Sparks, “The Influence of Tension, Pressure and Weight on pipe and Riser Deformations 

and Stresses,” Journal of Energy Resources Technology, (106.1),1984, pp. 46-54. 

42 S. A. Christman, “Casing Stresses Caused by Buckling of Concentric Pipes,” paper presented at Society of 

Petroleum Engineers Annual Fall Technical Conference and Exhibition: Paper Number SPE 6059, New Orleans, 

Louisiana, 1976; R.F.Mitchell, “Fluid Momentum Balance Defines the Effective Force,” paper presented at

SPE/IADC Drilling Conference and Exhibition: Document ID 119954, Amsterdam, Netherlands, 2009. 

43 30 C.F.R. 250.1911 (a) (1). 

44 Petroleum Safety Authority, Safety Status & Signals, 2012-2013, 2013, p.31.

45 30 C.F.R. 250.1911 (a) (1) (iv). 

46 Center for Chemical Process Safety (CCPS), Inherently Safer Chemical Process – A Life Cycle Approach, 2nd

ed., 2009; CCPS, Guidelines for Risk Based Process Safety, 2007; CCPS, Layer of Protection Analysis – 

Simplified Process Risk Assessment, New York: Center for Chemical Process Safety/AIChE, 2001.

47 Offshore Installations (Safety Case) Regulations 1992, http://www.legislation.gov.uk/uksi/1992/2885/made. 

Current regulations, Offshore Installations (Safety Case) Regulations 2005, use the same definition, 

http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf. 

48 Guidelines Regarding the Management Regulations, Re Section 9, Acceptance Criteria for Major Accident Risk 

and Environmental Risk, http://www.ptil.no/management/category406.html#p17. 

49 Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009, Chapter 1.5 Definitions 

http://www.comlaw.gov.au/Details/F2010C00422/Html/Text#param5. 

50 http://www.nopsema.gov.au/assets/document/GN271-Control-Measures-and-Peformance-Standards.pdf Guidance 

Note, N-04300-GN0271 Rev 3, December 2011.

51 Major Accident Hazard Risk Assessment – Deepwater Horizon, publicly available at 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-026050.pdf. Retrieved 

November15, 2013.

103 

 

000680
Macondo Investigation Report Volume 2 June 5, 2014

52 Major Accident Hazard Risk Assessment – Deepwater Horizon, TRN-MDL-03462606- TRN-MDL-03462606, 

publicly available http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-026050.pdf. 

Retrieved November 15, 2013.

53 UK HSE, Guidance on Risk Assessment for Offshore Installations, 

http://www.hse.gov.uk/offshore/sheet32006.pdf, Appendix C. Retrieved November 19, 2013; 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0271-Control-Measures-and-PerformanceStandards.pdf, p. 1. Retrieved February 18, 2014.

54 Exploration and Production Operating Management System Manual, Version 2.0, 2009, p. 80, BP-HZNMBI00208652.

55 BP-HZN-CSB00178190.

56 Modified from T. Kletz and P. Amyotte, Process Plants: A Handbook for Inherently Safer Design, 2nd ed,, RC 

Press, 2010. 

57 Guidelines for Engineering Design for Process Safety. New York: Center for Chemical Process Safety/AIChE, 

1993, p. 9.

58 Definition of “defense in depth” provided by the US Nuclear Regulatory Commission, 

http://www.nrc.gov/reading-rm/basic-ref/glossary/defense-in-depth.html. Retrieved December 20, 2013.

59 B. R. Sehgal, Nuclear Safety in Light Water Reactors – Severe Accident Phenomenology.: New York: Elsevier, 

2012: p. 8.

60 The History of Bowtie, http://www.cgerisk.com/knowledge-base/risk-assessment/the-bowtie-methodology, 

Accessed May 14, 2014.

61 US Chemical Safety and Hazard Investigation Board, Interim Investigation Report: Chevron Richmond Refinery 

Fire, April 2013, http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf; Center for 

Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach, 2nd ed., 2009, 

p. 46. 

62 UK HSE, “ALARP ʻat a Glance,’” http://www.hse.gov.uk/risk/theory/alarpglance.htm, How We Use ALARP. 

Accessed December 20, 2013; ALARP, NOPSEMA Guidance Notes, N-04300-GN0166, Rev. 4, December 

2012, p. 4. http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0166-ALARP.pdf. Accessed 

December 20, 2013.

63 US Chemical Safety and Hazard Investigation Board (CSB), Regulatory Report: Chevron Richmond Refinery 

Pipe Rupture and Fire, January 2014, 

http://www.csb.gov/assets/1/19/CSB_Chevron_Richmond_Refinery_Regulatory_Report.pdf; CSB, Interim 

Investigation Report: Chevron Richmond Refinery Fire, April 2013, 

http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf; CSB, Tesoro Refinery Fatal 

Explosion and Fire, May 2014.

64 Center for Chemical Process Safety, Guidelines for Hazardous Evaluation Procedures 3rd ed., New York: Center 

for Chemical Process Safety/AIChE, 2008. 

65 Center for Chemical Process Safety, Layer of Protection Analysis – Simplified Process Risk Assessment, New 

York: Center for Chemical Process Safety/AIChE, 2001.

66 Center for Chemical Process Safety, Layer of Protection Analysis – Simplified Process Risk Assessment, New 

York: Center for Chemical Process Safety/AIChE, 2001: p. 80.

67 A. Franks, Lines of Defence/Layers of Protection Analysis in the COMAH Context, HSE Report, Warrington, UK: 

Amey VECTRA Limited, 2003: p. 44.

68 IEC 61511:2003 1st ed. Functional safety – Safety Instrumented Systems for the process industry sector. The US 

version of this standard is ANSI/ISA 84.00.01-2004 Parts (1-3) (IEC 61511 Mod). There is a grandfather clause 

in ANSI/ISA 84.00.01-2004 for safety instrumented systems designed and constructed prior to acceptance of the 

standard.

69 IEC 61511:2003 First Ed. Functional Safety – Safety Instrumented Systems for the Process Industry Sector.

104 

 

000681
Macondo Investigation Report Volume 2 June 5, 2014

70 C. R. Timms, “IEC 61511—An Aid to COMAH and Safety Case Regulations Compliance, Measurement and 

Control (37.4), May 2004, pp. 115-122.

71 Control Measures and Performance Standards, NOPSEMA Guidance Notes, N-04300-GN0271, Rev. 4, December 

2012, p. 19, http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0271-Control-Measures-andPerformance-Standards.pdf. Accessed February 18, 2014.

72 UK Offshore Installations (Safety Case) Regulations 2005, 21 Continuing Effect of Verification Schemes 

http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf; Australia, Offshore Petroleum and 

Greenhouse Gas Storage (Safety) Regulations 2009, Chapter 1.4 Objects, 2 (d). 

(http://www.comlaw.gov.au/Details/F2010C00422/Html/Text#param5).

73 Norway, Regulations Relating to Management and the Duty to Provide Information in the Petroleum Activities 

and at Certain Onshore Facilities (the management regulations), Section 5: Barriers 

(http://www.ptil.no/management/category401.html).

74 UK Offshore Installations (Safety Case) Regulations 2005, 2 Interpretation, 

http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf. 

75 R. Pitblado, Real-Time Safety Metrics and Risk-Based Operations,

http://www.dnv.com/binaries/11_risk_based_operations_paper_tcm4-367860.pdf. Accessed December 12, 2013.

76 UK Offshore Installations (Safety Case) Regulations 2005, Interpretation 2(1) “safety-critical,” 

http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf. 

77 Norway, Regulations Relating to Conducting Petroleum Activities (the activities regulations), Section 45: 

Maintenance and Section 46: Classification (http://www.ptil.no/activities/category399.html). 

78 Australia, Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009, Chapter 2.5 Facility 

description, formal safety assessment and safety management system, 3 (h)(i) 

(http://www.comlaw.gov.au/Details/F2010C00422/Html/Text#param5).

79 Guidelines Regarding the Framework Regulations, Section 24: Use of Recognized Standards 

(http://www.ptil.no/framework/category408.html#p24); UK HSE, Assessment Principles for Offshore Safety 

Cases, p. 19, 

http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&sqi=2&ved=0CDUQFjAA&

url=http%3A%2F%2Fwww.hse.gov.uk%2Foffshore%2Faposc190306.pdf&ei=jg6OUuTzHaPhygHI7YE4&usg

=AFQjCNG9jDdqxIdUGguRCSNxT6GUoIozCg&sig2=6n2lF5b6kPPIzyXlEZA0cA&bvm=bv.56988011,d.eW0

. Retrieved November 21, 2013; Control Measures and Performance Standards, NOPSEMA Guidance Notes, N04300-GN0271, Rev. 4, December 2012, p. 27, http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-

GN0271-Control-Measures-and-Performance-Standards.pdf. Accessed December 20, 2013.

80 Offshore Installations (Safety Case) Regulations 2005, 2 Interpretations (5), 19 Verification Schemes, 20 Review 

and Revision of Verification Schemes, 21 Continuing effect of verification schemes, 

http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf. 

81 Regulations Relating to Conducting Petroleum Activities (the activities regulations), Section 45: Maintenance and 

Section 46: Classification (http://www.ptil.no/activities/category399.html); ALARP, NOPSEMA Guidance 

notes, N-04300-GN0166, Rev. 4, December 2012, pp 12, http://www.nopsema.gov.au/assets/Guidance-notes/N04300-GN0166-ALARP.pdf. Accessed December 20, 2013.

82 UK HSE, Guidance on Risk Assessment for Offshore Installations, 

http://www.hse.gov.uk/offshore/sheet32006.pdf. Retrieved November 19, 2013.

83 Wilkinson, P., The Role of “Active Monitoring” in Preventing Major Accidents, Noetic Group: 2014, 

http://www.csb.gov/investigations?F_InvestigationId=98&Type=undefined. 

84 Several sources were used to develop this section, including IEC 61511:2003 1st ed. Functional Safety – Safety 

Instrumented Systems for the Process Industry Sector; A. Summers, presentation to the CSB; IEC 61511/ISA 

84.00.01-2004, November 30, 2011; PSA, Principles for Barrier Management in the Petroleum Industry, 2013; 

070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2. 

105 

 

000682
Macondo Investigation Report Volume 2 June 5, 2014

85 30 CFR § 250.1611 (d) (3) and (4). 

86 Energy Institute, Guidelines for the Management of Safety Critical Elements, 2nd ed., p. 10.

87 Energy Institute, Guidelines for the Management of Safety Critical Elements, 2nd ed., p. 7; ANSI/ISA-84.91.03-

2012, Identification and Mechanical Integrity of Safety Controls, Alarms, and Interlocks in the Process Industry, 

September 20, 2012, p. 12.

88 IEC 61511: 2003, 1st ed. Functional Safety – Safety Instrumented Systems for the Process Industry Sector, Part 1, 

Clause 8, Process Hazard and Risk Assessment.

89 Energy Institute, Guidelines for the Management of Safety Critical Elements, 2nd ed., p. 10.

90 Major Accident Hazard Risk Assessment – Deepwater Horizon, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-026050.pdf. Retrieved November 

15, 2013.

91 Major Accident Hazard Risk Assessment – Deepwater Horizon, p. TRN-MDL-01184582, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-026050.pdf. Retrieved November 

15, 2013. 

92 Major Accident Hazard Risk Assessment – Deepwater Horizon, TRN-MDL-03462606- TRN-MDL-03462606, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-026050.pdf, Retrieved November 

15, 2013.

93 CFR § 250.416(e) (2012).

94 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p. 13, 

http://www.stepchangeinsafety.net/templates/asset-relay.cfm?frmAssetFileID=1402. Accessed April 29, 2014.

95 PSA, Principles for Barrier Management in the Petroleum Industry, 2013, p. 17.

96 Hearing before the Deepwater Horizon Joint Investigation, August 25, 2010, p. 387-388.

97 IEC 61511:2003 1st ed. Functional Safety – Safety Instrumented Systems for the Process Industry Sector, Part 1, 

Clauses 9 and 10, Allocation of Safety Functions to Protection Layers and SIS Safety Requirements 

Specification; PSA, Principles for Barrier Management in the Petroleum Industry, 2013, p. 12.

98 IEC 61511:2003 1st ed. Functional Safety – Safety Instrumented Systems for the Process Industry Sector, Part 1, 

Clause 16, SIS Operation and Maintenance.

99 IEC 61511:2003 1st ed. Functional Safety – Safety Instrumented Systems for the Process Industry Sector, Part 1, 

Clause 10 and 11, SIS Safety Requirements Specification and SIS Design and Engineering.

100 A. Summers, presentation to the CSB. IEC 61511/ISA 84.00.01-2004, November 30, 2011.

101 Transocean - Well Control Handbook - Level: L1B, Issue #3, Revision #1 - HQS-OPS-HP-01, publicly accessed 

at http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf, Section 9 (Well 

Control Equipment), Subsection 2.3.4 (Blind/Shear Rams).

102 IADC Daily Drilling Reports, Deepwater Horizon, February 16, 2010 to April 8, 2010.

103 Cameron Product Advisory #12114, EB 702D Update Regarding Shearing Capabilities of Cameron Shear Rams, 

(6/21/2007); Cameron Engineering Bulletin EB 701D Rev. BP Shearing Capabilities of Cameron Shear Rams

(1/21/2008). Cameron states that it has “performed extensive testing to validate & investigate the shearability of 

drilling tubulars [e.g., drillpipe] using various shear ram and operator configurations.

104 Email chain, Subject: Shear data, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/McWhorter_Jim-Depo_Bundle.zip. 

Exhibit 3322. Retrieved December 4, 2013; Email chain, Subject: FW: BOP Shear Rams, TRN-INV-02491951 - 

TRN-INV-02491953.

105 Testimony given in the U.S. District Court for the Eastern District of Louisiana under the Multi-District 

Litigation docket MDL No. 2179, see McWhorter Designations Vol. 1, p. 118, accessible at 

http://www.mdl2179trialdocs.com/releases/release201302281700004/McWhorter_Jim-Depo_Bundle.zip. 

Retrieved November 15, 2013.

106 

 

000683
Macondo Investigation Report Volume 2 June 5, 2014

106 GP 10-10 Well Control, November 18, 2008, BP-HZN-CSB00088455.

107 BP Report, Appendix H, p. 234. 

108 070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2, p. 9; IEC 61511:2003 First Ed. Functional safety - Safety Instrumented Systems for the process

109 IEC 61511:2003 1st ed. Functional Safety – Safety Instrumented Systems for the Process Industry Sector, Part 3.

110 S. T.Kim, K. P. Chang, Y.H. Kim, “Risk-based Design for Implementation of SIS Function Safety in the 

Offshore Industry,” in Safety, Reliability and Risk Analysis: Beyond the Horizon, E.D.J.M Steenbergen, et al. 

(Eds), 2013, p. 1875 -1880 

111 070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2, p. 6.

112 070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2, p. 87.

113 070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2, p. 42.

114 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p. 1, 

http://www.stepchangeinsafety.net/templates/asset-relay.cfm?frmAssetFileID=1402. Accessed April 29, 2014; 

070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2, p. 87.

115 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p. 13, 

http://www.stepchangeinsafety.net/templates/asset-relay.cfm?frmAssetFileID=1402. Accessed April 29, 2014.

116 ANSI/ISA-84.91.03-2012, Identification and Mechanical Integrity of Safety Controls, Alarms, and Interlocks in 

the Process Industry, September 20, 2012, p 12; Energy Institute, Guidelines for the Management of Safety 

Critical Elements, 2nd ed., p. 15.

117 070—Norwegian Oil and Gas Application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry, 

Revision 2, pp 42; ANSI/ISA-84.91.03-2012, Identification and Mechanical Integrity of Safety Controls, Alarms, 

and Interlocks in the Process Industry, September 20, 2012, p. 13.

118 PSA, Principles for Barrier Management in the Petroleum Industry, 2013, p. 28.

119 Noetic Group, High Hazard Unit Safety Case Training: What Is “Active Monitoring? www.noeticgroup.com.

120 Refurbishment Procedures for Cameron Solenoid Valves, Part No. 223290-15 and Part No. 223290-63, Rev. 2, 

2004, X-065393-03, CAM-CSB 000014170.

121 Testimony given in the U.S. District Court for the Eastern District of Louisiana under the Multi-District 

Litigation docket MDL No. 2179. See McWhorter Designations Vol. 2, p. 135 and TREX 3798 Instructions for 

Rebuilding Cameron Controls Solenoid Valve, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/McWhorter_Jim-Depo_Bundle.zip. 

Retrieved November 15, 2013.

122 Refurbishment Procedures for Cameron Solenoid Valves, Part No. 223290-15 and Part No. 223290-63, Rev. 2, 

2004, X-065393-03, CAM-CSB 000014173.

123 Testimony given in the U.S. District Court for the Eastern District of Louisiana under the Multi-District 

Litigation docket MDL No. 2179. See McWhorter Designations Vol. 2, p. 135 and TREX 3798 Instructions for 

Rebuilding Cameron Controls Solenoid Valve, accessible at 

http://www.mdl2179trialdocs.com/releases/release201302281700004/McWhorter_Jim-Depo_Bundle.zip. 

Retrieved November 15, 2013.

124 TREX 3798 Instructions for Rebuilding Cameron Controls Solenoid Valve, p. 5, accessible at 

http://www.mdl2179trialdocs.com/releases/release201302281700004/McWhorter_Jim-Depo_Bundle.zip. 

Retrieved November 15, 2013.

125 API Recommended Practice 53, 3rd ed. Blowout Prevention Equipment Systems for Drilling Wells, March 1997, 

p. 41.

107 

 

000684
Macondo Investigation Report Volume 2 June 5, 2014

126 WEST Engineering Services, Inc., Evaluation of Secondary Intervention Methods in Well Control for US 

Minerals Management Service. Available at 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-03298.pdf. Retrieved November 15, 

2013.

127 30 CFR §250.442 (2010, Interim Final Rule). 

128 30 CFR § 250.449 (2010, Interim Final Rule). 

129 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Increased Safety Measures for Energy 

Development on the Outer Continental Shelf, Docket ID BOEM–2012–0002, 77 Federal Register 163, August 

22, 2012, p. 50,868.

130 API Standard 53, 4th ed. Blowout Prevention Equipment Systems for Drilling Wells, November 2012, p 66.

131 API Standard 53, 4th ed. Blowout Prevention Equipment Systems for Drilling Wells, November 2012, Table 7.

132 API Standard 53, 4t

h ed. Blowout Prevention Equipment Systems for Drilling Wells, November 2012, Table 6.

133 API, Human Factors Tool for Existing Operations, 1st edition, February 2006.

134 CSB interviews.

135 IEC 61511:2003 1st ed. Functional Safety - Safety Instrumented Systems for the Process Industry Sector, Part 1, 

5.2.5.3 and 11.9.

136 Transocean – Well Control Handbook – Level: L1B, Issue #3, Revision #1 – HQS-OPS-HP-01, accessed at 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf, Section 5 (Shut In 

Procedures), Subsection 3 (Drilling Subsea BOP’s), “Bleed Off Pressure between Pipe Rams and Annular (If 

Possible) and Open Annular.; BP – Well Control Manual, Volume 1, Procedures and Guidelines, accessed at 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip, Exhibit 

2389; Section 4.2 (Annular Shut-in Versus Ram Shut-in), Shut-in with an annular, then promptly switch to hangoff on a ram BOP.

137 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p. 41, 

http://www.stepchangeinsafety.net/templates/asset-relay.cfm?frmAssetFileID=1402. Accessed April 29, 2014.

138 Offshore Installations (Safety Case) Regulations 2005, 19 Verification schemes (2) (a) 

(http://www.legislation.gov.uk/uksi/2005/3117/pdfs/uksi_20053117_en.pdf).

139 Regulations Relating to the Health, Safety and the Environment in the Petroleum Activities and at Certain 

Onshore Facilities (The Framework Regulations), Section 19: Verifications (http://www.ptil.no/frameworkhse/category403.html#_Toc357595247) 

140 Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009, 2.40 

(http://www.comlaw.gov.au/Details/F2010C00422/Html/Text#param5).

141 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p.41; Energy Institute, Guidelines for the 

Management of Safety Critical Elements, 2nd ed., p. 17.

142 Energy Institute, Guidelines for the Management of Safety Critical Elements, 2nd ed., p. 17; Step Change in 

Safety, Assurance & Verification Practitioner’s Guide, p. 13.

143 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p. 48.

144 Step Change in Safety, Assurance & Verification Practitioner’s Guide, pp. 48, 51-52.

145 R. Pitblado, on behalf of DNV GL (Houston)., external review comments, May 2014.

146 Step Change in Safety, Assurance & Verification Practitioner’s Guide, p. 42, 

http://www.stepchangeinsafety.net/templates/asset-relay.cfm?frmAssetFileID=1402. Accessed April 29, 2014; 

Energy Institute, Guidelines for the Management of Safety Critical Elements, 2nd ed., p. 17.

147 Rig Condition Assessment—Deepwater Horizon (Prepared for Transocean USA, I., Houston Texas) April 1-12, 

2010, available at http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-00088.pdf. 

Accessed April 30, 2014.

108 

 

000685
Macondo Investigation Report Volume 2 June 5, 2014

148 Department of the Interior, Increased Safety Measures for Energy Development on the Outer Continental Shelf

(Safety Measures Report), May 27, 2010, 

http://www.doi.gov/news/pressreleases/loader.cfm?csModule=security/getfile&PageID=33646. Accessed

September 25, 2013.

149 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Increased Safety Measures for Energy 

Development on the Outer Continental Shelf; Docket ID BOEM–2010–0034, 75 Federal Register 198 (October 

14, 2010), pp. 63,347-63,377.

150 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Increased Safety Measures for Energy 

Development on the Outer Continental Shelf; Docket ID BOEM–2012–0002, 77 Federal Register 163 (August 

22, 2012), pp. 50,856-50,901.

151 30 CFR §250.1900 Subpart S, Safety and Environmental Management Systems (2012).

152 30 CFR §250.1916 (2012).

153 API RP 14J, Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities, 2nd

ed., May 2001; reaffirmed: March 2007; incorporated by reference at § 30 CFR 250.800(b)(1) (2010) ; § 30 CFR 

250.901(a)(14) (2010).

154 30 CFR §250.1911 (2012).

155 30 CFR §250.1911. 

156 30 CFR §250.1911 (a) and (a) (3) (2012); UK HSE, Assessment Principles for Offshore Safety Cases, p. 10. 

Retrieved November 21, 2013; Norway, Regulations Relating to Management and the Duty to Provide 

Information in the Petroleum Activities and at Certain Onshore Facilities (the Management Regulations), Section 

17: Risk Analyses and Emergency Preparedness Assessments 

(http://www.ptil.no/management/category401.html#p9); Australia, Offshore Petroleum and Greenhouse Gas 

Storage (Safety) Regulations 2009, Part 2 Safety Cases, 2.5(2)(a).

157 30 CFR §250.1909. 

158 API Bulletin 97, Well Construction Interface Document Guidelines (1st Edition), November 2013, Section 5.7.1 

and 5.7.2.

159 CSB, (Draft) Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire, January 2014, 

http://www.csb.gov/assets/1/19/CSB_Chevron_Richmond_Refinery_Regulatory_Report.pdf; CSB, Interim 

Investigation Report: Chevron Richmond Refinery Fire, April 2013; 

http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf; CSB, Investigation Report: 

Catastrophic Rupture of Heat Exchanger, May 2014.

160 30 CFR §250.1913 (2012).

161 30 CFR §250.1913 (a) (1-5) (2012).

162 30 CFR §250.1913 (a) (7) (2012).

163 30 CFR §250.1913 (12) (2) (2012).

164 30 CFR §250.1913 (a) (12) and (d) (2012).

165 30 CFR §250.1913. 

166 30 CFR §250.1916 (2012). 

167 30 CFR §250.416 (e) and (f) (2012). 

168 P. Wilkinson, The Role of “Active Monitoring” in Preventing Major Accidents, Noetic Group: 2014, available at 

http://www.csb.gov/macondo-blowout-and-explosion/. 

169 See Safety and Environmental Management Systems, http://www.bsee.gov/Regulations-and-Guidance/Safetyand-Environmental-Management-Systems---SEMS/Safety-and-Environmental-Management-Systems---SEMS/, 

accessed March 8, 2014.

109 

 

000686
Macondo Investigation Report Volume 2 June 5, 2014

170 Performance Measures Data, Form 0131, http://www.bsee.gov/About-BSEE/Procurement-BusinessOpportunities/BSEE-OCS-Operation-Forms/BSEE-0131, accessed March 9, 2014.

171 30 CFR §250.1919 (2012). 

172 30 CFR §250.1919 (a) (2012). 

173 A. Summers, presentation to the CSB. IEC 61511/ISA 84.00.01-2004, November 30, 2011.

174 Montara Commission of Inquiry, Report of the Montara Commission of Inquiry, June 2010, 

http://www.ret.gov.au/Department/Documents/MIR/Montara-Report.pdf. Accessed September 26, 2013.

175 See http://www.nopsema.gov.au/about/history-of-nopsema/

176 NOPSEMA, The Safety Case in Context: An Overview of the Safety Case Regime, Rev. 6, June 2013, 

http://www.nopsema.gov.au/assets/document/N-04300-GN0060-The-Safety-Case-in-Context.pdf. Accessed 

September 25, 2013.

177 NOPSEMA, The Safety Case in Context: An Overview of the Safety Case Regime, Rev. 6, June 2013, 

http://www.nopsema.gov.au/assets/document/N-04300-GN0060-The-Safety-Case-in-Context.pdf. Accessed 

September 25, 2013.

178 Offshore Division, Hazardous Installations Directorate, Health and Safety Executive. Deepwater Horizon 

Incident Review Group: Interim Summary Report, 2011, Appendix E, p. 130, 

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CDUQFjAA&url=htt

ps%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile

%2F48252%2F3875-offshore-oil-gas-uk-indrev.pdf&ei=V0pDUrrmFrD1igLGlIDIAQ&usg=AFQjCNGWvCG_dHpZlFoeLWDmgR_tiAqRSQ&sig2=oKJH

hWF-bpwWQMV26WLx_Q&bvm=bv.53217764,d.cGE. Accessed September 25, 2013.

179 Petroleum Safety Authority Norway, The Deepwater Horizon Accident—Assessments and Recommendations for 

the Norwegian Petroleum Industry, June, 14, 2011, p. 3, 

http://www.ptil.no/getfile.php/PDF/DwH_PSA_summary.pdf. Accessed September 25, 2013.

180 Offshore Division, Hazardous Installations Directorate, Health and Safety Executive. Deepwater Horizon 

Incident Review Group: Interim Summary Report, 2011, pp. 130 - Appendix E, 

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CDUQFjAA&url=htt

ps%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile

%2F48252%2F3875-offshore-oil-gas-uk-indrev.pdf&ei=V0pDUrrmFrD1igLGlIDIAQ&usg=AFQjCNGWvCG_dHpZlFoeLWDmgR_tiAqRSQ&sig2=oKJH

hWF-bpwWQMV26WLx_Q&bvm=bv.53217764,d.cGE. Accessed September 25, 2013.

181 Petroleum Safety Authority Norway, The Deepwater Horizon Accident—Assessments and Recommendations for 

the Norwegian Petroleum Industry, June, 14, 2011, p. 3, 

http://www.ptil.no/getfile.php/PDF/DwH_PSA_summary.pdf. Accessed September 25, 2013.

182 R. Gribben, January 18, 2011. BP has been awarded four permits to begin exploring for oil and gas in deep water 

off the south Australian coast but with tougher scrutiny over its drilling and safety operations attached as a 

condition in the wake of the Gulf of Mexico oil spill disaster. UK Telegraph, 

http://www.telegraph.co.uk/finance/newsbysector/energy/oilandgas/8264729/BP-given-Australia-permits-todrill-for-oil-and-gas.html. Accessed December 12, 2012. 

183 Department of the Interior, Increased Safety Measures for Energy Development on the Outer Continental Shelf

(Safety Measures Report), May 27, 2010, 

http://www.doi.gov/news/pressreleases/loader.cfm?csModule=security/getfile&PageID=33646. Accessed 

September 25, 2013.

184 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Increased Safety Measures for Energy 

Development on the Outer Continental Shelf; Docket ID BOEM–2010–0034,75 Federal Register 198, October 

14, 2010, p. 63,353.

110 

 

000687
Macondo Investigation Report Volume 2 June 5, 2014

185 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Increased Safety Measures for Energy 

Development on the Outer Continental Shelf; Docket ID BOEM–2012–0002, 77 Federal Register 163, August 

22, 2012, p. 50,870.

186 James Dupree Letter to Michael Bromwich. July 15, 2011, Re: Commitments to Promote Safe Drilling 

Operations in the Deepwater Gulf of Mexico, 

http://www.bp.com/content/dam/bp/pdf/BP_Commitments_Letter.pdf. Accessed February 2, 2014.

187 Guilty Plea Agreement, United States v. BP Exploration & Prod., Inc., No. 12-292 (E.D. La. Nov. 15, 2012).

188 Oil & Gas UK, Guidelines on the Subsea BOP systems, Issue 1, July 2012, p. 59.

189 Internal BP document, Communication to VP Wells-RPU, December 27, 2010, BP-HZN-BL Y00357189.

190 Oil & Gas UK, Guidelines on Subsea BOP systems, Issue 1, July 2012.

191 Offshore Oil and Gas in the UK—An Independent Review of the Regulatory Regime, December 2011, 

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CC4QFjAA&url=htt

ps%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile

%2F48252%2F3875-offshore-oil-gas-uk-indrev.pdf&ei=3oZEUpKBE6_oiAKuh4HYBA&usg=AFQjCNGWvCG_dHpZlFoeLWDmgR_tiAqRSQ&bvm=bv.

53217764,d.cGE. Accessed September 26, 2013.

192 Offshore Oil and Gas in the UK—An Independent Review of the Regulatory Regime, December 2011, Appendix 

E,

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CC4QFjAA&url=htt

ps%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile

%2F48252%2F3875-offshore-oil-gas-uk-indrev.pdf&ei=3oZEUpKBE6_oiAKuh4HYBA&usg=AFQjCNGWvCG_dHpZlFoeLWDmgR_tiAqRSQ&bvm=bv.

53217764,d.cGE. Accessed September 26, 2013.

193 Offshore Oil and Gas in the UK—An Independent Review of the Regulatory Regime, December 2011, Appendix 

E, p. 127, 

,https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CC4QFjAA&url=htt

ps%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile

%2F48252%2F3875-offshore-oil-gas-uk-indrev.pdf&ei=3oZEUpKBE6_oiAKuh4HYBA&usg=AFQjCNGWvCG_dHpZlFoeLWDmgR_tiAqRSQ&bvm=bv.

53217764,d.cGE. Accessed September 26, 2013.

194 30 C.F.R. § 250, see discussion in “Oil and Gas and Sulphur Operations on the Outer Continental Shelf—Oil and 

Gas Production Safety Systems, Proposed Rule” 78 Federal Register 163 (August 22, 2013), p. 52240-52284.

195 “Oil and Gas and Sulphur Operations on the Outer Continental Shelf—Oil and Gas Production Safety Systems, 

Proposed Rule” 78 Federal Register 163 (August 22, 2013), p. 52240

196 “Oil and Gas and Sulphur Operations on the Outer Continental Shelf—Oil and Gas Production Safety Systems, 

Proposed Rule” 78 Federal Register 163 (August 22, 2013), p. 52240

197 “Oil and Gas and Sulphur Operations on the Outer Continental Shelf—Oil and Gas Production Safety Systems, 

Proposed Rule” 78 Federal Register 163 (August 22, 2013), p. 52240

198 Oil & Gas UK Guidelines on Subsea BOP Systems, Table 6, July 1, 2012, .

199 Oil & Gas UK, Guidelines on the Subsea BOP systems, Issue 1, July 2012, p. 17.

200 Oil & Gas UK, Guidelines on the Subsea BOP systems, Issue 1, July 2012, pp. 8 and 94.

111 

 

000688
Macondo Investigation Report Volume 2 June 5, 2014

112 

 

000689
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

VOLUME 3 

REPORT NO. 2010-10-I-OS

4/17/2016

DRILLING RIG EXPLOSION AND FIRE AT THE 

MACONDO WELL 

(11 Fatalities, 17 Injured, and Serious Environmental Damage) 

DEEPWATER HORIZON RIG

MISSISSIPPI CANYON 252, GULF OF MEXICO

KEY ISSUES: APRIL 20, 2010

• HUMAN FACTORS

• ORGANIZATIONAL LEARNING

• SAFETY PERFORMANCE INDICATORS

• RISK MANAGEMENT PRACTICES

• CORPORATE GOVERNANCE

• SAFETY CULTURE

000690
Macondo Investigation Report Volume 3 4/17/2016

2 

[This page left intentionally blank.]

000691
Macondo Investigation Report Volume 3 4/17/2016

3 

Contents

VOLUME 3 – INTRODUCTION .............................................................................................................. 15

Moving Beyond the Blowout Preventer ...................................................................................................... 19

Volume Overview ....................................................................................................................................... 20

1.0 HUMAN FACTORS ..................................................................................................................... 21

1.1 Macondo Temporary Abandonment Personnel ............................................................................. 25

1.2 Macondo Temporary Abandonment Activities: Four Phases ........................................................ 26

1.2.1 Phase 1: Presetting of the Diverter System Route ............................................................ 27

1.2.2 Phase 2: Displacement of the Drilling Mud from the Drillpipe and Upper Wellbore ...... 27

1.2.3 Phase 3: Monitoring Pressure in the Underbalanced Well ............................................... 30

1.2.4 Phase 4: Displacement of the Riser .................................................................................. 33

1.2.5 Human Performance at Macondo ..................................................................................... 34

1.3 Phase 1 – Organizational Influence on Human Performance ........................................................ 35

1.3.1 Diverter Dual Role: Operational and Emergency Mitigation Device ............................... 36

1.3.2 Organizational Policy and Practice Influence Human Performance ................................. 38

1.3.3 Diverter System Design Required Multi-Step Process to Divert Fluids Overboard ......... 41

1.3.4 Needed Improvements in Detecting Gas Influx Prior to Reaching Riser ......................... 45

1.4 Phase 2 – Seemingly Insignificant Decisions can have Great Impact in Complex Systems ......... 47

1.5 Phase 3 – Evidence of Confirmation Bias ..................................................................................... 54

1.5.1 Potential Influence of Distraction and Fatigue ................................................................. 59

1.5.1.1 Fatigue ........................................................................................................... 60

1.5.1.1 Distraction ..................................................................................................... 63

1.6 Phase 4 – Troubleshooting, Multiple Activities, and Communication Gaps Obscure Well 

Conditions ................................................................................................................................................... 63

1.7 Competency and Non-technical Skills ........................................................................................... 66

1.7.1 Case Study for NTS: Pressure Discrepancies between Drillpipe and Kill Line ............... 70

1.7.1.1 Role of Mudlogger ........................................................................................ 72

1.7.2 Case Study for NTS: Conversation between Well Site Leader and Onshore Engineer .... 76

1.7.3 Integration of Non-technical Skills ................................................................................... 81

1.8 Work-as-Imagined Versus Work-as-Done: The Operator/Drilling Contractor Gap ...................... 83

1.8.1 BP’s Development and Communication of the Temporary Abandonment Plan .............. 85

1.8.2 Gap between ‘Work as Imagined’ and ‘Work as Done’ at the Macondo Well ................ 91

000692
Macondo Investigation Report Volume 3 4/17/2016

4 

1.8.3 Transocean Procedural Development Policies .................................................................. 93

1.8.4 Lack of Written Transocean Procedures and Work Instructions at Macondo .................. 95

1.9 Management of Change (MOC) .................................................................................................. 102

1.9.1 Management of Change: A Missed Opportunity ............................................................ 103

1.9.2 MOC Regulatory Requirements and Good Practice Guidance ....................................... 107

1.9.2.1 Regulatory Requirements for an MOC Safety Management System .......... 107

1.9.2.2 Multi-party MOCs are an International Concern ........................................ 109

1.10 Inadequate Requirements for Incorporating Human Factors in US Offshore Operations ........... 110

1.10.1 After Macondo, Limited US Offshore Regulatory Requirements Remain for Including 

Human Factors .................................................................................................................................. 111

1.10.2 Good Practice Techniques and Guidance on Human Factors ......................................... 112

1.10.3 International Offshore Regulatory Requirements and Guidance .................................... 114

1.11 Conclusion ................................................................................................................................... 117

2.0 ORGANIZATIONAL LEARNING FROM INCIDENT INVESTIGATIONS .......................... 119

2.1 Joint Incident Investigations and Challenges to Disseminating Lessons Learned Between 

Companies................................................................................................................................................. 119

2.2 Challenges to Disseminating Lessons Globally ........................................................................... 121

2.3 Expanding Beyond Immediate Causes and Implementing Change ............................................. 126

2.4 Effectiveness of post-Macondo SEMS Requirements for Incident Investigation ........................ 127

2.5 Conclusion ................................................................................................................................... 131

3.0 SAFETY PERFORMANCE INDICATORS ............................................................................... 132

3.1 Process Safety Performance Indicators for High-hazard Work Environments ............................ 133

3.2 BP’s Selection and Use of Performance Indicators ..................................................................... 137

3.2.1 BP Corporate Policies Reflect a Focus on Production, Personal Safety, and Lagging 

Indicators 137

3.2.2 Individual Performance Plans Lacked Process Safety Metrics ....................................... 139

3.3 Transocean’s Selection and Use of Performance Indicators ........................................................ 143

3.3.1 Transocean Recognized Need for Process Safety Performance Indicators .................... 146

3.3.2 Transocean Bonus Awards Insufficiently Focused on Performance Relating to Process 

Safety and MAP ................................................................................................................................ 148

3.4 Advancing the Development and Use of Process Safety Performance Indicators ....................... 149

3.4.1 CSB Efforts to Advance Understanding and Use of Process Safety Performance 

Indicators 150

3.4.2 Selection of Effective Performance Indicators ............................................................... 152

000693
Macondo Investigation Report Volume 3 4/17/2016

5 

3.5 Process Safety Metrics Gleaned from the Macondo Blowout ..................................................... 157

3.5.1 Real-time Indicators for Safety Critical Elements .......................................................... 158

3.5.1.1 Well Kicks ................................................................................................... 159

3.5.2 Slow Moving Indicators for SMS Elements ................................................................... 160

3.5.2.1 Emerging MOCs Themes ............................................................................ 160

3.5.2.2 Cross Reference Indicators Between the Operator/Drilling Contractor ...... 164

3.6 Regulatory Requirements for Indicators Reporting ..................................................................... 165

3.7 Conclusion ................................................................................................................................... 166

4.0 INEFFECTIVE RISK MANAGEMENT APPROACHES AT MACONDO AND THE 

CHALLENGES OF THE MULTI-EMPLOYER OFFSHORE WORK ENVIRONMENT .................... 167

4.1 BP and Transocean Risk Reduction Goal: ALARP ..................................................................... 168

4.2 Contractor Safety Management Guidance Calls for Clear Definition of Roles and Responsibilities

 170

4.3 Transocean did not apply its More Rigorous Corporate Risk Management Policies to the 

Deepwater Horizon and Macondo Well .................................................................................................... 171

4.3.1 Transocean Lacks Implementation Guidance for its Risk Management Tools .............. 173

4.3.1.1 Transocean Identified Risk Mitigation Tool Weaknesses Post Incident ..... 174

4.4 Post-Texas City Refinery Disaster, BP Developed but Macondo did not Benefit from the Robust 

Corporate Risk Management System ........................................................................................................ 176

4.4.1 OMS Roll-out Lags Macondo Well Planning and Drilling—Related Safety Practices were 

not Effectively Applied at the Macondo Well .................................................................................. 178

4.4.2 Macondo Risk Analysis Lacked BP ALARP Requirements .......................................... 180

4.4.3 BP’s Major Accident Risk (MAR) Process was not Implemented ................................. 183

4.4.4 Absent Reporting Requirements ..................................................................................... 185

4.4.5 BP did not implement OMS-required Application to Contracted Rigs through Contracts 

and Bridging Documents .................................................................................................................. 187

4.5 BP Did Not Pursue Its 2008 Initiative to Engage GoM D&C Contractors in Risk and Barrier 

Management .............................................................................................................................................. 191

4.6 Conclusion ................................................................................................................................... 193

5.0 CORPORATE GOVERNANCE, THE INFLUENCE OF SHAREHOLDERS AND PUBLIC 

DISCLOSURE OF PROCESS SAFETY INFORMATION..................................................................... 195

5.1 Boards of Directors and Shareholders ......................................................................................... 197

5.1.1 What is Corporate Governance? ..................................................................................... 197

5.1.2 The Role of Shareholders and their Influence on Corporate Governance ...................... 198

000694
Macondo Investigation Report Volume 3 4/17/2016

6 

5.1.3 Corporate Governance Risk Management and Sustainability ........................................ 201

5.1.4 The Business Case for Effective Process Safety Oversight ............................................ 204

5.1.5 The Need for Better Reporting Illustrated by Consequences Stemming from the Macondo 

Blowout 206

5.2 BP and Transocean: Corporate Governance and Communication of Process Safety and Major 

Accident Prevention Information .............................................................................................................. 209

5.2.1 A Case Study of Board Involvement Demonstrated in Shareholder Communications .. 209

5.2.1.1 BP Shareholder Communications Before and After BP Texas City ........... 210

5.2.1.2 BP Shareholder Communications Before and After Macondo ................... 212

5.2.1.3 Transocean Shareholder Communications Before and After Macondo ...... 214

5.3 Historical BP Corporate Governance Issues ................................................................................ 216

5.4 US Financial Regulation Absent Regarding HSE Reporting ....................................................... 221

5.5 The Offshore Regulator’s Role – An International Perspective .................................................. 224

5.5.1 Norway: Management Findings from Audits and Investigations ................................... 225

5.5.2 United Kingdom: Guidance and Training ....................................................................... 227

5.6 Conclusion ................................................................................................................................... 232

6.0 CULTURE FOR SAFETY: FOCUS AND RESPONSE ............................................................. 233

6.1 Assessing Culture and whether it Promotes Process Safety ........................................................ 234

6.2 Culture Assessments of BP and Transocean ................................................................................ 236

6.3 Influencing a Culture for Process Safety from the Top ............................................................... 238

6.4 Conclusion ................................................................................................................................... 241

7.0 VOLUME 3 CONCLUSION ....................................................................................................... 242

8.0 RECOMMENDATIONS ............................................................................................................. 244

000695
Macondo Investigation Report Volume 3 4/17/2016

7 

Figures and Tables

Figures 

Figure 1-1. Control panel (left) and partial close-up of control panel on the Deepwater Horizon found in 

the driller’s cabin and on the bridge of the rig. These controls were used to preset the diverter. ....... 27

Figure 1-2. On the left, the well as spacer material is pumped into the well, beginning to push drilling 

mud out of the riser. On the right, the intended well configuration for the negative test. .................. 29

Figure 1-3. Initial negative test configuration for the Macondo well called for only displacing the kill line 

(left), but the final configuration had both the kill line and the drill pipe displaced with sea water. . 31

Figure 1-4. Actual well conditions, with spacer positioned across the BOP, which likely lead to plugging 

of the kill line. ..................................................................................................................................... 32

Figure 1-5. During the final displacement of the well, the remaining drill mud above the drillpipe is 

replaced with seawater. ....................................................................................................................... 33

Figure 1-6. The diverter system on a rig can be routed to direct well fluids containing flammable gas to 

the mud gas separator (green) so that gas can be vented away from rig floor or drilling fluids can be 

directed routed overboard (red). ......................................................................................................... 37

Figure 1-7. Control panel and partial close-up of control panel on the Deepwater Horizon found in the 

driller’s cabin and on the bridge of the rig. ......................................................................................... 42

Figure 1-8. Control Panel Pushbuttons to preset route to MGS or overboard. ........................................... 43

Figure 1-9. Control Panel Pushbuttons to preselect the overboard route. ................................................... 43

Figure 1-10. Crew Activities during Temporary Abandonment beginning at 3:00 p.m. on April 20, 2010.

 ............................................................................................................................................................ 56

Figure 1-11. Crew activities and actions during final displacement of the riser. ........................................ 66

Figure 1-12. Intricate Communication Routes of Well Operations Personnel. .......................................... 73

Figure 1-13. Deepwater Horizon negative test Task Specific THINK Plan. .............................................. 98

Figure 1-14. Transocean Task Specific THINK Procedure addressing displacing a riser with seawater. 100

Figure 1-15. Illustration of the Hierarchy of Controls, including inherent safety strategies, for minimizing 

and eliminating hazards. ................................................................................................................... 113

Figure 3-1. Safety performance goals for BP employees that were a part of the Deepwater Horizon’s 

organizational structure. .................................................................................................................... 141

Figure 3-2. Process Safety Indicator Pyramid as identified by the American Petroleum Institute and the 

International Association of Oil & Gas Producers. ........................................................................... 153

Figure 3-3. A Bowtie diagram model used by Statoil to track the health of specific barriers that are 

preventive or mitigative for major accident risks. ............................................................................ 158

Figure 4-1. Transocean’s Levels of Risk Management. The higher level risk management approaches 

were applied to activities with greater complexity and severity of risk. ........................................... 172

Figure 4-2. OMS Rollout at BP, 2006-2009. ............................................................................................ 179

000696
Macondo Investigation Report Volume 3 4/17/2016

8 

Figure 4-3. May 2008 BP D&C Teams and Contractor Engagement from the Major Hazard and Risk 

Management Presentation to the D&C Leadership group. The presentation, two years before the 

Macondo incident, envisioned a detailed allocation of risk and barrier management responsibilities 

between BP and the contractor. BP did not implement the responsibility matrix approach. ............ 193

Figure 6-1. Visual representation of organizational culture, based on Edgar Shein's levels of culture. ... 235

Tables

Table 1-1. Well Control Personnel on Board the Deepwater Horizon Rig on April 20, 2010, that are 

discussed in this volume.* .................................................................................................................. 25

Table 1-2. Identified human performance actions/decisions during the four phases of temporary 

abandonment leading up to the blowout. ............................................................................................ 34

Table 1-3. Selected steps from the M-I SWACO displacement procedure used at the Macondo well on 

April 20, 2010. .................................................................................................................................... 49

Table 1-4. Non-technical skill categories, definitions, and example behaviors associated with each. ....... 68

Table 1-5. Multiple Interpersonal Behaviors and Interactions amongst Well Operations Personnel 

Demonstrate Need for Non-technical Skills. ...................................................................................... 70

Table 1-6. Summary of communications between Mudlogger and Other Well Operations Crewmembers 

the evening of April 20, 2010. ............................................................................................................ 75

Table 1-7. Interview statements concerning conversation between the on-rig Well Site Leader (WSL) and 

the onshore drilling engineer (ODE); names have been replaced with title abbreviations. ................ 77

Table 1-8. Description of the development and communication of the Macondo TA program. ................ 89

Table 1-9. BP and Transocean instituted multiple changes to the temporary abandonment activities that 

had the potential to negatively affect well barriers without first assessing the hazards of those 

changes.............................................................................................................................................. 104

Table 1-10. A comparison of best practice elements of an MOC program, current BSEE MOC 

requirements, and BP and Transocean’s MOC programs in place at the time of the Macondo 

incident.............................................................................................................................................. 108

Table 2-1. Excerpts from the M.G. Hulme, Jr well control incident report that reflect WAI versus WAD 

conflicts. ............................................................................................................................................ 120

Table 3-1. Distinctions between Process and Personal Safety., ,

 ............................................................. 136

Table 3-2. Indicator data collected for the Gulf of Mexico as reported in BP’s Maroon Book for 2009. 138

Table 3-3. Corporate Quality, Health, Safety and Environment (QHSE) Strategy and Target Goals Status 

as reported by Transocean. ............................................................................................................... 146

Table 3-4. COS definitions of SPI 1 and SPI 2 process safety events. ..................................................... 154

Table 3-5. Four indicators as defined by Statoil in 2001. ......................................................................... 157

Table 3-6. Summary of MOCs documented by Transocean for the Deepwater Horizon BOP. ............... 161

000697
Macondo Investigation Report Volume 3 4/17/2016

9 

Table 4-1. Shore-based risk management tools as identified and described in Transocean’s Health and 

Safety Policies and Procedures Manual-Level. ................................................................................ 173

000698
Macondo Investigation Report Volume 3 4/17/2016

10 

Acronyms and Abbreviations

ALARP As Low As Reasonably Practicable

AMF Automatic Mode Function

ANSI American National Standards Institute

API American Petroleum Institute

ASTM American Society for Testing and Materials

BOEM Bureau of Ocean Energy Management

BOEMRE Bureau of Ocean Energy Management, Regulation, and Enforcement

BOP Blowout Preventer 

BSEE Bureau of Safety and Environmental Enforcement 

BSR Blind Shear Ram 

CCPS Center for Chemical Process Safety

CEO Chief Executive Officer

COS Center for Offshore Safety

COSO Committee of Sponsoring Organizations 

CRM Crew Resource Management 

CSB US Chemical Safety Board

DAFW Days Away From Work

DAFWC Days Away From Work Case

DAFWCF Days Away From Work Case Frequency

DART Days Away from Work, Restricted duty, and Transfer situations 

DAWFC Days Away from Work Case Frequency 

DNV Det Norske Veritas

DOI Department of Interior 

DWH Deepwater Horizon

DWOP Drilling and Wells Operation Practice 

EDS Emergency Disconnect System

EHS Environmental Health and Safety 

EPA Environmental Protection Agency

ERM Enterprise Risk Management 

000699
Macondo Investigation Report Volume 3 4/17/2016

11 

ETP Engineering Technical Practices

FAA Federal Aviation Administration 

FRC Financial Reporting Council 

GDP Group Defined Practice 

GHSER Getting HSE Right

GRI Global Reporting Initiative 

HAZID Hazard Identification 

HAZOP Hazard and Operability Study 

HIPO High Potential Incident 

HPDO High Potential Dropped Objects 

HRO High Reliability Organization

HSE Health Safety Executive

HSSE Health, Safety, Security and Environment 

HTO Human, Technology and Organization 

IADC International Drilling Contractors Association 

INPO Institute of Nuclear Power Operations 

IOGP International Association of Oil & Gas Producers

ITL Information to Lessee

LCM Loss Circulation Material

LMRP Lower Marine Riser Package

LOPA Layers of Protection Analysis

LOPC Loss of Primary Containment 

LTA Lost Time Accident 

LTI Lost Time Incident/Lost Time Incident rate

MAE Mary Accident Event

MAHRA Major Accident Hazard Risk Assessment

MHRA Major Hazard Risk Assessment

MAP Major Accident Prevention 

MAR Major Accident Risk

MBI Marine Board of Investigation

MBO Management by Objective

000700
Macondo Investigation Report Volume 3 4/17/2016

12 

MGS Mud-Gas Separator

MHRA Major Hazard Risk Assessments 

MIA Major Incident Announcement

MMS Minerals Management Service

MOC Management of Change

MODU Mobile Offshore Drilling Unit 

MSHA Mine Safety and Health Authority 

NAE National Academy of Engineering

NOPSA National Offshore Petroleum Safety Authority

NOPSEMA National Offshore Petroleum Safety and Environmental Management Authority 

NPT Negative Pressure Test

NRC Nuclear Regulatory Commission

NSOAF North Sea Offshore Authorities Forum 

NTL Notice to Lessee

NTS Non-technical Skills 

NTSB National Transportation Safety Board 

OCS Outer Continental Shelf

ODE Onshore Drilling Engineer 

OECD Organization for Economic Co-operation and Development

OIC Operations Integrity Case 

OIM Offshore Installation Manager 

OLF Norwegian Oil Industry Association 

OMS Operating Management System

OOC Offshore Operators Committee

OSH Occupational Safety and Health

OSHA Occupational Safety and Health Administration 

PMAA Performance Monitoring Audit and Assessment

PSA Petroleum Safety Authority

PSM Process Safety Management

QHSE Quality, Health, Safety and Environment 

RAT Risk Assurance Tool

000701
Macondo Investigation Report Volume 3 4/17/2016

13 

RIF Recordable Injury Frequency

SASB Sustainability Accounting Standards Board 

SCE Safety Critical Element

SCTA Safety Critical Task Analysis

SEC Securities and Exchange Commission

SEEAC Safety, Ethics and Environment Assurance Committee

SEMS Safety and Environmental Management System

SHAPE Safety and Health in Amec Process & Energy

SHE Safety, Health, and Environment 

SIC Serious Injury Case 

SID Standing Instructions to the Driller

SINTEF Norwegian: Stiftelsen for industriell og teknisk forskning 

SIS Safety Instrumented Systems

SMS Safety Management System

SOP Standard Operating Procedure 

SPE Society of Petroleum Engineers 

SPI Safety Performance Indicator

SPU Strategic Performance Unit

TPSR Total Potential Severity Rate

TRIR Total Recordable Injury Rate

TSTP Task Specific THINK Procedure

UK United Kingdom 

US United States

USCG United States Coast Guard

WAD Work as Done

WAI Work as Imagined

WBM Water Based Material

WCID Well Construction Interface Document 

WLCPF Well Lifecycle Practices Forum

WSL Well Site Leader 

000702
Macondo Investigation Report Volume 3 4/17/2016

14 

Volume 3 

Human, Organizational, and Safety 

System Factors of the Macondo

Blowout

000703
Macondo Investigation Report Volume 3 4/17/2016

15 

Volume 3 – Introduction

In 1988, the offshore oil and gas industry experienced its 

deadliest accident when an explosion aboard the Piper Alpha 

oil production platform took the lives of 167 individuals. In 

its aftermath, a major incident investigation revealed a 

number of issues concerning the management of major 

accident risk offshore.1 Twenty-five years later, the Piper 

Alpha disaster was described as “the lens through which we 

[the offshore industry] view our safety efforts.”2

 The 

Macondo incident serves to check the focus of that lens, as 

the blowout illuminates the increasing complexity of offshore 

operations, technologies, and drilling environments. To that 

end, the CSB’s investigation of the Macondo incident revisits 

some of Piper Alpha’s lessons and introduces new ones 

related to human performance, organizational learning, safety 

performance indicators, risk management coordination, and 

corporate cultures that promote safety. 

The risk management policies of both BP and Transocean 

promote an incident-free workplace. BP’s 2008 major 

corporate safety Operating Management System (OMS) 

framework states, “Our goals are simply stated: no accidents, 

no harm to people, and no damage to the environment.”3 In 

Transocean’s 2009 Health and Safety Policy statement, the 

company commits to operating in an “incident-free 

workplace—all the time, everywhere.”4

 ExxonMobil,5 Shell 

 

1 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary 

of State for Energy by Command of her Majesty. November, 1990. 

2 Oil & Gas UK. Health & Safety Report 2014; 2014; p 1. http://oilandgasuk.co.uk/wpcontent/uploads/2015/05/HS087.pdf (accessed December 20, 2015). 

3 Internal Company Document, BP. The BP Operating Management System Framework, Part 1, An Overview of 

OMS, Issue 2, November 3, 2008, p 24, BP-HZN-2179MDL0033320, see Exhibit 2352 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lynch_Richard-Depo_Bundle.zip 

(accessed October 7, 2015). 

4 Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, Revision 

07, HQS-HSE-PP-01, December 15, 2009, General, BP-HZN-2179MDL00132067, see Exhibit 4942 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015). 

5 ExxonMobil, Commitment to Safety, http://www.exxonmobile.com/USAEnglish/EMPCo/healthsafetyenvironment_safety.aspx (accessed December 8, 2014).

Volume 3 Overview 

Introduction 

Chapter 1 – Human Factors 

Chapter 2 – Organizational Learning 

from Incident 

Investigations

Chapter 3 – Safety Performance 

Indicators 

Chapter 4 – Risk Management and 

the Multi-employer Work 

Environment 

Chapter 5 – Corporate Governance 

and the Influence of 

Shareholders 

Chapter 6 – Culture for Process 

Safety 

Chapter 7 – Conclusion

Chapter 8 – Recommendations 

000704
Macondo Investigation Report Volume 3 4/17/2016

16 

Global,6 Total,7

 ConocoPhillips,8 and Chevron9 have similarly stated “zero incident” risk management 

goals, but zero incidents for a day, month, or even years do not preclude a company from an incident 

tomorrow. Preventing incidents requires a shift in focus from past successes to current risk reduction 

activities. Ultimately, risk reduction efforts must be continually accounting for inevitably changing 

circumstances (e.g., the drilling environment, technology, knowledge, and workforce). 

While the Macondo blowout occurred under the direction of Transocean and BP, it affected the offshore 

industry worldwide,10 demonstrating that risk management for preventing major accident events (MAEs) 

continues to challenge the offshore industry despite the numerous lessons from the Piper Alpha incident.11

For example, almost five years after the Macondo blowout, audit findings from one of the offshore US 

regulators, Bureau of Safety and Environmental Enforcement (BSEE), suggest that some companies use 

their safety and environmental management system (SEMS) programs12 to document regulatory 

compliance rather than to actually manage risks.13 In fact, post-incident CSB analyses of Transocean and 

BP risk management policies at the time of the blowout reveal that many of the policies would have 

satisfied current SEMS requirements. Yet the companies did not effectively implement these policies to 

manage the major accident risks of the Macondo well, and the companies were not held accountable by 

the regulator to ensure that they managed safety as their company policies stipulated. Beyond BP and 

Transocean, the CSB found a lack of US offshore industry regulations and guidance for human factors, 

process safety indicators, and corporate governance. Volume 3 of the CSB Macondo investigation report 

addresses the insufficient focus on managing major hazard risk throughout the lifecycle of the Macondo 

well, beginning with the well’s initial design, through execution of the project, which included several 

modifications, and finally during temporary abandonment planning and execution. The CSB’s report: 

 

6 Shell Global, Safety, http://www.shell.com/global/environment-society/safety.html (accessed December 8, 2014).

7 Total, Industrial Safety: Our Objectives and Ambitions, http://www.total.com/en/society-environment/industrialsafety/our-objectives-and-ambitions (accessed December 8, 2014). 

8 ConocoPhillips, Our Safety Commitment, http://www.conocophillips.com/sustainable-development/safetyhealth/Pages/our-safety-commitment.aspx (accessed February 8, 2015).

9 Chevron, Workforce Health and Safety, http://www.chevron.com/corporateresponsibility/approach/workforce/

(accessed December 8, 2014).

10 E.g., Oil & Gas UK. Guidelines on BOP Systems for Offshore Wells, Issue 2; Oil & Gas UK: Great Britain, May, 

2014; p 182.; House of Commons Energy and Climate Change Committee. UK Deepwater Drilling-Implications 

of the Gulf of Mexico Oil Spill; HC 450-1; The Stationery Office Limited: London, Great Britain, January 6, 

2011.; International Association of Oil & Gas Producers. Deepwater Wells: Global Industry Response Group 

Recommendations; Report No. 463; May, 2011.

11 E.g., Walker, S. Review of the Cullen Recommendations - are they still relevant?, Oil & Gas UK’s Piper 25 

Confernece, Aberdeen, Scotland, June, 2013.; Hackitt, J. Piper Alpha – honouring the legacy and adapting for the 

future, Oil & Gas UK’s Piper 25 Confernece, Aberdeen, Scotland, June, 2013.; Fryan, R. Piper Alpha 25, Oil & 

Gas UK’s Piper 25 Confernece, Aberdeen, Scotland, June, 2013.

12 30 C.F.R. §250.1900 Subpart S, Safety and Environmental Management Systems (2015).

13 Bureau of Safety and Environmental Enforcement. BSEE Priorities Regarding SEMS, Offshore Technology 

Conference, Houston, TX, 2015; 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Speeches/2015/OTC%202015%20Mtg%20SEMS%

20Presentation.pdf (accessed December 19, 2015).

000705
Macondo Investigation Report Volume 3 4/17/2016

17 

1. Identifies instances where crewmember’s actions were relied upon for successful and safe well 

operations, but neither BP nor Transocean effectively defined performance expectations, nor did 

they support the crew with a rigorous human factors management system.

2. Demonstrates that both BP and Transocean possessed safety management system policies meant 

to manage major accident hazards, but they did not effectively implement these policies because 

of: 

a. Inadequate incorporation of human factors into safety management practices and hazard 

assessments;

b. Ineffective organizational learning from previous incidents; 

c. Unclear roles and responsibilities, separately and jointly, for managing major accident 

risk; and

d. Insufficient fulfillment of internal company requirements to reduce risk to as low as 

reasonably practicable (ALARP).

3. Advances the importance of actively monitoring the effectiveness of barrier and safety 

management systems. 

4. Illuminates the influence of oversight from corporate board of directors and shareholders on risk 

management. 

5. Illustrates the current gaps in US regulations and guidance that do not incorporate recognized 

process safety concepts, including human factors, ALARP, and effective management of safety 

critical elements.

6. Lays the necessary foundation for carefully examining the strong oversight and influence required 

of the regulator in pushing companies to effectively implement what they claim they are doing to 

manage major accident risk and in driving them toward continual risk reduction. 

000706
Macondo Investigation Report Volume 3 4/17/2016

18 

Throughout Volume 3, the CSB refers to “the regulator” or “offshore regulations” to indicate either 

MMS or BSEE and their respective safety regulations for drilling and completions activities on the 

outer continental shelf. As indicated in the figure below, MMS evolved into BSEE after the Macondo 

incident occurred. In reality, several regulatory bodies oversee the offshore oil and gas industry, 

including the US Coast Guard (USCG), the Bureau of Ocean Energy Management (BOEM), and the 

Environmental Protection Agency (EPA), but the CSB generally limits its discussion to MMS and 

BSEE due to its specific authority over the safe conduct of offshore drilling and completion 

operations. 

000707
Macondo Investigation Report Volume 3 4/17/2016

19 

Moving Beyond the Blowout Preventer

Volume 2 of the CSB Macondo investigation report introduces safety critical elements (SCEs), also called 

safety barriers, as equipment or tasks that provide the highest level of protection against MAEs, and, 

conversely, whose failure increases the risk of an MAE.14 In that volume, the CSB uses the blowout 

preventer (BOP) as the vehicle to explore targeted risk reduction by describing the steps required for 

maintaining SCE effectiveness to ensure risk of an MAE is as low as reasonably practicable.15

Historically, safety barriers have been identified as physical in nature, intended to separate and protect 

people and the environment from hazards.16, 17 Physical barriers, such as the downhole cement and BOP 

installed at the Macondo well, have been closely assessed post-incident for their contribution to the 

blowout.18 But focusing on solutions to these technical failures cannot prevent future incidents without 

giving equal attention to failures of less visible, non-physical barriers and support systems. 

The safety barrier concept must extend beyond physical safeguards. For example, a blowout preventer 

should establish a physical barrier to prevent the flow of hydrocarbons from the well to the drilling rig, 

yet the BOP can accomplish this only if the crew detects the kick soon after ingress and activates the 

appropriate BOP component in time for it to seal the well. Beyond the crew’s actions, companies must 

appropriately manage several organizational factors to ensure the BOP will successfully function as a 

barrier, including: 

• proper selection of a BOP with capabilities appropriate to control the well being drilled; 

• maintenance and care to ensure the BOP can function as designed;

• a crew’s capabilities in identifying the need to close the well; 

• active monitoring of the BOP and its associated safety systems to ensure its effectiveness as a 

barrier when summoned; and

• company procedures and cultural practices that directly influence a crew’s actions. 

This brief dissection of the BOP as a physical barrier illustrates how its success depends upon a barrier 

system19 that incorporates operational/human and organizational elements. 

In the United States, Macondo precipitated numerous industry and government publications to address 

issues such as safe drilling operations, well containment and intervention capability, and oil spill response 

 

14 See CSB Macondo Investigation Report, Volume 2, Section 4.2.3.1, p 58.

15 Ibid., Figure 5-1, p 63.

16 Sklet, S. Safety Barriers: Definitions, Classification, and Performance. J. Loss Prevent. Proc. 2006, 19, 494. 

17 The weight of a column of fluid that fills the hole being drilled (wellbore) and the riser is the primary barrier used 

to control pore pressures and prevent kicks during drilling and completion activities; for more detail, see Volume 

1 of the CSB Macondo Investigation Report, Section 4.2.3.1, p 19.

18 CSB Macondo Investigation Report, Volume 2.

19 “A barrier system describes how a barrier function is realized or executed...A barrier element is a component or a 

subsystem of a barrier system that by itself is not sufficient, to perform a barrier function...” Sklet, S. Safety 

Barriers: Definitions, Classification, and Performance. J. Loss Prevent. Proc. 2006, pp 19, 494.

000708
Macondo Investigation Report Volume 3 4/17/2016

20 

capability.20 The focus of these US regulations, standards, and guidance has primarily been on the 

reduction of physical threats and improvements in managing technical barriers such as those related to 

this incident. In contrast, new US regulations and guidance aimed at advancing our understanding and 

management of human performance—the operational barriers—have been limited. This volume explores 

opportunities in the US for further improvements.

Volume Overview

Because Deepwater drilling is highly dependent on the actions of the well operations crew, Volume 3 of 

the CSB Macondo investigation report begins by exploring four specific phases of activity by the crew 

leading up to the blowout and subsequent explosions. These phases provide a framework for analyzing 

the human and organizational factors contributing to the April 20, 2010, incident. From there, this volume 

reviews several human factors issues relevant to the incident (Chapter 1.0). 

Volume 3 extends beyond human factors and safety system performance to organizational learning of 

offshore incident investigations (Chapter 2.0) and major challenges facing industry in this endeavor, as 

demonstrated by several well control incidents. Chapter 3.0 illuminates successful personal safety

program initiatives that BP and Transocean have not adequately applied to process safety. Chapter 3.0

then describes advances in safety performance indicators and suggests offshore process safety indicators 

appropriate for rig, company, industry, and regulatory levels. Chapter 4.0 details how several of BP’s and 

Transocean’s MAE risk management policies could have made a positive impact on work completed at 

the Macondo well, but safety roles and responsibilities were unclear, and ultimately neither company 

applied their policies. Since BP’s and Transocean’s boards of directors did not have sufficient oversight 

for process safety issues and major accident prevention, Chapter 5.0 reviews corporate governance good 

practice, as well as the influence that shareholders, SEC reporting requirements, and the regulator might 

have on ensuring boards of directors remain focused on potential MAEs. Ultimately, the organizational 

behaviors and practices of BP and Transocean demonstrated a focus on personal safety without an equal

attention to managing barriers and safety management systems meant to prevent MAEs, and both 

companies exhibited behaviors more akin to a minimal safety compliance approach (Chapter 0). With 

limited safety management regulatory provisions and oversight for the drilling operation, they did not 

abide—nor did any government authority require them to abide—by their own, more stringent corporate 

risk management policies. And in many respects, their documented policies still meet or exceed the 

current regulatory requirements for risk management.

In demonstrating that the deficiencies outlined in this volume continue to exist offshore in the Gulf of 

Mexico (GoM), the CSB identifies opportunities for further strengthening industry management of major 

accident hazards and the role of the regulator in this endeavor. The facts and findings described in 

Volume 3, as well as in Volumes 1 and 2, provide the bridge to Volume 4; this final volume illustrates 

how the regulatory changes since Macondo, while greatly significant, do not go far enough to put the 

onus on industry to effectively reduce risk, nor do they sufficiently provide the mechanisms for the 

regulator to proactively assure effective industry management and control of major hazards. 

 

20 Joint Industry Task Force (JITF). JITF Executive Summary; March 13, 2013, p 1. 

http://www.api.org/~/media/files/oil-and-natural-gas/exploration/offshore/executive-summary-final-031312.pdf

(accessed October 2015, 2015).

000709
Macondo Investigation Report Volume 3 4/17/2016

21 

1.0 Human Factors 

In the aftermath of a catastrophe, the individuals immediately 

involved in the activities that precipitated the event often 

receive much of the focus and subsequent blame, due largely

to the ease of drawing causal lines between those activities 

and the negative outcomes. This holds true for Macondo, 

where much attention has been on the incorrect interpretation 

of the well data during the negative test21 and well 

displacement, the delayed response to hydrocarbons entering 

the well, and the diversion of the well fluids to the mud gas 

separator instead of off the sides of the rig away from 

potential ignition sources and the people on board.22 Beyond 

Macondo, human “errors” have also been linked to numerous 

major accidents from a wide variety of environments, 

including Chernobyl (nuclear), Herald of Free Enterprise 

(passenger ferry),23 Clapham Junction (railroad),24 Piper Alpha (offshore production facility),25 and Texas 

City (onshore refinery).26, 27 

Pointing to human failure “is hardly surprising...every operational, inspection and maintenance task is 

carried out by a skilled technician and the successful outcome relies on error-free performance.”28 But we 

should expect human performance variability, and in fact it is normal and necessary.29 Humans are 

 

21 The negative test is defined in Section 1.2.2 and discussed at length throughout Chapter 1. The negative test is also 

referred to as ‘negative flow test’ and ‘negative pressure test,’ depending upon which variable is 

measured/observed as part of the test procedure. The CSB will use the general ‘negative test’ for the remainder of 

this volume.

22 The diverter system and mud gas separator are described in detail in Section 1.3. 

23 On March 6, 1987, a vehicle and passenger ferry capsized immediately after leaving its Belgian port when its bow 

door was left open, killing 193 people.

24 Poor maintenance and human fatigue were deemed causal in this December 20, 1988, multi-train collision that 

resulted in 35 deaths and 500 injuries.

25 On July 6, 1988, 167 individuals died from explosions and fire on this North Sea oil platform. A number of human 

factors issues were identified pertaining to procedures, the permit to work process, shift handover, 

communication, and training, among others. 

26 Several human factors were identified as contributory to the March 23, 2005 BP Texas City refinery explosions 

and fire leading to 15 deaths and 180 injuries. These included workload/staffing, distraction, fatigue, 

poor/inadequate instrumentation, and human-computer interface design of the unit control board. 

27 Energy Institute, Guidance on Human Factors Safety Critical Task Analysis, 1st ed., March 2011, p 1.

28 Hamilton, I. Human Error: in the loop; The Chemical Engineer, 2012, 854, p 40.

29 Shorrock, S. Humanistic Systems; 'Human error': The handicap of human factors, safety and justice, 

http://humanisticsystems.com/2013/09/21/human-error-the-handicap-of-human-factors-safety-and-justice/ 

(accessed October 7, 2015).; Hollnagel, E. Barriers and Accident Prevention; Ashgate: 2004.

Chapter 1.0 Overview

This chapter provides an analysis of 

the human factors pertinent to the 

incident to shed light on the 

reasoning behind the decisions and 

actions of those immediately involved 

in the drilling and temporary 

abandonment process at Macondo. 

The chapter describes the current 

industry dependence on human 

actions to maintain safe operations 

and details a significant gap in 

effective management of human 

factors in offshore operations. 

000710
Macondo Investigation Report Volume 3 4/17/2016

22 

valuable because of their flexibility—their ability to adapt and troubleshoot within workplace conditions 

that can be “vague, shifting, and suboptimal.”30 For every catastrophic incident, humans have achieved 

countless other successful outcomes because of their variability and ingenuity in the face of unexpected 

situations. As such, humans remain a critical component of any high-hazard system and play a direct and 

indispensable role in preventing or mitigating a major accident event. 

Human intervention is essential throughout the entire lifecycle of a drilling operation, where reliance on 

successful human performance begins with the initial hazard analysis to assess and design the well, and it 

continues through the plans and procedures developed and subsequently modified in response to the realtime well conditions. This reliance places a heavy dependence upon the decisions and actions of the well 

operations crew31 which can 1) increase or decrease the risk of a well kick, and 2) compromise or 

strengthen the effectiveness of various technical barriers32 intended to minimize the potential for a 

blowout. 

Official inquiries into the Macondo incident concluded that the well operations crew and rig management 

made decisions and took actions that they should not have,33 and some called for more technical 

competency training.34 Yet improving human performance goes far beyond simply retraining individuals 

on the technical aspects of offshore operations. As Sidney Dekker expresses in his book The Field Guide 

to Understanding Human Error, “Accidents are seldom preceded by bizarre behavior ... Mishaps are the 

result of everyday influences on everyday decision making, not isolated cases of erratic individuals 

 

30 Shorrock, S. Humanistic Systems; 'Human error': The handicap of human factors, safety and justice, 

http://humanisticsystems.com/2013/09/21/human-error-the-handicap-of-human-factors-safety-and-justice/ 

(accessed October 7, 2015).

31 While the well operations crew members often get credit for making decisions and taking direct action to conduct 

the drilling activities, a number of management and engineering personnel play a role in the decisionmaking/action-taking process through various means, such as providing leadership instruction, guidance, and 

technical analysis of the well. The complexity of these relationships provides support for improved methods of 

non-technical skills development, which is covered in Section 1.7 of this chapter. 

32 Technical barriers are physical in nature, such as the BOP or drilling mud, either of which can be used to 

physically stop the flow of hydrocarbons from a well. The CSB Macondo Investigation Report, Volume 2, 

chapters 2 and 4 provide further details on physical, operational, and organizational barriers.

33 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; p 10.; National Commission on the BP 

Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water The Gulf oil Disaster and the Future of Offshore 

Drilling; 2011; pp 115, 120-122.; National Commission on the BP Deepwater Horizon Oil Spill and Offshore 

Drilling. Chief Counsel's Report: The Gulf Oil Disaster; Feburary 17, 2011; Sections 4.6 – 4.8.; US Coast Guard. 

Report of the Investigation into the Circumstances Surrounding the Explosion, Fire, Sinking and Loss of Eleven

Crew Memebers Aboard the MODU, Deepwater Horizon; 2011; p 12.; National Academy of Engineering and 

National Research Council of the National Academies. Macondo Well – Deepwater Horizon Blowout: Lessons for 

Improving Offshore Drilling Safety; The National Academies Press: Washington, D.C., 2011; pp 3, 19.

34 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; pp 183-184.; National Commission on 

the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The Gulf Oil Disaster; 

Feburary 17, 2011; p 162.; Bureau of Ocean Energy Management, Regulation, and Enforcement. Report 

Regarding the Causes of the April 20, 2010, Macondo Well Blowout; 2011; pp 8, 210.

000711
Macondo Investigation Report Volume 3 4/17/2016

23 

behaving unrepresentatively.” 35, 36 Furthermore, human performance is often only deemed erroneous in 

the aftermath of a negative outcome. The CSB’s investigative work frequently finds a history of 

acceptable performance leading up to an incident that was never considered erroneous or critiqued until 

catastrophe happened. (See Call-out Box.) Indeed, “There is almost no human action or decision that 

cannot be made to look flawed or less sensible in the misleading light of hindsight.”37 Overall, the 

performance failures identified post-incident do not point to worker competency per se, but to a variety of 

situational, contextual, and organizational variables that influence even a highly competent person’s 

decision-making. 

 

“As a discipline, human factors is concerned with understanding interactions between people and other 

elements of complex systems. Human factors applies scientific knowledge and principles as well as 

lessons learned from previous incidents and operational experience to optimize human wellbeing, overall 

 

35 As in any CSB incident investigation, unless evidence suggests intentional criminal acts, it is assumed that the 

crew members were evaluating the information at hand and responding without any malicious intent toward 

themselves, their coworkers, and the facility/organization.

36 Dekker, S. The Field Guide to Understanding Human Error; Ashgate: 2006; p 18.; James Reason and others make

similar statements, e.g., see Reason, J. Human Error; Cambridge University Press: 1990.

37 Department of Transport. Investigation into the Clapham Junction Railway Accident; Her Majesty's Stationary 

Office: London, 1989, p 147.

Performance Judged “Good” or “Bad” Depending on the Outcome 

Error-free performance is unattainable, largely because the performance decision or 

action is subjectively judged erroneous or error-free based on the outcome. After an 

incident, the decisions and actions of those immediately involved in the event are 

invariably criticized. Personnel have broken rules, not followed procedures, and 

made “illogical” decisions. However, the CSB has frequently found that decisions 

and actions labeled as “poor” post-incident were previously accepted, and sometimes 

even rewarded. 

The BP Texas City refinery explosion (2005)† is one such example. On the day of the 

incident, process parameters were exceeded during unit startup. In fact, process 

parameters were deviated in the 18 previous startups of that unit. Sometimes these 

startups led to a hydrocarbon release into the unit, but none resulted in explosions 

and fatalities. These deviations were not assessed, nor were steps taken to prevent 

future deviations. Up until the day of the incident, the deviations to procedures were 

considered acceptable to protect the unit equipment and achieve successful unit 

startup. 

†

US CSB, Refinery Explosion and Fire: BP Texas City, Section 3.1.1, 

http://www.csb.gov/bp-america-refinery-explosion/.

000712
Macondo Investigation Report Volume 3 4/17/2016

24 

system performance and reliability. The discipline contributes to the design and evaluation of 

organisations, tasks, jobs and equipment, environments, products and systems.”38

Thus, drilling organizations—like any entity conducting high-hazard operations—must incorporate 

human factors into safety management practices. They must consider human strengths and limitations 

when designing a task and implement safety management systems to support the work activities of those 

conducting the hazardous operations.39 They must explicitly identify the performance expectations of the 

human-dependent controls, and continually assess those controls to ensure they are sufficient and can be 

reliably maintained or executed. 

This chapter provides specific evidence of the lack of effective integration of human factors into the 

design, planning, and execution of drilling and completions activities at the Macondo well, and it 

illustrates a demonstrable gap in US offshore regulation and guidance to incorporate more robust 

management of human factors. Specifically, this chapter shows:

• The organizational influence on human performance; 

• The importance of human factors engineering considerations for safety critical system design and 

usage;

• The still unresolved risk of gas-in-riser situations that place unrealistic expectations on well 

operations crews;

• The need for development and use of non-technical skills,40 including communication, 

teamwork, and decision-making, by the operator, drilling contractor, and other well services 

providers; 

• The gap between work-as-imagined (WAI) by well designers, managers, or regulatory authorities 

and work-as-done (WAD) by the well operations crew; and 

• The importance of assessment of safety critical tasks and identification of controls that could 

maximize the likelihood of successful human performance. 

 

38 International Association of Oil & Gas Producers. Human Factors Engineering in Projects, Report No. 454; 

August 2011.

39 Volume 3 offers multiple examples throughout of how multiple safety management system programs, including 

those for management of change, procedures, and incident investigations, can support successful human 

performance. 

40 Non-technical skills have been defined as “the cognitive, social and personal resource skills that complement 

technical skills, and contribute to safe and efficient task performance.” [Flin, R.; O'Connor, P.; Crichton, M. 

Safety at the Sharp End; Ashgate Publishing: Hampshire, England, 2008; p 1.] Non-technical skills will be 

discussed more fully in Section 1.7 of this chapter.

000713
Macondo Investigation Report Volume 3 4/17/2016

25 

1.1 Macondo Temporary Abandonment Personnel

To set the context of this analysis, Table 1-1 provides a review of the individuals immediately involved in 

the temporary abandonment activities. 

Table 1-1. Well Control Personnel on Board the Deepwater Horizon Rig on April 20, 2010, that are 

discussed in this volume.* 

Position Employer

No. On Board/

No. on Duty at 

time of blowout

Detail

Well Site Leader (WSL) BP 2 / 1

Considered the “Company Man,” this person 

represents the operator/leaseholder; there was 

also a third WSL on board who was a trainee

Offshore Installation 

Manager (OIM) Transocean 1 Manages all aspects of the rig, including well, 

crane, and marine operations

Senior Toolpusher Transocean 1 

Supervises well operations; conducts a variety 

of administrative tasks associated with the 

well operations; assists the OIM

Toolpusher Transocean 2 / 1 Supervises well operations/rig floor; advises 

and assists the driller

Driller Transocean 2 / 1

Operates drilling equipment; using visual 

observation of rig floor and down hole data, 

monitors and responds to well conditions

Assistant Driller Transocean 4 / 2

Assists the driller in operating the drilling 

equipment and monitoring/responding to well 

conditions

Mud Engineer M-I Swaco 2 / 1

Also called a drilling fluids specialist, this 

person is responsible for ensuring the drilling 

fluid (mud) meets design specifications 

necessary for the well operation

Mudlogger Sperry-Sun 2 /1 Monitors well (down hole) conditions and 

video feed of flow on rig to assist the driller

There are a number of additional personnel with responsibilities associated with well operations, such as the 

Subsea Supervisor, Floorhands, Derrickhands, and Cementers. However, these positions do not play a 

prominent role in the analysis presented within this volume. There are also a number of personnel on shore that 

provide technical and managerial support, such as the Onshore Drilling Engineer, who is discussed in Section 

1.7.2.

000714
Macondo Investigation Report Volume 3 4/17/2016

26 

Besides these 16 individuals, 110 others representing 13 companies were on board the rig on April 20, 

2010, most of whom (79) were Transocean personnel.

41 On official duty at the time of the blowout were 9 

of the 16 well operations crewmembers identified in Table 1-1. The drillers operated drilling equipment 

and monitored the well from the driller’s cabin (or shack) on the drill floor. The senior toolpusher 

supervised the toolpushers and the drillers’ activities. The mudlogger was housed in the mudlogger’s 

shack, a separate location one flight of stairs away from the drillers. Both the Offshore Installation 

Manager (OIM) and Well Site Leader (WSL) oversaw resources and operational performance. 

1.2 Macondo Temporary Abandonment Activities: Four Phases

By April 20, 2010, the Macondo crew completed exploratory drilling activities at the well after 

discovering several potential oil and gas producing zones.42 This success meant that the Macondo well 

would likely be converted from an exploratory well to a producing one at some future date, so the 

Deepwater Horizon (DWH) crew began the process to temporarily abandon the well.43 

As part of this process, and before leaving the well site, the DWH crew pressure tested the well to ensure 

there were no leaks and the hydrocarbon bearing zones were sealed. After the crew successfully 

conducted a positive pressure test of the well,44 BP’s temporary abandonment plan called for a negative 

test45 followed by displacement of the drilling mud from the riser with seawater. For the human factors 

analysis, this chapter divides this process into four phases: 

• Presetting of the diverter system route;

• Displacement of the drilling mud from the drillpipe and upper wellbore; 

• Monitoring of pressure in the underbalanced well; and 

• Displacement of the riser.

Dividing the activities of the crew into these four phases provides an opportunity to explore the contextual 

framework in which the crew was operating, which changed with each phase. This chapter discusses the 

implications of this dynamic framework on the human factors that influenced the crew’s collective 

understanding of the real-time conditions of the well. 

 

41 Table 1-2 from Volume 1 of the CSB Macondo Investigation Report provides additional details on the personnel 

on board.

42 The CSB Macondo Investigation Report, Volume 1 details Macondo exploratory drilling activities.

43 A production facility would return later to extract the oil and gas from the well.

44 See Volume 1, Section 2.2.1 for more details about pressure testing a well. During a positive pressure test, a well 

is pressured up and then held in this condition to see if the pressure is maintained, indicating no leaks in the 

casing. If a decrease in pressure is observed, regulations require that either the well be re-cemented, the casing 

repaired, or additional casing installed to ensure the well is sealed. 

45 See Volume 1, Section 2.2.1 for more details about pressure testing a well. A negative pressure text simulates the 

underbalanced condition of the well upon abandonment by displacing some of the heavy drilling mud from the 

well and closing the BOP to isolate the bottom of the well from the hydrostatic pressure exerted by fluids above 

the BOP. 

000715
Macondo Investigation Report Volume 3 4/17/2016

27 

1.2.1 Phase 1: Presetting of the Diverter System Route 

The diverter system is one of the pieces of equipment on a drilling rig designed to limit oil and gas from 

inundating the rig floor during excessive flow46 from the riser by routing the well fluids to a safer 

location. Using a control panel, the Deepwater Horizon crew could preset the route to one of two 

locations (Figure 1-1), either the mud gas separator (MGS, an atmospheric separating vessel), located on 

the rig, or overboard. The standard preset route was to the MGS; this was the route preset on April 20, 

2010.47 In this configuration, if the crew wanted to change the route before or during an emergency, they 

needed to complete a multi-step process to divert overboard (additional details in Section 1.3). 

Figure 1-1. Control panel (left) and partial close-up of control panel on the Deepwater Horizon found in 

the driller’s cabin48 and on the bridge of the rig. These controls were used to preset the diverter. 

1.2.2 Phase 2: Displacement of the Drilling Mud from the Drillpipe and Upper 

Wellbore

During a negative test, the crew purposely underbalances the well to simulate the condition that will exist 

once the well is abandoned. Generally, the primary barrier used to prevent the flow of hydrocarbons (oil 

and gas) from the reservoir is a column of heavy fluid that fills the wellbore and the riser and essentially 

 

46 Excessive flow could be the result of a blowout or, if the BOP is closed, a release of gas from the riser. Initially, 

the Macondo explosion was the latter because the BOP successfully sealed the well just prior to the explosion 

occurring with the well blowout evolving after the initial explosion. See CSB Macondo Investigation Report, 

Volume 2, Section 2.5, p. 30 and Appendix 2-A, p 23.

47 Internal Company Documents, Transocean. Interview Final Memo, June 2, 3, 4, and 11, 2010, Interviews with 

Drillers, Assistant Drillers, OIM, TRN-INV-00000180, TRN-INV-00000698, TRN-INV-00002791, and TRNINV-00003448, TRN-I NV-00004242. The driller’s cabin, on the drill floor, contains the primary control panel. 

Hearing before the Deepwater Horizon Joint Investigation, May 26, 2010, p 19

48 The driller’s cabin, on the drill floor, contains the primary control panel. Hearing before the Deepwater Horizon 

Joint Investigation, May 26, 2010, p 19.

000716
Macondo Investigation Report Volume 3 4/17/2016

28 

“pushes” back on the hydrocarbons. When a well is abandoned, some of the fluid column is replaced with 

lighter sea water, and the well may become underbalanced, meaning the weight of the fluid column may 

not be sufficient to keep hydrocarbons from entering the wellbore. If the hydrocarbon bearing zones in the 

well are sealed by additional barriers (e.g., cement), the well will not flow despite being underbalanced. 

By simulating the underbalanced condition and observing the pressure in the well, the crew is able to test 

the integrity of the well in a controlled manner before removing the fluid column barrier. 

At Macondo, between 3:00 p.m. and 5:00 p.m., the crew displaced drilling mud from the drillpipe and 

upper wellbore by pumping a dense spacer49 material (Figure 1-2, left) followed by seawater to push the 

drilling mud out of the drillpipe and the upper wellbore.50 The intent was to move this mud and all of the 

spacer material until they were both above the BOP (Figure 1-2, right). Then they closed the BOP to 

isolate the well from the hydrostatic pressure51 generated by the liquids above the BOP. Had the crew 

suspected any problems with the well at the end of this activity, they had the option to open the blowout 

preventer to reestablish the drilling mud barrier in the well. 

 

49 As defined by Schulmberger Oilfield Glossary (http://www.glossary.oilfield.slb.com/Terms/s/spacer_fluid.aspx), 

“Any liquid used to physically separate one special-purpose liquid from another. Special-purpose liquids are 

typically prone to contamination, so a spacer fluid compatible with each is used between the two...Spacers are 

used primarily when changing mud types and to separate mud from cement during cementing operations.” 

Ultimately, cement could be negatively affected if it is contaminated by the synthetic based oil drilling mud.

50 There was also a small amount of freshwater used during displacement that is not depicted in Figure 1-2. See 

footnote 36 in Appendix 2-A of the Macondo Investigation Report Volume 2 for more detail.

51 Hydrostatic pressure is exerted by liquid at a given point as a result of the weight of the column of fluid above it. 

See Volume 1, Section 2.1 for more description. 

000717
Macondo Investigation Report Volume 3 4/17/2016

29 

Figure 1-2. On the left, the well as spacer material is pumped into the well, beginning to push drilling 

mud out of the riser. On the right, the intended well configuration for the negative test.

After closing the BOP, the crew released a predictable amount of trapped pressure in the well by bleeding 

fluid (seawater) from the drillpipe.52 

 

52 The trapped pressure is commonly illustrated using a u-tube model. See more details in Section 1.4 and Appendix 

2-A from Volume 2 of the CSB Macondo Investigation Report.

000718
Macondo Investigation Report Volume 3 4/17/2016

30 

1.2.3 Phase 3: Monitoring Pressure in the Underbalanced Well

The crew declares a negative test successful, assuming the hydrocarbon bearing zone at the bottom of the 

well has been sealed, after crewmembers observe no flow or pressure increase from the underbalanced 

well upon releasing the initial trapped pressure. Various methods are possible to accomplish the negative 

test; indeed, at least six negative test procedures were used on the DWH between August 2007 and April 

2010.53 They generally fell into two main categories: 

1. displacing the drillpipe with the pipe end no deeper than 500 feet below the sea floor (at Macondo 

the bottom of the drillpipe was approximately 3,000 feet below the seafloor);54 and 

2. displacing a choke/kill line, a pipe that runs from the BOP to the rig, with the blind shear rams of 

the BOP closed. 

Initial BP temporary abandonment plans for the Macondo well proposed displacing the kill line (Figure 

1-3, left).55 Under this configuration, only the kill line could be used to conduct a negative test, but BP 

determined this approach did not create enough underbalance pressure to simulate the abandonment 

condition of the well.56 Instead, BP determined that drillpipe needed to be lowered into the well to 

displace the upper wellbore with seawater to create the necessary underbalance conditions. Ultimately, 

the negative test procedure employed at Macondo actually displaced both the drillpipe and the kill line, 

enabling the crew to observe pressure from the underbalanced well from either the kill line or the drillpipe 

(Figure 1-3, right). 

 

53 Internal Company Document, Transocean. Memorandum: Investigation of the Negative Test and Riser 

Displacement Procedures (Preliminary Report), July 26, 2010, TRN-INV-00847616, see Exhibit 5007 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Roller_Perrin-Depo_Bundle.zip (accessed 

October 7, 2015).

54 Internal Company Document, BP. Form MMS - 124 Application for Permit to Modify, April 16, 2010, Temporary 

Abandonment Procedure, BP-HZN-MBI00127909, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-00570.pdf (accessed October 7, 

2015).

55 See Appendix 2-A, p 61, of CSB Macondo Investigation Report, Volume 2 for more details.

56 BP intended to set a surface cement plug at 3,300 feet below the seafloor which increased the necessary negative 

test requirement. Displacing the kill line created only 1,844 psi pressure differential while displacing the upper 

wellbore would simulate an underbalance pressure of 2,371 psi, see Appendix 2-A, Section G, pp 61-62.

000719
Macondo Investigation Report Volume 3 4/17/2016

31 

Figure 1-3. Initial negative test configuration for the Macondo well called for only displacing the kill line 

(left), but the final configuration had both the kill line and the drill pipe displaced with sea water. 

However, the actual conditions of the well after displacement did not match the plans and expectations of 

the crew. The spacer material used during the displacement of the drillpipe and upper wellbore was not 

fully pushed above the BOP, reducing the pressure that would appear on the kill line. Also, some spacer

was positioned across the kill line in the BOP, likely enabling the dense material to enter and plug the line 

(Figure 1-4). Section 1.4 explores the reasons for the under-displacement.

 

000720
Macondo Investigation Report Volume 3 4/17/2016

32 

 

Figure 1-4. Actual well conditions, with spacer positioned across the BOP, which likely 

lead to plugging of the kill line.

During the 3 hours between when the crew first closed the BOP to begin the negative test and they 

deemed the test successful, indicating the well was sealed, they observed pressures or flow from the 

drillpipe and the kill line four times. Pressure on the drillpipe rose after each of the four observations,57

 

57 CSB Macondo Investigation Report, Volume 2, Appendix 2-A; National Commission on the BP Deepwater 

Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The Gulf Oil Disaster; Feburary 17, 2011; pp 

147-159.

000721
Macondo Investigation Report Volume 3 4/17/2016

33 

but flow from the kill line eventually ceased. The zero flow from the kill line and zero pressure continued 

for 30 minutes, so the crew considered this as evidence that the well was sealed. 

1.2.4 Phase 4: Displacement of the Riser

Acceptance of the negative test as 

successful indicated the Deepwater 

Horizon crew believed the well had 

been sealed. The crew proceeded to 

open the BOP and displace the 

remaining drilling mud from the 

Macondo well in preparation of setting 

a surface cement plug.58 With the 

drilling mud removed (Figure 1-5), the 

open blowout preventer was the only 

physical barrier against flow into the 

well (a kick). The ability of the 

blowout preventer to act as this barrier 

was contingent upon human detection 

of the kick and timely activation of the 

BOP.

During the process of displacing the 

riser, a mixture of seawater, drilling 

mud, and hydrocarbons erupted onto 

the drilling rig, which the crew 

immediately tried to divert to the mud 

gas separator (MGS). Within a minute 

after diverting, mud overwhelmed the 

MGS and erupted out of it and multiple 

other locations. From the time well 

fluids released onto the deck until the 

first explosion, the crew had 9 minutes 

to understand what was happening, 

determine the best well control 

responses, and implement them.59 

 

58 Cement plugs are portions of cement put into a wellbore to seal it. “Surface” is typically used to refer to the 

shallowest cement plug used in a well. See Volume 1, Section 2.0 for more details.

59 CSB Macondo Investigation Report, Volume 2, pp 29-30 describes the sequence of well control actions completed 

by the crew.

Figure 1-5. During the final displacement of the well, the remaining 

drill mud above the drillpipe is replaced with seawater.

000722
Macondo Investigation Report Volume 3 4/17/2016

34 

1.2.5 Human Performance at Macondo

Within the four phases of temporary abandonment crew activity, this chapter analyzes a number of human 

performance actions (Table 1-2) to give context for the actions and decisions in the hours leading up to 

the incident and to explore potential mitigating approaches or controls. 

Table 1-2. Identified human performance actions/decisions during the four phases of temporary 

abandonment leading up to the blowout. 

PHASE OF CREW 

ACTIVITY

HUMAN PERFORMANCE ACTIONS AND DECISIONS OF 

INTEREST POST-INCIDENT

Phase 1: Preset of the 

Diverter System Route

The diverter system route was preset to flow out of the well to the Mud Gas 

Separator (MGS). Once well fluids erupted from the well onto the deck, the 

crew did not successfully complete the multi-step process necessary to 

reroute the well fluids overboard (Section 1.3). 

Phase 2: Displacement of the 

Drilling Mud from the 

Drillpipe and Upper 

Wellbore

The crew did not achieve the intended well conditions during the 

displacement of the drillpipe and wellbore; some spacer material remained 

below the closed BOP. The under-displacement likely led to plugging of the 

kill line, impacting pressure readings used by the crew to assess well 

integrity (Section 1.4). 

Phase 3: Monitoring 

Pressure in the 

Underbalanced Well

The crew incorrectly rationalized pressure and flow indicators observed 

from the kill line and the drillpipe during the negative test. Thus, they 

considered the well sealed (Section 1.5).

Phase 4: Displacement of the 

Riser

During completion of the displacement process, the well experienced an 

influx of reservoir fluid. For almost an hour, the crew did not detect 

hydrocarbons flowing into the well and eventually up the riser toward the 

rig (Section 1.6). 

000723
Macondo Investigation Report Volume 3 4/17/2016

35 

 

1.3 Phase 1 – Organizational Influence on Human Performance 

During drilling and completion activities at a well, gas and oil can pass above a BOP before it is closed. 

This creates a gas-in-riser event that can progress to a “riser gas blowout,” identified as such to indicate 

that the wellbore is sealed and the only source of gas is in the riser. This is a hazardous situation because 

riser gas migration toward the rig may be nearly undetectable and can rapidly change from a seemingly 

stable condition to an extremely high flow rate, releasing large amounts of gas on the drilling rig that can 

ignite and explode.60

For Macondo, the April 20, 2010, incident progressed from a gas-in-riser event ultimately to an 

uncontrolled blowout after the crew’s well control actions and the physical well barriers (e.g., the BOP 

and diverter system) were unable to mitigate the hazardous conditions created once hydrocarbons entered 

the riser. The BOP as a barrier is analyzed in Volume 2. The diverter system, analyzed here, was activated 

by the crew as well fluids released out of the riser onto the rig. The system was preset to route well fluids 

to the mud gas separator, rather than overboard; it was quickly overwhelmed and hydrocarbons blew onto 

the rig floor. Post-Macondo, Transocean now requires well operations crews to preset the diverter system 

 

60 For example, see the MMS Zapata Lexington report, U.S. Department of the Interior/Minerals Management 

Service. Investigation of September 1984 Blowout and Fire Lease OCS-G 5893, Green Canyon Block 69 Gulf of 

Mexico, Off the Louisiana Coast; OCS Report 86-0101; Minerals Management Service: 1986; 

http://www.bsee.gov/Inspection-and-Enforcement/Accidents-and-Incidents/Panel-Investigation-Reports/86-0101-

pdf/ (accessed October 7, 2015).

Doing What Made Sense at the Time

Some investigation reports described “significant” and “obvious” anomalies in the 

real-time data available to the crew during the hours leading up to the blowout with 

assertions or implications that the crew should have recognized and acted upon these 

anomalies. † But how obvious were these indicators? Any declarations of what the 

control system data indicated about the Macondo well were constructed from 

extensive post-incident modeling of the well flow conditions and with hindsight as to 

the consequences of each decision or action taken by the crew. In the moment, no one 

person would have had the benefit of such comprehensive knowledge. These 

individuals were doing what made sense to them at the time. Each individual’s 

understanding of the well conditions was shaped by a complex interplay between the 

various communication tools used to share information about the well (verbal 

communications, control board systems, procedures) and the individual’s knowledge, 

experience, judgment, and biases.

† BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; pp 42; National 

Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water: The Gulf Oil 

Disaster and the Future of Offshore Drilling; 2011; pp 115, 177-179.

000724
Macondo Investigation Report Volume 3 4/17/2016

36 

route overboard,61 thus removing aspects of manual human intervention with an engineering control. 

However, the organizational decision to preset the diverter route to overboard increases the likelihood of 

discharges into the sea that might otherwise have been controlled through use of the MGS. Therein lies a 

risk to drift back to the original practice as, over time, the rig operator receives environmental penalties 

for discharges that, with hindsight, are determined to have been preventable. Furthermore, the decision to 

eliminate the manual intervention requirement does not fully resolve an underlying hazard for a diverter 

system to fail under high load even if it has been reset to direct well fluids overboard. Ultimately, as this 

section shows, there is a danger of inappropriately placing blame on human performance for a technical 

problem the offshore industry does not fully understand. 

Through an examination of the diverter system design and the evolution of its purpose and use offshore, 

this section demonstrates that unrealistic expectations were placed on the crew to send well fluids 

overboard once they entered the riser. Furthermore, a review of the actions of the Deepwater Horizon 

crew illustrates the strong influence that organizational policies, historic operational practices, and 

technical design have on human performance, including: 

• The economic and regulatory consequences for diversion of well fluids overboard; 

• The operational decision to preset the diverter system route to send flow from the well to the 

MGS, which was standard practice for Transocean and occurred far before the temporary 

abandonment activities commenced; 

• The design of the diverter system and the multi-step process to redirect well fluids overboard; 

• The reliance by all involved parties on the subjective judgment of the well operations crew to 

determine whether the well flow would be too great for the MGS to handle; and 

• The time available to the crew to respond in a chaotic and stressful situation. 

1.3.1 Diverter Dual Role: Operational and Emergency Mitigation Device 

During drilling and completion operations, drilling fluids returning from the well are routed to a variety of 

equipment so that they may be processed and recycled for future drilling. As part of that process, the 

diverter system can direct well fluids containing flammable gas to the MGS where the gas is segregated 

from the drilling mud and vented away from the drill floor (Figure 1-6).62 This might occur, for instance, 

in response to a well kick that the BOP has contained. The influx is then circulated though the MGS, a 

standard practice acknowledged in both BP and Transocean well control manuals.63 Less frequently, the 

 

61 Internal Company Document, Transocean. Well Control Handbook, Issue HQS-OPS-HB-01, Revision 00, July 22, 

2011, Handling Gas in the Riser, Exhibit 5781, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Braniff_Barry-Depo_Bundle.zip (accessed 

October 7, 2015). 

62 Internal Company Document, Transocean. Well Control Handbook, Revision 01, HQS-OPS-HB-01, March 31, 

2009, Well Control Equipment, BP-HZN-2179MDL0033106, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf (accessed October 7, 

2015).

63 Ibid., BP-HZN-2179MDL00330980.; Internal Company Document, BP. Well Control Manual: Volume 2 

Fundamentals of Well Control, Issue 3, BPA-D-002, 2000, Mud Gas Separator, pp 6-4-3, BP-HZN2179MDL00336730. See Exhibit 2390 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Frazelle_Andrew-Depo_Bundle.zip

(accessed October 7, 2015). 

000725
Macondo Investigation Report Volume 3 4/17/2016

37 

diverter system is also used as an emergency mitigation system meant to limit the amount of oil and gas 

inundating the rig floor from a riser gas event by directing the well flow overboard, thus minimizing the 

chance that flammable gases could find an ignition source on the rig.64 

Figure 1-6. The diverter system on a rig can be routed to direct well fluids containing flammable gas to 

the mud gas separator (green) so that gas can be vented away from rig floor or drilling fluids can be 

directed routed overboard (red).

 

64 Internal Company Document, BP. Well Control Manual: Volume 2 Fundamentals of Well Control, Issue 3, BPAD-002, December 2000, Blowout Preventer Equipment, BP-HZN-2179MDL00336706, see Exhibit 2390

http://www.mdl2179trialdocs.com/releases/release201302281700004/Frazelle_Andrew-Depo_Bundle.zip.; 

Internal Company Document, Transocean. Well Control Handbook, Revision 01, HQS-OPS-HB-01, March 31, 

2009, Equipment for Handling Gas in the Riser, BP- BP-HZN-2179MDL00330974, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf (accessed October 7, 

2015). 

000726
Macondo Investigation Report Volume 3 4/17/2016

38 

1.3.2 Organizational Policy and Practice Influence Human Performance 

Transocean’s Well Control Handbook (2009) at the time of the incident did not identify criteria for 

determining the diverter route during various well operations, and the handbook remained neutral on the 

preferred route.65 Historically, Deepwater Horizon rig personnel reported that use of the diverter system 

to send well fluids overboard was rarely, if ever, needed because the MGS successfully handled previous 

well control situations,66 and that the mud gas separator route was the standard arrangement on the 

Deepwater Horizon.67 

Diverting overboard has a number of consequences. For one, drilling mud is expensive and on-site mud 

supplies may be limited, so use of the MGS allows salvaging the mud.68 Also, discharging oil-based 

drilling mud overboard is legally restricted by both the EPA and BOEM, so sending material into the 

ocean can result in a citation for violating environmental regulations.

69 This well-known consequence was

one that crewmembers knew to avoid where possible.70 Such knowledge applies pressure on the well 

operations crew to default toward avoiding the higher probability environmental risk rather than the low 

probability, but high consequences of overwhelming the MGS. 

MGSs are designed to handle the circulated fluids and gas contained by a BOP in response to a well kick, 

and the diverter is intended to redirect manageable influxes of well fluids, not a blowout. Alignment of a 

diverter is a matter of (a) rig configuration, which is inherent to the rig selected by the oil company 

operator for a particular campaign, and (b) a well’s risk assessment, which the oil company operator 

 

65 Transocean Well Control Handbook: “If the riser is flowing, divert the flow overboard. If so equipped, the flow 

can be diverted through a gas handling system or MGS,” and “if the flow rate increases, be prepared to open up 

the diverter line to send the mud overboard.” Internal Company Document, Transocean. Well Control Handbook, 

Revision 01, HQS-OPS-HB-01, March 31, 2009, BP-HZN-2179MDL00330975 and BP-HZN2179MDL00330976, http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf

(accessed October 7, 2015).

66 CSB interview; National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling interview.

67 Internal Company Documents, Transocean. Interview Final Memo, June 2, 3,4, and 11, 2010, Interviews with 

Drillers, Assistant Drillers, OIM, TRN-INV-00000180, TRN-INV-00000698, TRN-INV-00002791, and TRNINV-00003448, TRN-I NV-00004242.

68 Internal Company Document, BP. Well Control Manual: Volume 2 Fundamentals of Well Control, Issue 3, BPAD-002, December 2000, Mud Gas Separator, see Exhibit 2390, BP-HZN-2179MDL00336730, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Frazelle_Andrew-Depo_Bundle.zip. 

69 30 C.F.R. 250.300 Pollution Prevention; 30 C.F.R. 122 EPA Administered Permit Programs: The National 

Pollutant Discharge Elimination System; see also Memorandum of Understanding Between the Environmental 

Protection Agency and the Department of the Interior Concerning the Coordination of NPDES Permit Issuance 

with the Outer Continental Shelf Oil and Gas Lease Program 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Publications_Library/001_1984-MOU.pdf (accessed 

Feburary 26, 2016). 

70 Internal Company Document, Transocean. Interviewing Form: OIM, October 13, 2010, TRN-INV-00001864, see 

Exhibit 3801 http://www.mdl2179trialdocs.com/releases/release201304041200022/Harrell_JimmyDepo_Bundle.zip (accessed October 7, 2015). National Commission on the BP Deepwater Horizon Oil Spill and 

Offshore Drilling interview.

000727
Macondo Investigation Report Volume 3 4/17/2016

39 

develops to address a geotechnical risk assessment.71 Well control procedures should address predicted 

exit flow rates from kick scenarios in the well’s risk assessment to avoid overwhelming the MGS. 

Transocean’s 2009 well control handbook indicates it is “essential to verify that the [mud gas separator] 

system is capable of handling the maximum amount of fluid and gas that could be produced by the well in 

the case of a severe kick. The relevant information of the well to be drilled should be obtained from the 

Operator and should be compared to the system capacity according to the Company [Transocean].”72 

MGSs are not usually designed for the fluid and gas that occur from a riser gas event or blowout, largely 

because those rates can be impractically large. In reality, limited information is available to the crew to 

discern when a situation exceeds the MGS capabilities or how quickly the situation may progress. (See 

Section 1.3.4 for more detail.) The Transocean well control handbook in effect at the time of the Macondo 

blowout implied that the crewmembers should observe the riser flow and that they would have sufficient 

time to react to a potentially hazardous situation: “if the riser is flowing [as the result of a kick], divert the 

flow overboard. If so equipped, the flow can be diverted through a gas handling system or MGS ... If the 

flow rate increases, be prepared to open up the diverter line to send the mud overboard.”73

The dual purpose of the diverter system and internal Transocean diverter/MGS policy created a 

significant human factors dilemma for the Deepwater Horizon crew. They were placed into a position of 

deciding if a gas-in-riser event was controllable, if the MGS could safely separate flammable gas from the 

well fluids, if the situation exceeded the capabilities of the system, and if they needed to divert mud 

overboard. 

Training strongly influences responses in emergency situations. The Transocean Well Control Handbook 

required each crew to conduct a diverter drill at the beginning of every tour to “improve the crew’s 

reaction time and prove the operation of all diverter system equipment.”74 However, a senior Transocean 

toolpusher from the Deepwater Horizon stated he was unaware of any drills to simulate gas in the riser 

and the required decision-making response, including changing the diverter flow path.75 As previously 

stated, testimony from DWH personnel suggests that training and typical practice emphasized well fluid 

diversion through the MGS. An Assistant Driller with Transocean for 6 years and with over 23 years 

offshore experience reported that he was taught to always divert to the MGS if mud came out of the riser 

before diverting overboard and to do this only if the MGS became overwhelmed.76 

 

71 The Australian offshore regulator provides useful guidance on well risk assessments 

http://www.nopsema.gov.au/assets/Guidance-notes/GN1602-Well-operations-management-plan-content-andlevel-of-detail-Rev-0-December-2015.pdf (accessed Feburary 26, 2016).

72 Internal Company Document, Transocean. Well Control Handbook, Revision 01, HQS-OPS-HB-01, March 31, 

2009, Well Control Equipment, BP-HZN-2179MDL00331068, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf (accessed October 7, 

2015). 

73 Ibid., Specific Environments, BP-HZN-2179MDL00330976. 

74 Ibid., Preparation and Prevention, BP-HZN-2179MDL00330825. 

75 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 5, 2013 pp 1894-95, 

http://www.mdl2179trialdocs.com/releases/release201303051200006/2013-03-05_BP_Trial_Day_6_PMFinal.pdf (accessed October 7, 2015). 

76 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling interview. 

000728
Macondo Investigation Report Volume 3 4/17/2016

40 

Yet gas-in-riser is a hazardous situation because riser gas migration toward the rig may be nearly 

undetectable in the early stages and can rapidly change from a seemingly stable condition to an extremely 

high flow rate, resulting in a release of large amounts of gas on the drilling rig that can ignite and 

explode.77 BP’s well control manual cautions: 

“Free gas in the riser represents one of the most dangerous situations on a rig from a standpoint of 

personnel safety... [A] small influx of free gas can expand as it approaches the surface to produce 

very significant gas volumes at surface. History has shown that this gas could unload violently as 

it approaches the surface...It is not out of the realm of possibilities that this slow migration of gas 

in the riser could go unnoticed as the other activities are taking place, and the gas will begin to 

unload before anyone notices it. These conditions are the most dangerous.”78

The Macondo blowout demonstrates that such a situation can quickly evolve into a dire emergency 

because, while gas flowed into the well for almost an hour without detection, only minutes passed 

between when it entered the riser and drilling mud shot across and above the drill floor.79 Add to that 

crisis the crew’s scant experience in sending well fluids overboard due to the rarity of riser gas events,

80

as well as the trained habit and actual practice to initially send fluids and gas to the MGS. 

 

77 For example, see the MMS Zapata Lexington report, U.S. Department of the Interior/Minerals Management 

Service. Investigation of September 1984 Blowout and Fire Lease OCS-G 5893, Green Canyon Block 69 Gulf of 

Mexico, Off the Louisiana Coast; OCS Report 86-0101; Minerals Management Service: 1986; 

http://www.bsee.gov/Inspection-and-Enforcement/Accidents-and-Incidents/Panel-Investigation-Reports/86-0101-

pdf/ (accessed October 7, 2015).

78 Internal Company Document, BP. Well Control Manual: Volume 2 Fundamentals of Well Control, Issue 3, BPAD-002, December 2000, Blowout Preventer Equipment, BP-HZN-2179MDL00336706, see Exhibit 2390 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Frazelle_Andrew-Depo_Bundle.zip. 

79 CSB Macondo Investigation Report, Volume 2, pp 29-30. 

80 CSB Interview: National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling interviews.

000729
Macondo Investigation Report Volume 3 4/17/2016

41 

1.3.3 Diverter System Design Required Multi-Step Process to Divert Fluids 

Overboard 

With presetting the Deepwater Horizon diverter flow to the MGS, the system design required the crew to 

take a two-step action to send flow overboard. 

Diverter Safety System Adapted for Operational Purposes – An Example of Organizational Drift 

Use of the diverter as an operational tool for routing drilling fluids to the MGS was a secondary 

development to its original design purpose of diverting well fluids and gas overboard during shallow 

gas blowouts. 

A recommendation in the early 1980s was to develop a dedicated additional device, now commonly 

called a “riser gas handler,” for installation below the telescopic joint at the top end of the riser. This 

location was chosen to avoid subjecting surface equipment (e.g., slip joint seals, diverter seals) to 

pressures that would exceed their design capabilities.

a, b This device was not intended to divert a well 

blowout fueled by a formation in the well, but to safely handle gas that had gotten into the riser above 

a closed BOP. In this manner, the riser gas handler allows for the circulation of a gas-in-riser event to 

a mud pit on the rig rather than diverting the riser fluids overboard. However, the riser gas handler 

has had only limited acceptance, and has been installed on few rigs. 

Years later came the recognition that a system capable of circulating the well fluid/mud through the 

MGS to remove small amounts of gas would allow for salvaging of the expensive drilling mud and 

would reduce environmental releases. The diverter system was then adapted to achieve this purpose. A 

line was installed upstream from the diverter line outlet valve, permitting mud from the riser to 

circulate through the MGS to remove residual gas. The diverter system aboard the Deepwater 

Horizon matched this design. 

Post-incident, the Norwegian Oil Industry Association (OLF) recommended eliminating the use of the 

diverter as a tool for routing drilling fluids to the MGS.

c

 To eliminate the possibility of overloading 

the MGS, OLF specifically recommended updating language of its relevant standard [Norsok D-001] 

to clarify that the diverter system’s function is safety and that it is designed to handle gas in the riser 

above the BOP by routing all hydrocarbons overboard and, ideally, downwind. As such, OLF 

recommended that any connection between the diverter system and the MGS should be designed out of 

the system, except for possibly a connection from the downstream end of the choke manifold to the 

MGS. Others followed suit, resurrecting the riser gas handler approach.b

a Hall, J. E.; Roche, J. R. Diverter for deepwater drilling risers permits kick control; Oil & Gas Journal 1985, pp 116-119. 

b E.g., Kozicz, J. R. Development of a marine riser gas managment system; Society of Petroleum Engineers 2012, January. 

c Norwegian Oil Industry Association (OLF). Deepwater Horizon Lessons learned and follow-up; May, 2012; 

Reccomentation no. 8, p 16. 

000730
Macondo Investigation Report Volume 3 4/17/2016

42 

The crew could use the diverter system from one of three locations: a Diverter Control Panel on the drill 

floor,81 a Driller Control Panel in the driller’s cabin,82 and a duplicate of the Driller Control Panel, called 

the OIM Control Panel, on the bridge.83 While the drill floor diverter control panel used toggle switches, 

the driller, who has primary responsibility for well control operations from the driller’s cabin, 84 and the 

OIM control panels used pushbuttons. As indicated in Figure 1-7, at the top left of the panels were three 

sets of pushbuttons to select: 

• the overboard flow path (starboard, portside, or both); 

• the overboard or MGS flow path; and 

• an open or closed position of the diverter.85 

Figure 1-7. Control panel and partial close-up of control panel on the Deepwater Horizon found in the 

driller’s cabin and on the bridge of the rig. 

 

81 Cameron Controls, Assembly, Diverter Control Panel, Sheet 1 of 6, Drawing No. SK-122358-21-04, Rev D01, 

March 23, 2000.

82 The driller’s cabin, shack, or doghouse (as it is informally called) was located on the drill floor; this location was 

where the drillers and assistant drillers monitored and controlled well conditions through control system panels 

that they could manipulate to operate various drilling equipment, including the BOP and diverter. Information on 

the Driller Control Panel can be found here: Cameron Controls, Assembly Drawing, Driller Control Panel, Sheets 

2 and 4 of 11, Drawing No. SK-122106-21-04, Rev F01, January 7, 2000.

83 Cameron Controls, Assembly Drawing, Toolpusher Remote Control Panel, Sheets 2 and 4 of 11, Drawing No. SK122107-21-04, Rev E01, May 16, 2000.

84 Hearing before the Deepwater Horizon Joint Investigation, May 26, 2010, p 19. 

85 These buttons were actually hydraulic fluid switches, meaning they physically redirected the flow of hydraulic 

fluid to manipulate the position of the diverter. Pushing the ‘VENT’ button for the diverter packer seen in Figure 

1-7 removes hydraulic pressure from the diverter packer. 

000731
Macondo Investigation Report Volume 3 4/17/2016

43 

When the diverter was closed, the system always maintained an open pathway, either overboard or to the 

MGS to not shut in the pressure from the well. This route was chosen by selecting either OVERBOARD 

or VERTICAL MGS (Figure 1-8). 

Figure 1-8. Control Panel Pushbuttons to preset route to MGS or overboard. 

Regardless of which vent pathway was opened (overboard or vertical MGS), one of the OVERBOARD 

SELECTOR/PRESELECT pushbuttons would remain lit (Figure 1-9), as it indicated only the preselection of the overboard valves that would open if the OVERBOARD button were subsequently 

selected.

 

Figure 1-9. Control Panel Pushbuttons to preselect the overboard route. 

Thus, pressing the OVERBOARD button would close the diverter and fluids would flow through either 

the portside, starboard, or both overboard lines as determined by the OVERBOARD 

SELECTOR/PRESELECT pushbuttons. 

This design is not ideal from a human factors perspective, as a crewmember could hit the one button that 

closes the diverter but miss the second step of changing the diverter route from MGS to overboard. Sound 

human factors engineering design suggests that opportunities for omission (skipping of steps) be designed 

000732
Macondo Investigation Report Volume 3 4/17/2016

44 

out of a system when possible.86 Adding an automated feature to the diverter control system is one way to 

achieve this goal. At least one Deepwater Horizon Well Site Leader believed the diverter had an 

automated function that would divert flow overboard upon detection of increased pressure within the 

MGS,87 a design used on other rigs in the Gulf of Mexico.88 However, post-incident analysis revealed that 

the Deepwater Horizon diverter did not have such functionality.89

Because the individuals who activated the diverter system did not survive the incident, no one can 

sufficiently explore whether this design hindered performance of the well operations crew on the day of 

the Macondo blowout. A draft 2002 Transocean Deepwater Horizon procedure for using the diverter 

when gas is in the riser lists 10 steps in addition to activating the control system buttons to send flow 

overboard, including stipulations that the crew must fully shut in the well, determine wind direction,90 and 

call the Bridge to verify wind direction and clear boats from the discharge location.91 Whether this 

procedure was meant to be used on the day of the incident, the speed at which a gas-in-riser event can 

evolve makes following a 10-step procedure unrealistic. 

From a human factors perspective, the question operators and drilling contractors need to ask is: how 

reliable is the human action to change the diverter location during reasonably anticipated emergency 

scenarios, such as a riser blowout? The speed at which a gas-in-riser event can evolve implies that crews 

may simply not have time to assess a situation before it is already out of control. Perhaps even more 

fundamental, consider Transocean’s observation concerning diverting fluids from the Macondo blowout 

overboard: “it is impossible given the magnitude of the blowout to know if the diverter packer would 

have kept flow diverted overboard and if the gas ignition could have been prevented.”92 It is impossible to 

a large degree because no adequate engineering tools/software exist to model the complex gas migration 

and 2-phase flow of gas and liquids in a riser.93 And various industry tests have given inconsistent results, 

 

86 HSE. Inspectors Toolkit: Human Factors in the Management of Major Accident Hazards; October, 2005, p 14. 

http://www.hse.gov.uk/humanfactors/topics/toolkit.pdf (accessed January 15, 2016).

87 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling interviews.

88 CSB Interview; National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling interview.

89 Internal Company Document, Transocean. Investigations: Mud Gas Separator Control, Janurary 14, 2011, TRNINV-03405410.

90 If the decision was to divert overboard, the operator had to choose which side would be best to divert (based on 

wind direction), and then redirect the diverted flow away from the MGS and over the side chosen. However, with 

dynamically positioned (DP) rigs, such as the Deepwater Horizon, the side chosen is less of an issue, as the DP 

system maintains the rig’s position so that it is headed into the wind. Thus, deciding which side to divert would be 

less of an issue; in fact, the preference would be to choose the both-sides option. 

91 Internal Company Document, Transocean. Deepwater Horizon Dverter Procedure with Gas in Riser, TRN-I NV00697095 attachement to Email from Deepwater Horizon OIM, Transocean, to Deepwater Horizon Toolpusher, 

Transocean, Subject: Horizon Dovierter Procedure, June 3, 2002, TRN-I NV-00697094. 

92 Transocean. Macondo Well Incident: Transocean Investigation Report Volumes I; June, 2011, p 193. 

93 Sonnenmann, P. IADC workgroup conducting studies to better understand, manage gas-in-riser events. Drilling It 

Safely, July 9, 2015, http://www.drillingcontractor.org/iadc-workgroup-conducting-studies-to-better-understandmanage-gas-in-riser-events-35793 (accessed October 7, 2015).

000733
Macondo Investigation Report Volume 3 4/17/2016

45 

highlighting the complexity of the phenomenon.94 Safety or performance concerns of existing riser gas 

handling designs should be identified, corrected, and reconciled. 

Ultimately, it would be unfair to cast blame on the Deepwater Horizon crew for diverting to the mud gas 

separator when the diverter system might have failed regardless. Post-Macondo, Transocean now requires 

well operations crews to preset the diverter system route overboard,95 thus removing aspects of manual 

human intervention with an engineering control. Considering the design limitation of the diverter system, 

a solution such as this, meant to remove the ‘choice’ to divert overboard, may actually lead to a false 

sense of security when in fact that hazard remains. This problem highlights the need for a hazard analysis 

that correctly identifies the uncertainty of the gas in the riser scenario.

1.3.4 Needed Improvements in Detecting Gas Influx Prior to Reaching Riser 

The decision to send flow overboard assumes the crew detects gas in the riser and recognizes when the 

gas volume will not exceed the rig’s surface handling capability (e.g., diverter system, mud gas 

separator). Such predictions are a challenge, as evident by Macondo and other incidents discussed below. 

Generally, it is not possible to predict surface flow rates of a gas-in-riser event, a necessary parameter for 

determining when to unload overboard.96 Any gas that enters into the riser can migrate toward the drilling 

rig, much as a bubble rises in water. The rate of migration depends on many factors and cannot be reliably 

predicted or even readily detected until the gas nears the surface. A gas bubble may disaggregate into a 

harmless foam, but it can also become unstable and rapidly erupt onto the rig floor. How severely 

depends on the size of the original bubble, or the amount of dissolved gas in the oil or oil-based mud. In a 

severe case, it may overload a closed surface diverter system. This tragically happened at Macondo, 

where the contents of the 5,000-foot riser (calculated to be initially 20-50% full of gas and oil, or more) 

erupted onto the rig floor only 2-3 minutes after the BOP was sealed.97 

 

94 Hauge, E.; Godhavn, J. M.; Molde, D. O.; Cohen, J. H.; Stave, R. S.; Toftevaag, K. R. Analysis of Field Trial Well 

Control Results with a Dual Gradient Drilling System, Offshore Technology Conference 2015, Houston, TX, May 

4-7, 2015; OTC-26056-MS.; Tarvin, J. A.; Hamilton, A. P.; Gaynord, P. J.; Lindsay, G. D. Gas Rses Rapidly 

Through Drilling Mud, IADC/SPE Drilling Conference, Dallas, TX, Fedbruary 15-18, 1994; IADC/SPE 27499.; 

Gonzalez, R.; Shaughnessy, J.; Grindle, W. Industry Leaders Shed Light on Drilling Riser Gas Effects; Oil & Gas 

Journal 2000, July 17, pp 42 - 46.; Johnson, A.; Rezmer-Cooper, I.; Bailey, T.; McCann, D. Gas Migration: Fast, 

Slow, or Stopped, SPE/IADC Drilling Conference, Amsterdam, February 26, 1995; SPE/IADC 29342.

95 Internal Company Document, Transocean. Well Control Handbook, Issue HQS-OPS-HB-01, Revision 00, July 22, 

2011, Handling Gas in the Riser, Exhibit 5781, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Braniff_Barry-Depo_Bundle.zip (accessed 

October 7, 2015).

96 Sonnenmann, P. IADC workgroup conducting studies to better understand, manage gas-in-riser events. Drilling It 

Safely, July 9, 2015, http://www.drillingcontractor.org/iadc-workgroup-conducting-studies-to-better-understandmanage-gas-in-riser-events-35793 (accessed October 7, 2015).

97 CSB Macondo Investigation Report, Volume 2, Appendix 2-A, pp 6, 21, 23.

000734
Macondo Investigation Report Volume 3 4/17/2016

46 

In a separate riser unloading98 event that occurred a little over a year before the Macondo incident on a 

Transocean semi-submersible off the coast of West Africa,99 issues arose concerning the use of the 

diverter while gas was in the riser. Similar to Macondo, the crew did not detect the situation until mud 

and gas began releasing out of the riser onto the rig. However, in this instance, the crew was able to shut 

in the well and the gas vented and dispersed before it found an ignition source. 

In December 2009, the Transocean-owned rig, Sedco 711, also experienced a riser blowout; well ingress 

went undetected by the crew until hydrocarbons were releasing onto the rig. However, similar to the West 

Africa incident, the crew was able to close the well and the released flammable material did not ignite.100

(Chapter 2.0 discusses these incidents in more detail.) Transocean identified riser unloading events as “the 

biggest concern” when identifying areas for well control improvement.101 And with wells being drilled in 

deeper water, the requisite riser length continues to increase, suggesting the increased potential for severe 

riser unloading if gas flows above the BOP. The well operations crew needs tools to understand well 

conditions before a riser unloading situation develops. Yet these incidents demonstrate the challenges to 

detecting hydrocarbon ingress into the well before the gas enters the riser. 

 

98 The sudden and uncontrolled release of the riser contents (e.g., drilling mud, gas, etc.) onto the rig caused by 

expanding gas in the riser.

99 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 19, 2013 p 4593, 

http://www.mdl2179trialdocs.com/releases/release201303191200014/2013-03-19_BP_Trial_Day_14_AMFinal.pdf (accessed October 7, 2015).; Internal Company Document, Transocean. EAU Incident Investigation 

Report - M.G. Hulme, Jr. Well Control Incident - Riser Unloading, OER-MGH-09-005, March 26, 2009, TRNINV-01143039, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05650.pdf (accessed 

October 7, 2015).

100 Internal Company Document, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, TRNMDL-02840790, see Exhibit 5749 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015). 

101 Internal Company Document, Transocean. Annual Report - 2009 Well Control Events & Statistics 2005 to 2009, 

p 7, TRN-INV-00760060, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05649.pdf

(accessed May 22, 2015).

Free Gas in the Riser Recognized by BP as “Most Dangerous” to Rig Personnel in 

the Gulf of Mexico

“As is intuitively obvious, the possibility of free gas getting into the riser in very 

deepwater locations is quite high and is probably the one event that is most 

dangerous to rig floor personnel. This is of particular concern in the Gulf of Mexico 

due to the preponderance of shallow geopressured formations.”†

†

Internal Company Document, BP. Well Control ManualV of Well Control, Issue 3, BPA-D-002, 

December 2000, Blowout Preventer Equipment, BP-HZN-2179MDL00336706, see Exhibit 2390

http://www.mdl2179trialdocs.com/releases/release201302281700004/Frazelle_AndrewDepo_Bundle.zip/

000735
Macondo Investigation Report Volume 3 4/17/2016

47 

Appendix 2-A of Volume 2 discusses the existence of two BOP pressure transducers on the Deepwater 

Horizon BOP that could have allowed the crew to cross-check the conflicting pressure readings between 

the drillpipe and the kill line. While it is not known if they were functional or used on the day of the 

incident, they were used during well control operations the previous month.102 Neither the BP nor the 

Transocean well control manual referenced their use in operations and there were no signal processing or 

alarms associated with the sensor data.103 If these sensors are incorporated into well monitoring activities, 

they (or similar other devices) may provide early indication of gas entering the riser. 

Macondo and other delayed kick detection incidents support the need for improvements in kick detection 

capabilities and assessments of the reliability of those capabilities during emergency situations. Indeed, 

riser unloading events, while not common, are serious near-misses and can result in rig and environmental 

damage, as well as death.104 As such, the CSB recommends industry further study riser gas unloading 

scenarios, testing, and modeling to improve understanding of this behavior and better manage the risk of 

large riser gas events.

1.4 Phase 2 – Seemingly Insignificant Decisions can have Great 

Impact in Complex Systems

In the previous section, examples from Macondo demonstrate the impact of organizational policies and 

practices on human performance. This section explores another characteristic of complex highlyinterconnected systems—how minute indiscriminate decisions and behaviors of apparently no 

consequence when performed individually can coalesce into an unanticipated outcome.105 Put another 

way, local decisions can have global impact.106 At Macondo, introducing spacer material into the well and 

inadvertently placing it across the kill line of the BOP may have led to plugging of the kill line during the 

negative test, causing the zero pressure reading that the crew accepted as indication of a secure well.107 In 

the moment, local decisions and actions taken by rig personnel and management pertaining to initial 

displacement may have seemed inconsequential, but they contributed to the positioning of the spacer 

across the kill line in the BOP: 

 

102 Bureau of Ocean Energy Management, Regulation, and Enforcement. Report Regarding the Causes of the April 

20, 2010, Macondo Well Blowout: Volume II Appendices; 2011; pp F-57 to F-61.

103 CSB Macondo Investigation Report, Volume 2, Appendix 2-A, pp 5, 39-40.

104 See Chapter 2 and U.S. Department of the Interior/Minerals Management Service. Investigation of September 

1984 Blowout and Fire Lease OCS-G 5893, Green Canyon Block 69 Gulf of Mexico, Off the Louisiana Coast; 

OCS Report 86-0101; Minerals Management Service: 1986; http://www.bsee.gov/Inspection-andEnforcement/Accidents-and-Incidents/Panel-Investigation-Reports/86-0101-pdf/ (accessed October 7, 2015).

105 This phenomenon is a “routine byproduct of the characteristics of the complex system itself.” Dekker, S. Drift 

into Failure: From Hunting Broken Components to Understanding Complex Systems; Ashgate Publishing: 

Burlington, VT, 2011; pp 14 & 159. 

106 Dekker, S. Drift into Failure: From Hunting Broken Components to Understanding Complex Systems; Ashgate 

Publishing: Burlington, VT, 2011; pp 158-172. 

107 BP Report, Appendix Q, 3: concluded “Solids from the spacer could have plugged the kill line, or the viscosity or 

gel strength of the spacer could have been too high to allow pressure to be transmitted through the kill line.” 

000736
Macondo Investigation Report Volume 3 4/17/2016

48 

• Onshore BP personnel chose an unusual spacer type and used a large volume when displacing 

drilling mud from the riser to avoid hazardous waste management fees and environmental 

penalties. 

• BP did not perform a risk assessment of the atypical spacer before its use; while conduct of risk 

assessment in itself does not guarantee that the risks will be managed, the act of conducting a risk 

assessment provides the opportunity for identification and control of those risks. 

• The morning of the displacement, one of the BP Well Site Leaders on the rig and an onshore BP 

Drilling Engineer requested a well fluids specialist, a third-party contractor, to prepare the 

displacement procedure based upon previous displacements conducted on the rig. No others 

played a role in developing the procedure, no pressure and volume parameters were identified to 

gauge successful completion of the procedure, and no effective verification for accuracy of the 

procedure occurred before it was rolled out to the crew.

• As was customary, a drilling fluids specialist from M-I SWACO assumed the Horizon’s pump 

efficiency was 96.1%, but the actual pump efficiency was closer to 90%, resulting in a smallerthan-planned volume of sea water to be pumped into the well. 

• During troubleshooting efforts for the negative test, the Deepwater Horizon crew noticed that the 

riser was not full; a judgment was made that an annular preventer was leaking and the crew 

mitigated the perceived problem. 

The independent local decisions regarding hazardous waste management, the informal and casual 

procedural development for the displacement process, and the judgment made concerning the riser fluid 

level seemed inconsequential to the successful completion of the temporary abandonment process, but 

with hindsight these decisions clearly had significant ramifications for the temporary abandonment. 

BP chose to use Lost Circulation Materials (LCM)108 as the spacer material between the drilling mud and 

the sea water to displace the mud from the well.109 By doing so, BP was able to discharge the 450 barrels 

of leftover LCM overboard without environmental legal obligations and removed any need to pay for its 

disposal onshore.110 The company never tested the LCM material for this application, had no operational 

reason for using it, and not assess the potential risks of using this spacer. Similar to routing the diverter 

line to the MGS, management was influenced by the potential risk of regulatory environmental penalties, 

which dictated the actions of the crew. 

On the morning of April 20, 2010, a drilling fluids specialist from M-I SWACO111 on the Deepwater 

Horizon received two different calls from a BP Well Site Leader and a BP Drilling Engineer to discuss 

 

108 Lost Circulation Material (LCM) is a class of drilling fluids designed to plug the fractured walls in the wellbore 

so that drilling mud is not lost into the formation.

109 E.g., Volume 1, p 27; Transocean. Macondo Well Incident: Transocean Investigation Report Volumes I and II; 

June, 2011; p 28.; National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief

Counsel's Report: The Gulf Oil Disaster; Feburary 17, 2011; p 147.

110 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The 

Gulf Oil Disaster; Feburary 17, 2011; p 151, The Chief Counsel’s Report noted that BP would avoid hazardous 

waste disposal obligations stipulated by the Resource Conversation and Recovery Act.; Hearing before the 

Deepwater Horizon Joint Investigation, July 19, 2010, pp 67, 79, 90.

111 As a drilling fluids specialist, he was in charge of the properties of the drilling fluids, maintaining an inventory of 

what the rig had, and communicating what the rig would need. The drilling fluids specialist would also mix lost 

000737
Macondo Investigation Report Volume 3 4/17/2016

49 

the displacement procedures the crew had been using to conduct its negative tests.112 The drilling engineer 

conveyed that they would be displacing the well more than normal, so the fluids specialist wrote a 

procedure that included the details he had been communicated (Table 1-3). At a 3:00 p.m. pre-job safety 

meeting (also referred to as a THINK drill),113 the fluids specialist reviewed the procedure with the crew 

and reported no one raised any concerns.114 The fluids specialist possessed only a general knowledge of 

conducting a negative test, and the procedure he provided to the crew addressed only the types and 

volumes of fluids that would be used during the displacement process. The procedure did not address the 

negative test other than to indicate that it would occur.115

Table 1-3. Selected steps from the M-I SWACO displacement procedure used at the Macondo well on 

April 20, 2010.116

Macondo Displacement Procedure Steps 

(verbatim from M-I SWACO document)

CSB Interpretation of the Procedure Steps and 

Explanatory Information

1 Before displacing to seawater, conduct a 

THINK DRILL with all.

Refers to Transocean’s THINK planning and risk 

management process (see Section 1.8.3).

2 Build 425 bbl WBM spacer in pit #5, and use 

Duo Vis to thicken up.

“WBM Spacer” refers to the water-based material that 

was used to separate drilling mud from seawater during 

the displacement of the well. Leftover lost circulation 

material was used as a 16-pound-per-gallon (ppg) 

dense spacer at Macondo. Duo Vis is a thickening 

ingredient.

3 

Capacities:

• Choke 100 bbls/794 strokes; 

• Kill 100 bbls/794 strokes;

• Boost 73 bbls/579 strokes; 

• Drill pipe 196 bbls/1555 strokes;

• Casing/Riser w/drill pipe annular 1817 

bbls/14,420 stks.

• Total displaced volume for hole and drill 

string, 2012 bbls/15,968 strokes

‘Stks’ refers to the number of strokes on the pump 

pushing the material into the well. The displacement 

procedure assumed one pump stroke gave 0.126 bbls of 

fluid which is 96.1% volumetric efficiency of the 

theoretical value. This was the customary assumption 

for this rig.117 However, analyses of subsequent real 

time data shows that the actual efficiency was less, 

 

circulation material like that used in the spacer material; Hearing before the Deepwater Horizon Joint 

Investigation, July 19, 2010, pp 39-41,

112 Hearing before the Deepwater Horizon Joint Investigation, July 19, 2010, p 42.

113 Ibid., pp 43, 55. See also Section 1.8.4 for more details concerning THINK Drills.

114 Hearing before the Deepwater Horizon Joint Investigation, July 19, 2010 pp 43, 55.

115 Section 1.8.3 details Transocean’s polices concerning procedure development, including that for a negative test. 

116 Internal Company Document, MI SWACO. BP/Deepater Horizon Rheliant Displacement Procedure "Macondo" 

OCS-G 32306, BP-HZN-BLY00094818, see Exhibit 0052 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lacy_Kevin-Depo_Bundle.zip. 

117 Transocean. Macondo Well Incident: Transocean Investigation Report:Volume II; June, 2011; Appendix G, pp 

41, 57, 63.

000738
Macondo Investigation Report Volume 3 4/17/2016

50 

• Pump Output 0.126 bbls/stk about 89-91%.118 As a consequence, less seawater was 

actually pumped than planned, leaving spacer in and 

below the BOP.

4 Displace choke, kill, and boost lines, and close 

lower valves after each. Zero stroke counter. 

5 Pump 425 bbl WBM spacer from pit # 5 down 

drill pipe followed by seawater.

6 Pump 775 bbls or 6150 stks. Spacer should be 

above the upper annular.

This step does not indicate if a total of 775 bbls should 

be pumped or if an additional 775 bbls is intended. It 

becomes clear during a later step this is intended to be 

the cumulative total (spacer + seawater).

This procedure and its 775 bbl. value erroneously do 

not include 30 bbl. of freshwater of pit wash that was 

reportedly planned and likely pumped just after the 

spacer. Analysis of real-time data indicates that the 

driller actually used 775+30 = 805 bbls for this step.119

This additional 30 bbl. volume is necessary for the 

calculated volumes to place the spacer above the BOP. 

7 Close annular and conduct negative test. After 

successful negative test, open bag. “Bag” refers to the annular BOP.

8 

When WBM spacer returns at 15,968 

stks...Compliance Engineer will take a sample 

for Static Sheen test...

Sheen test: A sample of the returning well fluids is 

added to water and a visual determination is made if it 

causes a sheen, indicating synthetic oil based mud is 

still present and the returning fluids from the well 

cannot be disposed into the sea. An acceptable sheen 

test indicates that the displacement volumes were 

adequate, and such was the report to the driller.120

Unknown to the crew, the volumetric efficiency of the rig’s pump during the displacement was less than 

that assumed in the procedure, as noted in step 3. As a result, not enough seawater was pumped to 

 

118 CSB Macondo Investigation Report, Volume 2, Appendix 2-A, pp 5 & 12.; Transocean. Macondo Well Incident: 

Transocean Investigation Report:Volume II; June, 2011; Appendix G, pp 41, 57, 63.

119 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; p 83. CSB Macondo Investigation 

Report, Volume 2, Appendix 2-A, pp 5, 12, 9 (footnote 36) and 14; Transocean. Macondo Well Incident: 

Transocean Investigation Report:Volume II; June, 2011; Appendix G, p 57.

120 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The 

Gulf Oil Disaster; Feburary 17, 2011; p 179. 

000739
Macondo Investigation Report Volume 3 4/17/2016

51 

displace all the spacer fluid above the BOP as intended. In hindsight, displacing all of the atypical spacer 

above the BOP was critical to minimize the possibility of plugging the kill line. Moving forward, a 

proactive measure may be to incorporate a safety factor on the target strokes to displace the spacer above 

the BOP. 

At the end of the displacement (step 6), the drillpipe had 2,300 psi of trapped fluid pressure (see call-out 

box on page 53). If all of the spacer had been placed above the BOP as intended, the crew should have 

observed only ~1,600 psi of trapped pressure.121 The high pressure reading could have warned the crew of 

the under-displacement, but the crew would have needed to be predisposed to look for this data and use it 

to deduce the conditions of the well, yet they weren’t given that information and had no a priori reason 

for suspecting a problem. 

Further, two pieces of evidence indicate that the well lost integrity during the initial displacement for the 

negative test. The loss of integrity would have further contributed to the under-displacement of spacer 

fluid, slowly taking fluid out of the well and reducing the displacement volume.122 First, just after the 

crew closed an annular preventer123 to isolate the well from the hydrostatic pressure of the riser, the realtime Deepwater Horizon data indicates the drillpipe pressure began to drop, implying a loss of well

integrity.

124 Second, after closing the annular and initially attempting to bleed trapped pressure, the crew 

noticed that the riser was not full and assumed that the annular preventer was leaking riser fluid back into 

the well, causing drillpipe pressure to rise.125 No witness testimony indicates the crew considered the 

possibility that well integrity had been compromised, and for at least two reasons the crew would have 

been predisposed to accept the leaking annular theory: 

• The well had successfully passed a positive pressure test earlier in the day; and

• It is “not uncommon” to see an annular leak.126 

Performing a visual check of the riser once the mud-displacing pumps were stopped, but before the 

annular preventer was closed for the negative test, could have provided a means to confirm if well 

integrity was secure or if remedial steps were necessary before proceeding with a negative test. However, 

 

121 CSB Macondo Investigation Report, Volume 2, Appendix 2-A, p 14.

122 CSB Macondo Investigation Report, Volume 2, Appendix 2-A, p 10. 

123 Annular preventers are rubber components of a BOP that are designed to seal around virtually any object that 

passes through them as well as an open hole when no drillpipe is present. See Section 2.1 in Volume 2 for figures 

and further description.

124 The leak possibilities were in either the casing or the wiper plug in the lower shoe. The CSB could find no 

evidence or technical reason why either of these should have leaked, but a leak assumption was necessary to 

model the real-time data. For the well data simulations found in Appendix 2A of the CSB Volume 2 Macondo 

report, it was assumed that the leakage occurred at the casing shoe, but leakage at the casing crossover (12,488 ft.) 

also provided a good data match. CSB Macondo Investigation Report, Volume 2, Appendix 2A, p 14.

125 Witnesses at the Hearings before the Deepwater Horizon Joint Investigation Team gave contradictory 

recollections; Hearing before the Deepwater Horizon Joint Investigation, May 28, 2010 pp 115 & 133, “During 

the negative test they felt like they lost approximately 60 barrels of mud through the annular.” A Transocean 

Subsea Supervisor also recalled that a BP well site leader spoke to a Transocean driller on shift who observed, 

“We didn’t lose no mud through the annular. He say it U-tubed. Where it U-tubed to, I don’t know;” Hearing 

before the Deepwater Horizon Joint Investigation, August 25, 2010 pp 271-272. August 25, 2010, pp 271-272.

126 As a Transocean Senior Toolpusher and BP Wellsite Leader later described, I 2016.02.17 Day 2 Afternoon p 179, 

2016.02.18 Day 3 Afternoon p 561.

000740
Macondo Investigation Report Volume 3 4/17/2016

52 

witness testimony indicates such a visual check did not occur until after the crew began to troubleshoot 

the pressure increases in the well. Once the crew became aware of the drop in riser level, a decision was 

made to increase the annular closing pressure and fill the riser with more drilling mud; it stayed full, thus 

reinforcing the assumption of an annular leak.127 A procedure providing the expected drill pipe pressure at 

the end of the initial displacement and a maximum acceptable value would have helped the crew detect 

the displacement shortfall.

The issues covered in this section reveal numerous assumptions of the operator, drilling contractor, and 

other well service providers concerning the ability of the crew to accurately understand the conditions of 

the well throughout displacement. In reality, this status was inferred from the various indicators available 

and, as demonstrated here, incorrectly so. This evidence further supports the need for improved tools for 

accurate interpretation of well conditions, and this knowledge gap must be recognized when making 

decisions about well status throughout the drilling and temporary abandonment process. 

 

127 Hearings before the Deepwater Horizon Joint Investigation Team, May 28, 2010, pp 279 -280. 

000741
Macondo Investigation Report Volume 3 4/17/2016

53 

As described in Section 1.2.3, depending on the configuration of a negative test, the well pressure can be 

monitored from either the drillpipe, the kill line,a or in some instances both. 

The pressure a crew observes after 

displacing drilling mud from a well 

can be illustrated by using the u-tube 

model seen here. The drillpipe, or the 

kill line, containing only relatively 

light seawater, is shown on one side 

of the u-tube.

b On the other side, the 

annulus contains some seawater, but 

also much heavier drilling mud and 

spacer material. The heavier annulus 

material pushes down through the utube and up on the drillpipe 

seawater, increasing the drillpipe 

pressure, commonly called u-tube 

pressure, which can be predicted 

before fluid conditions in a well 

change. c

Similar to trapping gas in an inflated 

balloon, pressure will remain in a 

pipe if it is shut in. When the crew at 

Macondo closed the BOP, the u-tube 

pressure was trapped in the well until 

the crew intentionally released it 

from either the drillpipe or the kill 

line in preparation for the negative 

test. 

a The kill line is a pipe that runs from the BOP to the rig.

b Hydrostatic pressure is height of the fluid column multiplied by the density of the fluid.

c The u-tube pressure is the hydrostatic pressure exerted by seawater in the drillpipe subtracted from the hydrostatic pressure 

generated in the annulus from the drilling mud and spacer material. Planned u-tube pressure at Macondo was ~1,600 psig. 

Calculated hydrostatic pressures: 

Drilling mud: 3,746 ft * 14.2 ppg * 0.052 = 2,766 psi

Spacer material: 1,255 ft * 16 ppg * 0.052 = 1,044 psi

Seawater: 5,001 ft * 8.55 ppg * 0.052 = 2,223 psi

where 0.052 is a units constant to convert feet-pounds per gallon (ppg) to pounds per cubic inch (lbs/in3) 

000742
Macondo Investigation Report Volume 3 4/17/2016

54 

1.5 Phase 3 – Evidence of Confirmation Bias 

After displacement of the drillpipe, the crew took steps to conduct the negative test by bleeding and 

observing pressure and flow from the well several times over three hours (striped portion of Figure 1-10).

After closing the annular, (~5:00 pm) the crew bled trapped pressure from the drillpipe, but subsequently 

observed it rise. They then noticed the low riser level, increased closing pressure on the annular, refilled 

the riser, and bled pressure from the drillpipe again (~5:25 pm). Afterwards, the crew again observed 

drillpipe pressure rise. 

Shift change was officially at 6:00 pm for the toolpushers and WSLs.128 The night shift WSL came on 

duty. After discussions (addressed in more detail shortly) among the Transocean well operations crew and 

both BP well site leaders, the decision was made to change the procedure to test on the kill line stipulated 

in the drilling permit submitted to MMS.129 The crew bled pressure from the kill line (5:50 p.m.) until the 

pressure was zero in the kill line. The crew next pumped seawater into the kill line to ensure it was full 

(6:35 p.m.) and then observed no flow on the kill line for 30 minutes.130 Despite this, pressure on the 

drillpipe remained. As the timespan in solid green illustrates in Figure 1-10, about an hour and a half 

passed without further actions by the crew, as discussions of the pressure on the drillpipe ensued. 

Purportedly, the night toolpusher131 offered an interpretation of the drillpipe pressure that justified the 

observed pressure. Post-incident, this theory, termed the bladder effect, annular compression, and annular 

compaction,132 could not be supported. While it is in dispute whether the entire on-duty well operations 

crew and both Well Site Leaders on the rig accepted this rationale,133 ultimately, they proceeded with 

displacement. Continuation of the temporary abandonment process signified their acceptance of the 

negative test results and their belief that well integrity was secure. 

 

128 The mud engineers also have shift change at this time, although they play a support role in the well operations. 

The drillers did not change out at this time; their shift change was at noon and midnight. (USA v. Robert Kaluza, 

Docket No. 12-CR-265, February 7, 2016, pp 153:5-154:3; USA v. Robert Kaluza, Docket No. 12-CR-265, 

February 18, 2016, p 304:`6-18.)

129 Internal Company Document, BP. Form MMS - 124 Application for Permit to Modify, April 16, 2010, Temporary 

Abandonment Procedure, BP-HZN-MBI00127909, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-00570.pdf (accessed October 7, 

2015).; USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 320:20-21, 323:7-9, & 328:22-

329:5.

130 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, p 358:12-360:1

131 The toolpusher plays a supervisory role within the drill crew, advising and assisting if the driller runs into a 

problem; Internal Company Document, Transocean. Field Operations Policies & Procedures Manuel, Issue 01, 

Revision 00, HQS-POP-PP-01, August 8, 2009; USA v. Robert Kaluza, Docket No. 12-CR-265, February 17, 

2016, p 92:11-19. 

132 The bladder effect/annular compression theory is detailed in various places in the Chief Counsel's Report. The 

theory purported that the weight of the heavy drilling mud and spacer material pressed againt the annular 

preventer which in turned pressed against the fluids below the preventer, forcing them up the drillpipe; National 

Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The Gulf Oil 

Disaster; Feburary 17, 2011; pp 157, 162, and 229-30 (amongst others). USA v. Robert Kaluza, Docket No. 12-

CR-265, February 18, 2016, pp 326:1-17 & 366:2-17 & 550:6-553:15

133 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 366:8-11 & 439:23-440:11 & 472:9-15 & 

554:1-8.

000743
Macondo Investigation Report Volume 3 4/17/2016

55 

Why would the WSLs and well operations crew continue with the displacement despite the pressure 

reading on the drillpipe? Not all of these individuals survived to explain their rationale. Yet from those 

who did, along with the evidence available, it can be reasonably assumed that they would have not 

proceeded with the displacement had they believed a blowout to be a real possibility.134 But they did 

proceed, removing the fluid barrier from the well. 

 

134 There exists a difference between real-time operational risk awareness by those conducting the work in the 

moment and risk awareness in the “back-office” sense by those removed from the actual operational setting. 

McLeod offers a useful discussion of the difference. [McLeod, R., 2015, Designing for Human Reliability in the 

Oil, Gas and Process Industries, Elsevier, Ltd.: Oxford, UK, pp 30-32.]

Subsea supervisor testimony offered during the Joint Marine Board investigation 

provides insights into the general mindset of a crew during these final stages of 

drilling and abandoning a well:†

 

When you run that last string of casing and you have got it cemented, it’s 

landed out and a test was done on it, then you say this job, we are at the end 

of it. Everything is going to be okay. Now I’m telling you this, not from a 

supervisor, not from the well-site leader’s office, but from the working men 

that are out there, we have finished this well. You are thinking ahead to your 

next job. You’re moving on.

†

Hearing before the Deepwater Horizon Joint Investigation, July 20, 2010, p 63.

000744
Macondo Investigation Report Volume 3 4/17/2016

56 

 

Figure 1-10. Crew Activities during Temporary Abandonment beginning at 3:00 p.m. on April 20, 2010. 

000745
Macondo Investigation Report Volume 3 4/17/2016

57 

Several facts, experiences, and rational justifications explain why the well operations crew proceeded: 

• Up to the point of the blowout, challenges of the well throughout the drilling process were

successfully overcome, including: 1) multiple losses of well control events throughout the drilling 

of the well in which the crew was able to regain control of the well135 and 2) changes to the 

drilling plans to accommodate those challenges (e.g., drill depth, casing choice). The ability to 

regain control of the well numerous times prior could have reinforced a mentality that success 

was inevitable.

• The crew explained away or remediated several anomalies during the cementing process.

136

• Various personnel deemed successful the bottom-hole cement job—the primary physical barrier 

set in the well to prevent loss of well control and the major operational task of temporary 

abandonment.137 

• The positive pressure test conducted earlier in the day to verify casing integrity (i.e., no leaks 

from inside the well to the outside) was successful. While this test does not verify the integrity of 

the bottom hole cement job, it represents another successfully completed step in temporary 

abandonment. 

• A rationale for the loss of riser fluid was provided. 

• The well operations group purportedly discussed, and at least partially accepted, a rationale for 

the drillpipe pressure. The individual purported to have provided the rationale was considered 

highly competent in skills directly applicable to this situation—“[he] makes quality decisions on a 

consistent basis,” “has always been a recognized leader on the Deepwater Horizon, and uses his 

experience to help others.”138 The professional respect for this individual, as well as the backing 

 

135 Numerous ‘lost returns’ events on February 17, March 2, 3, 21, 31, April 3, 4, and 9, 2010, well kicks on October 

26, 2009 and March 8, 2010, and a ballooning event on March 25, 2010; National Commission on the BP 

Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The Gulf Oil Disaster; Feburary 17, 

2011; Figure 4.2.8, p 59.

136 These included issues with converting the float valve assembly, a device that allows cement to be pumped into a 

well and then to prevent flow back up the casing once pumping ceased. Ultimately, much higher pressure was 

required to convert the float valves. Additionally, the anticipated cement circulation pressure was lower than 

predicted, but the eventual conclusion was that the lower-than-expected pressure actually reflected a broken 

pressure gauge. National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief 

Counsel's Report: The Gulf Oil Disaster; Feburary 17, 2011; Chapter 4.3, p 67. 

137 Email from Cementing Engineer, Halliburton, to Cementing Engineer, Halliburton, Subject: 9.875" x 7" Casing 

Post Job, “We have completed the job and it went well,” April 20, 2010, HAL 0011208, see Exhibit 0708 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Stringfellow_William-Depo_Bundle.zip

(accessed October 7, 2015).; Email from Drilling Engineer, BP, to Drilling Engineering Team Leader, Senior 

Drilling Engineer, Wells Team Leader, BP, Subject: Nitrogen Cement Team, “the Halliburton cement team ... did 

a great job,” April 20, 2010, BP-HZN-MBI00129141.; Foamed Casing Post Job Report from Macondo stated that 

the cement job was “pumped as planned” and that full returns were seen throughout the process; Internal 

Company Document, Halliburton. 9.875" x 7" Foamed Production Casing Post Job Report, April 20, 2010, 

HAL_0011210, Exhibit 0708 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Stringfellow_William-Depo_Bundle.zip

(accessed October 7, 2015). 

138 Internal Company Document, Transocean. 2009 Senior Supervisor Performance Appraisal - Performance 

Appraisal and Development Plan, October 31, 2009, TRN-MDL-08076982, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-52649.pdf (accessed October 7, 

2015).

000746
Macondo Investigation Report Volume 3 4/17/2016

58 

by others of the rationale as something plausible,

139 and even seen before,140 gave the crew 

comfort that the theory was valid.

• The night shift WSL recalled participating in approximately 50 previous negative tests; to his 

knowledge, never had one failed.141

• They had conducted the negative test according to the drilling permit, seeing no flow for 30 

minutes,

142 an indication of a successful negative test.143 

It is reasonable to assume that these facts, experiential knowledge, and justifications convinced the crew 

that successful completion of the well was inevitable. This information strongly indicates that the well 

operations crew and WSLs were subject to confirmation bias,144 a one-sided case-building process of 

unconscious selectivity in gathering and using evidence that supports one’s beliefs.145 Acceptance of an 

explanation or decision despite indications otherwise is more likely when a recognized leader supports the 

position, a lot is at stake, and an alternative scenario would be costly.146 (See also Section 1.7.1.) Thus, the 

situation predisposed the crew to interpret the negative test as successful on April 20, 2010. 

 

139 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 326:7-17, 554:1-6; Hearing before the 

Deepwater Horizon Joint Investigation, July 20, 2010 pp 90-91, 153.

140 Internal Company Document, BP. Notes from Bob Kaluza Interview, April 28, 2010, BP-HZN-MBI00021276, 

see Exhibit 0005 http://www.mdl2179trialdocs.com/releases/release201302281700004/Daigle_KeithDepo_Bundle.zip (accessed October 7, 2015).

141 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 282:13-15, 294:2-6.

142 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, p 358:12-360:1; Hearing before the U.S. 

District Court for the Eastern District of Louisiana under the Multi-District Litigation docket MDL No. 2179, 

March 5, 2013 p 1682:13-17, http://www.mdl2179trialdocs.com/releases/release201303051200006/2013-03-

05_BP_Trial_Day_6_AM-Final.pdf (accessed October 7, 2015).

143 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 166:21-22, 358:12-360:1

144 This analysis is in alignment with Hopkins, A. Disastrous Decisions; CCH Australia: Australia, 2012; p 40. 

145 Nickerson, R. S. Confirmation Bias: A Ubiquitous Phenomenon in Many Guises; Review of General Psychology 

1998, 2 , pp 175-176.

146 The logical extension of this argument would suggest that if integrity is lost but not acted upon, as was the case 

with Macondo, the result could be significantly costlier. However, research on confirmation bias demonstrates 

that people influenced generally weigh more heavily data that supports and affirms their beliefs. Nickerson, R. S. 

Confirmation Bias: A Ubiquitous Phenomenon in Many Guises; Review of General Psychology 1998, p 176.

000747
Macondo Investigation Report Volume 3 4/17/2016

59 

1.5.1 Potential Influence of Distraction and Fatigue

A variety of performance shaping factors147 contributed to the decisions and actions of the crew, some of 

which have already been discussed. Two additional factors have been prominently raised in review of the 

incident: fatigue and distraction of those carrying out temporary abandonment. While the CSB does not 

find conclusive evidence to assert that these factors played a causal role in the blowout, the agency cannot 

rule them out. Both are briefly covered here.

 

147 Performance shaping factors, also called performance influencing factors, are the characteristics of the job (e.g., 

nature, workload, procedures, environment, etc.), individual (e.g., skills, attitude, personality, mental state, etc.) 

and organization (e.g., culture, leadership, resources) that influence human performance. (UK HSE, Performance 

Influencing Factors, http://www.hse.gov.uk/humanfactors/topics/pifs.pdf) 

Shift Change of Supervisory Personnel

Shift change for both the toolpushers and the WSLs was scheduled to occur at 6:00 p.m. on April 20, 

which coincided with the time the well operations crew were conducting and discussing the negative 

test.a

 Changing out were the toolpusher, identified as the rig floor supervisor of the drilling 

operations, and the WSL, the designated decision-maker for the well operations.b The day toolpusher 

reported that he left his shift approximately 20 minutes after his replacement arrived the evening of 

April 20;c if his time estimates are accurate, he would not have been in the drill shack for a significant 

portion of the discussion about the negative test that occurred during the day shift and the next steps 

for the night shift crew. There were also understanding gaps between the day and night WSLs, which 

were not realized until those conversations were deconstructed post-incident.d

 It can be argued that 

because the drill crew does not change out at the same time, the potential for communication gaps is 

lessened. But this situation reveals an opportunity to review shift change procedures and practices for 

all safety critical positions and to assess whether training in (non-technical) communication skills is 

warranted (see Section 1.7).

a Internal Company Document, BP. Steve R. Notebook, BP-HZN-MBI00021427, see Exhibit 4953 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed October 7, 

2015). The mud loggers also had shift change at this time, but they were in support roles more than supervisory. Testimony 

given in the U. S. Districk Court for the Eastern District of Louisiana under the Multi-District Litigation docket MDL No. 

2179, March 5, 2013, pp 1676, http://www.mdl2179trialdocs.com/releases/release201303051200006/2013-03-

05_BP_Trial_Day_6_AM-Final.pdf (accessed May 22, 2015).

b Internal Company Document, Transocean. Interviewing Form: Toolpusher, June 4, 2010, TRN-INV-00004994, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-07532.pdf (accessed October 7, 2015).; USA 

v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 319:12-13, 348:17.

c Internal Company Document, Transocean. Interviewing Form: Toolpusher, June 4, 2010, TRN-INV-00004994, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-07532.pdf (accessed October 7, 2015).; 

Testimony given in the U. S. Districk Court for the Eastern District of Louisiana under the Multi-District Litigation docket 

MDL No. 2179, March 5, 2013, pp 1676, http://www.mdl2179trialdocs.com/releases/release201303051200006/2013-03-

05_BP_Trial_Day_6_AM-Final.pdf (accessed May 22, 2015). 

d The night WSL asserted that he likely would have changed his decisions/actions on the night of April 20 if he had this 

information at the time. USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 371:21, 73:13.

000748
Macondo Investigation Report Volume 3 4/17/2016

60 

1.5.1.1 Fatigue

Fatigue can negatively affect workplace performance by increasing errors, delaying responses, and 

clouding decision-making.148 Complex task decision-making that requires innovative and flexible 

thinking is also sensitive to fatigue.149 “Fatigued people are less able to respond to unusual or emergency 

conditions effectively. They are also more likely to take risks.”150 The following facts are known about 

the Macondo blowout: 

• Transocean implemented 21-day hitches (called “3 and 3”) across all North American Division 

rigs in October 2009; prior to that time, both 14- and 21-day hitches were used. The analyses 

conducted, and rationale given, by Transocean to switch its Gulf regional fleet from a 14-day 

hitch to a 21-day hitch expressly focused on schedule predictability, interchangeability of crews 

from rig to rig, more time for crew training, and financial savings.151 Missing from the analysis is 

consideration of sleep science.

• Limited research exists on performance impacts resulting from offshore 21-day hitch durations in 

comparison two 14-day hitches;152 however, general sleep science shows detrimental 

performance effects increase as periods of consecutive shift work increase,

153 and most North Sea 

operations154 in both UK and Norwegian waters implement 14-day hitches followed by 14 - 28 

days of onshore rest.155 

 

148 Rogers, A.S., Spencer, M.B., and Stone, B.M., 1999. Report 245/Validation and Development of a Method for 

Assessing the Risks Arising from Mental Fatigue, prepared by the Defence Evaluation and Research Agency 

Center for Human Services, for the HSE, U.K; Lerman, S. et al., Fatigue Risk Management in the Workplace, 

ACOEM Presidential Task Force on Fatigue Risk Management, Journal of Occupational and Environmental 

Medicine, 54(2), February 2012, p 1; and UK HSE, Human Factors, Specific Topic 2: Managing Fatigue Risks, 

http://www.hse.gov.uk/humanfactors/topics/specific2.pdf, p 1, accessed March 21, 2016.

149 Rogers, A.S., Spencer, M.B., and Stone, B.M., 1999. Report 245/Validation and Development of a Method for 

Assessing the Risks Arising from Mental Fatigue, prepared by the Defence Evaluation and Research Agency 

Center for Human Services, for the HSE, U.K. Rosekind, M., Gander, P., et al., 1996. “Managing Fatigue in 

Operational Settings I: Physiological Considerations and Countermeasures,” Behavioral Medicine, Vol. 21, pp 

157-165.

150 Energy Institute, Improving Alertness through Effective Fatigue Management, 2006, p 1; this document has been 

superseded by Managing Fatigue using a Fatigue Risk Management Plan, 1st ed., 2014, 

https://www.energyinst.org/technical/human-and-organisational-factors/human-factors-fatigue (accessed March 

26, 2016).

151 April 20, 2011, response by Transocean to CSB subpoena requests for records and information on Transocean’s 

21-day on/off work schedule. 

152 HSE, Offshore Working Time in Relation to Performance, Health and Safety: A review of Current Practice and 

Evidence, RR772, 2010, p 23 & 51.

153 Rosekind, M., Managing work schedules: an alertness and safety perspective, in Principles and Practice of Sleep 

Medicine, eds. By Kryger, M, Roth, T., & Dement, W. Philadelphia, PA, 2004, pp 682 & 686.

154 The exceptions most commonly include those working in remote UK waters, e.g., West of Shetland.

155 Parkes, K., Shift schedules on North Sea oil/gas installations: a systematic review of their impact on performance, 

safety and health, Safety Science, (50), 2012, pp 1638.

000749
Macondo Investigation Report Volume 3 4/17/2016

61 

• Historical accident and injury data from the North Sea suggest that the ratio of fatalities and 

severe injuries to less severe injuries was markedly higher for hitches longer than 14 days in 

comparison to those of lesser quantity.156

• Research shows that schedules rotating ‘backwards’ from night to day shifts (as opposed to

rotating ‘forward’ from day to night shifts),157 and that make this switch in the middle of the 

hitch,158 are more likely to negatively impact performance by causing fatigue as the body 

readjusts to a new sleep-wake schedule. 

• Workers reported in a Lloyds Register culture/climate review that the 21-day hitch was causing 

fatigue, particularly during the final week.159

• The driller and one assistant driller working the evening of April 20 were on shift 20 of their 21-

day hitch; the second assistant driller was on shift 19 of 21; each shift was 12 hours, not including 

any overage worked to conduct shift turnover. 

• The day shift toolpusher was on day 20 of his hitch; his shifts were also 12 hours. 

• The toolpusher on the evening of April 20 was only on day 6 of his hitch, but he was scheduled to 

leave the Deepwater Horizon the next day for another offshore facility; he would not be returning 

to the Horizon, where he spent approximately half his life for almost the last decade.160 

• The BP Well Site Leaders were on a 14-day hitch; they were scheduled to have their swing-shift 

rotation at 2:00 a.m. on April 21. 

To determine causality, investigators require sufficient evidence that identifiable fatigue factors161 were 

present at the time of the incident and that fatigue-related performance loss contributed to or caused the 

 

156 Parkes, K. (University of Oxford). Psychosocial Aspects of Work and Health in the North Sea Oil and Gas 

Industry, 1996 – 2001, Sudbury: Health and Safety Executive, 2002, p 38.

157 HSE, Offshore Working Time in Relation to Performance, Health and Safety: A review of Current Practice and 

Evidence, RR772, 2010, pp 33-35; Rosa, R. and M. Colligan. Plain Language about Shift Work, Cincinnati: US 

Department of Health and Human Services (Centers for Disease Control and Prevention, National Institute for 

Occupational Safety and Health), July 1997, p 9.

158 Parkes, K. (University of Oxford). Psychosocial Aspects of Work and Health in the North Sea Oil and Gas 

Industry, 1996 – 2001, Sudbury: Health and Safety Executive, 2002, pp 7, 37-38; HSE, Offshore Working Time in 

Relation to Performance, Health and Safety: A review of Current Practice and Evidence, RR772, 2010, pp 32-33; 

Parkes, K., Shift schedules on North Sea oil/gas installations: a systematic review of their impact on performance, 

safety and health, Safety Science, (50), 2012, p 1647.

159 “On their last week, they seem like they are in another world,” and “On the last week, you are so tired that you 

feel like a robot” were two quoted responses. TREX-04261, Lloyd’s Register Safety Management Systems and 

Safety Culture/Climate Reviews: Deepwater Horizon closing meeting on March 16, 2010, TRN-INV-00016761 

and Lloyd’s Register EMEA Aberdeen Energy, Safety Management and Safety Culture/Climate – Deepwater 

Horizon, May 11, 2010, p.16. TRN-HCEC-00090589. 

160 US District Court, Eastern District of Louisiana, MDL-2179, March 5, 2013, Day 6 morning session, p 1737.

161 Fatigue factors are physiological aspects of an individual’s sleep/wake cycle that underlie fatigue. Rosekind, M., 

Gregory, K., et al., 1993. “Analysis of crew fatigue factors in AIA Guantanamo Bay aviation accident, Appendix 

E,” to Aircraft Accident Report: Uncontrolled Collision with Terrain, NTSB/AAR-94/04, Washington, D.C.: 

NTSB. 

000750
Macondo Investigation Report Volume 3 4/17/2016

62 

accident.162 Fatigue factors include acute sleep loss and cumulative sleep debt,163 continuous hours of 

wakefulness, circadian rhythm disruptions, and potential medical sleep conditions. 

This analysis cannot go further due to the lack of specific information pertaining to the sleep and wake 

cycles of the individuals involved, many of whom suffered fatal injuries as a result of the incident or were 

not made available to the CSB for interviews. Without such information, the CSB cannot draw strong 

connections between fatigued mental states and explicit performance detriments demonstrated by the 

individuals. The CSB does not know how the well operations crew spent their off time in the days leading 

up to the blowout, what portion of that time they spent sleeping, and whether their sleep was of high 

quality. Yet the CSB does know that the night shift toolpusher and WSL were more likely to be fatigued 

due to their 6:00 p.m. – 6:00 a.m. schedules. The CSB can surmise that leaving the MODU after almost a 

decade would take an emotional toll on the toolpusher, which may amplify the effects of fatigue;

164

however, the evidence available does not provide sufficient information to make that claim. 

Overall, sufficient information is not available for a causal connection to the blowout. Yet, the facts 

outlined here raise sufficient concern for the offshore industry to address fatigue as a safety issue. 

Testimony from Steve Newman, then the Transocean CEO, confirmed Transocean also implemented 28-

day hitches.165 Some offshore workers may prefer extended hitches for the equivalent-in-length non-work 

periods. But management has the responsibility to effectively manage the risks inherent in the work, and 

working hours, shift patterns, and hitch length are within its span of control. Reasons for implementing 

long hitches include limitations on the number of personnel that can be accommodated on the offshore 

facility and reductions in the number of shift changes, which minimize opportunities for error that could 

arise from more frequent staff change-outs.166 An additional benefit is reduced helicopter traffic, which 

has also been recognized as a major offshore risk. Thus, a safety management system is necessary to 

assess the risk of fatigue and to establish and maintain policies and practices to effectively reduce those 

risks. API Recommended Practice 755 is voluntary US onshore guidance for developing and 

 

162 This two-step methodology was employed by the NASA Fatigue Countermeasures Program and the National 

Transportation Safety Board (NTSB) to assess operator fatigue in accidents, and it has been used in NTSB 

investigations of pipeline and transportation incidents. As the tasks of the well operations crew, pilots, board 

operators, and drivers parallel each other in that they all deal with issues of critical decision-making, attending 

to/monitoring technological systems, reacting quickly to abnormal conditions, and rectifying deviations from 

normal conditions, the methodology is appropriate and applicable to offshore well operations events.

163 Acute sleep loss is the amount of sleep lost from an individual’s normal sleep requirements in a 24-hour period. 

Cumulative sleep debt is the total amount of lost sleep over several 24-hour periods. If a person who normally 

needs 8 hours of sleep a night to feel refreshed gets only 6 hours of sleep for five straight days, this person has a 

sleep debt of 10 hours. 

164 “...combinations of stressors may act additively or combine to produce multiplicative effects on health and safety 

outcomes.” HSE, Offshore Working Time in Relation to Performance, Health and Safety: A review of Current 

Practice and Evidence, RR772, 2010, pp 9-10.

165 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 19, 2013 p 4666, 

http://www.mdl2179trialdocs.com/releases/release201303191200014/2013-03-19_BP_Trial_Day_14_AMFinal.pdf (accessed October 7, 2015).

166 UK HSE, Guidance for Managing Shiftwork and Fatigue Offshore, Information Sheet No. 7/2008, 

http://www.hse.gov.uk/offshore/infosheets/is7-2008.htm (accessed February 14, 2011).

000751
Macondo Investigation Report Volume 3 4/17/2016

63 

implementing a fatigue risk management system, but its scope is expressly applicable to shift workers 

commuting daily to the worksite.167

1.5.1.1 Distraction

Testimonies from witnesses suggest that the executive tour was only in the drill shack (and thus capable 

of interrupting/distracting those involved in the well operations) for about 5 minutes. The OIM and senior

toolpusher, who were on the tour, were asked to stay within the drill shack to help the drill crew, and they 

did so for about 15 minutes more. The senior toolpusher stated that he did not play a role in the decisionmaking occurring with the shack concerning the negative tests and that he actually stepped out of the 

shack to discuss some next steps in temporary abandonment with the assistant driller.

168 The drill crew 

and WSLs continued to discuss the negative test and well data for some time after the tour group left, 

suggesting that they were focused on the work and not distracted by the executive group. However, 

without more detailed evidence of what was said, by whom, in what manner, and to what extent within 

that drill shack, the CSB cannot determine with any level of certainty how the tour might have impacted 

the flow of communication and the analysis of the well data/negative tests.

1.6 Phase 4 – Troubleshooting, Multiple Activities, and 

Communication Gaps Obscure Well Conditions

After accepting the negative test results at 7:55 p.m. (Figure 1-11), the crew continued with displacement 

of the riser. The crew engaged in multiple activities during this time, including a sheen test, several mud 

and well fluid transfers into and out of various locations, and displacement pump shutdowns and restarts 

(Figure 1-11). Unbeknownst to the people on the Deepwater Horizon, at ~8:50 pm, reservoir fluids began 

to flow into the well. Between 8:50 p.m. and 9:08 p.m., when the crew stopped displacing the riser to 

conduct the sheen test, the influx rate into the well was approximately 9 bpm (barrels/minute), and the pit 

gain on the rig was about 60 barrels over 16 minutes.169 The crew did not detect this influx. Post-incident, 

the senior toolpusher noted that the number of pre-calculated strokes (step 8, Table 1-3) on the pump used 

 

167 API, Recommended Practice 755: Fatigue Risk Management Systems for Personnel in the Petroleum and 

Petrochemical Industries, 2007, p.1. The CSB notes that it has identified a number of ways this recommended 

practice could be further improved. See 

http://www.csb.gov/assets/1/7/Fatigue_Evaluation_for_Public_Comment_3_11_20131.pdf. 

168 USA v. Robert Kaluza, Docket No. 12-CR-265, February 17, 2016, pp 162:25, 163:12.

169 The computer simulation found in Appendix 2-A indicates that by 9:09 p.m. about 9 bpm were flowing into the 

well, and the pit gain on the rig was about 60 barrels over 16 minutes. These conditions should have been 

sufficient to be observable on the rig, but the crew was not predisposed to look for them.

000752
Macondo Investigation Report Volume 3 4/17/2016

64 

to displace the riser correlated with the visual sheen test results, indicating that the drilling mud in the 

riser had been displaced and the spacer had reached the rig.170, 171 In short, “everything looked good.”172 

As a backup to the well operations crew, the Sperry Sun173 mudloggers aboard the rig were hired by BP to 

monitor surface instruments that provided drilling and well information and to raise concerns for any 

abnormalities.174 Sperry Sun had installed its own flow meter on the rig to monitor returns from the well, 

but apart from this particular device, the mudlogger monitored the same data as the drillers.175 Yet, prior 

to resuming the displacement, the mudlogger was not privy to all the discussions about whether to accept 

the negative test. He was not with the well operations crew in the drill shack; instead, he was in a separate 

windowless office approximately 15 feet from the perimeter of the rig floor.176 He surmised that the 

negative test was successful only because displacement of the drillpipe was occurring.177 While he did 

leave his monitoring post to go to the restroom in the hour before blowout, this purportedly occurred 

sometime between 8:50 p.m. and 9:15 p.m., when fluid transfer movements were either impacting or were 

perceived to be impacting the flow-out meter.178 

If an organization is relying upon individuals to monitor and troubleshoot an operational process, it must 

make efforts to ensure they have enough information to do so. The mudlogger might have had the same 

raw data available to him as the driller, but the information was contextually incomplete—he was not a 

 

170 Internal Company Document, Transocean. Senior Toolpusher Interviewing Form, May 28, 2010, TRN-MDL00493745, http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-50296.pdf (accessed 

October 7, 2015).

171 Subsequent analysis by both Transocean and the CSB indicates that the spacer had not yet reached the surface at 

9:08 p.m. A possible explanation for the successful sheen test may be that spacer bypassed some of the drilling 

mud, giving a false displacement indication. If a sheen were detected, it would have been an indication of an 

incomplete displacement, that the actual pump efficiency was lower than assumed; Macondo Well Incident: 

Transocean Investigation Report:Volume II; June, 2011; Appendix G, Figure 44, p 103; CSB Macondo 

Investigation Report, Volume 2, Appendix A, Figure 9, p 20.

172 Internal Company Document, Transocean. Senior Toolpusher Interviewing Form, May 28, 2010, TRN-MDL00493745, http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-50296.pdf (accessed 

October 7, 2015).

173 A subsidiary of Halliburton; see Volume 1, Section 1.1, for description of various well service providers 

contracted by BP. 

174 Hearing before the Deepwater Horizon Joint Investigation, December 8, 2010, p 267; Hearing before the 

Deepwater Horizon Joint Investigation, December 7, 2010, p 18. 

175 The mudlogger reported that Transocean had its own HiTech Profibus system, the data of which was shared with 

the mudloggers, but not necessarily communicated in the same format; Hearing before the Deepwater Horizon 

Joint Investigation, December 7, 2010, p 116. For a more detailed analysis, see Hopkins, A., February 2011, A 

working paper prepared for the CSB: the failure of monitoring prior to blowout, available at the Macondo 

investigation page of the CSB.gov website.

176 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 13, 2013 p 3494, 

http://www.mdl2179trialdocs.com/releases/release201303131200011/2013-03-13_BP_Trial_Day_11_AMFinal.pdf (accessed October 7, 2015).

177 Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, pp 28, 158.

178 Starting around 9:08 p.m., when the overboard line was opened, the mudlogger’s ability to see flow out of the 

well was impaired; Hearing before the Deepwater Horizon Joint Investigation, December 8, 2010, p 189.; Hearing 

before the Deepwater Horizon Joint Investigation, December 7, 2010, pp 212, 216.

000753
Macondo Investigation Report Volume 3 4/17/2016

65 

part of the conversations concerning the negative test results and their implications for the well, nor was 

he fully abreast of the fluid transfers,

179 yet he was relied upon as the independent layer of protection for 

kick detection.180 In actuality, during temporary abandonment, he was a dependent layer, able to interpret 

well conditions only from the data that was available to him. 

Once the sheen test was accepted, the crew diverted overboard the fluids returning from the well, 

bypassing the pit volume monitoring system, which is the prime means for the crew to detect flow 

anomalies from the well. A pressure anomaly was observed at ~9:31 p.m., but instead of checking the 

well for flow—which would be the anticipated course of action if well influx was suspected—the crew 

shut down the displacement pumps and began troubleshooting valves and lines at the surface.

181 Within 

nine minutes of shutting down the pumps, oil and gas erupted a mixture of seawater, drilling mud, and 

hydrocarbons up onto the drilling rig floor. 

The actions of the crew, summarized in Figure 1-11, depict a group that was neither idle nor complacent 

in the minutes leading up to the blowout at 9:40 p.m. Rather, the crew demonstrated that they knew 

something was amiss, and they were actively trying to understand the situation by examining surface 

valves and lines. The crew’s performance of these surface checks suggests their perception of only minor 

problems, such as a valve leak, not a catastrophic gas-in-riser situation. 

 

179 The mudlogger reported calling the drill shack several times to understand the data he was seeing from his control 

station. Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District 

Litigation docket MDL No. 2179, March 13, 2013 pp 3603, 3605-2606, 3527-3828,

http://www.mdl2179trialdocs.com/releases/release201303131200011/2013-03-13_BP_Trial_Day_11_AMFinal.pdf (accessed October 7, 2015).

180 Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with Mark Hafle, July 8, 

2010, BP-HZN-BLY00144213, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX04447.pdf (accessed October 7, 2015).; Hearing before the Deepwater Horizon Joint Investigation, December 8, 

2010, p 267; Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, p 18.

181 CSB Macondo Investigation Report, Volume 2, Appendix 2-A, p 11.

000754
Macondo Investigation Report Volume 3 4/17/2016

66 

Figure 1-11. Crew activities and actions during final displacement of the riser. 

The crew was predisposed to interpret the pressure anomaly as unrelated to cement integrity because of a 

perceived “successful” completion of the well. In summary, “as operations continue, the resulting 

anomalies remain undetected or are satisfactorily accounted for until matters evolve to a point where 

events demolish the reality inside which the crew is operating.”182

1.7 Competency and Non-technical Skills

The human factors contributing to the Macondo incident almost automatically raise questions about 

competency of the personnel involved, and more fundamentally about the meaning of competency. More 

job-specific training is often the recommendation in the aftermath of a catastrophic incident, as was the 

 

182 Thorogood, J. The Macondo Inflow Test Decision: Implications for Well Control and Non-technical Skills 

Training, SPE/IADC Drilling Conference and Exhibition, London, March 17-19, 2015; SPE/IADC-173123-MS, p 

8.

000755
Macondo Investigation Report Volume 3 4/17/2016

67 

case in Macondo.183 Traditional training typically consists of teaching crews to manage conditions based 

on plans (rules, procedures, policies). As such, post-incident investigations often focus on the need to 

improve those skills (i.e., knowledge of procedures and ability to execute them), and steps are taken to 

revise procedures and manuals so that individuals will be prepared for those specific unanticipated 

conditions when they arise. 

This approach faces two challenges. First, task-specific or technical competency training does not 

guarantee error-free performance. A highly skilled, technically competent person can make glaring human 

errors.184 For example, an expert surgeon may amputate a patient’s right limb with technical precision 

only to realize later that the left one was to be removed.185 Second, within complex systems, “rules, 

regulations, policy or procedures cannot be written to address all the situations that people may face,”186

precisely because these systems can have emergent properties that are inherently unpredictable.187

Consequently, “expertise is required to recognize when the unexpected is present or may arise.”188 Thus, 

technical competency is only one aspect of an individual’s performance capabilities, and other nontechnical skills (NTS) are necessary to prepare individuals to manage the natural variability inherent 

within the complex system. Non-technical skills are meant to enhance human performance reliability in 

high-demand and high-risk work environments (e.g., the hospital operating room, the nuclear plant 

control room), 189 where innovation and adaptation by people are needed to successfully operate within 

imperfect systems.190

Akin to crew resource management (CRM)191 skills used in aviation, NTS are “the cognitive, social and 

personal resource skills that complement technical skills, and contribute to safe and efficient task 

 

183 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water The Gulf oil 

Disaster and the Future of Offshore Drilling; 2011; p 122.; National Commission on the BP Deepwater Horizon 

Oil Spill and Offshore Drilling. Chief Counsel's Report: The Gulf Oil Disaster; Feburary 17, 2011, pp 162, 185. 

184 Health and Safety Executive. Reducing Error and Influencing Behaviour; HSG48; 2009; pp 12-17. 

http://www.hseni.gov.uk/hsg_48_reducing_error_and_influencing_behaviour.pdf (accessed October 7, 2015). 

185 This scenario is based upon the example given in Flin, R.; O'Connor, P.; Crichton, M. Safety at the Sharp End; 

Ashgate Publishing: Hampshire, England, 2008; p 10. 

186 Pupulidy, I. Novices, Experts & Errors: Toward a Safer Fire Ground; Wildfire 2015, 24 (1), p 33.

187 Dekker, S. Drift into Failure: From Hunting Broken Components to Understanding Complex Systems; Ashgate 

Publishing: Burlington, VT, 2011; pp 155-160. Weick, K.; Sutcliffe, K. Managing the Unexpected: Resilient 

Performance in an Age of Uncertainty, 2nd ed.; John Wiley & Sons, Inc: San Francisco, CA, 2007. 

188 Pupulidy, I. Novices, Experts & Errors: Toward a Safer Fire Ground; Wildfire 2015, 24 (1), p 33.

189 Flin, R.; O'Connor, P.; Crichton, M. Safety at the Sharp End; Ashgate Publishing: Hampshire, England, 2008, p 

1.

190 Pupulidy, I. Novices, Experts & Errors: Toward a Safer Fire Ground; Wildfire 2015, 24 (1), p 33.

191 Crew Resource Management (CRM) is defined as “a management system which makes optimum use of all 

available resources—equipment, procedures and people—to promote safety and enhance the efficiency of ... 

operations.” The focus of CRM training is on cognitive and intrapersonal skills. (Civil Aviation Authority. Crew 

Resource Management (CRM) Training, Guidance for Flight Crew, CRM Instructors and CRM Instructor 

Examiners; CAP 737; Chapter 1, Sections 2.1 and 2.2.)

000756
Macondo Investigation Report Volume 3 4/17/2016

68 

performance.”192 As defined in Table 1-4, they focus on situation awareness, decision-making, 

communication, teamwork, leadership, and stress and fatigue management.

193 

Table 1-4. Non-technical skill categories, definitions, and example behaviors associated with each.

194

Skill Category Definition Types of Behaviors

Situation 

awareness

Developing and maintaining a dynamic 

awareness of the situation and the risks 

present during a wells operation, based on 

gathering information from multiple sources 

from the task environment, understanding 

what the information means, and using it to 

think ahead about what may happen next.

• Gathering information

• Understanding information and risk 

status

• Anticipating future developments

Decision-making

Diagnosing the situation and reaching a 

judgment to choose an appropriate course of 

action.

• Identifying and assessing options

• Selecting and communicating an option 

• Implementing and reviewing decisions

Communication

Exchanging (transmission and reception) of 

information, ideas and feelings, by verbal 

(spoken, written) or non-verbal methods.

• Briefing and giving feedback

• Listening

• Asking questions

• Communicating assertively

Teamwork

Working in a group, in any role, to ensure 

joint task completion, including

coordination, cooperation and conflict 

resolution.

A core concept of CRM training is not 

necessarily to strengthen any particular team 

but rather to make individuals more effective 

in whichever team they are working in.195

• Understanding own role with the team

• Coordinating tasks with team 

members/other shift

• Considering and helping others

• Resolving conflicts

Leadership

Directing, managing, and supporting a team 

in order to accomplish tasks for set targets.

• Planning and directing

• Maintaining standards

• Supporting team members

Stress and Fatigue 

Management 

Mitigating the effects of stress and fatigue. • Identifying signs of stress and fatigue

• Coping with effects of stress and fatigue

 

192 Flin, R.; O'Connor, P.; Crichton, M. Safety at the Sharp End; Ashgate Publishing: Hampshire, England, 2008, p 

1.

193 Ibid. ; IOGP. Crew Resource Management for Well Operations; 501; April, 2014; p 12. 

http://www.ogp.org.uk/pubs/501.pdf (accessed October 7, 2015).

194 Except where specifically footnoted, this information is extracted and compiled from IOGP Crew Resource 

Management for Well Operations; 501; April, 2014; pp 12-15. http://www.ogp.org.uk/pubs/501.pdf (accessed 

October 7, 2015).

195 Flin, R.; O'Connor, P.; Crichton, M. Safety at the Sharp End; Ashgate Publishing: Hampshire, England, 2008; p 

93.

000757
Macondo Investigation Report Volume 3 4/17/2016

69 

Aviation provides perhaps the most notable example of focused effort to develop individuals’ nontechnical skills, where this effort came to fruition after recognition that aviation accidents were not 

primarily the result of technical problems or lack of technical knowledge of the crew, but due to the 

crew’s inability to understand their situation and respond appropriately.196 The Tenerife runway collision 

that killed 538 individuals in 1977 is one of the more well-known examples. The black box recordings of 

the two cockpits and air traffic control communications provide unique insight into non-technical aspects 

of their interactions that might have contributed to the event. The transcript of these communications 

reveals usage of vague and nonstandard language, hesitation by lower ranked individuals to assertively 

question higher ranked personnel, unclear communication of decisions among teams, and an insufficient 

verification of understanding verbal messages.197 United Airlines also experienced a significant accident 

in 1978, in which similar interpersonal behaviors were identified as contributory, and in 1979 the 

National Transportation Safety Board issued a recommendation requiring flight crew training in resource 

management skills.198 Two years later, United initiated the first US crew resource management 

program.199 

The offshore oil and gas industry does not have the benefit of black box recorders to examine critical 

interactions between its well control personnel for both assessment and further improvements. Yet 

Macondo provides a unique set of data to explore potential non-technical skill gaps—the behavior and 

actions of the both on and offshore crew and management in the hours leading up to the gas release onto 

the rig underscore the importance of non-technical skills development in offshore high-risk operations. 

Three specific examples from the activities leading up to the blowout are (1) the 80 minutes when the 

toolpusher, driller, well site leader, and others discussed pressure discrepancies between the drillpipe and 

kill line, (2) when the well site leader mentioned those discrepancies to the onshore drilling engineer, and 

(3) the interactions of the mudlogger with others from the well operations crew in monitoring the well. An 

analysis of these situations is presented here to demonstrate that systematic application of various NTS 

could have altered the interactions between rig personnel for the better. 

 

196 Civil Aviation Authority. Crew Resource Management (CRM) Training, Guidance for Flight Crew, CRM 

Instructors and CRM Instructor Examiners; CAP 737; Chapter 1, Section 1.1 and 2.2.

197 An annotated transcript of these communications is available here: http://www.pbs.org/wgbh/nova/space/finaleight-minutes.html (accessed December 7, 2015). 

198 NTSB, Aircraft Accident Report: United Airlines, Inc., Douglas DC-8-54, N8082U, Portland, Oregon, December 

28, 1978 (NTSB-AAR-79-7), 1979, Washington, DC.; Helmreich, R. L.; Merritt, A. C.; Wilhelm, J. A. The 

evolution of crew resource management training in commercial aviation; International Journal of Aviation 

Psychology 1999, 9(1), p 19.

199 Helmreich, R. L.; Merritt, A. C.; Wilhelm, J. A. The evolution of crew resource management training in 

commercial aviation; International Journal of Aviation Psychology 1999, 9(1), p 19.

000758
Macondo Investigation Report Volume 3 4/17/2016

70 

1.7.1 Case Study for NTS: Pressure Discrepancies between Drillpipe and Kill 

Line

Despite its limitations,200 the evidence and testimony from surviving witnesses provides sufficient 

information to perform a simple assessment of when the toolpusher, driller, well site leader and others 

discussed the pressure discrepancies between the drillpipe and kill line. (See the solid green shaded 

portion of Figure 1-10.) The well operations crew, less the mudlogger, spent 80 minutes discussing the 

negative test results and their implications. This discussion suggests that the crew did, in fact, recognize 

that the well data they were examining were atypical enough to warrant further observations and 

consideration. Yet, the survivors’ testimonies reveal a lack of discussion about the possibility of well 

integrity loss—as if the crew could not conceive this possibility. Why? What can be done to help crews 

recognize when they are falling into such a mental trap? Table 1-5 highlights evidence suggesting the well 

operations crew exhibited ineffective use of non-technical skills. 

Table 1-5. Multiple Interpersonal Behaviors and Interactions amongst Well Operations Personnel 

Demonstrate Need for Non-technical Skills. 

Testimony Illustrating Interpersonal Behaviors of the Well 

Operations Crew

Relevant Non-technical Skills (using options 

listed in Table 1-4) 

An experienced and highly-esteemed toolpusher explained 

the negative test results as something that “happens all the 

time,” 201 and the driller confirmed that he had seen these 

results before.202

• Situation awareness (gathering information, 

understanding information and risk status, 

anticipating future state/developments);

• Decision making (identifying and assessing 

options); 

• Implementing and reviewing decisions

Other crewmembers questioned the bladder effect 

explanation but ultimately agreed with the rationale.203

• Teamwork (resolving disparate 

opinions/conflict); 

 

200 There is limited testimony pertaining to the negative tests, and even where testimony exists, witnesses tend to 

contradict each other. The individuals most involved in the negative test discussion either refrained from giving 

testimony to the CSB and other post-incident civil and criminal hearings, or they did not survive the incident. 

201 The Toolpusher, who had significant on-the-job experience and received noteworthy remarks in his performance 

review as “extremely competent” and someone who “does all within his level of authority to prevent exposure to 

potentially compromising situations.” Internal Company Document, Transocean. 2009 Senior Supervisor 

Performance Appraisal - Performance Appraisal and Development Plan, October 31, 2009, TRN-MDL08076982, http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-52649.pdf (accessed 

October 7, 2015).

202 Internal Company Document, BP. Notes from Bob Kaluza Interview, April 28, 2010, BP-HZN-MBI00021276, 

see Exhibit 0005 http://www.mdl2179trialdocs.com/releases/release201302281700004/Daigle_KeithDepo_Bundle.zip (accessed October 7, 2015). 

203 Hearing before the Deepwater Horizon Joint Investigation, July 20, 2010 pp 90-91; Internal Company Document, 

BP. Notes from Don Vidrine Interview, April 27, 2010, BP-HZN-MBI00021424, see Exhibit 0006 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Pleasant_Christopher-Depo_Bundle.zip

(accessed October 7, 2015).

000759
Macondo Investigation Report Volume 3 4/17/2016

71 

• Communication (asking questions; being 

assertive);

• Situation awareness (understanding 

information and risk status)

The day shift WSL deferred to the toolpusher, saying “if you 

have seen this so many times before, it must be true.”204

• Situation awareness (understanding 

information and risk status); 

• Decision-making (identifying and assessing 

options; 

• Implementing and reviewing decisions);

• Communication (asking questions)

The night shift WSL coming on duty during the middle of 

the negative test process was teased for questioning the 

annular compression rationale.205 

• Teamwork (resolving disparate 

opinions/conflict, understanding role within 

team); 

• Communication (asking questions; being 

assertive);

• Situation awareness (understanding 

information and risk status); 

• Leadership (planning and directing)

The same WSL focused on performing the negative test as 

stated in the permit submitted to the regulator. When the test 

on the kill line was conducted, as stipulated in the permit, 

there was no flow for 30 minutes which he took as 

confirmation that the well was secure. 

• Situation awareness (understanding 

information and risk status);

• Decision-making (identifying and assessing 

options;

• Implementing and reviewing decisions);

• Communication (asking questions)

The night shift WSL reported looking for changes in the 

pressure readings rather than the absolute pressure in the 

well. As a result, although 1400 psi was indicated on the 

drillpipe, it remained stable, which he stated indicated to him 

that no gas was coming up the well.206 

• Situation awareness (understanding 

information and risk status);

• Decision-making (identifying and assessing 

options, implementing and reviewing 

decisions);

• Communication (asking questions)

There was a lack of explicit coordination with the mudlogger 

and a need for the well operations crew and mudlogger to 

articulate their expectations for the mudlogger’s monitoring 

• Situation awareness (gathering information; 

understanding information and risk status); 

• Decision-making (identifying and assessing 

options; communicating the options chosen); 

 

204 Internal Company Document, BP. Notes from Bob Kaluza Interview, April 28, 2010, BP-HZN-MBI00021277, 

see Exhibit 0005 http://www.mdl2179trialdocs.com/releases/release201302281700004/Daigle_KeithDepo_Bundle.zip (accessed October 7, 2015).

205 Internal Company Document, BP. Notes from Don Vidrine Interview, April 27, 2010, BP-HZN-MBI00021424, 

see Exhibit 0006 http://www.mdl2179trialdocs.com/releases/release201302281700004/Pleasant_ChristopherDepo_Bundle.zip (accessed October 7, 2015).

206 Ibid., BP-HZN-MBI00021424, 

000760
Macondo Investigation Report Volume 3 4/17/2016

72 

role throughout the displacement stages.207 (See also 

Sections 1.6 and 1.7.1.1.)

• Communication (giving feedback; asking 

questions; being assertive); 

• Teamwork (understanding role within team; 

coordinating tasks with team members)

Decision-making is a two-stage cognitive process: (1) what is the problem (situation assessment) and (2) 

what shall I do?208 The situation assessment of the negative test was inaccurate. “If the situation 

assessment is incorrect, then it is likely that the resulting decision and selected course of action that is 

taken in response will not be suitable.”209 This can occur when “conditions change so insidiously that the 

operators do not update their situation assessments often enough”, and when “the current situation has 

altered to some extent from the expected situation and that remedial actions are required to return to the 

planned path.”210 “Sources of failure in team decision-making, according to Orasanu and Salas (1993), 

include poor communication, logical errors, inadequate situation assessment and pressure to conform.”211

The evidence described in Table 1-5 suggests that improvements in non-technical skills of personnel 

involved in offshore well operations decision-making and implementation would benefit major accident 

prevention.212 

1.7.1.1 Role of Mudlogger

During displacement of the riser, communication was inadequate. The mudlogger was identified postincident as a perceived independent layer of protection, yet he was not privy to all pertinent information 

to fulfill this protective role. Indeed, there was not a shared situation awareness of the well, in part 

because the mudlogger was separate from the well operations crew and unaware of the rig activities that 

impacted his understanding of the data he was meant to monitor. 

Communication in offshore operations, like any high-hazard work environment, is vital for successful 

completion. Figure 1-12 shows the various communication channels expected to be effectively 

functioning during drilling and completion activities. 

 

207 Both explicit coordination and articulated expectations are characteristics of highly effective teams. See Flin, R.; 

O'Connor, P.; Crichton, M. Safety at the Sharp End; Ashgate Publishing: Hampshire, England, 2008, p 109. 

208 Ibid., p 45. 

209 Ibid., p 46. 

210 Ibid. 

211 Ibid., p 113. IOGP. Crew Resource Management for Well Operations; 501, April 2014, p, 12. 

http://www.ogp.org.uk/pubs/501.pdf (accessed October 7, 2015).

212 Others have analyzed the effectiveness of non-technical skills usage at Macondo. For example, Roberts, Flin and 

Cleland examined the well operation crew’s situational awareness via content analysis of eight official 

investigation reports of the event as well as eight transcripts from two court hearings. See Roberts, Flin & 

Cleland. Everything was fine: An analysis of the drill crew’s situation awareness on Deepwater Horizon. Journal 

of Loss Prevention in the Process Industries (38), 2015, pp 87-100.

000761
Macondo Investigation Report Volume 3 4/17/2016

73 

Figure 1-12. Intricate Communication Routes of Well Operations Personnel. 

Both mudloggers gave testimony post-Macondo that they were uncomfortable with the multiple fluid 

movements and transfers between pits and off the rig.213 While the day mudlogger voiced concerns, the 

transfers continued.214 The night shift mudlogger confirmed that he did not speak up about this 

discomfort.215 Considering the hierarchical organizational structure of the rig, the well service provider, as 

a client of the operator (i.e., BP), is perceived to be below that of the driller and assistant driller who are 

primary members of well control operations crew. A hesitation to be assertive with concerns by “lower” 

ranking individuals was a critical interpersonal behavior that CRM was meant to counter in the aviation 

industry. 

 

213 Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, pp 31-32; Internal Company 

Documents, BP. Interview with Service Data Mudlogger, May 26, BP-HZN–BLY00161924.

214 Internal Company Documents, BP.

215 Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, pp 31, 181.

000762
Macondo Investigation Report Volume 3 4/17/2016

74 

Four transfers occurred between 9:10 p.m. and 9:35 p.m., and the displacement went to two pits. The 

night shift mudlogger attributed these fluid transfers to some of the data he was seeing.216 There is some 

conflicting testimony by the mudlogger regarding if and how often he communicated with others from the 

well operations crew (e.g., the assistant driller, a mud engineer) concerning the rig activities and well data 

in the hours leading up to the release of mud onto the rig (Table 1-6). However, various purported 

exchanges between him and other well operations crew evinces a need for improved communications, 

including adequate feedback that the verbal messages and their implications were understood, as well as 

sufficiently shared situation awareness of the well and rig conditions among the entire well operations 

crew. 

The testimony highlighted in Table 1-6 illustrates the challenges faced by the mudlogger. Communication 

is more difficult when the parties are not co-located. The mudlogger was only a short distance from the 

driller’s cabin, but he was not privy to the same visual217 and verbal information, nor to the context of that 

information. 

Good practice guidance created post-Macondo identifies the mudlogger as “top priority” support 

personnel within the wells operations team (along with the roughneck and derrickman). As such, 

mudloggers should receive NTS training along with the driller, assistant driller, toolpusher, company man 

(i.e., WSL), drilling supervisor, rig manager, superintendent, and well services supervisor.218

Improvements in team communication, both in training and in everyday application of this non-technical 

skill, between the various wells operations personnel would be beneficial. If the mudlogger had the 

requisite NTS, the limited access to well information that hindered his ability to act as an independent 

layer of protection might have been overcome. 

 

216 Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, pp 218-219.

217 Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, p 122.

218 IOGP. Crew Resource Management for Well Operations; 501; April, 2014; Table 1, p 6. 

http://www.ogp.org.uk/pubs/501.pdf (accessed October 7, 2015). 

000763
Macondo Investigation Report Volume 3 4/17/2016

75 

Table 1-6. Summary of communications between Mudlogger and Other Well Operations Crewmembers 

the evening of April 20, 2010. 

Date and Source 

of Testimony

Transcript excerpts and information concerning the Mudlogger’s communication 

with others from the well operations crew

December 7, 2010

Joint United 

States Coast 

Guard/Bureau of 

Ocean Energy 

Management 

Investigation

When he noticed that the mud pumps were being brought online in a “staggering” 

manner during the final displacement and called an assistant driller to find out why, the

assistant driller said, “That’s the way we’re going to do it this time.”219

He also spoke with the mud engineer when he noticed a gain in one of the active pits, 

although he could not recall the time. The mud engineer informed him that “they were 

moving mud out of some sand traps.”220

No other communications with the well operations crew during his shift were 

identified.

221

March 13, 2013

United States 

District Court, 

Eastern District of 

Louisiana, Civil 

Action no. 10-

MD-2179 “J”

Based upon examination of the data post-incident, at around 9:13 p.m. he noticed that the 

mud pumps were being brought online in a “staggering” manner.222 He called an

assistant driller to find out why, and the assistant driller “said, we’re just doing it like 

that. He abruptly hung up.”223 Within minutes, he noted a spike in the standpipe 

pressure.224 He called again to inquire, and was told that the crew, “had a valve lined up 

wrong, and we blew a pop-off, and we’re sending a crew down there.”225 No other 

information was provided to him regarding the matter.226 

Earlier in his shift, around 8:30 p.m., the mudlogger called the mud engineer regarding a 

slow gain he was detecting in the active pit, and the engineer said that “they were 

flushing out one of the sand traps into the active pit.”227 Prior to that time, no one 

informed the mudlogger that this activity was to be undertaken.228

Overall, he was not informed about the fluid movements occurring onboard the rig the 

evening of April 20.229

 

219 Hearing before the Deepwater Horizon Joint Investigation, December 7, 2010, pp 177 and 216.

220 Ibid, pp 178-179.

221 Ibid, pp 177-178.

222 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 13, 2013, pp 3605- 3606, 

http://www.mdl2179trialdocs.com/releases/release201303131200011/2013-03-13_BP_Trial_Day_11_AMFinal.pdf (accessed October 7, 2015).

223 Ibid. 

224 Ibid., pp 3606-3607. 

225 Ibid., pp 3605-3606. 

226 Ibid., p 3606.

227 Ibid., p 3527-3528. 

228 Ibid., p 3528. 

229 Ibid., p 3603. 

000764
Macondo Investigation Report Volume 3 4/17/2016

76 

1.7.2 Case Study for NTS: Conversation between Well Site Leader and 

Onshore Engineer

This section dissects the purported phone conversation between the on-rig Well Site Leader (WSL) and 

the onshore Drilling Engineer (for simplicity, in this section referred to as ODE). Much focus was given 

to this conversation in the aftermath of the incident, as it was deemed a critical opportunity when the crew 

could have identified loss of well control and taken actions to secure the well.

The conversation was noted in interview summary write-ups conducted shortly after the incident,230

before many of the facts of the incident were known (Table 1-7). In the months after Macondo, both 

individuals took legal positions that protected them from giving sworn testimony at various civil and 

criminal legal proceedings. The CSB was unable to interview either individual directly, thus must restrict 

its analysis to the one existing trial deposition231 and the summaries of others. Nevertheless, the CSB

identifies opportunities for NTS improvement by examining the description of the phone conversation 

from the perspective of both individuals. 

Examining the conversation between the WSL and the ODE from each perspective gives clues as to the 

individuals’ situation awareness of the well conditions and the perceived purpose of the call. The WSL 

appears to be focused on the cement plug and the method for setting it.232 When the ODE suggests 

something may not be right with the negative test results, the WSL seems to dismiss conversation about 

the negative test, trying to refocus the ODE on the cement plug. The WSL reiterates that the negative test

was redone and the results were good. There is ambiguity about whether the pressure difference between 

the drillpipe and kill line was a problem only initially or with all negative tests. The WSL was seeking 

one-way communication (seeking info on setting the surface plug), not seeking feedback and advice on 

the negative test.

233 The purpose of the phone calls and the respective roles of the WSL and ODE are 

ambiguous and varied—sometimes to inform and other times to obtain information, advice, or instruction. 

 

230 BP Well Site Leader was interviewed by the BP Investigation Team on April 23 and 27, 2010, May 7 and 12, 

2010; Internal Company Documents, BP. Interview of Donald Vidrine, Well Site Leader on the Horizon Rig, April 

23, 2010, TRN-MDL-00265598, see Exhibit 3572 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Kaluza_Robert-Depo_Bundle.zip (accessed 

October 7, 2015) and Notes from Don Vidrine Interview, BP-HZN-MBI00021424, 21427, 21429, see Exhibit 

0006 http://www.mdl2179trialdocs.com/releases/release201302281700004/Pleasant_ChristopherDepo_Bundle.zip (accessed October 7, 2015). BP Senior Drilling Engineer was interviewed by the BP 

Investigation Team on May 2, 2010 and July 8, 2010; Internal Company Documents, BP. Interview of Mark Hafle 

- Sr. Drilling Engineer, May 2, 2010, see Exhibit 0300, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Martin_Brian-Depo_Bundle.zip (accessed 

October 7, 2015) and BP Incident Investigation Team - Notes of Interview with Mark Hafle, July 8, 2010, BPHZN-BLY00103037, see Exhibit 0296 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Cowie_James-Depo_Bundle.zip (accessed 

October 7, 2015).

231 USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016.

232 In his February 18, 2016, testimony, the WSL states that he does not recall why he called the ODE, but he knows 

it was not to discuss the negative test. USA v. Robert Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 

470:17-471:6. 

233 The WSL confirms the purpose of the call as informational in his February 18, 2016 testimony. USA v. Robert 

Kaluza, Docket No. 12-CR-265, February 18, 2016, pp 471:7-472:24, 511:12-19.

000765
Macondo Investigation Report Volume 3 4/17/2016

77 

Table 1-7. Interview statements concerning conversation between the on-rig Well Site Leader (WSL) and the onshore drilling engineer (ODE); 

names have been replaced with title abbreviations. 

Interview Excerpts from Interview Notes/Summaries Assessment of the Interpersonal Behaviors being described and the 

Identified Potential Non-technical Skills Failures

WSL 

Interview 

April 27, 

2010

WSL 

statements 

as 

summarized 

by various 

interviewers 

(same 

interview)

Called ODE to discuss surface plug. [Later in the testimony] ODE called back 

while displacing @ +/- 9 p – not sure why he called – curious about how things 

going.234

Called ODE to discuss surface plug, said still watching stripping tank, dripping 

had stopped and everything looked fine.235

ODE calls to check. He tells ODE negative test was squirrelly. Told ODE no 

problems.236

The 1400 psi was the difference between the mud in the riser. This was annular 

compression – they (toolpusher, etc) said it does that all the time. If we have 

1400 psi on the drill pipe we should see it on the kill line? Let’s bleed it off and 

see—the kill line was bled then stopped.

I then went to call ODE. When I came back they were still watching the 

stripping tank and the dripping had stopped. Everything looked fine. 

[Later in the testimony] I talked to ODE about the 1400—said that if there had 

been a kick in the well we would have seen it.237

Reveals uncertainty about the purpose of the call 

– communication (briefing, asking questions);

– teamwork (understanding role, coordinating tasks)

Purpose of call appears to be for the WSL to inform only, not seek 

counsel. 

– teamwork (understanding roles)

Problem noted (“squirrelly” results), but not explored fully by either 

party 

– situation awareness (gathering information, understanding 

information and risk status, anticipating future states)

– communication (briefing and giving feedback, listening, asking 

questions, being assertive [on the part of the ODE])

– leadership (planning, directing, supporting)

Information is shared between the WSL and ODE implies that the 

possibility of a kick is not absent from their mindsets (“if there had been 

a kick in the well, we would have seen it”), but further discussion on 

this point is absent by either party. 

 

234 Internal Company Document, BP. Steve R. Notebook, BP-HZN-MBI00021407, see Exhibit 4953 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed October 7, 2015).

235 Internal Company Document, BP. Interview Notes Don Vidrine, BP-HZN-MBI00021424, see Exhibit 4953 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed October 7, 2015).

236 Internal Company Document, BP. Interview Notes Don Vidrine (Kent C. handwritten notes), April 27, 2010, BP-HZN-MBI00021415, see Exhibit 4953 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed October 7, 2015).

237 There are several sets of notes from the various interviews conducted by BP post incident; according to testimony given in the Multi-District Litigation 

hearing, the following document is a compilation of all interviewers’ notes from the April 27, 2010 interview: Internal Company Documents, BP. See Exhibit 

0303, http://www.mdl2179trialdocs.com/releases/release201302281700004/Martin_Brian-Depo_Bundle.zip (accessed October 7, 2015); Testimony given in 

the U. S. District Court for the Eastern District of Louisiana under the Multi-District Litigation docket MDL No. 2179, February 21, 2011 pp 34-35, see Martin 

Designations, http://www.mdl2179trialdocs.com/releases/release201302281700004/Martin_Brian-Depo_Bundle.zip (accessed May 22, 2015); Internal 

000766
Macondo Investigation Report Volume 3 4/17/2016

78 

– situation awareness (gathering information, understanding 

information and risk status, anticipating future states)

– communication (briefing and giving feedback, listening, asking 

questions, being assertive [on the part of the ODE])

– leadership (planning, directing, supporting)

ODE 

Interview 

May 2, 2010 

ODE 

statement as 

summarized 

and 

compiled by 

various 

interviewers

While watching monitors of rig activity while he worked he received a call at 

8:52 pm from WSL. Loss the phone connection—he called WSL back. 

WSL asked if they were going to test the plug? 

ODE asked WSL, “What’s going on?” WSL said the day crew screwed up the 

inflow test and he had to go up and run another test.

ODE asked WSL if everything was OK? WSL replied that nothing came out of 

the kill line. 

ODE said good night and hung up the phone.

Problem with negative test raised as a tangential item to the main 

purpose of the call, to ask the ODE about the surface plug. The WSL 

was not calling to seek counsel on the negative test, but shared info 

when prompted by ODE. 

Based on limited information shared and the manner of the exchanges, it 

appears the WSL provides answers to ODE’s questions to inform.

When the ODE asks about the test problem, The WSL shares very little 

information, and the ODE does not probe for additional information. 

The ODE does not request a follow-up.

– situation awareness (gathering information, understanding 

information and risk status, anticipating future states)

– communication (briefing and giving feedback, listening, asking 

questions, being assertive)

– teamwork (understanding role);

– leadership (planning, directing, supporting)

ODE 

Interview

July 8, 2010 

ODE 

statement as 

summarized 

and 

compiled by 

various 

interviewers

Later, on April 20, 2010, WSL called ODE at 8:52 p.m. to talk about how to 

test the surface plug and whether they should apply a pressure test or a weight 

test. ODE noted that WSL also talked to him about the negative tests. WSL told 

ODE that the crew had zero pressure on the kill line, but that they still had 

pressure on the drillpipe. ODE said he told WSL that you can’t have pressure 

on the drillpipe and zero pressure on the kill line in a test that’s lined up

properly. ODE said that he told WSL he might consider whether he had trapped 

pressure in the line or perhaps he didn’t have a valve properly lined up. WSL 

told ODE that he was fully satisfied that the rig crew had performed a 

successful negative test. ODE said he didn’t have the full context for what had 

transpired during the tests and it wasn’t clear to him whether WSL was talking 

Purpose of the call was to discuss the surface plug; discussion of 

negative test was tangential to that purpose.

When sharing the observed pressure data from the negative test, the 

ODE identifies a problem (“you can’t have pressure on the drill pipe 

and zero pressure on the kill line in a test that is properly lined up”), and 

identifies a potential solution. 

Yet the WSL rejects the suggestion of a problem (“fully satisfied”). 

ODE accepts judgment of WSL, assuming lack of context. He was at an 

onshore location separate from the crew, not part of the immediate team 

 

Company Document, BP. Interview Notes Don Vidrine (Kent C. handwritten notes), April 27, 2010, BP-HZN-MBI00021419-00021420, see Exhibit 4953

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed October 7, 2015). 

000767
Macondo Investigation Report Volume 3 4/17/2016

79 

about the first or second negative tests. WSL told him he watched the kill line 

for 30 minutes and didn’t see a drip come out of it, so ODE assumed that WSL 

had concluded that it was not a problem.238

conducting the work. ODE admits to lack of clarity but did not explore 

the issue further.

WSL provides ODE with evidence (lack of flow for 30 minutes on kill 

line) to further support is judgment. 

– situation awareness (gathering information, understanding 

information and risk status, anticipating future states)

– communication (briefing and giving feedback, listening, asking 

questions, being assertive [on the part of the ODE]) 

– teamwork (understanding role—was ODE meant to verify well 

data/decisions or only provide counsel when requested?)

– leadership (planning, directing; supporting)

 

238 Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with Mark Hafle, July 8, 2010, BP-HZN-BLY00103032, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00296.pdf (accessed October 7, 2015).; Testimony given in the U. S. Districk 

Court for the Eastern District of Louisiana under the Multi-District Litigation docket MDL No. 2179, April 9, 2013, pp 16-23, 

http://www.mdl2179trialdocs.com/releases/release201304090900024/2013-04-09_BP_Trial_Day_24_PM-Final.pdf (accessed May 22, 2015). 

000768
Macondo Investigation Report Volume 3 4/17/2016

80 

The WSL and ODE faced a number of challenges to effective communication the night of April 20, 2010. 

The offshore-onshore arrangement for this work team hinders its ability to have a shared understanding of 

the contextual aspects of the work environment and engenders a lack of awareness of each other’s roles 

and responsibilities.239 While the ODE had access to rig-based data on the well, it is not clear to what 

extent the ODE perceived, comprehended, or analyzed that data. In theory, such shared computer systems 

are meant to improve communication and understanding, but research shows that “information exchange 

is often less complete and the discussion more biased.”240 

Interestingly, post-incident the ODE stated that he couldn’t determine if the well was flowing from the 

data at his disposal because he didn’t know what was occurring on the rig, and he criticized the 

mudlogger company for less-than-desirable well monitoring performance. Yet the ODE had the same 

Sperry Sun software and rig data available to monitor as the mudlogger.241 Along the same lines as the 

drilling engineer, the mudlogger was not fully abreast of what was occurring on the rig during the time he 

was expected to monitor the well for flow. Additionally, when returns were routed overboard, the volume 

of fluids leaving the well could not be monitored. 242

Other seemingly ancillary factors may also have influenced the conversation between the WSL and ODE. 

For example, whether the individuals were relative strangers or long-time acquaintances could influence 

the tone and style of the discussion, as well as unspoken agreements about the purposes of such calls. A 

less formal, more casual informational conversation would be more typical of the latter, even when 

organizational hierarchies may suggest otherwise. In this case, however, the organizational hierarchy 

within BP was such that the ODE did not have direct line management accountability over the WSL.243

He was not meant to instruct or give orders but to counsel, and it appears that this counsel could be freely 

given or solicited; thus, neither party expected the ODE to explicitly probe or verify the decisions of the 

WSL. As far as they were both concerned, the point of the call was to discuss the next steps in the 

temporary abandonment process, and the discussion of the negative test was incidental to the call.

This organizational arrangement may not be atypical for industry. The onshore drilling engineer, while 

identified as part of the larger group of well operations team, is not included in the top 17 wells roles 

 

239 Flin, R.; O'Connor, P.; Crichton, M. Safety at the Sharp End; Ashgate Publishing: Hampshire, England, 2008, p 

77. 

240 Ibid. 

241 Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with Mark Hafle, July 8, 

2010, BP-HZN-BLY00103037, see Exhibit 0296 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Cowie_James-Depo_Bundle.zip (accessed 

October 7, 2015), and Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, February 10, 2011, see Corser designations Vol 1, pp 83-84, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Corser_Kent-Depo_Bundle.zip (accessed 

October 7, 2015).

242 The Senior Toolpusher noted: “There was no way to monitor the volume of what was dumped overboard;”

Internal Company Document, Transocean. Senior Toolpusher Interviewing Form, May 28, 2010, TRN-MDL00493744, http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-50296.pdf (accessed 

October 7, 2015). 

243 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The 

Gulf Oil Disaster; Feburary 17, 2011, p 31.

000769
Macondo Investigation Report Volume 3 4/17/2016

81 

examined for CRM applicability in the latest offshore guidance.244 This suggests that the role of the ODE 

in such a situation had not been identified as a critical opportunity for decision-making input into well 

operations. 

In the aftermath of Macondo, assertions have been made that this conversation should have led to a 

decision to shut-in the well. If communication between shore engineering support is to be designated a 

useful barrier for the mitigation of well influx, then roles and responsibilities for both parties must be 

explicitly defined. The development and incorporation of NTS into everyday practices within the work 

environment often includes improved protocols for communication, decision-making, and role clarity that 

would improve performance for a wide range of interpersonal relationships. 

1.7.3 Integration of Non-technical Skills

To improve team interactions and counter situations such as in the examples above, the aviation industry 

(and other high-hazard industries, such as nuclear) introduced crew resource management into the 

everyday operational performance of flight crews. In 2006 the NTSB placed CRM improvements on its 

Most Wanted List, and five years later the Federal Aviation Administration (FAA) published the final rule 

to require CRM training for all crewmembers, including pilots and flight attendants.245 

In the oil and gas industry, the concept of non-technical skills is not completely foreign. The UK offshore 

regulator, the Health Safety Executive (HSE), honed in on the importance of non-technical skills for line 

management personnel when it conducted a 2010 human and organizational factors inspection of four 

Transocean rigs in the North Sea. The HSE identified an absence of training for supervisors, including 

OIMs and senior/say toolpushers, in interpersonal leadership capabilities, finding that a number of these 

supervisors were put in managerial positions “with no skills or training to support them in this role.”246

The inspection noted that interviews with personnel revealed “there is no training once staff are promoted 

above driller level ... This reinforces the view that training is focused on technical skills, rather than 

management or non-technical skills.”247 These inspection findings are relevant when considering that 

some of the primary decision-makers on the negative test results were the Transocean toolpushers and 

OIM, as well as the BP Wells Site Leaders.248 Transocean and BP are not unique. Industry has 

acknowledged needed improvements in the non-technical skills of offshore facility personnel. In its report 

on the lessons learned from the Deepwater Horizon, OLF suggested CRM be considered for well 

activities on the Norwegian Continental Shelf.249 And various international industry associations have 

 

244 IOGP. Crew Resource Management for Well Operations; 501; April, 2014, Table 1, p 6. 

http://www.ogp.org.uk/pubs/501.pdf (accessed October 7, 2015).

245 NTSB, We are safer, http://www.ntsb.gov/safety/mwl/Pages/was2.aspx, (accessed October 9, 2015) 

246 HSE, Specialist Inspection Report, Offshore Division Human and Organizational Factors Team. TransoceanHuman & Organizational Factors Intervention; July - October, 2009, p 4.

247 Ibid., pp 23-25, 27.

248 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water The Gulf oil 

Disaster and the Future of Offshore Drilling; 2011, pp 107-109.

249 Norwegian Oil Industry Association (OLF). Deepwater Horizon: Lessons learned and follow-up; May, 2012; 

Section 2.3.9, pp 29-30, recommendation No. 29.

000770
Macondo Investigation Report Volume 3 4/17/2016

82 

since developed non-technical skills training guidance,250 while some companies are exploring methods 

of incorporating such skill development into the curriculum of their offshore personnel. Yet, at this time, 

no US regulatory requirements or guidance for such training have been established. 

It has been suggested that an organization that embodies the characteristics of an HRO (high reliability 

organization) encourages and continually develops the non-technical skills expertise of its personnel.251

Training, practice, and assessment of people’s NTS must be an integral part of everyday activity. “[T]he 

level of transfer will depend on the prevailing organizational culture at the worksites .... The training 

instructions have to be reinforced at the worksite, where observation and constructive feedback on well 

crewmembers’ non-technical skills should become part of the normal way of operating at the worksite. 

The language of CRM should become part of everyday worksite discussions.”252 Furthermore, “the course 

content should be informed by an ongoing human factors analysis of task performance during well 

operations, especially in relation to the detection and management of control problems.”253 Finally, 

communication training should be an inherent component of each module of CRM training, and standard 

communication terminology and phraseology should be embedded within technical training so that good 

communication practices are intimately associated with the technical aspects of the work.254

 

250 IOGP produced two guidance documents, Crew Resource Management for Well Operations; Report No. 501, 

April, 2014. http://www.ogp.org.uk/pubs/501.pdf (accessed October 7, 2015) and Guidelines for Implementing 

Well Operations Crew Resource Management training, Report No. 502, December 2014; 

http://www.iogp.org/pubs/502.pdf (accessed October 7, 2015); Oil & Gas UK published Guidelines on 

Competency for Wells Personnel, Issue 1 (January 2012); the Energy Institute developed Guidance on Crew 

Resource Management (CRM) and Non-technical Skills Training Programmes, 1st ed., 2014. Also, the 

International Association of Drilling Contractors offers a resource database of both technical and non-technical 

competencies for a wide array of offshore job positions, see http://www.iadc.org/knowledge-skill-and-ability/.

251 Thorogood, J. L.; Crichton, M. T. Threat-and-error management: the connection between process safety and 

practical action at the worksite; SPE Drilling & Completion 2014, December, pp 465-471.

252 IOGP. Crew Resource Management for Well Operations; 501, April, 2014, p 19. 

http://www.ogp.org.uk/pubs/501.pdf (accessed October 7, 2015).

253 Ibid. 

254 Ibid. 

000771
Macondo Investigation Report Volume 3 4/17/2016

83 

Drilling is increasing in complexity as wells are drilled at greater and greater depths with high degrees of 

coordination between various companies (operators, drilling contractors, multiple well service providers) 

with specialized expertise. Such complexity impairs predictability of all potential safety challenges; thus, 

risk assessments of such operations will likely not identify all of the possible scenarios. Variability is 

inevitable, and NTS or CRM training will help prepare personnel and management to be resilient to that 

variability.

1.8 Work-as-Imagined Versus Work-as-Done: The Operator/Drilling 

Contractor Gap

Offshore drilling and well completion involves the complex interaction of multiple employers, including 

the leaseholder/operator (e.g., BP) and drilling contractor (e.g., Transocean), and other essential service 

providers (e.g., Sperry Sun255). In offshore drilling operations, the drilling contractor brings the 

infrastructure (drilling rig), supplies the majority of the workforce, and has more direct control over the 

primary operations (drilling) and emergency response (well control). The operator, though, is responsible 

for the well’s design and drilling program, which form the basis for establishing safe drilling operations, 

and should account for site-specific conditions that could increase the risk or complexity of the 

contractor’s various drilling and well control operations. 

Successful execution of a drilling program requires that the operator and the drilling contractor actively 

work to bridge the gap between work-as-imagined (WAI) in the drilling program and work-as-done 

(WAD) by the well operations crew. 256 In essence, WAI describes what well designers and managers 

expect will or should happen at the well, while WAD is what the well operations crew actually does. 

There is a natural gap between WAI and WAD because it is not possible to write a drilling program that 

 

255 See Volume 1, p 9 for a description of other well service providers hired by BP to help drill the Macondo well.

256 Dekker, S., Chronicling the Emergence of Confused Consensus: Work as Imagined versus Work as Actually 

Done, chapter 7, pp 86-90, within Hollnagel, E., Woods, D.D., and Leveson, N., eds., Resilience Engineering: 

Concepts and Precepts, Ashgate Publishing: Hampshire, England, 2006. 

Non-technical Skills and Organizational Culture

In the post-Macondo world, increasing personnel proficiency in NTS is critical for 

those working in the dynamic and high-hazard offshore work environment. However, 

training on NTS is not enough. Like so many other safety system components, 

inculcating non-technical skills will be successful only if the organization itself places 

importance on it. Evolving to high levels of operational discipline will promote NTS 

usage in everyday activity. †

† Thorogood, J. L.; Crichton, M. T. Threat-and-error management: the connection between process 

safety and practical action at the worksite; SPE Drilling & Completion 2014, December, pp 465-471.

000772
Macondo Investigation Report Volume 3 4/17/2016

84 

foresees all circumstances and covers every detail, or that crewmembers can follow exactly as written.257

Reality and necessity require that well operations crews continually adjust to accommodate current work 

conditions in order to achieve the desired work goals. 

To minimize that gap between WAI and WAD in offshore drilling, the operator and drilling contractor 

generally rely upon the knowledge and experience of their well site leaders and well operations crew, but 

they should also focus on building a resilient process that can “adjust its functioning prior to, during or 

following changes and disturbances so that it can sustain required operations under both expected and 

unexpected conditions.”258 Ideally, the safety management systems of the operator and drilling contractor 

will reinforce one another (and sometimes overlap) to continually develop a workforce adept in technical 

and non-technical skills, evaluate various well and rig specific scenarios, create rig/well specific 

procedures, and identify risk reduction measures. If done effectively, this process would help maximize 

drilling contractor or operator practices that lead to a more resilient process which can adapt to and 

successfully manage the evolving risk of a drilling operation. 

Numerous Macondo investigation reports commented on the minimal detail provided to the Deepwater 

Horizon crew for the negative test and temporary abandonment procedures, 259 but it is important to 

review the operational structures in both companies that permitted the situation to evolve as it did. To 

deconstruct the gap between WAI and WAD that occurred at the Macondo well, this section explores 

BP’s development and communication of the temporary abandonment plan, the Deepwater Horizon’s

displacement and negative test procedures, and both companies’ management of change programs. By 

exploring these topics, the CSB demonstrates how to minimize the WAI and WAD gap. 

This analysis highlights the following key findings: 

• BP’s development of the Macondo Temporary Abandonment (TA)260 plan occurred without a 

formal process, creating conditions for a TA design that lacked assessment of decisions, including 

review of internal policies and standards for quality control;

 

257 Dekker, S., Chronicling the Emergence of Confused Consensus: Work as Imagined versus Work as Actually 

Done, chapter 7, p 86, within Hollnagel, E., Woods, D.D., and Leveson, N., eds., Resilience Engineering: 

Concepts and Precepts, Ashgate Publishing: Hampshire, England, 2006. 

258 Hollnagel, E. Prologue: The Scope of Resilience Engineering. In Resilience Engineering in Practice: A 

Guidebook; Hollnagel, E., Paries, J., Woods, D. D., Wreathall, J., eds.; Ashgate: Surrey, UK, 2011, p xxxvi.

259 National Academy of Engineering and National Research Council of the National Academies. Macondo Well – 

Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety; The National Academies Press: 

Washington, D.C., 2011, p 32.; BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; pp 

85.; Transocean. Macondo Well Incident: Transocean Investigation Report Volumes I and II; June, 2011; pp 85-

86.; USCSB, 2014. Explosion and Fire at the Macondo Well, Gulf of Mexico, April 20, 2010, Report No. 2010-

10-I-OS, Appendix 2-A, p 42, 

http://www.csb.gov/assets/1/19/Appendix_2_A__Deepwater_Horizon_Blowout_Preventer_Failure_Analysis1.pdf

(accessed October 7, 2015), June 2014.

260 While the Macondo TA plan included choices on the production casing design (e.g., long string vs. liner, 

Sizes/grades of pipe, etc.) and other abandonment features (e.g., BOP/riser retrieval, rig clean-up, surface cement 

plug etc.), for purposes of the CSB analysis in this Volume, the TA plan discussion will be limited to the negative 

test and displacement of the well. The CSB previously discussed the placement of the surface cement plug; 

Volume 1, pp 18, 25.

000773
Macondo Investigation Report Volume 3 4/17/2016

85 

• BP sent a final written “Forward Plan” to the Transocean well operations crew concerning the TA 

plan on April 16, 2010, and those instructions lacked any mention of the negative test. Ultimately, 

a drilling fluids specialist from M-I SWACO provided written negative test instructions to the 

well operations crew on the afternoon of April 20.261

• Post-incident, BP described the negative test procedure as “broad, operational guidelines” and 

that it expected the Deepwater Horizon rig crew to use “the method consistent with their regular 

practice on prior wells.”262 The broad nature of the procedure implies that the Transocean drilling 

team and BP well site leaders would deal with any problems occurring during the TA plan by 

employing their knowledge, experience and skills. Missing from the process were tools that could 

have minimized the gap between WAI and WAD, such as written work plans or safety critical 

procedures. 

• Transocean did not enforce its own policy to utilize written Standing Instructions to the Driller, 

which a previous Transocean incident investigation noted should “raise awareness and [...] 

highlight” underbalanced conditions in a well when a single barrier is present.263

• The lack of safety critical task identification or incorporation of hazard controls in the TA 

procedures provided to the Deepwater Horizon crew did little to emphasize or optimize crew 

performance;

• Transocean did not follow its corporate policies to meaningfully engage the workforce in 

managing risks posed by an activity through identifying effective barriers. (1) Transocean did not 

develop written safety critical procedures for negative tests and displacement of a riser, even 

though internal Transocean policies required them for the Macondo well. (2) Generic Deepwater 

Horizon safety critical procedures for displacement and negative tests did not identify potential 

major accident events like loss of well control or a blowout. Most of the identified hazards 

focused on personal safety or relatively minor spills of drilling mud on the rig and overboard. (3) 

Transocean was unable to identify an operational safety critical procedure that addressed the 

lineup of the diverter system for either normal or non-normal (i.e., emergency) operating 

conditions. 

1.8.1 BP’s Development and Communication of the Temporary Abandonment 

Plan 

BP manages the development and delivery of a well through a five stage-gate process that incorporates 

peer review by sub-surface specialists (geologists and geoscientists) as well as engineering and 

 

261 See discussion in Section 1.4 and summary of instruction in Table 1-3 for more details.

262 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010, p 85.

263 Internal Company Document, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, Exhibit 

5749, TRN-MDL-02840797, http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_DerekDepo_Bundle.zip (accessed October 7, 2015).

000774
Macondo Investigation Report Volume 3 4/17/2016

86 

operational specialists from the Drilling and Completions (D&C) business unit.264,265 Approval to move 

through the various stages is a formal process supported by documented risk assessments and assurances. 

BP policies and standards in the Drilling and Wells Operation Practice (DWOP)266 and related 

Engineering Technical Practices (ETPs)267 define the process. The DWOP and ETPs outline practices for 

drilling and well operations intended to minimize harm to people and the environment as well as to 

prevent accidents that could have a high negative impact either financially or to the company’s reputation. 

It follows that compliance to these policies and standards should reduce the risk of a drilling operation to 

levels that BP management deems acceptable.

The risks of a well can be broadly divided into two categories: those created or controlled through design 

and those created or controlled through execution of the design plan (referred to here as operational risk). 

Major design risks that could affect the safety and well-delivery schedule generally emerge early in the 

well-planning process. For example, drilling is easier and safer if the well design can avoid hazards such 

as natural pockets of gas or seafloor faults.268,269 For hazards that cannot be designed out of the well, 

mitigation measures affecting operational practices at the well can be adopted.270 For instance, design 

engineers of the Macondo well indicated that traditional kick tolerances were not practicable in deepwater 

wells like Macondo. As a result, they requested a dispensation from BP’s accepted kick tolerance271 as 

 

264 BP operations are divided into business units like the Gulf of Mexico Drilling & Completions or the Gulf of 

Mexico Exploration & Appraisal units. Individual business unit leaders oversee operations and performance of the 

units.

265 Internal Company Document, BP. Gulf of Mexico SPU: Drilling Engineering BtB Stage Gate Process (Well 

Level), Revision 1, November 30, 2009, Introduction, BP-HZN-2179MDL00284917, see Exhibit 1515

http://www.mdl2179trialdocs.com/releases/release201302281700004/Cocales_Brett-Depo_Bundle.zip (accessed 

October 7, 2015).

266 The DWOP is “a summary of the key elements of the DC&W [Drilling Completion & Wells] Engineering 

Technical Practices. It also encompasses a number of standard practices that are not the subject of the ETPs. 

Where any potential conflict or lack of detail exists, the ETP has primacy. It is important to note that the ETPs 

may contain important requirements over and above those summarised in this document and therefore 

conformance solely with this document does not ensure conformance with the ETPs or STPs [Site Technical 

Practicies] derived from those ETPs;” Internal Company Document, BP. GP 10-00 Drilling and Well Operations 

Practice, Issue 1, October 2008, BP-HZN-BLY000332264, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 2015).

267 BP developed written ETPs to ensure wells are designed, drilled, completed and maintained to consistent 

standards.

268 As defined by The Free Dictionary (http://www.thefreedictionary.com/geological+fault), a fault is “a crack in the

earth's crust resulting from the displacement of one side with respect to the other.” 

269 CSB interviews.

270 For example, there can be a pre-spud exercise known as “drilling the well on paper” to inform the crew of the 

well-specific hazards; e.g., Hearing before the Deepwater Horizon Joint Investigation, August 24, 2010 p 16. 

271 BP defines kick tolerance as the maximum volume of a kick influx that can be safely shut in and circulated out of 

the well without breaking down the formation at the open hole weak point;” Internal Company Document, BP. GP 

10-00 Drilling and Well Operations Practice, Issue 1, October 2008, "This document contains the practices that 

have been agreed by BP management as current and relevant for drilling and well operations.", BP-HZNBLY00034543, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed 

May 26, 2015).

000775
Macondo Investigation Report Volume 3 4/17/2016

87 

defined in the DWOP, and they indicated that the drilling contractor’s well control operations at Macondo 

would instead rely on upon other emerging technologies.272 

For development wells,273 where the geology is known with a high degree of confidence, the subsequent 

completion or temporary abandonment program may be developed, reviewed and approved either as part 

of the main program itself or as a separate document. However, for exploration and appraisal wells, as in 

Macondo, the outcome is not known a priori and the well may require production flow testing274 before 

either temporary or permanent abandonment. Under these circumstances, detailed planning is postponed 

to avoid wasted effort until the outcome is known.275 Being exploratory in nature, the Macondo well was 

drilled to collect data about the geology and quality of the oil and gas at its location.276 BP’s permit to 

drill highlighted the need to wait for an evaluation of the geology to determine final plans for the well, 

including whether it would ultimately be abandoned or converted to a production well.277 Consequently, 

BP did not develop a temporary abandonment plan for the well during the initial five stage-gate process. 

 

272 The request indicated, “Slow pump rates have previously been proven successful in circulating out influxes 

[kicks]. If unable to circulate out influx at reduced rates, bullhead techniques may be required;” Internal Company 

Document, BP. DCMOC-09-0048, Kick Tolerance less than 25 bbls with a 1.0 ppg kick intensity, July 10, 2009, 

BP-HZN-CSB00175983. The engineers completing the request cited BP’s own well control manual which states, 

“Traditional kick tolerance calculation is based on circulating the kick out. Deepwater drilling is subject to 

particular complications due to tight mud weight/fracture margins and high chokeline friction pressures which 

would render some wells non-drillable in compliance with policy. In such event, a different approach can be 

adopted based on keeping the problem downhole and utilising bullhead techniques or other emerging

technologies.” The well control manual does not specify the “emerging technologies” it is referring to.; Internal 

Company Document, BP. Well Control Manual: Volume 1 Procedures and Guidelines, Issue 3, BPA-D-002, 

December 2000, Deepwater Drilling Considerations, 1-5-10, BP-HZN-2179MDL00336023, see Exhibit 2389 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015). 

273 Wells drilled in a previously explored area where the geology of the field has been documented and has been 

shown to be suitable for production of oil and gas.

274 Well testing helps determine the how much and how fast a well will produce; Dyke, K. V. In Fundamentals of 

Petroleum; 4th ed.. The University of Texas at Austin, p 161.

275 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, June 30, 2011; see Little designations Vol 3, p 35, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Little_Ian-Depo_Bundle.zip (accessed 

October 7, 2015).

276 USCSB, 2014. Explosion and Fire at the Macondo Well, Gulf of Mexico, April 20, 2010, Report No. 2010-10-IOS, Volume 1, p 13 http://www.csb.gov/file.aspx?DocumentId=679 (accessed October 7, 2015). 

277 BP’s Application for Permit to Drill a New Well stated, “A decision on the way forward will be made following 

evaluation of the [12-1/4" x 14"] open hole interval. The well will either be P&A'd or temporarily abandoned for 

future completion. Once the final evaluation program is complete, a decision will be made as to whether to 

sidetrack, TA well, or PA the well.” If the well proved commercially viable, data concerning the well’s geology 

and hydrocarbon properties would be collected and used to create a production plan; alternatively, if the well was 

not viable, the data would be gathered to determine why the commercial predictions failed; Internal Company 

Document, BP. Form MMS 123A/123S Application for Revised New Well, October 29, 2009, 11; see Exhibit 

1336 http://www.mdl2179trialdocs.com/releases/release201302281700004/Paine_Kate-Depo_Bundle.zip 

(accessed October 7, 2015).

000776
Macondo Investigation Report Volume 3 4/17/2016

88 

As completion of the well neared, BP personnel developed a temporary abandonment program (Table 

1-8) in a process that generally aligned with the common company process. They:

278

• completed a high level risk assessment for the well;

• delayed the TA program preparation until the well was reasonably well configured; 

• followed the general process of TA program preparation, working out options and preparing, 

discussing, and finalizing a draft program;

• created a well design that conformed with policies described in the DWOP and ETPs, but the 

DWOP and ETPs did not address all temporary abandonment issues such as location of a surface 

cement plug279 or negative test; 

• expected teams to deal with unforeseen operational risks that materialized by employing their 

knowledge, experience, and skills.

Herein though lay an operational gap in BP’s well development process of the Macondo well. The 

Temporary Abandonment program was not reviewed through the stage-gate process, and it was not 

normal practice to do so.280After the initial draft of the TA program, changes to the negative test and final 

well design, including the location of the surface cement plug,281 were addressed through the 

Management of Change process (see Section 1.9), while others were addressed by “Ops Notes.” There 

was no formal process for approving Ops Notes, which could consist simply of short emails. (See Table 

1-8.)282 As a result, the development of the Macondo TA plan occurred without a formal process that 

included a structured document complete with revision history and a signature page. This created 

conditions for an incomplete and unauditable development of the TA design that lacked formal 

 

278 Internal Company Document, BP. Gulf of Mexico SPU: Drilling Engineering BtB Stage Gate Process (Well 

Level), Revision 1, 2200-T2-DO-RP-0003, November 30, 2009, Introduction, BP-HZN-2179MDL00284914, see 

Exhibit 1515 http://www.mdl2179trialdocs.com/releases/release201302281700004/Cocales_BrettDepo_Bundle.zip (accessed October 7, 2015). 

279 Cement plugs are portions of cement put into a wellbore to seal it. “Surface” is typically used to refer to the 

shallowest cement plug used in a well. 

280 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, June 30, 2011; see Little designations Vol 3, pp 35-39, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Little_Ian-Depo_Bundle.zip (accessed 

October 7, 2015).

281 BP stated that the surface cement plug was designed “in accordance with common industry practice,” but BP did 

not address surface cement plugs in either the DWOP or ETPs; BP. Deepwater Horizon Accident Investigation 

Report; September 8, 2010, p 92. See Volume 1, pp 18 and 25 for additional information on surface cement plugs.

282 Internal Company Document, BP. Horizon - Onshore/Offshore Communication Process, BP-HZNBLY00096591, see Exhibit 7312 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Cowie_James-Depo_Bundle.zip (accessed 

October 7, 2015); Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, June 30, 2011; see Little designations Vol 3, pp 35-39, 44, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Little_Ian-Depo_Bundle.zip (accessed 

October 7, 2015); Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, March 22, 201; see Sprague designations Vol 2, p 71, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Sprague_John-Depo_Bundle.zip (accessed 

October 7, 2015).

000777
Macondo Investigation Report Volume 3 4/17/2016

89 

documentation or assessment of decisions, including review of internal policies and standards to provide 

quality control.

Table 1-8. Description of the development and communication of the Macondo TA program. 

Communication 

date

Email 

Subject (If 

Applicable)

Sender Recipient CSB Characterization of 

Communication

4/14283 Forward Ops BP Drilling 

Engineer

BP Well Site Leader Brainstorming session for the temporary 

abandonment plan.

4/15284 Updated Procedure BP Drilling 

Engineer

BP

Well Site Leaders and 

trainee

Wells Team Leader

Senior Drilling Engineer

Operations Engineer

Drilling Engineering Team 

Leader

M-I SWACO 

Drilling Fluids Specialist

Macondo Drilling Production Interval for 

the final section of the well; a 21-page 

document describing the temporary 

abandonment program.

4/15285 N/A

BP Senior 

Drilling 

Engineer

BP 

Drilling Engineering Team 

Leader

Drilling & Completions 

Operations Manager

Engineering Manager

Management of Change for the production 

casing at Macondo that also mentions the 

final cement job, but not the negative test

4/16286 N/A BP Regulatory 

Representative

Minerals Management 

Service (MMS)

a

Application for Permit to Modify: BP’s 

submittal of its Temporary Abandonment 

plan to MMS. The plan is described on a 

single page in 8 steps.

 

283 Email from Drilling Engineer, BP, to Well Site Leader, BP, Subject: Forward Ops, April 14, 2010, BP-HZN-MBI 

00126982, http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-00537.pdf (accessed 

October 7, 2015).

284 Email from Drilling Engineer, BP, to Various, BP, Subject: Updated Procedure, April 16, 2010, Attachment: 

GoM Exploration Wells MC 252 #1ST00BP01 - Macondo Prospect - 7 x 9-7/8 Interval, BP-HZN2179MDL00249965, http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-00545.pdf

(accessed October 7, 2015).

285 Internal Company Document, BP, Production Casing for Macondo, DCMOC-10-0069, April 14, 2010, BP-HZNMBI00143259. http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-02659.pdf (accessed 

January 28, 2015).

286 Internal Company Document, BP. Form MMS - 124 Application for Permit to Modify, April 16, 2010, Temporary 

Abandonment Procedure, BP-HZN-MBI00127909, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-00570.pdf (accessed October 7, 

2015).

000778
Macondo Investigation Report Volume 3 4/17/2016

90 

4/16287 none

BP Well Site 

Leader

Numerous Transocean 

Personnel including the 

well operations crew and 

the OIM

A one-page summary of the Macondo 

Drilling Production Interval; it is missing 

any reference to the negative test. 

4/18 ~11AM288 Negative Test BP Drilling 

Engineer BP Wells Team Leader

Brainstorming session of negative test

options, as stated in the email, “The way 

we currently have it set up is the standard 

we have been using, but this one is 

slightly different because the plug is so 

deep...”

4/18 5PM289 RE: Negative Test BP Drilling 

Engineer BP Wells Team Leader

Agreement to displace drillpipe with 

seawater to the wellhead and conduct the 

negative test

4/20 

~7:30AM290 N/A

BP Drilling 

Engineer and 

BP Well Site 

Leader

M-I SWACO Drilling 

Fluids Specialist

Phone calls from BP personnel to inquire 

about standard DWH displacement 

procedure and to provide details about the 

temporary abandonment plan to the M-I 

SWACO Drilling Fluids Specialist.

4/20 10AM291 Ops Note BP Drilling 

Engineer

BP 

Well Site Leaders

Well Site Leader trainee

Wells Team Leader

Senior Drilling Engineer 

Operations Engineer

Drilling Engineering Team 

Leader

Modifications of temporary abandonment 

plan.

4/20 3PM292 N/A

M-I SWACO 

drilling fluids 

specialist

The well operations crew

BP/Deepwater Horizon displacement 

procedures used on the day of incident 

Added a large volume of 16 ppg spacer 

(significant change). See Section 1.9.1 for 

details.

a US offshore safety regulator at the time of the Macondo accident until June 18, 2011.

 

287 Internal Company Document, BP. Forward Plan, April 16, 2010, BP-HZN-2179MDL00002043, see Exhibit 

2337 http://www.mdl2179trialdocs.com/releases/release201304041200022/Taylor_Carl-Depo_Bundle.zip

(accessed October 7, 2015).

288 Email from Drilling Engineer, BP, to Wells Team Leader, BP, Subject: Negative Test, April 18, 2010, BP-HZNBLY00070087, http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-001816.pdf

(accessed October 7, 2015).

289 Ibid. 

290 Hearing before the Deepwater Horizon Joint Investigation, July 19, 2010, pp 271-272.

291 Email from Drilling Engineer, BP, to Numerous, BP, Subject: Ops Note, April 20, 2010, BP-HZN2179MDL00060995, http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-00097.pdf

(accessed October 7, 2015).

292 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; Appendix P: BP/Deepwater Horizon 

Rheliant Displacement Procedure “Macondo” OSC-G 32306.

000779
Macondo Investigation Report Volume 3 4/17/2016

91 

1.8.2 Gap between ‘Work as Imagined’ and ‘Work as Done’ at the Macondo 

Well

At the Macondo well, the gap between the work-as-imagined (WAI) by the planners and the work-asdone (WAD) at the rig site needed to be bridged by the BP operations engineers onshore and the 

knowledge and experience of the BP WSLs and Transocean well operations crew on the rig. Postincident, BP described the final temporary abandonment plan as “broad, operational guidelines” and that 

it expected the Deepwater Horizon rig crew to use “the method consistent with their regular practice on 

prior wells.”293 In effect, the well operations crew would deal with any problems that occurred during the 

TA plan employing their knowledge, experience and skills. Missing from the process though were tools 

that could have minimized the gap between WAI by BP and WAD by Transocean, such as written work 

plans or safety critical procedures.

As indicated in Table 1-8, BP did not include Transocean in the discussions to develop the temporary 

abandonment plan, and while BP provided the crew with a written displacement procedure, it did not give 

them negative test instructions. (See Section 1.4.) The practice on the Deepwater Horizon was for BP to 

provide the OIM and well operations crew a “Forward Plan” that described upcoming critical 

operations.294 On April 16, 2010, BP sent a Forward Plan describing the temporary abandonment 

activities, 295 but it was missing any reference to the negative test. The OIM bridged what was possibly a 

simple documentation oversight,296 a potential gap in WAI versus WAD at Macondo, which he described

post-incident: “I told [the BP Well Site Leader] it was my policy to do a negative test before displacing 

with seawater.”297 Worth noting is that the OIM indicated it was “his” policy and did not refer back to a 

corporate Transocean policy.298 It is unknown if a different OIM would have had the same “personal” 

policy. 

 

293 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; p 85. 

294 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, July 14, 2011; see Taylor designations p 65, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Taylor_Carl-Depo_Bundle.zip (accessed 

October 7, 2015).

295 Internal Company Document, BP. Forward Plan, April 16, 2010, BP-HZN-2179MDL00002043, see Exhibit 

2337 http://www.mdl2179trialdocs.com/releases/release201304041200022/Taylor_Carl-Depo_Bundle.zip

(accessed October 7, 2015).

296 Concerning the omission, the DWH OIM stated “[they] didn’t have no problem [with performing a negative test]. 

They just left it out of the [forward] plan;” Hearing before the Deepwater Horizon Joint Investigation, May 27, 

2010, p 116.

297 Hearing before the Deepwater Horizon Joint Investigation, May 27, 2010 p 26.

298 The Transocean Well Control Handbook in place at the time of the incident did not address negative tests; 

Internal Company Document, Transocean. Well Control Handbook, Revision 01, HQS-OPS-HB-01, March 31, 

2009, BP-HZN-2179MDL00330768, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf (accessed October 7, 

2015). After the incident, Transocean updated its handbook which now states “prior to displacing kill weight fluid 

from the wellbore/riser, a negative/inflow test must be performed. This test must expose all barrier components to 

a pressure equal to or lower than the pressure it will be exposed to during or after the displacement is complete;” 

Internal Company Document, Transocean. Well Control Handbook, Issue HQS-OPS-HB-01, Revision 00, July 22, 

2011, Well Planning Considerations, see Exhibit 5781 

000780
Macondo Investigation Report Volume 3 4/17/2016

92 

A corrected Forward Plan was not sent; consequently, the April 16, 2010, communication is the last 

documented daily instruction the rig received (see Table 1-8). A BP Well Site Leader trainee on the 

Deepwater Horizon commented post-incident that the issuance of daily instructions depended upon the 

Well Site Leader and that the DWH Well Site Leader likely relied on verbal discussions in daily meetings 

to communicate information.299 

Transocean described written Standing Instructions to the Driller (SID) as a key communication tool with 

the customer (in this case BP), and that the SID should be developed with the customer representative and 

communicated to the drillers at the beginning of each shift.300 The SID is supposed to include well hazard 

descriptions, focusing on the next 12 hours of well operations. In a company advisory issued just weeks 

before the Macondo blowout, Transocean noted that a SID should “raise awareness and [...] highlight” 

underbalanced conditions in a well when a single barrier is present.301 Despite Transocean’s SID 

requirements and the recent advisory, there is no evidence that SIDs were used on the Deepwater Horizon 

as envisioned in corporate policies. This underscores a missed opportunity to bridge gaps between the 

operator and the drilling contractor.

While SIDs could support communications between the operator and the drilling contractor, they do not 

replace the need for safety critical procedures. The consistent development and appropriate use of written 

operating procedures are key to managing the risk of a hazardous operation. Procedures are not safety 

barriers on their own, and using them does not guarantee that work-as-done will be completed as 

imagined. But procedures facilitate reliable and informed human performance from one individual to 

another or even by the same individual by documenting the intended steps of a task.302 

 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Braniff_Barry-Depo_Bundle.zip (accessed 

October 7, 2015).

299 Internal Company Document, BP. Interview of Lee Lambert, April 29, 2010, see Exhibit 2157, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Harrell_Jimmy-Depo_Bundle.zip (accessed 

October 7, 2015).

300 Internal Company Document, Transocean. Field Operations Policies & Procedures Manuel, Issue 01, Revision 

00, HQS-POP-PP-01, August 8, 2009, Performance Management: Rig and Well Operation Management, TRNCSB-0002380.

301 More specifically, advisory sites a ‘mechanical barrier,’ but the circumstances of the incident were such that the 

crew was relying on a tested barrier, lowering their risk perception of the operation. Internal Company Document, 

Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, Exhibit 5749, TRN-MDL-02840797, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015). See also Chapter 2.0 describing this incident (also referred to as Sedco 711) and other previous 

incident investigations.

302 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007, p 246.

000781
Macondo Investigation Report Volume 3 4/17/2016

93 

1.8.3 Transocean Procedural Development Policies

Transocean requires rig supervisors and managers to work with the lease holders to assess rig-specific and 

site-specific conditions that could increase the risk or complexity of various drilling operations.303, 304

Transocean asserts that the planning has both commercial and safety purposes. From a commercial 

standpoint, the planning enables Transocean and the lessees to identify critical milestones for a well and 

potential impact that planned Transocean activities might have on well delivery. Planning improves the 

safety of well operations by:305 

• identifying risk reducing controls by elevating various well and rig-specific scenarios; 

• eliminating assumptions that could negatively impact safety during operations; 

• encouraging a multidisciplinary team approach to ensure best industry practices; and 

• considering lessons learned from previous wells or other installations. 

These interactions are intended to contribute to the development of procedures for safety critical tasks.306 

Transocean has a formal method, the THINK Planning Process, for well operations crews to develop, 

communicate, and monitor tasks. 307 THINK is a planning and risk management tool that begins with task 

 

303 Internal Company Document, Transocean, Performance and Operations Policies and Procedures Manual-Level 

L1A, Issue #1, Revision # 00, April 19, 2010, Section 2 (Planning and Reporting), Subsection 1 (Well 

Construction Planning), TRN-MDL-00607022. 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip Exhibit 

1474 (accessed January 28, 2015). Despite the late revision date on this document, testimony given by several 

individuals in the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179 indicated that the policies described in this document were in effect at Macondo. For 

example, see Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District 

Litigation docket MDL No. 2179, April 26, 2011; see Rose Designations Vol 2, pp. 25, 28-29, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

January 28, 2015).

304 Internal Company Document, Transocean. Field Operations Policies & Procedures Manuel, Issue 01, Revision 

00, HQS-POP-PP-01, August 8, 2009, Performance Management: Rig and Well Operation Management, TRNCSB-0002274 – TRN-CSB-0002320.

305 Internal Company Document, Transocean, Performance and Operations Policies and Procedures Manual-Level 

L1A, Issue #1, Revision # 00, April 19, 2010, Section 2 (Planning and Reporting), Subsection 1 (Well 

Construction Planning), TRN-MDL-00607018, see Exhibit 1474 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

January 28, 2015).

306 Internal Company Document, Transocean, Health and Safety Policies and Procedures Manual-Level L1, Issue 

#3, Revision # 7, December, 15, 2009, Section 4 (Safety Policies, Procedures and Documentation), Subsection 6.3 

(Evaluating and Improving), TRN-MDL-00046866, see Exhibit 1449 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip, Exhibit 

(accessed October 8, 2014).

307 THINK is a five step process that involves planning, inspecting, identifying, communicating, and controlling risk; 

Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, April 25, 2011; see Rose Designations Vol 1, p 32, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

January 28, 2015); Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, 

Issue 03, Revision 07, HQS-HSE-PP-01, December 15, 2009, Preface, BP-HZN-2179MDL00132055, see Exhibit 

000782
Macondo Investigation Report Volume 3 4/17/2016

94 

development and identification of associated task hazards. The THINK process requires users to 

communicate hazards they identify to other crewmembers and to establish controls to mitigate them. The 

complexity of a task determines the depth of assessment and formality of the THINK plan.308 According 

to company policy, for a low risk job, THINK can be a mental process by an individual or a verbal 

conversation between multiple people, while a more complex or higher risk job requires a written THINK 

plan that supervisors must assess for completeness and quality. However, THINK does not define how to 

determine the complexity of the task or the severity of the risks, it implies a subjective determination by 

the employee. Thus, if crewmembers perceive the task to be well understood or minimally risky, the 

potential is significant for individuals not to perform the necessary task analysis, risk assessment, and 

procedural development for safety critical activities.

When a planned activity involves safety critical tasks, Transocean requires a written Task Specific 

THINK Procedure (TSTP). 309 Transocean identified 106 key operations that require a written TSTP prior 

to the Macondo blowout,310 including temporary abandonment activities and negative tests like those that 

occurred at Macondo at the time of the incident.311 All crewmembers involved in a critical task or 

potentially affected by it are supposed to participate in developing the Task Specific THINK Procedure, 

which requires individuals or groups to:312

• review and discuss the Task Specific THINK Procedures prior to commencing the task;

• confirm the control measures for all task steps within the procedure;

• ensure personnel understand their responsibilities to carry out the steps; 

• understand the hazards and the consequences of those hazards; and

 

4942 http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip

(accessed October 7, 2015).

308 Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, 

Revision 07, HQS-HSE-PP-01, December 15, 2009, Section 4 (Safety Policies, Procedures and Documentation), 

Subsection 2.1 (THINK Planning Process), BP-HZN-2179MDL00132217, see Exhibit 4942 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).

309 Ibid., BP-HZN-2179MDL00132224. 

310 Internal Company Document, Transocean, Transocean HSE Review, April 10, 2008, TRN-INV-00705442; Email 

from Deepwater Horizon Offshore Installation Manager, Transocean, to Deepwater Horizon Toolpusher, 

Transocean, Subject: FW: List of Critical TSTPs and Maintenance Tasks; Basic 106 TSTPs, June 5, 2007, TRNINV-02063839; Internal Company Document, Transocean, List of TSTPs and Critical Maintenance Activities, 

TRN-INV-02063841.

311 Internal Company Document, Transocean, Performance and Operations Policies and Procedures Manual-Level 

L1A, Issue #1, Revision # 00, April 19, 2010, Section 3 (OPS—Drilling Related), Subsections 5 and 6 

(Simultaneous Drilling and Production Operations, Well Testing/DST), TRN-MDL-00607137 and TRN-MDL00607142, see Exhibit 1474 http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_AdrianDepo_Bundle.zip (accessed October 8, 2014).

312 Internal Company Document, Transocean, Health and Safety Policies and Procedures Manual, Issue 03, 

Revision 07, HQS-HSE-PP-01, December 15, 2009, Section 4 (Safety Policies, Procedures and Documentation), 

Subsection 2.1 (Risk Management), TRN-MDL-00046636, see Exhibit 1449 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip, (accessed 

October 8, 2014).

000783
Macondo Investigation Report Volume 3 4/17/2016

95 

• ensure the expected results are understood prior to commencing the activity.

Transocean also requires a Task Risk Assessment for all critical task steps in a TSTP to ensure that risks 

related to specific task steps are as low as reasonably practicable.313 The Task Risk Assessment is 

intended to provide a greater level of risk assessment and to clearly identify potential consequences for 

each step so that crewmembers and/or management can verify control measures to prevent or mitigate an 

undesired event. 

In practice, the Deepwater Horizon well operations crew had access to a company database of TSTPs, but 

Transocean standards require the Rig Manager314 to review the TSTP and any risk analyses, including 

Task Risk Assessments or those conducted by a customer, such as an Operator like BP, to ensure they 

remain relevant for the proposed operation at a specific well.315 The Vice President of Quality, Health, 

Safety and Environment described the use of the TSTP database:316

“... we have a database with [TSTPs] ... we call it the THINK database ... They are rig specific, 

because every rig is a little different ... people can go into that database and they can see the task 

specific THINK procedure for another rig doing the same job and they might want to compare it 

with that. 

But we do warn that every time we do a job, the conditions are changed. The weather conditions 

may be different. The experience of the crew may be different. You have to take into account that 

every time you do it, it may not be exactly the same as the last time.”

1.8.4 Lack of Written Transocean Procedures and Work Instructions at 

Macondo 

An expert hired by BP post-incident to review the negative test activities at Macondo commented, “The 

rig crew does not have to be told how to run a negative test. This should be a routine operation that fits 

within their training.”317 This sentiment does not address the fact that procedures are more than a set of 

instructions; they are tools for competent, motivated individuals to plan, coordinate, verify, and assure 

 

313 Ibid., TRN-MDL-00046637. 

314 The Rig Manager is a shore-based position with responsibilities for the personnel, training, and operational 

performance of the offshore facility/rig; the Offshore Installation Manager has direct line accountability to the Rig 

Manager. (Hearing before the Deepwater Horizon Joint Investigation, August 23, 2010, pp 5-6.)

315 Internal Company Document, Transocean, Performance and Operations Policies and Procedures Manual-Level 

L1A, Issue #1, Revision # 00, April 19, 2010, Section 3 (OPS—Drilling Related), Section 3 (OPS—Drilling 

Related), Subsection 6 (Well Testing/DST), TRN-MDL-00607142, see Exhibit 1474 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

October 8, 2014).

316 Hearing before the Deepwater Horizon Joint Investigation, May 26, 2010, pp 219-220. 

317 Bourgoyne, A. T. Expert Report - In RE: Oil Spill by the Oil Rig "Deepwater Horizon" in the Gulf of Mexico, on 

April 20, 2010; United States District Court Eastern District of Louisiana MDL No. 2179, Section J Judge 

Barbier; Magistrate Shushan: October 7, 2011; p 52. 

http://www.mdl2179trialdocs.com/releases/release201304080900023/TREX-08173.pdf (accessed October 7, 

2015). 

000784
Macondo Investigation Report Volume 3 4/17/2016

96 

performance will achieve the intended results.318 Minimizing the difference between WAI and WAD 

requires the participation of the individuals actually performing the work. 

Companies and their workforce may employ various methods and parameters for conducting a negative 

test and, as the Macondo incident demonstrates, both individual variations and the interpretation of the 

data can be critical. Good practice guidance asserts that safety critical tasks demand an error assessment 

process because of their potential to cause or mitigate a major accident event.319 It is not about the 

competency of the individual performing the task, as even the best employees will not be able to achieve 

positive performance outcomes all of the time.320 

On the morning of the incident, there was a safety meeting to hold a THINK drill before displacing 

drilling mud from the well.THINK drills are an opportunity to discuss the proposed job, including the 

TSTP, assign crewmembers tasks, and discuss potential hazards.321 Witnesses described the THINK drill 

on April 20, 2010 as covering the basic steps to be completed that day,322 as described in the M-I 

SWACO displacement procedure (Table 1-3), and only generally addressing the types and volumes of 

fluids that were to be used.323 In practice, a TSTP is to be used as a basis for a THINK drill, but the M-I 

SWACO procedure was not a TSTP. Instead, there was a presumptive role the M-I SWACO procedure 

would play in managing the risks associated with displacement and the negative pressure, even though it 

did not include a hazard analysis of the proposed steps. A TSTP, or in this case a procedure, that fails to

identify the well-specific hazards and controls for a given operation yields a weak THINK drill, which 

does not adequately inform the crew about the hazards associated with their tasks.

The DWH crew completed numerous negative test procedures between August 2007 and April 2010, and 

each should have triggered development and use of a TSTP that reflected the real-time conditions of the 

well.324 However, the CSB could identify only one TSTP for a negative test (Figure 1-13), which 

 

318 Health and Safety Executive. Reducing Error and Influencing Behaviour; HSG48; 2009; p 10. 

http://www.hseni.gov.uk/hsg_48_reducing_error_and_influencing_behaviour.pdf (accessed October 7, 2015).

319 Energy Institute 1st ed., Guidance on Human Factors Safety Critical Task Analysis, March 2011, p 1.

320 Health and Safety Executive. Reducing Error and Influencing Behaviour; HSG48; 2009; p 10. 

http://www.hseni.gov.uk/hsg_48_reducing_error_and_influencing_behaviour.pdf (accessed October 7, 2015).

321 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 5, 2013 p 1972, 

http://www.mdl2179trialdocs.com/releases/release201303051200006/2013-03-05_BP_Trial_Day_6_PMFinal.pdf (accessed October 7, 2015).

322 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, April 10, 2013, p 8274, 

http://www.mdl2179trialdocs.com/releases/release201304101200025/2013-04-10_BP_Trial_Day_25_PMFinal.pdf (accessed October 7, 2015); Hearing before the U.S. District Court for the Eastern District of Louisiana 

under the Multi-District Litigation docket MDL No. 2179, March 5, 2013 p 1946, 

http://www.mdl2179trialdocs.com/releases/release201303051200006/2013-03-05_BP_Trial_Day_6_PMFinal.pdf (accessed October 7, 2015). 

323 Internal Company Document, MI SWACO. BP/Deepater Horizon Rheliant Displacement Procedure "Macondo" 

OCS-G 32306, BP-HZN-BLY00094818, see Exhibit 0052 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lacy_Kevin-Depo_Bundle.zip. 

324 Internal Company Document, Transocean. Memorandum: Investigation of the Negative Test and Riser 

Displacement Procedures (Preliminary Report), July 26, 2010, TRN-INV-00847616, see Exhibit 5007 

000785
Macondo Investigation Report Volume 3 4/17/2016

97 

Transocean refers to as a “negative flow test.” This TSTP fails to describe or prompt users of the TSTP to 

identify the location of the drillpipe in the well, the displacement of the drillpipe, or the use of spacer 

material. Consequently, while this generic document represents a starting point from which a procedure 

could be developed in the manner described in Section 1.8.3, it is insufficient for a negative test like that 

conducted at Macondo on April 20, 2010. 

 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Roller_Perrin-Depo_Bundle.zip (accessed 

October 7, 2015).

000786
Macondo Investigation Report Volume 3 4/17/2016

98 

Figure 1-13. Deepwater Horizon negative test Task Specific THINK Plan.325

 

325 Internal Company Document, Transocean. Deepwater Horizon Task Specific THINK Procedure: Negative flow 

test using choke and kill lines, TRN-MDL-01995569,

000787
Macondo Investigation Report Volume 3 4/17/2016

99 

A generic Deepwater Horizon TSTP for displacing the riser with seawater appears in Figure 1-14; this 

activity was being conducted at the time of the Macondo blowout. The hazards in the TSTP focus on 

minor spills of synthetic-based drilling mud onto the rig floor (and their becoming a personal safety slip 

hazard) or on going overboard. The TSTP does not address major accident hazards, such as the number or 

robustness of the barriers to prevent a kick or blowout while one of the primary barriers, the drilling mud, 

is being removed. It is also generic enough to be used in several circumstances and does not mention the 

importance of assessing cement integrity or the potential for kicks if the well is placed into an 

underbalanced state. Instead, the TSTP implies implicit trust that the casing/bottom hole cement barrier is 

good, so no additional barriers will be required. Despite multiple examples of tested barriers subsequently 

failing on Transocean rigs (see Section 2.0), there are no controls indicated in the TSTP, such as the 

prohibition of bypassing pressure, flow, or volume monitoring systems that could indicate a subsequent 

barrier failure any time the well is being circulated. Furthermore, Transocean was unable to identify an 

operational TSTP that included the line-up of the diverter system for either normal or abnormal (i.e., 

emergency) operating conditions.326 

 

http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX-04640.pdf (accessed October 7, 

2015). 

326 Internal Company Document, Transocean. Investigations - Daily Summary, September 9, 2010, TRN-INV01816603.

000788
Macondo Investigation Report Volume 3 4/17/2016

100 

Figure 1-14. Transocean Task Specific THINK Procedure addressing displacing a riser with seawater.

Managing safety critical task procedures through Transocean’s TSTP process could provide Transocean 

the opportunity to assess more thoroughly the human performance expectations for the tasks at hand. For 

example, with the removal of physical well barriers, a question should arise concerning what tools and 

mechanisms are in place for crewmembers to quickly recognize and a gas in the riser situation. Such a 

process would benefit from the participation of individuals with expertise in assessing human 

performance and potential organizational influences. A human factors safety critical assessment of the 

diverter system design would include recognizing situational conflicts and identifying meaningful actions 

to resolve them. The Transocean well control handbook was updated post-Macondo to instruct the crew to 

preset the route overboard.327 While using an engineering control eliminates the manual intervention 

 

327 Internal Company Document, Transocean. Well Control Handbook, Issue HQS-OPS-HB-01, Revision 00, July 

22, 2011, Handling Gas in the Riser, Exhibit 5781, 

000789
Macondo Investigation Report Volume 3 4/17/2016

101 

previously required of the crew to change the diverter route if gas in the riser exceeds MGS capacity, this 

organizational decision to preset the diverter route to overboard may ultimately cause other problems. It

increases the likelihood of discharges into the sea that might otherwise have been controlled through use 

of the MGS. Thus, there is a risk of organizational drift back to the original practice as, over time, the rig 

operator receives environmental penalties for discharges that, with hindsight, a regulator determines to 

have been preventable.328 These tradeoffs and the potential influences they may have on decision-making 

are examples of what must be recognized as part of a human factors safety critical task assessment 

process (discussed in more detail in Section 1.10.2).

The CSB could not identify Macondo-specific TSTPs or formal Task Risk Assessments for any safety 

critical tasks, and Transocean did not conduct a qualitative risk assessment with rig management approval 

as part of developing temporary abandonment procedures. Despite all of its internal company policies, 

post-incident Transocean claimed that it was BP’s responsibility to conduct a hazard analysis and develop 

 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Braniff_Barry-Depo_Bundle.zip (accessed 

October 7, 2015).

328 This also implies a powerful influence by a regulator on the organizational behaviors it intentionally (and 

sometimes unintentionally) encourages through its regulations. The role of a regulator in driving safety change is 

discussed in Volume 4 of the CSB Macondo Investigation Report. 

Lack of Assessment of Human Factors in Previous Transocean Incidents

The UK offshore regulator, the Health and Safety Executive (HSE) found a lack of a 

structured and systematic consideration of the human contribution to safety during in 

2009 a multi-rig Human & Organizational Factors inspection. The HSE noted, 

“human failures and the range of factors that may influence human performance have 

not been adequately addressed in risk assessment or within incident investigations,”a

and this was “particularly with respect to major hazard risk assessment.”b In its 2003 

Major Accident Hazard Risk Assessment (MAHRA), Transocean identified that a 

failure of the diverter system could result in a rig floor blowout with multiple injuries, 

fatalities, or loss of the rig.c

 The MAHRA listed prevention controls focused on the 

diverter equipment (testing, inspections, and maintenance), but did not address any 

vulnerabilities of manual activation of the diverter. 

a HSE, Specialist Inspection Report, Offshore Division Human and Organizational Factors Team. 

Transocean-Human & Organizational Factors Intervention; July - October, 2009, p 3.

b HSE, Specialist Inspection Report, Offshore Division Human and Organizational Factors Team. 

Transocean-Human & Organizational Factors Intervention; July - October, 2009, p 6.

c Internal Company Document, Transocean. Major Accident Hazard Risk Assessment Deepwater 

Horizon, Revision 01, August 29, 2004, TRN-MDL-01184777, 

http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-02188.pdf (accessed 

October 7, 2015).

000790
Macondo Investigation Report Volume 3 4/17/2016

102 

the written negative test and temporary abandonment procedures used at the Macondo well.329 Thus, at 

Macondo, the operator and drilling contractor each presumed the other was responsible for a proper 

negative test procedure. The crew was left to put together something to get the work done. 

Nancy Leveson frames major accident causation and prevention in terms of a problem of control of a 

complex system.330 When examining well engineering and operations from that perspective, two 

conclusions can be drawn. First, in an industry dominated by engineers, the design and planning aspects 

of preparing an operation are addressed in the management systems of the majority of organizations and 

reinforced by regulatory requirements. Second, by contrast, once the drilling program is signed off, there 

is a notable lack of guidance either within the industry at large or within operator organizations as to 

exactly how to execute the program at the rig site—in other words, how the plan will be translated into 

action. 

This lack of control over bridging the gap between work-as-imagined and work-as-done, or absence of 

objective control mechanisms, extends beyond the simple requirement for operational, or procedural, 

discipline to the whole framework of communication command and control. Thorogood and Crichton 

addressed this question by suggesting that a company evaluate its organizational and workforce 

capabilities to conduct safe and efficient operations through documented management, training, and 

monitoring of eight elements:331 

1. preparation of programs 

2. generation of written work instructions 

3. operations monitoring procedures 

4. handling changes and deviations 

5. decision-making protocols 

6. operational discipline 

7. mission rules 

8. competency

1.9 Management of Change (MOC)

Experience shows that changes in the operating environment, systems, procedures, equipment, 

organization, and management personnel and practices represent some of the biggest challenges to 

effectively managing major hazard risks. Poorly managed change frequently results in serious failures, 

many of which are precursors to major accidents (or higher costs as well). A vital component of change 

management is an assessment of how those technical changes may influence human performance. 

In the offshore drilling industry, these change management responsibilities do not reside with only one 

company. Due to the various specialties and coordination required to drill a well, all parties involved in a 

drilling operation should share them—leaseholder, drilling contractor, and other well service providers 

 

329 Transocean. Macondo Well Incident: Transocean Investigation Report Volumes I and II; June, 2011, p 78. 

330 Leveson, N. G. Engineering a Safer World; Massachusetts Institute of Technology: Cambridge, MA, 2011.

331 Thorogood, J.; Crichton, M. T. Operational Control and Managing Change: The Integration of Non-technical

Skills With Workplace Procedures; SPE Drilling and Completion 2013, 28, pp 203-211.

000791
Macondo Investigation Report Volume 3 4/17/2016

103 

(third-party contractors).332 The lease holder of a well is responsible for designing the well plan, but 

changes to a plan potentially have health, safety, and environmental consequences that could impact the 

drilling contractor’s rig, crew, and others involved in the operation. Conversely, changes to the drilling 

rig, equipment, materials, and personnel by the drilling contractor or well service providers may introduce 

new challenges to the safe execution of the well plan. 

At Macondo, both BP and Transocean initiated or instituted multiple changes to the temporary 

abandonment activities that negatively affected the effectiveness of the safety critical barriers meant to 

prevent blowouts, and they did this without first assessing the hazards introduced by those changes, 

including human performance impacts.333 As a result, they missed opportunities, often simple and 

relatively low cost, to implement effective human performance controls to prevent or mitigate unwanted 

consequences. 

This section shows that BP and Transocean did not effectively manage changes with the temporary 

abandonment process, further supporting the conclusion that the companies did not identify safety critical 

steps in the temporary abandonment process as safety critical, nor did they recognize the impact of those 

changes on human performance. Ultimately, this section discusses how regulatory oversight was absent or 

ineffective in ensuring either BP or Transocean upheld internal management of change policies or that 

company policies effectively controlled for major accident hazards. (Section 3.5.2 describes indicators 

that owners and operators can use for internal company oversight.) 

1.9.1 Management of Change: A Missed Opportunity

Table 1-9 identifies several changes to the Macondo temporary abandonment plan, highlighting the 

potential hazards introduced by the changes, and the actual human performance impacts of those changes.

At the time of the Macondo incident, BP had internal MOC guidelines for the Gulf of Mexico and 

Drilling and Completions (D&C) Organization that covered administrative, organizational, and technical 

changes, as well as dispensations from BP’s Drilling and Wells Operation Practice (DWOP) and BPowned rig equipment.334 Contractors, like Transocean, were to utilize their own MOC systems, which 

should include BP “as appropriate,” and which BP reserved the right to audit. 

 

332 Drilling a well requires third-party contracted support like cementing and well monitoring support services. See 

Volume 1, Section 1.1 of the CSB’s Macondo report for more detail.

333 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel’s Report: The 

Gulf Oil Disaster; Feburary 17, 2011, p 107. http://permanent.access.gpo.gov/gpo4390/C21462-

407CCRforPrint0.pdf (accessed October 7, 2015).; BP. Deepwater Horizon Accident Investigation Report; 

September 8, 2010, p 36.; Transocean. Macondo Well Incident: Transocean Investigation Report Volumes I; June, 

2011, p 10.

334 Internal Company Document, BP. GoM Drilling and Completions D&C Recommended Practice for Management 

of Change, Revision 0, 2200-T2-PM-PR-0001-0, March 31, 2009, see Exhibit 6291 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Daigle_Keith-Depo_Bundle.zip (accessed 

October 7, 2015).

000792
Macondo Investigation Report Volume 3 4/17/2016

104 

Table 1-9. BP and Transocean instituted multiple changes to the temporary abandonment activities that 

had the potential to negatively affect well barriers without first assessing the hazards of those changes.

Scope of Change Potential Hazard Human Performance 

Implications at Macondo

Leftover circulation material was 

used as a spacer in the Macondo 

cement job design.

The lost circulation material (LCM) 

was never tested as a spacer, and its 

viscous, gelling nature made it 

susceptible to plugging lines used 

for the negative test. Also, its high 

density added complexity to the 

correct interpretation of the test 

pressures.

The LCM was under-displaced, 

leaving part of the spacer below the 

BOP and adversely affecting the 

test interpretation (Section 1.4).

Foamed cement335 design for 

cement placed at the bottom of the 

well in an oil-base mud to seal the 

hydrocarbon bearing zone.

The design was both complex and 

challenging, increasing the risk of 

poor cement quality once installed 

at the bottom of the well.

The cement barrier failed to seal the 

well (Section 1.9.1). This was the 

primary barrier relied upon during 

displacement of the riser, but the 

crew was not made aware of the 

increased risk of a poor cement job.

Cement from a previous well was 

used for the foamed cement job at 

the Macondo well. 

The cement had a defoaming 

additive that might have negatively 

affected foaming efforts for the 

Macondo well cement design, 

increasing the risk of poor cement 

quality once installed at the bottom 

of the well.

Cement barrier failed to seal the 

well (Section 1.9.1). This was the 

primary barrier relied upon during 

displacement of the riser, but the 

crew was not made aware of the

increased risk of a poor cement job.

BP’s MOC guidelines required a justification statement to describe the rationale for a proposed change, 

such as the potential to improve safety, increase efficiency, or reduce costs. The scope of the change, 

including necessary resources, potential impacts, and interfaces, was also to be described. Assigned 

reviewers of an MOC were supposed to work as a team to ensure a “thorough technical evaluation and 

impact assessment.”336 Typical reviewers would be managers who were accountable for the overall 

impact of the proposed change. If a requested change was an exception to approved BP practices,

337 a 

 

335 Foamed cement is a mixture of cement slurry (cement, water, and other dry or liquid additives), foaming agent, 

and a gas that physically resembles a lightweight shaving cream.

336 Ibid., p BP-HZN-2179MDL00339810. 

337 BP’s used Engineering Technical Practices (ETPs), Site Technical Practice (STPs), and Group Practices to define 

minimum engineering and operations corporate standards.

000793
Macondo Investigation Report Volume 3 4/17/2016

105 

dispensation to the DWOP, 338 or a change in well design, then an Engineering Authority (EA)339 would 

also have to act as an approver for the change.340

Section 1.8.1 treats the lack of a hazard analysis on the temporary abandonment process as a flawed 

design process, but a secondary opportunity to complete a hazard analysis presented itself in a BP MOC 

that cited the bottom hole cement job. 341 Senior BP managers reviewed and approved the MOC, which 

listed risks such as fracturing the wellbore during cementing operations and noted the possible need to 

seek MMS approvals for resulting mitigation strategies if that risk materialized. The MOC did not discuss

the inherent challenges of using foamed cement, including impacts it might have on well integrity and the 

need for increased vigilance by the rig crew for barrier failure.342 

While industry guidelines address general cementing practices,343 each cement job is dictated by specific 

well characteristics that vary throughout the drilling operation. Consequently, cement job designs are 

adjusted to accommodate real-time well conditions. Internal BP guidance for cementing complex wells 

states, “Due to unknown or unforeseen well conditions, the properties of the foam cement in the 

annulus344 could end up being significantly different from the original design. The sensitivity of the 

design and the associated risk to the well should be evaluated on a case-by-case basis [italics 

original].”345 The guidance lists several possible risks and specifically indicates that loss of well control or 

well kicks could result from circumstances leading to poor cement quality.346 Post-incident BP noted that 

the foamed cement design for Macondo was complex and that improved MOC could have raised 

awareness of the challenges to achieving a successful cement job.347 

 

338 The DWOP is a document that BP management agrees contains current and relevant practices for drilling and 

well operations. These practices are intended to minimize harm to people and the environment as well as to 

prevent accidents that could have a high negative impact either financially or to the company’s reputation.

339 The EA is the top ranking decision-maker for engineering decisions in a business unit. 

340 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, May 4, 2011; see Grounds designations p 99, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Grounds_Cheryl-Depo_Bundle.zip

(accessed October 7, 2015).

341 Internal Company Document, BP. Production Casing for Macondo, DCMOC-10-0069, April 14, 2010, BP-HZNMBI00143259, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-02659.pdf (accessed 

October 7, 2015).

342 Ibid. 

343 API Standard 65, 2nd ed., Isolating Potential Flow Zones During Well Contruction-Part 2, December 2010.

344 The annulus is the space between the drillpipe and wellbore. See Deepwater Drilling and Temporary 

Abandonment of the Macondo Well in Volume 1, p 20 of the CSB Macondo report for more details and diagrams.

345 Internal Company Document, BP. Cementing in hostile environments: Guidelines for obtaining isolation in 

demanding wells, December 200263 BP-HZN-BLY00175616. 

346 The guidance lists cement channeling, low foam quality, and unstable foam—all possibilities BP listed in its 

investigation report as potential sources of cement failure at Macondo; BP. Deepwater Horizon Accident 

Investigation Report; September 8, 2010; p 36.; Transocean. Macondo Well Incident: Transocean Investigation 

Report Volumes I; June, 2011, pp 34, 55. 

347 BP, Deepwater Horizon Accident Investigation Report; September 8, 2010, p 36. 

000794
Macondo Investigation Report Volume 3 4/17/2016

106 

Beyond the foamed cement design, three substitutions or replacements occurred during the cementing 

process at Macondo. Leftover cement from a previous well was used and leftover lost circulation material 

was substituted as a spacer in the cement job design.348 These changes were treated as “replacement in 

kinds”349 without assessing whether they fulfilled necessary specifications or whether they could perform 

as anticipated. The substituted cement was designed for a non-foamed cement job and was being 

converted to a foamed design for Macondo,350 but neither the crew nor management evaluated the 

conversion.351 The lost circulation material was never tested as a spacer, and its viscous, gelling nature 

made it susceptible to plugging lines used for the negative test.

352 

Concerning other aspects of the TA program (e.g., the negative test, underbalancing the well), the BP 

Wells Team Leader responsible for initiating an MOC stated that he did not feel the changes were 

significant and that the team was experienced at conducting negative tests, so an MOC was not 

prepared.353 Personnel experience is only one of many potential factors to consider in assessing and 

managing risk because wells can offer unique circumstances that even experienced crewmembers have 

not previously addressed. Furthermore, experience and competency do not preclude human error, so 

considerations of potential error must be part of the MOC process. 

Transocean criticized BP for not preparing MOC documents to address the risks of the temporary 

abandonment operations,354 but in its own investigation report Transocean failed to address the Deepwater 

Horizon’s noncompliance with Transocean Corporate requirements. Transocean identified numerous 

scenarios for conducting formal MOC plans, including:355

• Change in people; 

• Change in installation/facility specific procedures; 

• Changes to safety systems or critical operating equipment; 

• Changes to software and hardware; 

• Equipment and structural changes, including non-original equipment replacement, upgrades or 

modifications; and

 

348 To avoid mixing the foamed cement and the synthetic-oil-based-mud, a spacer fluid is used in between the two 

fluids.

349 A replacement in kind is a replacement component or procedure with the same specifications or effects as the 

original.

350 The leftover cement contained a defoaming additive which could negate efforts to create a foamed cement.

351 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010, p 60.

352 CSB, 2014, Explosion and Fires at the Macondo Well, Gulf of Mexico, April 20, 2010, Report No. 2010-10-I-OS, 

June 2014, Appendix 2-A, p 17.

353 Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with John Guide, July 1, 

2010, p BP-HZN-BLY00124225, see Exhibit 0153

http://www.mdl2179trialdocs.com/releases/release201302281700004/Paine_Kate-Depo_Bundle.zip (accessed 

October 7, 2015). 

354 Transocean. Macondo Well Incident: Transocean Investigation Report Volumes I; June, 2011, p 10-11. 

355 Internal Company Document, Transocean. Company Management System, Issue 04, Revision 05, HQS-CMSGOV, November 30, 2009, Corporate Policies and Procedures, Level 1, TRN-MDL-00032841, see Exhibit 0925 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

October 7, 2015).

000795
Macondo Investigation Report Volume 3 4/17/2016

107 

• Mobile Offshore Drilling Unit (MODU)356 design and/or operating criteria. 

Changes to installation/facility specific procedures included the negative test and temporary abandonment 

plans. The THINK Planning Process (Section 1.8.3)—the backbone of Transocean’s MOC program—

dictates how a plan for a task is developed. The plan should then be observed and monitored while it is 

executed using Transocean’s START Observation and Monitoring Process. START (See, Think, Act, 

Reinforce, Track) is a tool to reinforce safe behavior, correct unsafe behavior, and ensure controls or 

barriers remain in place during implementation of a plan. Despite these requirements, Transocean did not 

generate MOCs (or TSTPs) while drilling the Macondo well. Chapter 4.0 further explores the lack of 

clarity concerning safety roles and responsibilities between the operator and drilling contractor, as 

influenced by US regulations, for safety critical activities. 

1.9.2 MOC Regulatory Requirements and Good Practice Guidance 

Management of Change is recognized as one of several vital components of an effective safety 

management system for hazardous operations.357 While voluntary guidance recommended that 

leaseholders/operators develop and use an MOC process,358 companies operating in the Gulf of Mexico at 

the time of the Macondo event were not required to have a formal MOC process as part of a larger major 

accident prevention program, nor did regulations require that these parties effectively coordinate their 

management of change activities. 

1.9.2.1 Regulatory Requirements for an MOC Safety Management System

Offshore safety guidance in effect in the US at the time of the Macondo blowout, Recommended Practice 

for the Development of a Safety and Environmental Management Program for Offshore (API RP 75), 

recommended that MOC programs include the development of a written MOC procedure that contains 

design basis for the change; analysis of safety, health and environmental considerations for the proposed 

changes; revisions to operating procedures, work practices, and training; communication of the changes; 

and required authorizations to implement the change. 

 

356 As defined by US Code 2101 15(a), a MODU is “a vessel capable of engaging in drilling operations for the 

exploration or exploitation of subsea resources.”

357 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; Chapter 15.; International Association of Drilling Contractors, Health, Safety and Environment Case 

Guidelines for Mobile Offshore Drilling Units, Issue 3.6, January 2015, p 13. 

While the CCPS guidelines were not expressly written for offshore operations, they have recently been effectively 

implemented in drilling and well operations. [Chajai, H.; Smith, C. Defining and Improving Process Safety for 

Drilling and Well Services Operations, IADC/(SPE) Drilling and Completion (SPE) Drilling Conference and 

Exhibition, 4-6 March 2014, Fort Worth, TX]. As such, they complement the IADC guidelines for assessing BP 

and Transocean policies in place at the time of the incident and BSEE’s current MOC program requirements.

358 API Recommended Practice, 75, 3rd (2004, reaffirmed 2008) ed., Recommended Practice for Development of a 

Safety and Environmental Management Program for Offshore Operations and Facilities, pp 9-10.

000796
Macondo Investigation Report Volume 3 4/17/2016

108 

While API RP 75 was voluntary, both companies’ MOC policies had requirements that incorporated or 

went beyond the recommendations contained within the RP. However, such MOC analyses were not 

performed for a number of changes at the Macondo well. (See previous section.) After the incident, the 

regulator codified industry good practices for MOC already stipulated within the corporate policies of BP 

and Transocean (Table 1-10). 

Table 1-10. A comparison of best practice elements of an MOC program, current BSEE MOC 

requirements, and BP and Transocean’s MOC programs in place at the time of the Macondo incident.

MOC Program Elements

Required by 

Regulator at 

Time of 

Incident

Included in 

BP MOC 

Policies

Included in 

Transocean 

MOC 

Policies

Required by 

Regulator Post 

Macondo ††

Write MOC procedures for changes 

to equipment, procedures, 

personnel, materials, and operating 

conditions

x x x 

Review changes x x x 

Include technical basis in review

x x x 

Include impact on safety, health, 

and the environment in review x x x 

Include time period for change in 

review x x x 

Approve procedure x x x 

Communicate change and train 

appropriately x x x 

Document changes to operating 

procedures x x x 

Identify, track, and implement 

changes through management 

system. Activities should be audited 

and used to improve dependability 

of MOC process.

x 

Drive risk to as low as reasonably 

practicable through MOC process implied† x 

†BP’s MOC guidelines do not explicitly state ALARP, but they do reference BP’s OMS Exploration and Production Drilling and 

Well Operations Practice (DWOP), which states “all risks shall be managed to a level which is as low as reasonably practical” or 

ALARP; Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, pp A-9, BPHZN-BLY00034504, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 

2015).

††Specific requirements for an MOC program are addressed in 30 C.F.R. § 250.1912 (2015), while management’s general 

responsibilities, which includes the improvement of the safety and environmental management system (SEMS) program, are 

addressed at 30 C.F.R. § 250.1909 (2015). 

000797
Macondo Investigation Report Volume 3 4/17/2016

109 

BSEE now requires leaseholders359 to identify their MOC approval procedures and give both the technical 

basis for the change as well as an evaluation of the potential impacts on safety and health.360 Companies 

now are required to communicate changes and document MOCs that result in procedural changes.361

While BSEE requires companies to establish MOC program goals, there are no requirements to align risk 

tolerance expectations between BSEE and the companies its regulations cover, such as driving risk to as 

low as reasonably practicable (ALARP).362

1.9.2.2 Multi-party MOCs are an International Concern

At the time of the incident, no voluntary US industry guidance recommended how drilling contractors 

might provide critical reviews of their clients’ designs or programs for the well to assure that the 

design/program did not put their equipment and personnel at an unacceptable level of risk. The multiparty 

environment of offshore oil and gas operations supports the need to coordinate any changes initiated by 

the various parties that have the potential to impact the safety of the crew, rig, equipment, and 

environment. 

On a global level, after the Macondo blowout, there was a surge of industry recognition and appreciation 

for the interplay between leaseholder, drilling contractor, and well service providers. A 2013 

multinational audit of offshore operators and drilling contractors in the North Sea raised as a primary 

concern the crucial need for improvements in the coordination and interface between client and driller, 

noting a “lack of clarity in the various levels of bridging and interfacing documentation/processes” as 

well as a “lack of effective gap analysis in the client and drilling contractor systems/documentation.”363 

In the US, the API published new voluntary guidance in November 2013 to address the need to develop a 

Well Construction Interface Document (WCID) that bridges safety and environmental management 

systems among the lease holder, drilling contractor, and other third-party contractors.364 API’s guidance 

specifically calls for the WCID to address MOC systems and risk assessment processes. Thus, while each 

company should have its own system for managing risk, the changes should be coordinated and 

communicated between all the potentially affected parties.365 (The CSB further discusses the important 

role of bridging documents in effectively managing safety in Section 4.4.5.) 

 

359 However, as discussed in Volume 4, Section 3.3 of the CSB Macondo Investigation Report, the key federal 

offshore safety management regulations that address MOC programs (the Safety and Environmental Management 

Systems Rule) issued in the wake of the Macondo incident do not directly cover contractors.

360 30 C.F.R. § 250.1912 (d) (1-2, 4) (2012). 

361 30 C.F.R. § 250.1912 (a) (2) (2012).

362 See Section 4.1 in this Volume and Section 3.1 in Volume 4 for further discussion on ALARP. 

363 North Sea Offshore Authorities Forum (NSOAF). Multi-National Audit Human and Organisational Factors in 

Well Control 2012-2013, pp 3-4; http://www.hse.gov.uk/offshore/nsoaf.pdf (accessed May 2016, 2015).

364 American Petroleum Institute, Bulletin 97, 1st ed., Well Construction Interface Document Guidelines, November 

2013, p 1. 

365 Ibid., pp 7-8. 

000798
Macondo Investigation Report Volume 3 4/17/2016

110 

1.10 Inadequate Requirements for Incorporating Human Factors in 

US Offshore Operations

Before the Macondo incident, a company conducting US offshore drilling and completion operations was 

not required to maintain and implement a documented safety management program.366 Thus, there were 

no requirements to incorporate human factors into such a program.367 Also missing were any 

requirements for the safe management of critical tasks, operating procedures, and changes to the 

operational plan, process or the people conducting the work. US offshore lacked requirements for industry 

to incorporate good practice process safety principles, such as using the hierarchy of controls when 

deciding on the technical, operational and organizational barriers needed to prevent a major accident. 

Despite this regulatory shortfall, the importance of human factors offshore did not go unrecognized by 

industry and regulators.368 The following conclusion was noted at an April 2002 seminar to discuss 

human factors integration into oil and gas offshore operations: “Ignoring human factors will result in an 

increase not a decrease in incidents, lower safety performance and increased costs. Human factors are 

paramount to all aspects of offshore operations and essential in reducing human performance-related 

risks.”369 Participants of this event included the US and UK offshore regulators (MMS and HSE, 

respectively), and major companies in industry, such as BP, Shell, and Exxon. 

Several years later, in 2006, API published Human Factors Tool for Existing Operations to assist industry 

members in “incorporating human factors considerations into existing equipment and tasks.”370

According to the guidance document, this tool is meant for use by those conducting the actual work—the 

rig crew or process unit operators and mechanics.

371 It provides a methodology for identifying both (1) 

latent human error conditions and (2) potential human errors immediately prior to commencing hazardous 

 

366 The SEMS Rule was promulgated in October 2010.

367 Related the safe operation of a ship and pollution prevention, the US Coast Guard has had regulations since 1998 

that require certain vessels, including self-propelled MODUs, to comply the International Management Code for 

the Safe Operation of Ships and for Pollution Prevention (ISM Code). As a result, vessels must “have on board 

valid documentation showing that the vessel's company has a safety management system which was audited and 

assessed, consistent with the International Safety Management Code of IMO Resolution A.741(18);” 33 U.S.C. § 

96.370 (a) (1) (2016). See also International Management Code for the Safe Operation of Ships and for Pollution 

Prevention (International Safety Management (ISM) Code), 62 Fed. Reg. 67492 (December 24, 1997). 

368 The USCG acknowledged the role of human factors in major accidents when introducing regulations requiring 

the ISM Code, “Recent casualty studies concluded that in excess of 80 percent of all high consequence marine 

casualties may be directly or indirectly attributable to the ‘‘human element.’’ [...] The ISM Code offers a 

systematic approach to mariners with the policy and procedures needed to understand their duties and address the 

human element issues and risks that can prevent casualties from occurring.”; International Management Code for 

the Safe Operation of Ships and for Pollution Prevention (International Safety Management (ISM) Code), 62 Fed. 

Reg. 67492 (December 24, 1997)

369 Demystifying Human Factors: Practical solutions to reduce incidents and improve safety quality and reliability, 

2nd International Workshop on Human Factors in Offshore Operations, Houston, TX, April 8-10, 2002.

370 API, Human Factors Tool for Existing Operations, API Human Factors Task Force, Regulatory Analysis & 

Scientific Affairs Department, February 2006, p 1.

371 Ibid., p 2.

000799
Macondo Investigation Report Volume 3 4/17/2016

111 

work.

372 The expectation is to use the information compiled through this process to identify needed 

safeguards, to determine the risks most likely to result in consequences, and to develop recommendations 

for the reduction or elimination of the hazards.

373 While the document suggests the tool requires little or 

no training, 374 a certain level of human factors expertise and authority to examine management system 

failures and cultural influences are likely needed to identify and accurately risk-rank the latent conditions 

that can contribute to human error scenarios. Furthermore, it does not emphasize the importance of 

considering human factors in the designing and planning phases of a hazardous operation/equipment 

lifecycle, and it fails to indicate where technical and operational barriers may be identified and 

implemented. And since the document is merely guidance, its use offshore is optional. 

The emerging lessons of Macondo demonstrate the criticality of the human component within safe 

offshore operations. Yet, there remains a dearth of US regulatory requirements or national industry 

guidance aimed at improving human performance during safety critical offshore operations. In the 

aftermath of the blowout, the regulator and industry hastened numerous US task force initiatives to 

address issues such as safe drilling operations, well containment and intervention capability, and oil spill 

response capability,375 but focused these initiatives on physical threats and technical barriers and controls. 

In comparison, at the time of the incident, international offshore regions with developed regulatory 

regimes provided both regulatory requirements and guidance on human factors, and made further 

advancements in managing human factors offshore. This section makes some global comparisons and 

identifies opportunities to further incorporate human factors into safety management practices within the 

US offshore. 

1.10.1 After Macondo, Limited US Offshore Regulatory Requirements Remain 

for Including Human Factors 

In the US, companies operating offshore are not required to demonstrate to the regulator that they are 

effectively managing safety critical tasks, nor must they incorporate human factors into the management 

of those tasks to reduce risk. The post-Macondo safety management regulation, Safety and Environmental 

Management Systems regulations (SEMS Rule [30 C.F.R. 250 Subpart S]), very minimally addresses 

human factors. It requires that “The factors (human or other) that contributed to the initiation of the 

incident and its escalation/control” be addressed in incident investigations [250.1919(a)(2)], yet that 

requirement is limiting and reactive, seeking only to assess human performance for its immediate causal 

ties to a given incident. 

 

372 Ibid., pp 2-3.

373 Ibid., p 3.

374 Ibid, p 1.

375 Four Joint Industry Task Forces (JITFs) comprising of members from various industry associations were created 

post-Macondo to address critical offshore activities: operating procedures, equipment, subsea well control and 

containment, and oil spill preparedness and response. The aim of the JITFs was to further improve existing API 

standards and make recommendations to the regulator. [Joint Industry Task Force (JITF). JITF Executive 

Summary ; March 13, 2013; p 1. http://www.api.org/~/media/files/oil-and-naturalgas/exploration/offshore/executive-summary-final-031312.pdf (accessed October 15, 2015).] 

000800
Macondo Investigation Report Volume 3 4/17/2016

112 

The American Petroleum Institute’s Recommend Practice for Development of a Safety and Environmental 

Management Program for Offshore Operations and Facilities (API RP 75), which has been incorporated 

into the SEMS Rule by reference, suggests that human factors be “considered” in the following aspects of 

safety management: the design and implementation of the company’s SEMS program; the design of new 

facilities or major modifications to those facilities; the development of operating procedures and safe 

work practices; the facility hazard analysis; and in regards to equipment accessibility for operation, 

maintenance and testing.376 But considered is a weak requirement that does not suggest any action to 

incorporate human factors principles and best practice. A company could consider human factors issues, 

do nothing, and still meet the requirements outlined in the regulation. API RP 75 does not provide 

instruction on how to identify and assess human performance or implement controls for those potential 

performance failures that may impact safety critical task completion. 

Furthermore, only one human factors standard, ASTM F1166-95,377 is a related reference in API 75. The 

ASTM standard focuses on maritime facilities and equipment design, particularly on ergonomic design 

criteria and anthropometric considerations.378 While this ASTM voluntary standard does provide guidance 

on a number of human performance principles,379 it is not required of industry. 

Application of the API tool remains voluntary. It has not been revised or amended since its creation, nor 

has it been incorporated by reference into the SEMS Rule or listed as a normative reference within API 

75. 

1.10.2 Good Practice Techniques and Guidance on Human Factors 

Human factors technical standards and guidance applicable to the oil and gas industry exists, some of 

which have been referenced in this volume.380 In addition to that guidance, a variety of tools and methods 

have been developed over the years to assess the human contribution to safety and operational success, 

ranging in name and complexity including, among others: 381 

• Human Factors Risk Assessment 

 

376 API Recommended Practice, 75, 3rd ed. (2004, reaffirmed 2008 and 2013), Recommended Practice for 

Development of a Safety and Environmental Management Program for Offshore Operations and Facilities, 

Sections 1.2.2, 2.3.5, 5.1, 6.1, 8.1 and 3.1. 

377 American Society for Testing and Materials (ASTM) F1166-95, Standard Practice for Human Engineering 

Design for Marine Systems, Equipment, and Facilities, 1995.

378 ASTM F1166-95 (3.1.10) defines anthropometrics as the (1) study of the physical size, strength, and range of 

motion of the human body and the application of that data to the design of systems, equipment, workspaces, and 

tools to maximize human performance and safety in a work setting; and (2) measurement of human variability of 

body dimensions and strength as a function of gender, race, and regional origin.

379 ASTM FM6611-95 Section 4.2.

380 Further, McLeod provides a succinct summary of the most widely used guides pertaining to human factors 

engineering. See, McLeod, R., Designing for Human Reliability: Human Factors Engineering in the Oil, Gas and 

Process Industries, Elsevier, 2015, pp 348 – 356.

381 E.g., HSE, Human Factors Assessment of Safety Critical Tasks, OTO 1999, Report 095; Energy Institute, 

Guidance on Human Factors Safety Critical Task Analysis, March 2011; HSE, Inspector’s Human Factors 

Toolkit, Identifying Human Failures, Core Topic 3. http://www.hse.gov.uk/research/otopdf/1999/oto99092.pdf

(accessed March 26, 2016). 

000801
Macondo Investigation Report Volume 3 4/17/2016

113 

• Human Reliability Assessment 

• Human HAZOP 

• Hierarchical Task Analysis 

• Predictive Human Error Analysis 

• Safety Critical Task Analysis (SCTA)

The SCTA is a proactive safety management activity of identifying human performance expectations, 

potential hindrances to those expectations, and controls to mitigate or eliminate those hindrances before 

safety-critical work commences.

382 Potential severe consequences of a blowout or gas in the riser scenario 

are the very hazards identified as particularly in need of more in-depth hazard assessment. An HSE 

technical report suggests that “only hazards with implications for kick and blow-out scenarios [be] 

considered [for safety critical task assessment], since these are considered to be the greatest sources of 

risk in well operations.”383 SCTAs are meant to assess failure mechanisms that extend beyond the span of 

control of the crew, into areas such as equipment design and mechanical integrity, as well as 

organizational factors that could influence decision-making, including production or time pressures. As 

such, these assessments often require the involvement of shore-based personnel as well as the crew.

The hierarchy of controls is one approach to test the sufficiency of the barriers for a safety critical task; in 

fact, it is considered a step in the human performance assessment process.384 A foundational argument of 

the hierarchy of controls principle is that the most effective control minimizes or removes the hazard. If 

that is not possible, then one of the other progressive inherent safety strategies listed in Figure 1-15 may 

be used to manage those hazards and reduce risks associated with the operation.

Figure 1-15. Illustration of the Hierarchy of Controls, including inherent safety strategies, for minimizing 

and eliminating hazards. 

 

382 Energy Institute, Guidance on Human Factors Safety Critical Task Analysis, March 2011, p 1.

383 HSE. Human Factors Assessment of Safety Critical Tasks, Offshore Technical Report - OTO 1999 092; July, 

2000; p 14. http://www.hse.gov.uk/research/otopdf/1999/oto99092.pdf (accessed March 26, 2016). 

384 HSE, Inspector’s Human Factors Toolkit, Identifying Human Failures, Core Topic 3. 

http://www.hse.gov.uk/humanfactors/topics/toolkit.pdf (accessed March 26, 2016). 

000802
Macondo Investigation Report Volume 3 4/17/2016

114 

1.10.3 International Offshore Regulatory Requirements and Guidance

The UK HSE requires consideration of human factors and offers guidance to its duty holders on the 

principles to which the regulator will assess the treatment of human factors.385, 386 These principles 

include clearly describing the defined role of the human element in a hazardous operation/facility and 

demonstrating its reliability to perform the desired tasks; analyzing safety critical tasks and demonstrating 

(drawing upon recognized human factors good practice) that task performance can be delivered as 

expected; accounting for occupational factors, such as workload and shiftwork schedules; and analyzing 

human performance issues, such as work task feasibility, procedure design, training, and humantechnology interfaces.387 Furthermore, companies operating in the UK waters of the North Sea are 

expected to conduct qualitative analyses of human performance and demonstrate to the regulator they 

have identified potential performance consequences and the measures to counteract or mediate those 

consequences.388 The UK HSE provides publicly-available guidance for its regulatory inspectors to both 

 

385 UK Health Safety Executive, Assessment Principles for Offshore Safety Cases (APOSC), March 2006, Forward. 

http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed March 26, 2016). 

386 HSE, Safety report assessment guide: Human factors and HSE, Assessment principles for offshore safety cases 

(APOSC) http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed March 26, 2016).; HSE, Human Factors 

Assessment of Safety Critical Tasks, Offshore Technical Report – OTO 1999 092 (July 2000), Section 3.2.1, p 32. 

http://www.hse.gov.uk/research/otopdf/1999/oto99092.pdf (accessed March 26, 2016). 

387 UK Health Safety Executive, Assessment Principles for Offshore Safety Cases (APOSC), March 2006, Principle 

8, items 43 – 48. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed March 26, 2016). 

388 HSE, Inspector’s Human Factors Toolkit, Identifying Human Failures, Core Topic 3. 

http://www.hse.gov.uk/humanfactors/topics/toolkit.pdf (accessed March 26, 2016). 

Using the Hierarchy of Controls to Assess Human Performance Aspects of Safety 

Critical Tasks†

• Minimize: Can the consequences of the human failure be prevented (or 

mitigated), e.g., by additional barriers in the system? 

• Substitute: Can the human contribution be removed, e.g., by a more reliable 

automated system? 

• Moderate: Can human performance be assured by mechanical or electrical 

means? For example, the correct order of valve operation can be assured 

through physical key interlock systems or the sequential operation of switches on 

a control panel can be assured through programmable logic controllers. Actions 

of individuals alone should not be relied upon to control a major hazard. 

• Simplify: Can the PIFs [Performance Influencing Factors] be optimised, (e.g., 

improve access to equipment, increase lighting, provide more time available for 

the task, improve supervision, revise procedures or address training needs)?

†

Energy Institute, Guidance on Human Factors Safety Critical Task Analysis: London. March 2011, p 16.

000803
Macondo Investigation Report Volume 3 4/17/2016

115 

understand how to effectively analyze safety critical task performance and to audit companies’ efforts at 

considering human performance variability and potential negative outcomes.389 

In Australia, the regulator, NOPSEMA, asserts that the use of strategies that identify and optimize human 

factors will help industry reduce risk of a major accident, and using such strategies will help companies 

meet their obligations under the applicable Act and associated Regulations.390 NOPSEMA stresses the 

importance of the hierarchy of controls, stating “The nature, number and scale of the controls should be 

such that they are robust, not easily defeated and the level of control is effective for the risks they are 

intended to manage, prevent or mitigate. A hierarchy of controls should be established, with those that 

eliminate or prevent MAEs given priority over those that reduce or mitigate the outcomes.”391

The Norwegian offshore regulator, the Petroleum 

Safety Authority (PSA), asserts that the interaction 

among human, technology and organization—

HTO—is central for accident prevention and the 

basic element in its petroleum industry Health, 

Safety and Environment regulations.392 Section 13, 

Work processes, specifically states, “The 

interaction between human, technological and 

organisational factors shall be safeguarded in the 

work process.”393 As such, PSA emphasizes, 

among other human factors issues, the importance 

of the psychosocial and organizational factors, as 

well as HTO in safety critical systems.394 

 

389 HSE, Safety report assessment guide: Human factors and HSE, Assessment principles for offshore safety cases 

(APOSC); HSE, Human Factors Assessment of Safety Critical Tasks, Offshore Technical Report – OTO 1999 

092 (July 2000).

390 The Offshore Petroleum and Greenhouse Gas Storage Action (2006) and the Offshore Petroleum and Greenhouse 

Gas Storage (Safety) Regulations. National Offshore Petroleum Safety and Environmental Management Authority 

(NOPSEMA), Resources: Human Factors, http://www.nopsema.gov.au/resources/human-factors/ (accessed July 

31, 2015).

391 NOPSEMA, Guidance Note N-04300-GN0060, The Safety Case in Context: An Overview of the Safety Case 

Regime, rev. 6, June 2013. http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0060-The-SafetyCase-in-Context-An-Overview-of-the-Safety-Case-Regime-Rev-6-June-2013.pdf (accessed March 26, 2016). 

392 Petroleum Safety Authority, HSE Management: HTO/Human factors, August 28, 2013, http://www.psa.no/htohuman-factors/category965.html (accessed January 23, 2016).

393 Regulations Relating to Management and the Duty to Provide Information in the Petroleum Activities and at 

Certain Onshore Facilities (The Management Regulations), Last amended December 18, 2015, 

http://www.ptil.no/management/category401.html#_Toc280619401 (accessed January 24, 2016).

394 Petroleum Safety Authority, HSE Management: HTO/Human factors, August 28, 2013, http://www.psa.no/htohuman-factors/category965.html. (accessed January 23, 2016).

“Drilling and wells are examples of areas with great 

challenges in the interaction between people, 

technology and organisation. For example, the driller 

must maintain control of the well, lead the work on 

the drill floor and deal with technically advanced, 

screen-based solutions in the drilling cabin. It may 

thus be challenging to understand, operate and 

maintain an overview of all the incoming data – and 

simultaneously maintain control and overview of what 

is physically taking place on the drill floor.”

Petroleum Safety Authority, HSE Management: HTO/Human 

factors, August 28, 2013, http://www.psa.no/hto-humanfactors/category965.html (accessed January 23, 2016).

000804
Macondo Investigation Report Volume 3 4/17/2016

116 

The International Association of Drilling Contractors (IADC) is a global industry association, of which 

Transocean is a member. The organization publishes the Health Safety and Environmental Case 

Guidelines (HSE Case Guidelines) for Mobile Offshore Drilling Units, such as the Deepwater Horizon, 

providing guidance for a harmonized global framework and methodology for the management of safety. 

Ten countries require use of the guidelines by force of regulation, and it is recognized as best practice in 

ten additional countries, some of which have regulations pending to require adoption of the guidelines.395

The document, however, is only a voluntary standard in the US. Part 2 of the guidance contains HSE 

management objectives related to “procedural (human factors) controls.”396 The HSE Case Guidelines 

recommend that drilling contractors verify HSE critical activities and tasks, as well as the more typical 

physical safety critical equipment, stipulating, “Identification of Critical Activities or Tasks is essential to 

effectively manage major hazards or high risk hazards.”397 Part 4 of the Guidelines states, “A recognized 

best practice for risk optimization is to address each risk systematically according to a strategic hierarchy 

[of control].”398 The HSE Case Guidelines also explicitly focus on the drilling contractor’s management 

system, stating that it “needs to ensure that personnel policies, training, competencies, attentiveness and 

alertness, and other human factors allow individuals to perform their Critical Activities or Tasks 

effectively and efficiently,”399 and that such factors be monitored periodically.400Onshore Regulatory 

Requirements and Industry Guidance 

A number of US onshore regulations and standards address various aspects of human factors in 

downstream oil and gas operations, which are more robust than current offshore requirements. The federal 

onshore safety regulations applicable to oil and gas operations, Process Safety Management of Highly 

Hazardous Chemicals (PSM), stipulates that the required initial hazard analysis must address human 

factors.

401 Contra Costa County, California, goes beyond this PSM requirement; refineries within its 

jurisdiction must abide by the County Safety Ordinance, which has provisions that each refinery develop 

and implement a human factors program for its process hazard analysis, operating and maintenance 

procedures, and incident investigation management systems.402 The Ordinance also stipulates that the 

human factors program include staffing and shiftwork considerations, as well as the management of 

 

395 Countries requiring use of the guidelines by force of regulation include Australia, Cuba, Denmark, Faeroe 

Islands, Germany, Ireland, the Netherlands, New Zealand, Norway, and the United Kingdom. Angola, Canada, 

Brazil, India, Malaysia, Oman, Qatar, Senegal, South Africa, and Trinidad & Tobago recognize the guidelines as 

best practice. See http://www.iadc.org/iadc-hse-case-guidelines/. 

396 IADC, HSE Case Guidelines for MODU, Issue 3.4, November 2011, section 2.0.4 Demonstrating Assurance of 

HSE Management Objectives.

397 Ibid., section 4.7 Risk Treatment.

398 Ibid., section 4.7 Risk Treatment.

399 Ibid., section 4.7 Risk Treatment.

400 Ibid., section 6.3 Periodic Monitoring.

401 OSHA, Process Safety Management of Highly Hazardous Chemicals, 1910.119(e)(3)(vi).

402 County Ordinance Chapter 450-8, Risk Management, 450-8.016(b)(1)(a, b, d, and e), Stationary source safety 

requirements, Human factors program, http://cchealth.org/hazmat/iso/ (accessed January 22, 2016).

000805
Macondo Investigation Report Volume 3 4/17/2016

117 

organizational changes that affect staffing, and employee training on human factors principles and the 

human factors program itself.403 

The State of California OSH proposed Process Safety Regulation for Petroleum Refineries, 5189.1, goes 

even further, requiring the written human factors program to examine issues including but not limited to 

workload, staffing, shiftwork arrangements, procedural clarity, and job task conditions as they influence 

human performance.404 The proposed regulation also would require a human factors analysis of process 

controls (such as automated functions), as part of the larger process hazard analysis, for any major design 

changes to a process, and all incident investigations and organizational changes.405 

Both the Contra Costa County Ordinance and the proposed State of California process safety regulation 

include requirements for employee and employee representative participation in developing the human 

factors program,406 and that the regulated party document this program within its “safety plan.”407 

API Publication 770, A Manager’s Guide to Reducing Human Errors: Improving Human Performance in 

the Process Industries,408 provides guidance for onshore petrochemical processes on the topic of human 

factors engineering, a subset of larger human factors field, as well as on one specific human factors 

assessment method, human reliability assessment. The guidance illustrates the inherent and critical role of 

the human in successful completion of a hazardous operation throughout the lifecycle of operation (e.g., 

research and design, construction, installation, operation and maintenance), as well as throughout the 

various organizational levels within an organization (e.g., actions of the unit operator all the way to 

decisions by the corporate office).409 This guidance has not been extended to offshore. 

1.11 Conclusion

When a company does not complete a hazard assessment that accounts for well-specific conditions for 

safety critical procedures, does not identify vulnerability to human error in a structured and effective way, 

and does not identify appropriate controls to mitigate risk, it is relying on the workers’ varied knowledge 

and experience to effectively perform drilling tasks. In other words, the operational barrier for activities 

 

403 Ibid., 450-8.016(b)(1)(c and f) and 450-8.016(b)(3).

404 State of California, Division of Occupational Safety and Health, Proposed GISO §5189.1, Process Safety 

Management for Petroleum Refineries, Version 4.5, May 26, 2015, §5189.1(s)(2), p.26-27.

405 Ibid., §5189.1(s)(3) & (t), pp 26-27.

406 County Ordinance Chapter 450-8, Risk Management, 450-8.016(b)(2), Stationary source safety requirements, 

Human factors program, http://cchealth.org/hazmat/iso/ (accessed January 22, 2016).

407 County Ordinance Chapter 450-8, Risk Management, 450-8.016(b)(4), Stationary source safety requirements, 

Human factors program, http://cchealth.org/hazmat/iso/ (accessed January 22, 2016) and State of California, 

Division of Occupational Safety and Health, Proposed GISO §5189.1, Process Safety Management for Petroleum 

Refineries, Version 4.5, May 26, 2015, §5189.1(s)(7), p.27 and §5189.1(q), p.24. The ‘safety plan’ is submitted by 

the regulated party to the regulator as a record of asserted compliance with the provisions of the regulation and 

description of the manner of that compliance. County Ordinance Chapter 450-8, Risk Management, 450-8.016, 

http://cchealth.org/hazmat/iso/ (accessed January 22, 2016).

408 API Publication 770, A Manager’s Guide to Reducing Human Errors: Improving Human Performance in the 

Process Industries, March 2001.

409 See table 1 on page 2 of the referenced document for a useful example.

000806
Macondo Investigation Report Volume 3 4/17/2016

118 

such as displacement of a well and completion of a negative test is one hundred percent error-free 

performance by the workers. Thus, a question emerges from Macondo: If the workers’ knowledge and 

experience do not match the particular details of a negative test and the human decisions regarding the 

test are in error, what barriers are left to ensure a safe outcome?

If the critical layer of protection is the crew, then assessment of their capabilities and interactions with 

each other, the equipment, and the work environment must be comprehensive, and it must acknowledge 

human nature, variability, capabilities and limitations. Performance expectations and standards need to be 

realistic and appropriate in light of this fact.

Macondo provides numerous examples of not addressing human factors considerations in planning and 

executing temporary abandonment, factors that contributed to the well operations crew’s decisions and 

actions on the day of the incident. The multiple human factors issues explored in this chapter illustrate the 

need for incorporating human factors in process safety management for offshore oil and gas exploration 

and development activities. The full consequences of Macondo suggest a strong need for companies and 

regulators to assess how to strengthen the complex interactions among the human, technological, and 

organizational elements of a system. Yet, from the major reports published on the Macondo incident,410

only NAE recommended incorporating human factors in safety management,411 as part of two very broad 

recommendations aimed at improving offshore drilling safety and fostering an effective safety culture. 

Ultimately, the NAE recommendations make the same suggestions of the current SEMS Rule, to 

“consider” human factors principles for improving human performance and reliability, yet neither 

advocates for mandated action to ensure incorporation of human factors into MAE safety management. 

“Consider” is not enough, and as Volume 4 addresses more explicitly, it can lead to a check-the-box 

activity.412 Consequently, a more rigorous incorporation of human factors and safety strategies for 

managing human performance into US safety management requirements and practices is necessary for 

preventing major accidents. 

 

410 National Academy of Engineering and National Research Council of the National Academies. Macondo Well – 

Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety; The National Academies Press: 

Washington, D.C., 2011; BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; Transocean. 

Macondo Well Incident: Transocean Investigation Report Volumes I and II; June, 2011; National Commission on 

the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The Gulf Oil Disaster; 

Feburary 17, 2011; Transportation Research Board of the National Academies. Evaluating the Effectiveness of 

Offshore Safety and Environmental Management Systems; Special Report 309; National Academy of Sciences: 

Washington DC, 2012.

411 NAE made the following recommendations: Industry should greatly expand R&D efforts focused on improving 

the overall safety of offshore drilling in the areas of design, testing, modeling, risk assessment, safety culture, and 

systems integration. Such efforts should encompass well design, drilling and marine equipment, human factors, 

and management systems. These endeavors should be conducted to benefit the efforts of industry and government 

to instill a culture of safety; and (2) Industry, BSEE, and other regulators should foster an effective safety culture 

through consistent training, adherence to principles of human factors, system safety, and continued measurement 

through leading indicators. 

412 Volume 4, Chapters 2 and 3.

000807
Macondo Investigation Report Volume 3 4/17/2016

119 

2.0 Organizational Learning from Incident Investigations 

In the months and years leading up to the Macondo blowout, 

multiple well control incidents occurred on Transocean rigs 

active around the world under various operators.413 Several of 

these events call attention to aspects of offshore incident 

investigations that are addressed in this chapter, including the 

operator/drilling contractor interface and challenges to 

disseminating lessons learned in a global company and across an 

industry. The quality of the responsive risk reduction corrective 

actions implemented as a result of lessons learned will be 

affected by the nature of information gathered on the incident. 

Thus, this chapter concludes with a look at the US regulatory 

requirements for incident investigation during Macondo and 

currently for opportunities to overcome the challenges.

Investigations provide companies with an opportunity to 

formally review, report, track, and learn from undesirable 

events.414 An effective incident investigation program identifies 

hazards and system causal deficiencies and takes corrective 

actions to reduce risk before further similar accidents occur.415

By reviewing previous Transocean incidents that involved 

various operators, the CSB reiterates that not only a company, 

but in fact the industry, “suffers from repeated failures and incidents because less formal feedback 

mechanisms are not sufficient to identify effective recommendations.”416 

2.1 Joint Incident Investigations and Challenges to Disseminating 

Lessons Learned Between Companies

Work-as-imagined and work-as-done discrepancies, described in Section 1.8, are not unique to the 

Macondo incident or BP and Transocean.

417 For example, on February 20, 2009, Transocean experienced 

 

413 Internal Company Document, Transocean. Transocean Annual Report - 2010 Well Control Events & Statistics 

2005 to 2010, TRN-MDL-01858257, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-036071.pdf (accessed October 7, 

2015).

414 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; pp 552, 556.

415 American National Standards Institute/American Industrial Hygiene Association (ANSI/AIHA) Z10-2012, 

Occupational Health and Safety Managment Systems, 2012, p 25.

416 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007, p 556.

417 In almost every investigation conducted by the CSB, the agency has found significant disparities between 

company policies and actual practice at the worksite. The reasons for the disparity are often multi-faceted. 

Chapter 2.0 

This chapter explores incident 

investigations from a variety of 

perspectives, including the 

operator/drilling contractor interface, 

different geographical regions of an 

international organization, and a 

regulatory regime that does not 

explicitly require root cause 

investigations to address safety 

management systems. It also 

highlights numerous challenges that 

inhibit effective communication of 

lessons learned across the 

international offshore industry. 

000808
Macondo Investigation Report Volume 3 4/17/2016

120 

a well control event that resulted in the riser unloading aboard the M.G. Hulme, Jr. while drilling for t 

Eni418 off the coast of West Africa. The crew did not detect a kick until gas passed above the BOP when 

gas and drilling mud released onto the rig. The investigation concluded that the gas zone was reached 

earlier than predicted and the crew did not detect an influx that occurred when pumps had been shut down 

to investigate a problem.419 Phrases found in Transocean’s investigation report are indicators of 

inadequate bridging between work-as-imagined versus work-as-done (Table 2-1).

Table 2-1. Excerpts from the M.G. Hulme, Jr well control incident report that reflect WAI versus WAD 

conflicts.420

Excerpts from the Transocean M. G. Hulme, Jr. 

investigation report† CSB observations

“the well program made no mention ...” 

“the use of the [...]† system is a significant change 

from conventional drilling ...” 

“Did not challenge [the operator] on the quality of 

the pre-spud meeting or the adequacy of the well 

planning material.”

“the TSTP did not adequately quantify the hazards, 

nor did it discuss the preventative or mitigating 

controls”

“due to the use of the E-CD† equipment the Driller 

did not understand that he could ...” 

“Did not recognize the importance of...”

“Assigned driller with limited [...] experience”

“the driller was in a new position ...”

• Lack of, or minimal, detail provided by the operator 

in written work plans places a heavy reliance on the 

skills, knowledge, and experience of the drilling 

contractor which may not be sufficient for the task. 

• More than a set of instructions, procedures are tools 

for competent, motivated individuals to plan, 

coordinate, verify, and assure performance will 

achieve the intended results.

† Eni Circulation Device (E-CD), “permits the continuous circulation of mud in the well, which maintains a 

constant down hole pressure over the entire drilling process...,” http://www.eni.com/en_IT/innovationtechnology/technological-focus/safe-drilling/safe-drilling.shtml.

The need to identify lessons from incidents like the Macondo blowout or the M. G. Hulme, Jr. well 

control event transcends individual companies because the operators and drilling contractors have 

 

418 http://www.eni.com/en_IT/home.html (accessed October 7, 2015).

419 Internal Company Document, Transocean. EAU Incident Investigation Report - M.G. Hulme, Jr. Well Control 

Incident - Riser Unloading, OER-MGH-09-005, March 26, 2009, TRN-INV-01143039, 

http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05650.pdf (accessed October 7, 

2015).

420 Ibid. 

000809
Macondo Investigation Report Volume 3 4/17/2016

121 

different roles, expertise, and safety management systems that influence the design and operational risk of 

drilling a well. As a result, efforts to minimize the gap between WAI and WAD would be most effective 

if operators and drilling contractors alike work together to investigate incidents and identify corrective 

opportunities. 

2.2 Challenges to Disseminating Lessons Globally

Four months before the Macondo incident, on December 23, 2009, a Transocean-owned rig, Sedco 711, 

experienced a significant well control event in the North Sea.421 Delayed detection of a well kick resulted 

in gas and drilling mud from the riser unloading onto the rig with some being lost to the sea. Unlike the 

situation at the Macondo well, the flammable material that reached the rig did not ignite, and the BOP 

was able to seal the well and limit the release to what had already traveled above the BOP before it was 

closed.

The Sedco 711 incident occurred when a mechanical barrier that successfully passed a positive inflow test 

subsequently failed while the well was being underbalanced.422 The crew did not detect the kick, in part, 

because the mud returns were being routed to reserve pits, which prevented the crew from monitoring the 

returns on the active pit system.423,424 Other data were not interpreted as indicators of loss of well control 

based on the crew’s faith in the successful well barrier test. Transocean identified three immediate 

technical and operational causes, including failure of the tested downhole barrier, failure to monitor and 

identify the influx, and failure to close in the well prior to the influx reaching the BOP.425 Shell, the well 

 

421 Internal Company Document, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, TRNMDL-02840795, http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_DerekDepo_Bundle.zip, Exhibit 5749, (accessed October 7, 2015); Hearing before the U.S. District Court for the 

Eastern District of Louisiana under the Multi-District Litigation docket MDL No. 2179, June 13, 2011 pp 22-26, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Cameron_David-Depo_Bundle.zip 

(accessed October 7, 2015).; Internal Company Document, Transocean. 711 Well Control Incident Power Point, 

TRN-MDL-00870381, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-01760.pdf 

(accessed October 7, 2015).; Internal Company Document, Shell. Incident Investigation Report Bardolino Well 

Control Incident, Report: EP201002315140, January 26, 2010, p 4, TRN-INV-01823569.

422 Internal Company Document, Transocean. 711 Well Control Incident Power Point, p 4, TRN-MDL-00870381, 

http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-01760.pdf (accessed October, 7 

2015, October).

423 Internal Company Document, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, TRNMDL-02840795, http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_DerekDepo_Bundle.zip, Exhibit 5749, (accessed October 7, 2015). 

424 An important kick indicator is an increase in fluids coming from the well compared to the volume of fluids 

pumped into the well. As described by the National Commission on the BP Deepwater Horizon Oil Spill and 

Offshore Drilling (Commission). Chief Counsel’s Report: The Gulf Oil Disaster, February 17, 2011, p 165, “The 

active pit system refers to a computer setting that allows the driller (and others) to select several pits and 

aggregate their volumes into one "active pit volume" reading. Even though there are several different pits 

involved, the rig's computer system displays them as a single pit for volume monitoring purposes.”

425 Internal Company Document, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, TRNMDL-02840796, see Exhibit 5749. 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015).

000810
Macondo Investigation Report Volume 3 4/17/2016

122 

operator, reported both onshore and offshore personnel believed that once the crew successfully 

performed the inflow test, the barrier would not fail, which “led to a blinkered approach” by the crew 

regarding the true well conditions.426 The report states, “This belief is highlighted by the fact that there 

were clear indications of the operation not going to plan, but the thoughts were tailored in looking for 

surface reasons for the anomalies.” 427 Ultimately, the crew rationalized the well control indicators to 

support the conclusion that the well barrier was intact. 

A Transocean operations advisory noted a lack of clear well control procedures and a weak risk 

assessment for planning and executing the well plan.428 As at Macondo, procedures were missing critical 

process parameters, “The well planning did not highlight that the well would be under balance during the 

[...] operation. There were no hydrostatic step up/down charts to show the expected pressures in the well 

at the different stages of the well clean up, and specifically when the well went under balance.”429 As a 

result of the Sedco 711 event, Transocean and Shell, separately identified corrective actions. Shell’s 

proposed actions focused on written tools that Section 1.8 previously noted were important for closing the 

WAI and WAD gap:

• Inclusion of loss of well barrier risks on TSTPs (see Section 1.8.3 for TSTP discussion);430

• Increased communication of Standing Instructions to the Driller (SID) with clear roles, 

accountability, and responsibilities listed (see Section 1.8.2 for SID discussion); 431

• Development and use of written work instructions for well control operations that include 

guidance information on overbalance and underbalance operations and on conducting inflow 

tests, and that document the risk assessment and mitigation actions.432 

• Revisions to the Well Control Handbook pertaining to conducting fluid displacements under 

controlled conditions and calculating hydrostatic pressure;

433 

• Review of the Transocean (contractor) and Shell (operator) bridging document to clarify 

accountabilities and standardize the well control process into defined phases that identify when 

decision-making requires management or technical onshore support (see Section 4.4.5 for 

Macondo bridging documents discussion);434 and 

 

426 Internal Company Document, Shell. Incident Investigation Report Bardolino Well Control Incident, Report: 

EP201002315140, January 26, 2010, p 12, TRN-INV-01823569.

427 Ibid. 

428 Internal Company Document, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, TRNMDL-02840796, see Exhibit 5749

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015). 

429 Ibid., TRN-MDL-02840797.

430 Internal Company Document, Shell. Incident Investigation Report Bardolino Well Control Incident, Report: 

EP201002315140, January 26, 2010, p 41, TRN-INV-01823569.

431 Ibid., p 20, TRN-INV-01823569.

432 Ibid., pp 4, 14, TRN-INV-01823569.

433 Ibid., p 15, TRN-INV-01823569.

434 Ibid., p 16, TRN-INV-01823569. 

000811
Macondo Investigation Report Volume 3 4/17/2016

123 

• Corrective actions for Schlumberger (third-party contractor) related to including relevant parties 

in hazard assessment activities435 and to incorporating a lateral learning process for capturing 

lessons learned from operational incidents (to Schlumberger)436 and risk assessment changes and 

management (to Shell).437 

As part of its investigation, Transocean noted two “missed opportunities” related to the mudlogger. One 

was that the mudlogger reported an increase in well fluids, but the driller did not act upon it, attributing 

the increase instead to reasons other than loss of well integrity. A second was that the mudlogger did not 

inform the client supervisor, toolpusher, or the driller again when the flow of well fluids continued to 

rise.438 These lines of communication match what is presented in Figure 1-12. Despite observing that the 

well kick indicator was reported by the mudlogger and that increased communication might have helped, 

neither Transocean’s nor Shell’s corrective actions addressed communication skills or gaps. Instead, their

corrective actions focused more generally on increasing awareness among crew members by reviewing 

the incident, reiterating the need for early kick detection, and ensuring well programs noted when 

underbalanced conditions were to exist in a well. Third-party mudlogger services like those provided by 

Schlumberger during this project are contracted by the operator, indicating that the operator is likely best 

positioned to cause bridging between the drilling contractor and other third-party contractors. Beyond the 

mudlogger missed opportunities, Transocean was also concerned with updating its well control manual as 

a result of Shell’s recommendation.439

Four months later, Transocean’s Well Operations Manager in the Gulf of Mexico sent an email to 

colleagues in the North Sea, stating, “I’m still on the fence as to whether an advisory [on Sedco 711] is 

required or not.”440 He was concerned that the well control manual sufficiently addressed underbalanced 

well conditions. The response he received from his North Sea counterparts was, “Expectation from Shell 

is an update in the [well control] manual—hence request for advisory until update issued. If not done then 

we will require to issue an [North Sea] advisory but I know Shell will ask what the Shell rigs are doing 

elsewhere in the world...”441 Subsequently, an advisory for the Gulf of Mexico was developed that 

suggested additional text be included in the well control manual, including the statement, “Do not be 

complacent because the reservoir has been isolated and inflow tested. Remain focused on well control and 

maintain good well control procedures.” 

 

435 Ibid., p 15, TRN-INV-01823569.

436 Ibid., p 15, TRN-INV-01823569.

437 Ibid., p 17, TRN-INV-01823569.

438 Internal Company Documents, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, TRNMDL-02840796, see Exhibit 5749

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip, (accessed 

October 7, 2015). 

439 Email from Aberdeen Operations Manager, Transocean, to Well Operations Manager, Transocean, Subject: 

potential advisory from 711 event, March 31, 2010, TRN-INV-03407526.

440 Ibid. 

441 Ibid. 

000812
Macondo Investigation Report Volume 3 4/17/2016

124 

The DWH crew never received the US advisory describing the text changes that would be made to the 

well control manual. 442 Post-incident, Transocean’s General Manager of North America who was 

responsible for forwarding the information to the GoM rigs stated that the email containing the advisory 

came in while he was on vacation and that he never saw it.443 Another person covered the general 

manager’s duties while he was on vacation, but upon review of both email accounts, neither person 

forwarded the advisory to employees working in the Gulf of Mexico. The advisory was posted on 

Transocean’s internal electronic document system at the same time it was sent to the General Manager,444

but unless employees subscribed for notifications of newly added documents, they would not have be 

made aware of its submission.445 

Without auditable follow-up actions, and a person responsible for tracking them, such an unintended 

oversight is more likely to occur. Databases require users to initiate searches, and emails can languish in 

an inbox. Consequently, industry needs to consider how to most effectively communicate the various 

database resources (including those with email notifications) and how to absorb lessons into the 

organization’s safety management systems. Inundating people with too much information leads to their 

overlooking critical information for immediate action. Changing this mindset will require industry and 

regulators to distinguish such critical information from learnings that could be reviewed on a less frequent 

basis.

The Well Operations Group Advisory developed for the Gulf of Mexico was also markedly different from

the North Sea Operations Advisory concerning Sedco 711.446,447 Where the GoM advisory described the 

 

442 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 28, 2011; see Johnson Designations Vol 1, pp 91-93, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Johnson_Paul-Depo_Bundle.zip (accessed 

October 7, 2015).; Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, October 27, 2011; see Braniff Designations Vol 1, p 27, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Braniff_Barry-Depo_Bundle.zip (accessed 

October 7, 2015).; Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, March 24, 2011; see Canducci Designations Vol 2, pp 141-142, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Canducci_Gerald-Depo_Bundle.zip

(accessed October 7, 2015).

443 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, July 27, 2011; see Sannan Designations Vol 1, p 75, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Sannan_Stuart-Depo_Bundle.zip (accessed 

October 7, 2015).

444 Ibid., 1, p 81. 

445 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, April 25, 2011; see Rose Designations Vol 1, p 113, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

October 7, 2015).

446 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 28, 2011; see Johnson Designations Vol 1, pp 104-106, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Johnson_Paul-Depo_Bundle.zip (accessed 

October 7, 2015).

447 Internal Company Documents, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, and Well 

Operations Group Advisory, HQS-OPS-ADV-09, April 5, 2010, TRN-MDL-02840793 and TRN-MDL000813
Macondo Investigation Report Volume 3 4/17/2016

125 

event simply as a “well control event,” the North Sea included a description of the consequences such as 

11 days of lost time, cost of approximately 5.2 million Euros (~6.5 million US dollars), and significant 

loss to Transocean’s reputation. While the US advisory only addressed the well control manual text 

changes, the North Sea advisory provided details concerning: 

• misplaced faith in a tested barrier; 

• secondary activities that obscure the ability to monitor the pit levels; 

• rationalizing rig data; 

• no clear procedures in underbalanced conditions; 

• weak risk assessments; 

Despite the suggestion of several inherent human performance issues, the advisory corrective actions 

focused on reminding the drill crew of the importance of kick detection and their responsibilities, as well 

as the need to provide written warnings in the daily instructions when a single mechanical barrier is in 

effect.

448 Missing was an attempt to understand the psychological and cognitive reasons the crew placed 

faith in the barrier or rationalized the data. (For example, perhaps control board design or inadequate 

instrumentation contributed to their situational awareness of the well. This would be unknown unless 

examined as part of the investigation.) Also absent were identified steps the company might take to 

provide procedural clarity, conduct more useful risk assessments, or ensure secondary activities do not 

eclipse safety critical activities in future projects. Furthermore, the mudlogger communication issues 

mentioned earlier were not addressed.449 Both the North Sea advisory and the more limited US version do 

not address these important underlying factors in order to resolve the human factors issues revealed in the 

investigation. 

Large corporations like Transocean often consist of a series of business units which act as freestanding 

commercial organizations. So, while Transocean’s North Sea and Gulf of Mexico business units work 

from the same corporate policies, implementation of those polices is determined separately by the 

independent business unit leaders. This can be described as centralized direction with decentralized 

implementation. As the Sedco 711 incident exemplifies, this approach can lead to different results among 

business units in the same company. The CSB and others previously noted the role a decentralized 

organizational structure can play in a major accident,450 leading to systemic and cultural differences 

across business units rather than a consistent approach to managing major accident risk. 

 

02840795, see Exhibit 5749 http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_DerekDepo_Bundle.zip, (accessed October 7, 2015). 

448 Internal Company Documents, Transocean. Operations Advisory, NRS-OPS-ADV-008, April 14, 2010, and Well 

Operations Group Advisory, HQS-OPS-ADV-09, April 5, 2010, TRN-MDL-02840793 and TRN-MDL02840795, see Exhibit 5749 http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_DerekDepo_Bundle.zip, (accessed October 7, 2015). 

449 See Section 1.7.1.1.

450 CSB, 2007. Refinery Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, March 

2007.; Hopkins, A. Disastrous Decisions; CCH Australia: Australia, 2012; pp 97 - 110.; The Baker Panel. The 

Report of the BP US Refineries Independent Safety Review Panel; January, 2007; p 94. 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015).; UK Health and Safety 

Executive and Scottish Environment Protection Agency. Major Incident Investigation Report BP Grangemouth 

Scotland; August 18, 2003; p 62. 

000814
Macondo Investigation Report Volume 3 4/17/2016

126 

2.3 Expanding Beyond Immediate Causes and Implementing 

Change

The broadest learning impact can be achieved when investigations extend beyond the immediate technical 

causes of an incident. Addressing deficient safety management systems and inadequate organizational 

practices can result in findings that go beyond the immediate chain events that preceded any one incident. 

As examples in this chapter show, while the immediate causes of a well control incident might vary, the 

safety management systems and organizational findings can be similar. Ultimately, BSEE has the 

opportunity to mandate such a focus and then facilitate the dissemination of lessons across the 

operator/drilling contractor boundary and geographical regions. 

There is the danger of concentrating on the exact mechanism of the previous incident rather than 

identifying broad lessons. Regulatory requirements may exacerbate this narrow focus for investigating 

major accidents and near-misses. In the US, the SEMS Rule excludes drilling contractors and require only 

operators to complete incident investigations. Additionally, the SEMS Rule requires that the 

investigations identify contributing factors but do not explicitly require investigations to extend beyond 

the immediate causes to deficient safety management systems on the rig and inadequate organizational 

practices by either the operator or the drilling contractor.451 In Europe, a recently adopted directive strives 

“to facilitate the exchange of information and to prevent future accidents of a similar nature,” but then 

focuses on information of “technical interest” when describing information to be reported on nearmisses.

452

The global nature of drilling and the overlap that occurs when drilling contractors like Transocean work 

for multiple operators presents the opportunity for expediting industrywide learning with each well 

control event. Similarly, international operators could expose each other to learnings as a part of their 

joint ventures. Well incident databases from before453 and after454 the Macondo incident collect safety 

incident information that can be analyzed and shared across the industry to increase lessons learned. 

While industry develops and maintains these incident databases, regulators can also influence incident 

reporting and the sharing and implementing of lessons learned.

 

451 30 C.F.R. § 250.1919 (2015). 

452 Directive 2012/18/EU of the European Parliament and the Council of 4 July 2012 on the Control of MajorAccident Hazards Involving Dangerous Substances, Amending and Subsequently Repealing Council Directive 

96/82/EC. 

453 For example, Step Change in Safety supported Safety Alert Database and Information Exchange (SADIE) (now 

known as the Incident Alerts Database) https://www.stepchangeinsafety.net/safety-conversations/intro; (accessed 

October 7, 2015), SINTEF Offshore Blowout Database http://www.sintef.no/en/projects/sintef-offshore-blowoutdatabase/ (accessed October 7, 2015), and the Norwegian Oil and Gas’ Drilling Managers Forum initiative, 

Sharing to be Better, https://www.norskoljeoggass.no/en/Activities/HSE-and-operation/Sharing-to-be-better/. 

454 For example, in the UK the Oil & Gas Producers Wells Expert Group started a well control incident database 

http://www.iogp.org/Newsroom/News/PostId/71/well-control-incidents-database-submissions-a-benefit-toindustry (accessed October 7, 2015); in the US the Center for Offshore Safety initiated a Learning from Incidents 

program http://www.centerforoffshoresafety.org/COS%202013%20Annual%20Performance%20Report.pdf

(accessed October 7, 2015). 

000815
Macondo Investigation Report Volume 3 4/17/2016

127 

2.4 Effectiveness of post-Macondo SEMS Requirements for Incident 

Investigation 

At the time of the Macondo blowout, BSEE’s predecessor MMS published investigations of selected 

serious incidents,455 but US offshore regulations did not require companies to investigate their own 

incidents. With BSEE’s promulgation of the SEMS Rule, operators now must develop investigation 

procedures for “all incidents with serious safety or environmental consequences.”456 For situations that 

 

455 See BSEE’s Panel Investigation Reports at http://www.bsee.gov/Inspection-and-Enforcement/Accidents-andIncidents/Panel-Investigation-Reports/Panel-Investigation-Reports/ (accessed October 7, 2015). 

456 30 C.F.R. § 250.1919 (2014).

Additional Roadblocks to Organizational Learning 

Beyond the challenges discussed in this chapter, there are additional roadblocks that cannot be 

ignored. 

Legal challenges to sharing information from internal investigations threaten maximum learning. At 

the Expert Forum on the Use of Performance-Based Regulatory Models in the US Oil and Gas 

Industry, Offshore and Onshore, a a staff consultant from the Center for Chemical Process Safety 

commented, “too often when it’s post-incident, lawyers get involved and it’s very, very difficult to 

share information.” b The speaker also described how companies fear that lessons learned will result 

in a punitive response from the regulator, so they start to protect documents under attorney-client 

privilege. He commented, “So, the more punitive the lawyers become concerned, the more closely they 

hold information. And really we need to go the other direction.” c 

The timeliness of information is also of concern. The legalities surrounding incidents can affect when, 

if ever, information concerning an incident is released. For example, some technical findings related 

to the Macondo blowout were released within a year of the incident, d but information that provided 

insight to the organizational and operational issues (including human performance) was not released 

until almost three years later when the US District Court for the Eastern District of Louisiana posted 

documents and depositions online that had been submitted as part of the criminal hearings. 

These two critical challenges must be overcome to further advance learning. 

a Expert Forum on the Use of Performance-Based Regulatory Models in, 77 Fed. Reg. 50172 (August 20, 2012) 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed 

October 7, 2015).

b Stakeholder meeting transcript for the Expert Forum on the Use of Performance-Based Regulatory Models in the U.S. 

Oil and Gas Industry, Offshore and Onshore, OSHA-2012-0033-0022, September 21, 2012, p 17.

c Stakeholder Meeting Transcript for the Expert Forum on the Use of Performance-Based Regulatory Models in the U.S. 

Oil and Gas Industry, Offshore and Onshore, OSHA-2012-0033-0022, September 21, 2012, p 36.

d Bureau of Ocean Energy Management Regulation and Enforcement (BOEMRE). Forensic Examination of Deepwater 

Horizon Blowout Preventer; Report No. EP030842; March 11, 2011.

000816
Macondo Investigation Report Volume 3 4/17/2016

128 

have the “potential” for serious consequences, facility management or the regulator may determine that an 

investigation is necessary. Factors that contributed to the incident and recommended changes must be 

addressed, and a corrective action program must be established where the conclusions are distributed to 

“similar facilities and appropriate personnel within their organization.”457 The requirements do not 

explicitly stipulate that safety management systems, the interface between the operator and contractors, or 

lessons learned from either international incidents or other companies be addressed. A March 8, 2010, 

well kick at Macondo exemplifies how an investigation lacking in these characteristics can result in 

missed opportunities to prevent similar consequences. 

While drilling the Macondo well at a depth of approximately 13,250 feet, a well kick occurred.458 The 

crew noted an increasing gain in pit volume,459 prompting them to shut in the well for evaluation. Rig 

data indicates the well flowed undetected for approximately 30 minutes and resulted in a gain of 35 

barrels before the situation was brought under control.460 The larger the ingress, the greater the potential 

hazard, and Transocean documented that the majority of well kicks are detected in under 20 barrels, and 

noted that “failure to limit a kick to less than 20 barrels is less than ideal.”461 Thus, the March 8 and 

previously described Sedco 711 and M.G. Hulme, Jr., incidents proved to be crucial missed opportunities 

for Transocean to examine crew kick response time, share the subsequent lessons learned, and incorporate 

changes in their safety management systems to support improvements. Ultimately, while Sedco 711 and 

M.G. Hulme identified systemic deficiencies, none appeared in the official investigation of the March 8 

incident by either company, nor were corrective actions taken to remedy such failures. 

 

457 30 C.F.R. § 250.1919(b)(3).

458 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, May 11, 2011; See Sepulvado Designations Vol 1, pp 29-32, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Sepulvado_Murry-Depo_Bundle.zip

(accessed October 7, 2015).; Internal Company Document, Transocean. IADC Daily Drilling Report, Deepwater 

Horizon, Report No. 37 (March 8, 2010), 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00657.pdf (accessed October 7, 

2015). 

459 See footnote 424 for definition.

460 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, May 11, 2011; See Sepulvado Designations Vol 1, pp 29-32, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Sepulvado_Murry-Depo_Bundle.zip

(accessed October 7, 2015).; Internal Company Document, Transocean. IADC Daily Drilling Report, Deepwater 

Horizon, Report No. 37 (March 8, 2010).; Hearing before the U.S. District Court for the Eastern District of 

Louisiana under the Multi-District Litigation docket MDL No. 2179, April 20, 2011; see Burgess Designations pp 

31 - 38, http://www.mdl2179trialdocs.com/releases/release201302281700004/Burgess_Mark-Depo_Bundle.zip

(accessed October 7, 2015).; Internal Company Document, BP. File Note: Information regarding kick taken on 

Deepwater Horizon on March 8th 2010, Exhibit 676, BP-HZN-BLY00096442, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lee_Philip-Depo_Bundle.zip (accessed 

October 7, 2015).

461 In 2009, Transocean recorded that 84% of kicks were detected in under 20 barrels, and 14% of kicks ranged from 

20 to 60 barrels. Internal Company Document, Transocean. Well Control Events & Statistics 2005 to 2009, p 6, 

TRN-INV-00760054, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05649.pdf

(accessed June 24, 2015). 

000817
Macondo Investigation Report Volume 3 4/17/2016

129 

BP requires well control incidents be reported in its official corporate incident reporting system, 

Tr@ction.

462 However, no Tr@ction report was created for the March 8 event.463 The Wells Team Leader 

for the DWH “did not know that reporting this type of an incident was a requirement.”464 BP did, 

however, conduct a technical examination of the kick, which looked at the variables such as the 

geological conditions of the well and pore pressure detection analytics.465 BP’s Tiger Team466 shared 

additional lessons learned through emails among the team.467 Mainly, the lessons were technical, but one 

concerned better lines of communication among BP rig personnel and the “Houston office.” It was noted 

that the mudlogger and wellsite pore pressure/fracture gradient468 personnel should openly communicate 

with the wellsite geologist, who should then communicate with the BP well site leader.469 However, this 

document did not address the potential human factors related to the well operations crew’s kick response 

capabilities, nor how to improve that response through more effective technologies, barrier management, 

and safety system performance. 

 

462 Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, 

Section 15.2.12, BP-HZN-BLY00034504, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 2015).

463 Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with John Guide, July 1, 

2010, BP-HZN-BLY00124228, see Exhibit 0153 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Paine_Kate-Depo_Bundle.zip (accessed 

October 7, 2015).; Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with 

Mark Hafle, July 8, 2010, BP-HZN-BLY00144214, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-04447.pdf (accessed October 7, 

2015).

464 Internal Company Document, BP. BP Incident Investigation Team - Notes of Interview with John Guide, July 1, 

2010, BP-HZN-BLY00124228, see Exhibit 0153 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Paine_Kate-Depo_Bundle.zip (accessed 

October 7, 2015).

465 Internal Company Document, BP. Macondo LL, March 18, 2010, Powerpoint presentation prepared by the BP 

Macondo well onshore engineering team, BP-HZN-2179MDL00340813, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-000051.pdf (accessed October 7, 

2015).; Internal Company Document, BP. File Note: Information regarding kick taken on Deepwater Horizon on 

March 8th 2010, BP-HZN-BLY00306271, see Exhibit 7321 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Cowie_James-Depo_Bundle.zip (accessed 

October 7, 2015).

466 The Tiger Team is a group of experts (e.g., in shallow hazard assessment, pore pressure prediction, operations 

geology, etc.) that provides onshore sub-surface support for the planning and execution of deepwater exploration 

wells. 

467 Email from Tiger Team Members, BP, Subject: RE: Lesson learned - Plan forward: Macondo, March 18, 2010, 

BP-HZN-2179MDL00015694, http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX00214.pdf (accessed October 7, 2015).

468 See Volume 1, Section 2.1 for description of pore pressure and fracture gradient.

469 Email from Tiger Team Members, BP, Subject: RE: Lesson learned - Plan forward: Macondo, March 18, 2010, 

BP-HZN-2179MDL00015697, http://www.mdl2179trialdocs.com/releases/release201304041200022/TREX00214.pdf (accessed October 7, 2015).

000818
Macondo Investigation Report Volume 3 4/17/2016

130 

At the time of the incident, Transocean required a Well Control Event Report whenever the rig 

experienced a well kick.

470 The Well Control Event Report recorded the conditions in the well at the time 

of the kick (e.g., mud weight, shut in drillpipe pressure, size of influx), and it required a root cause 

analysis of the event. In response to the March 8 kick, Transocean created an operation event report for 

the March 8 kick, attributing the event to “drill[ing] into abnormal pressure,” but provided minimal 

information about the event and identified no corrective actions.471 In emails with the BP Wells Team 

Leader, the Transocean Rig Manager identified the need to improve hazard recognition among the 

crew.472 However, neither BP nor Transocean connected similarities of the March 8 kick with previous 

Transocean incidents, nor reviewed previously identified safety management system or communication 

deficiencies that might also have occurred at the Macondo well. 

Ultimately, the March 8 incident was not investigated for its safety implications. It is worth 

reemphasizing that BP did not identify the delayed response on March 8 as a safety concern in its formal 

investigation of the incident, but it did acknowledge it post-Macondo.473 

While current US offshore regulations require companies to address contributing factors in incident 

investigations, the regulations do not explicitly require investigations to extend beyond the immediate 

causes to deficient safety management systems and inadequate organizational practices. The Macondo 

blowout and other incidents discussed in this chapter point toward a need for an investigation to cover the 

operator/ contractors interactions, but the SEMS Rule excludes contractor compliance.474 And while the 

SEMS Rule requires that “The factors (human or other) that contributed to the initiation of the incident 

and its escalation/control” be addressed in incident investigations [250.1919(a)(2)], it does not provide 

guidance on human and organizational analyses and joint operator/drilling contractor investigations. 

Companies may comply only minimally with regulations that require the conduct of an activity (in this 

case, investigation of an incident) but do not explicitly stipulate the outcome to be achieved (i.e., major 

 

470 Internal Company Document, Transocean. Well Control Handbook, Revision 01, HQS-OPS-HB-01, March 31, 

2009, Well Control Procedures and Responsibilities and Appendix, BP-HZN-2179MDL0033078 AND BP-HZN2179MDL00331106, http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00596.pdf

(accessed October 7, 2015).

471 Internal Company Document, Transocean. Well Control Event Report, OER-DWH-10-023, March 8, 2010, 

TRN-MDL-00287183, see Exhibit 0688 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Johnson_Paul-Depo_Bundle.zip (accessed 

October 7, 2015).

472 Email from Macondo Rig Manager, Transocean, to Wells Team Leader, BP, Subject: Hazard Recognition, 18 

March, 2010, BP-HZN-2179MDL00289217, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-000684.pdf (accessed October 7, 

2015).

473 In the aftermath of Macondo, the response time of the crew to the March 8 kick was criticized. The BP Wells 

Team Leader indicated that the well operations crew’s response to the kick as “very poor,” and that the 

Transocean Rig Manager believed the crew “had screwed up;” Internal Company Document, BP. BP Incident 

Investigation Team - Notes of Interview with John Guide, July 1, 2010, BP-HZN-BLY00124228, see Exhibit 0153 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Paine_Kate-Depo_Bundle.zip (accessed 

October 7, 2015).

474 See Volume 4, Section 3.2 for details.

000819
Macondo Investigation Report Volume 3 4/17/2016

131 

accident prevention through demonstrated risk reduction).475 This reality exists even when internal 

company policies stipulate more stringent practices (Section 4.1). The SEMS Rule does not require that 

corrective actions from investigation findings demonstrably reduce risk to an identified goal. Volume 2 of 

the CSB’s Macondo investigation report highlights pitfalls of not requiring companies to mitigate risk to 

targeted risk levels.476 In summary, the potential exists for a company to satisfy regulatory requirements 

even though they may not adequately or effectively reduce the hazards of major accidents. The SEMS 

Rule requirements need to move beyond an activity-based focus, require in-depth assessment of 

organizational contributions, and encourage sharing of lessons learned across the offshore global 

community within and between companies. 

2.5 Conclusion

Several of the issues raised in Chapter 1 concerning system and organizational deficiencies were not 

unique to the work conducted at the Macondo well—latent kick detection was not a Deepwater Horizon 

crew problem, but a challenge that Transocean faced internationally several times before. International 

investigation reports reviewed in this chapter identified improvements in tools that help minimize the gap 

between WAI and WAD, as well as those to help raise a crew’s hazard awareness, but they were not 

implemented in the Gulf of Mexico. 

Offshore regulations provide the minimal safety expectations a company must meet. Accordingly, if US

regulations do not establish goals for incident investigations that require not just immediate technical 

findings, but also lessons from international incidents, then companies have the opportunity to limit what 

they do in response to incidents and near-misses. The M G. Hulme Jr., Sedco 711, and Deepwater 

Horizon March 8 well control event and April 20 blowout all indicate that incidents and near-misses need 

to be viewed beyond an individual rig level and within the larger context of a safety performance 

indicators program (addressed in detail in the next chapter). But, an indicators program can be only as 

good as the data upon which it is based, and it will be ineffective if the findings resulting from an 

investigation or indicator program are not actually acted upon to continually improve safety. 

 

475 See Volume 4, Section 2.5 for details. 

476 Volume 2, Section 6.1.1.1

000820
Macondo Investigation Report Volume 3 4/17/2016

132 

3.0 Safety Performance Indicators 

Companies involved in offshore drilling and production—and even 

trade associations and regulators—can develop and use organizational 

and managerial measures, also called indicators, to monitor safety 

performance, compare or benchmark that safety performance, and set 

goals for continual improvement. 

In the oil and gas industry, safety performance can be separated into two 

categories: personal safety (also called occupational safety) and process 

safety, which addresses efforts to reduce the potential for a major 

accident event.

477 The distinction is important because the indicators to 

monitor and the approaches to manage the two categories are different. 

For example, good personal safety is indicated by low individual worker 

injury rates which, for some tasks, could be achieved by simply using 

appropriate personal protective gear. In contrast, an offshore process 

safety indicator might be a well operations crew’s well kick response 

time which, as Chapter 0 indicates, could require a variety of 

approaches to improve including safety critical task analysis and better 

communication between the operator and contractors. 

History has repeatedly proven that good personal safety statistics have, 

in fact, often preceded major accident events, yet industry and 

regulators still rely on personal safety metrics to indicate good process 

safety performance. After the Macondo blowout when, then-CEO, Tony Hayward commented on BP’s 

safety record: 

Before this tragic incident, our safety record was improving, with the key metrics such as 

recordable injury frequency (RIF),478 days away from work case frequency (DAFWC)479 and onsite fatalities all on a downward trend. This accident has been a terrible exception to that trend 

and we must learn the lessons from it.480 

 

477 A process safety incident is the unexpected releases of toxic, reactive, or flammable liquids and gases in 

processes involving highly hazardous chemicals—Process Safety Management, OSHA 3132, 2000 (reprinted). 

478 Recordable injuries as those that result in death, days away from work, restricted work or transfer to another job, 

medical treatment beyond first aid, or loss of consciousness, § 1904.7

479 An industry benchmark defined as injuries that result in an employee being away from work for at least one 

calendar day after the injury.

480 Email from BP's Employee Communications, to BP Employees, Subject: Gulf of Mexico update from Tony 

Hayward, July 9, 2010, BP-HZN-2179MDL01617349, see Exhibit 6059, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_Anthony-Depo_Bundle.zip

(accessed October 7, 2015). 

Chapter 3.0 Overview

This chapter begins with a more 

detailed description of efforts to 

advance understanding of effective 

safety performance indicators and a 

review of why indicators reflected in 

company policies, practices, audits, 

rewards, and reports become the 

foundational elements of a company’s 

approach to risk management. The 

chapter then illustrates that BP and 

Transocean inadequately collected 

and used process safety indicator

data. Finally, a review of the 

guidance available to industry calls 

for further improvements in 

developing, collecting, and using 

safety performance indicators. 

000821
Macondo Investigation Report Volume 3 4/17/2016

133 

Unfortunately, good personal safety indicators can produce a false sense of security concerning process 

safety performance. RIF and DAFWC trends are the wrong ones to monitor the robustness of safety 

critical barriers and safety management systems intended to prevent and mitigate major accident events. 

This chapter begins by distinguishing personal and process safety indicators, providing several 

demonstrable examples when good personal safety statistics did not equate to good process safety, and 

then delves into BP’s and Transocean’s indicator programs. At the time of the Macondo incident, both BP 

and Transocean measured and rewarded personal safety metrics, many of which require reporting to the 

regulator; correspondingly, both companies achieved low personal worker injury rates. Conversely, 

process safety did not receive the same attention from either company. 

The chapter then describes advances in safety performance indicators since Macondo. After describing 

the general characteristics of effective process safety indicators, the chapter presents a selection of 

process safety indicators from various industry viewpoints. As the timescale of various indicators is 

diverse, this chapter discusses slow-moving metrics and real-time metrics that can be used to improve 

daily operational activities. Finally, the CSB proposes several indicators that could have made a positive 

impact on risk management at the Macondo well. 

Both industry and the regulator must collect and assess valuable industrywide process safety indicators 

across the offshore community. Because companies may use various approaches to reduce risk and 

manage their major accident hazards, they also need to develop their process safety indicators for their 

specific barriers and actively monitor that data to maximize the benefits of their indicator programs. 

Industrywide good practice guidance on such indicators is relatively general at this time, so companies, 

regulators, and industry trade associations have an opportunity to propel it toward more detailed and 

practical proposed indicators. 

3.1 Process Safety Performance Indicators for High-hazard Work 

Environments

Personal safety incidents can have serious consequences for individual workers, and are statistically far 

more common than major process safety incidents. As such, companies and regulators have taken steps to 

minimize them with some success. Yet process safety expert and chemical engineer Trevor Kletz (1922-

2013) noted that relying on good personal safety performance results, such as recordable injury rates, as a 

barometer for process safety can introduce “a feeling of complacency, a feeling that safety was well 

managed.”481 Numerous findings from major chemical and petrochemical accidents in the United States, 

including several the CSB investigated, demonstrate that personal safety statistics are not good indicators 

for the health of barriers and safety management systems intended to prevent major accidents: 

• In 1989, a Phillips chemical plant experienced a catastrophic series of explosions and fires that 

killed 23 workers, yet the company operated for several million work hours without a lost time 

incident.482 Post-incident findings indicated that no hazard analysis was utilized at the plant to 

 

481 Kletz, T. An Engineer's View of Human Error, 3rd ed.; Institution of Chemical Engineers: Warwickshire, UK, 

2001. 

482 A Lost Time Incident (LTI) is an injury that makes so a worker is unable to perform his or her regular duties, 

needs to take time off for recovery, or has to be assigned modified job activities.

000822
Macondo Investigation Report Volume 3 4/17/2016

134 

identify process hazards, a permit to work system was not enforced at the plant, and personnel 

and critical control equipment were not separated from process units in accordance with accepted 

good engineering principles.483 

• In 2004, the BP Texas City refinery was lauded by the BP Group CEO for the refinery’s “best 

year ever” in terms of safety performance due to low recordable injury statistics—despite the 

documented failure to correct major process safety and management system deficiencies 

identified that same year in audits, mechanical integrity reviews and incident investigations. The 

following year, OSHA injury data noted the refinery was off to such a good start that its 2005 

safety performance record “may be the best ever,” a characterization which was turned on its 

head when a March 2005 refinery explosion killed 15 workers and injured 180 others.484

• In 2007, the Valero McKee Refinery in Sunray, Texas suffered a process safety incident that 

seriously burned 4 workers and forced an unexpected plant shutdown, despite low OSHA 

recordable injury rates and a fine personal safety record. Post incident findings noted a lack of 

management of change reviews before the incident,485 a process hazard analysis that did not 

effectively identify hazards posed by fire exposure to neighboring equipment, and lack of 

engineering controls to stop the flow of high pressure flammable material.486 

• In 2008, the Bayer CropScience facility in Institute, West Virginia, suffered a serious process 

safety incident that killed 2 workers and injured 8 others, among other documented process safety 

incidents, despite low OSHA recordable injury rates.

487 Post-incident findings indicated that a 

pre-startup safety review was not applied and personnel had been inadequately trained to operate 

new equipment involved in the accident. 

• In 2010, CITGO’s Corpus Christi refinery received national industry recognition488 for safety 

performance in 2010 based on the refinery’s low recordable injury rates in the previous year as 

 

483 US Department of Labor Occupational Safety and Health Aministration. The Phillips 66 Company Houston 

Chemical Complex Explosion and Fire; 1990. 

484 USCSB, 2007. Refinery Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, March 

2007, pp 168 and 175, http://www.csb.gov/assets/1/19/csbfinalreportbp.pdf (accessed October 7, 2015).

485 Management of Change is a systematic method for reviewing the safety implications of modifications to process 

technology, facilities, equipment, chemicals, organizations, policies, and standard operating practices and 

procedures. 

486 USCSB, 2008. LPG Fire Valero - McKee, Sunray, TX, Feburary 16, 2007, Report No. 2007-05-I-TX, July 2008, 

http://www.csb.gov/assets/1/19/CSBFinalReportValeroSunray.pdf (accessed October 7, 2015).

487 USCSB, 2011. Pesticide Chemical Runaway Reaction and Pressure Vessel Explosion, Bayer Crop Science, 

Institute, West Virginia, August 28, 2008, Report No. 2008-08-I-WV, January 2011, 

http://www.csb.gov/assets/1/19/Bayer_Report_Final.pdf (accessed October 7, 2015). 

488 This CITGO site received the National Petrochemical and Refiner’s Association (now called the American Fuel 

& Petrochemical Manufacturers, or AFPM) annual award for the previous year’s safety performance. Through the 

latter portion of the last decade, NPRA/AFPM relied exclusively on records maintained for employee injuries, 

illnesses, or death as recorded on the required OSHA 300 Form, though according to AFPM’s website, current 

award qualification criteria is now based on both the “OSHA 300A Summary and API 754 Process Safety 

Collection.” See www.afpm.org/Safety-Programs/ (accessed October 7, 2015). 

000823
Macondo Investigation Report Volume 3 4/17/2016

135 

reported to OSHA, notwithstanding that in 2009 the company suffered a major fire and release of 

dangerous hydrofluoric acid in its alkylation unit.489

• In 2010, the Tesoro Refinery in Anacortes, Washington, only a few weeks after winning the same 

national safety award as CITGO, suffered a devastating explosion and fire that took seven 

workers’ lives when a nearly 40-year-old heat exchanger catastrophically failed during a 

maintenance operation to switch a process stream between two parallel banks of exchangers.490

Post-incident findings indicated that safeguards were not evaluated, hazardous leaks at the 

refinery were normalized, process hazard analyses repeatedly failed to control the hazards

presented by the leaks, and Tesoro did not monitor the actual operating conditions of the 

equipment that failed.

• At the time of the Macondo incident, a visiting team of executives focused on personal safety 

issues, touring the Deepwater Horizon rig to help celebrate the rig’s excellent total recordable 

injury rate and to share lessons learned from a personal injury incident on another rig.491

Risk management approaches and measures to monitor for and manage the process safety hazards noted 

above are different than those for personal safety. Table 3-1 highlights some of significant differences.

 

489 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; pp 13 – 14, 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015). 

490 USCSB, 2014. Catashtrophic Rupture of Heat Exchanger, Anacortes, WA, April 2, 2010, Report No. 2010-08-IWA, May 2014, http://www.csb.gov/assets/1/7/Tesoro_Anacortes_2014-May-01.pdf (accessed October 7, 2015).

491 CSB interviews. 

“Industry has a long history of measuring safety performance based on lost time 

accident (LTA) rates ... Safety is taken very seriously by most organizations and 

senior management takes an active interest in reducing LTA rates, providing 

leadership and resources aimed at improving performance ... Unfortunately, LTAs do 

not show senior managers how well the low frequency/high consequence accidents 

are being managed. Incidents involving the failure of process safety can be 

devastating with the potential for multiple fatalities, offsite impacts and large scale 

environmental damage. Managers often fall into the trap of believing that a low and 

reducing LTA rate means that corporate safety is under control. History shows us that 

this is often not the case.”

Christopher J. Beale, Process Safety Performance Indicators – Experience Gained from Designing 

and Implementing a System of PSPIs for Different Chemical Manufacturing Operations, ICheme Loss 

Prevention Bulletin 212 (April 2010), p 23.

000824
Macondo Investigation Report Volume 3 4/17/2016

136 

Table 3-1. Distinctions between Process and Personal Safety.

492, 493, 494

Process Safety Personal Safety

Examples of Safety indicators Hydrocarbon releases, inspection 

frequency, number of well kicks, well 

kick response time, PSM/SEMS audit 

action item closure

Recordable injury rate, days away 

from work frequency, number of 

behavior observations

Scope Complex technical and organizational 

systems and/or operations and barriers

Individuals, individual 

behaviors/actions

Risk Incidents with catastrophic potential

(low frequency, high consequence)

Slips, trips, falls, dropped objects, 

etc. (high frequency, low 

consequence in terms of number 

injured) 

Consequences of a single event Release of dangerous materials or 

energy (e.g., fires, explosions) with the 

potential for multiple fatalities, major 

destruction of property/equipment, and 

environmental damage, all of which 

could extend beyond the confines of 

the workplace, as well as commercial 

and reputational damage

Most often results in individual 

workplace injury/fatality and/or 

minor facility/equipment damage.

Yet, many companies, as well as industry groups, and even the Occupational Safety and Health 

Administration (OSHA)495 and the Mineral Management Service (MMS, now BSEE), as onshore and 

offshore safety regulators, respectively, have tended to rely on personal safety performance indicators as 

the preeminent measures of a company’s overall status of “safety.”496This leaves a critical gap in process 

safety performance monitoring that needs to be filled to prevent the next Macondo. 

 

492 Holmstrom, D. US Performance Indicators to Drive Improvement: CSB Overview, CSB Safety Performance 

Indicator Public Hearing, Houston, TX, July 23, 2012, slide 4. 

http://www.csb.gov/UserFiles/file/Holmstrom%20%28CSB%29%20PowerPoint.pdf (accessed October 7, 2015). 

493 The Baker Panel. The Report of the BP US Refineries Independent Safety Review Panel; January, 2007; p 21. 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015). 

494 Hopkins, A. Thinking About Process Safety Indicators; Working Paper 53; National Research Centre for OSH 

Regulation: May, 2007, p 3. 

495 While OSHA injury and illness collected data do not focus on process safety, it can reflect critical occupational 

health and safety indicators that extend beyond “personal” safety matters. For example, the data may establish 

patterns of illness or injury that affect worker populations. 

496 See Volume 4, Section 4.2 for discussion on MMS/BSEE’s use of indicators. An industry example includes the 

International Association of Drilling Contractors (IADC) which tracks work-related recordable injuries as part of 

its Incident Statistics Program (ISP) that recognizes companies for their “outstanding safety performance,” 

http://www.iadc.org/isp/ (accessed October 7, 2015). 

000825
Macondo Investigation Report Volume 3 4/17/2016

137 

3.2 BP’s Selection and Use of Performance Indicators

Through a review of key corporate documents, corporate-wide communications, and programs, this 

section shows that BP primarily used lagging, infrequent, and personal safety performance indicators as a 

means of assessing, measuring, and managing process safety. 

3.2.1 BP Corporate Policies Reflect a Focus on Production, Personal Safety, 

and Lagging Indicators

BP’s overall approach to using performance indicators in the Gulf of Mexico at the time of the Macondo 

incident is described in the BP Gulf of Mexico Drilling and Completions Operating Plan and Local OMS 

Manual.

497 In the document, BP committed that its management system was part of a continual 

improvement process that would establish clear plans and controls to achieve and maintain goals. This 

process was to be monitored by establishing key performance indicators to track progress using different 

safety, environmental, and regulatory metrics, which became for GoM business unit leaders the content of 

a report, commonly referred to as the Maroon Book (see Table 3-4).498,499

 

497 Internal Company Document, BP, GoM Drilling and Completions; GoM D&C Operating Plan/Local OMS 

Manual, 2200-T2-DM-MA-0001, November 1, 2009, p 19, BP-HZN-MBI00193448, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-06065.pdf (accessed October 7, 

2015).

498 BP operations are divided into business units like the Gulf of Mexico Drilling & Completions or the Gulf of 

Mexico Exploration & Appraisal units. Individual business unit leaders oversee operations and performance of the 

units.

499 Hearing before the Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, April 10, 2013, pp 8109 – 8110, 

http://www.mdl2179trialdocs.com/releases/release201304101200025/2013-04-10_BP_Trial_Day_25_AMFinal.pdf (accessed October 7, 2015).; Hearing before the U.S. District Court for the Eastern District of Louisiana 

under the Multi-District Litigation docket MDL No. 2179, June 17, 2011, see Dupree Designations Vol 2 p 176, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Dupree_James-Depo_Bundle.zip (accessed 

October 7, 2015); Internal Company Document, BP. Gulf of Mexico SPU Operating Plan (OMS Handbook), 

December 3, 2008, BP-HZN-2179MDL00333175, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-002908.pdf (accessed October 7, 

2015).

000826
Macondo Investigation Report Volume 3 4/17/2016

138 

Table 3-2. Indicator data collected for the Gulf of Mexico as reported in BP’s Maroon Book for 2009.500

Gulf of Mexico (GoM) BP’s Classification/Description Reported Number for 2009

Major Incidents and HIPOs

Major Incident Announcements (MIAs) Lagging 0

High Potential Incidents (HIPOs) Lagging 11 total (only 1 process safety related)

MIA & HIPO Lessons Learned Reports Issued Leading 9

Health and Safety

Workforce Fatalities Lagging, mature industry standard metric 0

Days Away from Work Case Frequency (DAFWCF) † Lagging, mature industry standard metric 0 BP/0.1 Contractors

Recordable Injury Frequency (RIF) Lagging, mature industry standard metric 0.9 BP/0.54 Contractor

Recordable Occupational Illness Frequency Lagging, aim is improved reporting 0.09 BP/0 Contractor

Operations Integrity

Process Safety Incident Index* Lagging metric 21 BP/ Contractor not reported

Fires & Explosions Lagging, industry standard -

Loss of Primary Containment (LOPC) Lagging, emerging industry standard 26 BP/ 2 Contractor

Flammable Gas Releases Lagging, based on LOPC 11 BP/ 0 Contractor

Number of Oil Spills Lagging, mature industry standard metric 8 BP/1 Contractor

Volume of Oil Spills Lagging, mature industry standard metric All spills less than 100 barrels

Overdue Plant Inspections & Tests Leading No reported numbers

Major Accident Risk (MAR) Assessments Completed Leading No reported numbers

MAR Action Closures Leading No reported numbers

Compliance, Audit and Action Closure

Safety & Operations (S&O) Audit Delinquent Actions Number overdue 0

Number of Approved Changes Change to content/Due Date/Responsibility 

for S&O Audit Action 0 

Incident Investigation - Action Closure Actions from HIPO & MIA Investigations 100%

†

An industry benchmark defined as injuries that result in an employee being away from work for at least one calendar day after the injury (see definition in API 754). API 754 classifies DAWFC as process safety events only 

if they are the result of an actual loss of containment due to weaknesses in barriers. BP did not distinguish between personal and process safety DAWFC in its metrics.

*The Process Safety Index considers four outcomes: (1) hazard severity of LOPC, (2) severity of fires and explosions, (3) injuries sustained, and (4) environmental impact. 

 

500 Internal Company Document, BP. GoM Maroon Book, http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-045257.xls (accessed June 16, 2015).

000827
Macondo Investigation Report Volume 3 4/17/2016

139 

As BP indicated, no reported data for the leading indicators was listed in Table 3-2, and the rest of the 

indicators were lagging, many of them typical metrics used across industry and collected by the 

regulator.501 Notably missing from Table 3-2 are process safety indicators to address safety management 

systems, safety critical barriers, or even well kicks, several of which BP-contracted Transocean rigs 

experienced.

502 Nor is there any indication of threats (e.g., weather, ship traffic, or active work permits) 

that could provide feedback to original risk assessment assumptions.

503 As evident in Table 3-2, 

contractor data is incorporated into the Maroon Book statistics. 

BP also published an Orange Book quarterly that was shared with senior BP executives and the Board, 504

and included metrics used to generate the Maroon Book, but it addressed the entire international upstream 

segment.505,506 Although BP executives and management could have used the Orange Book data for 

action planning or other more strategic initiatives related to process safety or major accident prevention 

(MAP), the indicators did not provide insight for BP’s safety management systems, safety critical 

barriers, or threats. Furthermore, lacking from the Orange Book were stated goals, objectives, or other 

desired outcomes (e.g., reduction targets), set forth as expectations against which to compare, measure, 

and improve actual safety performance. BP did not state in advance how it would use the data to drive 

continual improvement, and it did not discuss variance in the level of safety attained versus the level of 

safety expected. 

3.2.2 Individual Performance Plans Lacked Process Safety Metrics 

Performance indicators can be used to drive individual performance safety goals when management uses 

them to steer the organization toward specific safety goals. In this way, the workforce can be influenced 

to approach “safety” as the company defines it. A review of performance contracts for BP employees 

connected to the Macondo well at various levels and job positions (Figure 3-1) indicates that personal 

 

501 Oil and Gas and Sulphur Operations in the Outer Continental Shelf - Incident Reporting Requirements, 71 Fed. 

Reg. 19,640 (April 17, 2006).

502 Internal Company Document, Transocean. Annual Report - 2009 Well Control Events & Statistics 2005 to 2009, 

p 7, TRN-INV-00760087, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05649.pdf

(accessed May 22, 2015).

503 Section 3.4 provides more examples of potential indicators.

504 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, Feburary 28, 2013 pp 1156-1157, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/2013-02-28_Barbier_Day_04_PM-Final.pdf

and June 29, 201, see Mogford Designation Vol 2,1 p 49, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Mogford_John-Depo_Bundle.zip (accessed 

October 7, 2015).

505 BP’s upstream segment encompasses exploration, development and production activities. 

506 Internal Company Document, BP. 

000828
Macondo Investigation Report Volume 3 4/17/2016

140 

safety metrics such as Total Recordable Incident Rate (TRIR)507 and DAFWC trends were included in 

individual performance goals, but several indicators tracked in the Maroon and Orange Books were not.508

Instead, many of the indicators listed on BP performance plans were compliance-based metrics that 

lacked continual performance process safety goals (e.g., adherence to regulations, completed training, 

adherence to BP policies). During CSB interviews, BP drilling and well completion managers and 

engineers alike stated that BP’s safety focus in audits, reviews, and safety score cards primarily addressed 

personal safety, which was also reported to be the sole focus in relevant team meetings and company 

reports, and during benchmarking activities. 

 

507 TRIR = (the number of medical treatment cases other than first aid + the number of restricted Work/Transfer 

Cases + the number of Lost Time Incidents + the number of fatalities) multiplied by 200,000 then divided by the 

Total Hours Worked. See IADC definitions at http://www.iadc.org/wp-content/uploads/2014/01/2015-ISPReporting-Guidelines.pdf (accessed October 7, 2015). 

508 BP provided numerous Annual Individual Performance Assessments to the CSB. Two examples that have been 

made public for the Macondo Well Site Leader and a Gulf of Mexico Engineering Manager are, Exhibit 3555 

found at http://www.mdl2179trialdocs.com/releases/release201304041200022/Kaluza_Robert-Depo_Bundle.zip

and Exhibit 0755 found at http://www.mdl2179trialdocs.com/releases/release201302281700004/Sprague_JohnDepo_Bundle.zip (accessed October 7, 2015).

000829
Macondo Investigation Report Volume 3 4/17/2016

141 

Figure 3-1. Safety performance goals for BP employees that were a part of the Deepwater Horizon’s 

organizational structure.

000830
Macondo Investigation Report Volume 3 4/17/2016

142 

Without an explicit focus on process safety, employee performance expectations can be overshadowed by 

intense cost performance expectations. For example, a former BP vice president of drilling and 

completion indicated an “incredible pressure with respect to cost reduction in 2008 and 2009,” while at 

the same time production targets in his own individual performance contract were “significantly” 

raised.509 The net result was that in pursuit of his duties, this vice president “slashed hundreds of millions 

of costs and increased production” from BP’s offshore drilling operations.510 BP’s vice president of 

drilling and completions at the time of the Macondo incident also noted that his own individual 

performance contract had a number of cost containment goals, particularly in 2008 and 2009, due in part 

to a then-recent drop in oil prices.511 These goals were informed by benchmarking information from 

industry sources relating to metrics of drilling progress, primarily in terms of cost and time,512 along with 

“a lot of emphasis on cost,” driven by specific targets for cost reduction during the calendar year before

Macondo, all of which shaved approximately 10 percent off the 2009 operating budget.513 However, this 

came without an accompanying set of goals for process safety in his performance contract.514 

Even when there are safety indicators, such as those for personal safety, the former vice president of 

drilling and completion indicated to the CSB that he made conscious efforts to ensure leaders “were not 

putting pressure on the [well site leaders] and confusing the value of safety with priorities on cost or 

time.” He observed, “it was a bit of a new thing for [leaders/well site leaders] to talk about how to have 

safety and performance in the same conversation.”515 Production focus is not unique to companies 

operating in the Gulf of Mexico. A 2012/2013 multinational audit in the North Sea observed that 

benchmarking key performance indicators (KPIs) often focused on drilling progress and efficiency with 

little to no mention of well control. The auditors noted: 

There is the potential for such performance orientated KPIs to conflict with safety performance, 

as it was common practice to have penalties in place for underperformance (e.g., in relation to the 

downtime rate of drilling progress) but how this was being managed from a human factors 

perspective was not clear. In other words, there was a lack of attention as to how penalties for 

underperformance could influence the performance of the driller in relation to safety-related 

decision-making and behaviour at the front-line.516 

 

509 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, June 1, 2011, see Lacy Deposition, pp 792-804, 

http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-25002.pdf (accessed October 7, 

2015). 

510 Ibid, p 804.

511 While this individual discussed his performance plan with the CSB during an interview, BP did not provide the 

actual performance plan to the CSB.

512 CSB interview.

513 CSB interview.

514 CSB interview.

515 CSB interview.

516 North Sea Offshore Authorities Forum (NSOAF). Multi-National Audit Human and Organisational Factors in 

Well Control 2012-2013, p 13. http://www.hse.gov.uk/offshore/nsoaf.pdf (accessed May 2016, 2015). 

000831
Macondo Investigation Report Volume 3 4/17/2016

143 

3.3 Transocean’s Selection and Use of Performance Indicators

Transocean identified two “key tools” for safety management in both its contract with BP and in its 

Health and Safety Policies and Procedures Manual: (1) a risk assessment policy, which asked the 

workforce to identify hazards immediately before conducting a task, and (2) a safety observation program 

to identify positive and negative actions by the crew. 517 These two programs, the THINK Planning 

Process (described in Section 1.8.3) and the START Observation and Monitoring Process, and the data 

derived from them ultimately resulted in a direct company focus on personal/occupational safety and 

individual behavioral-based safety improvements and inattention to control major accident hazards. 518

The aims of programs such as THINK and START are to reinforce safe behavior and correct unsafe acts 

or conditions.519 These programs rely upon the employees to observe and recognize unsafe situations or 

activities. Thus, the types of safety issues likely to be documented are those that are readily observable, 

such as breaches to occupational safety rules and policies (e.g., missing personal protective equipment, 

poor housekeeping). However, process safety hazards and the active and passive safeguards meant to 

control, reduce, or mitigate them are not always readily observable. Thus, the THINK and START 

programs emphasized worker focus on personal safety observations and easily identifiable deviations 

from safety rules and company practices.520 

Transocean required all personnel to monitor work practices and workplace conditions. All Transocean 

rig personnel were required to participate by each submitting a START observation card daily where they 

 

517 Internal Company Document, BP. Amendment No. 38 to Drilling Contract No. 980249, September 28, 2009, BPHZN-CEC041519, see Exhibit 1488, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_Anthony-Depo_Bundle.zip

(accessed October 7, 2015).; Internal Company Document, Transocean. Health and Safety Policies and 

Procedures Manual, Issue 03, Revision 07, HQS-HSE-PP-01, December 15, 2009, Preface, BP-HZN2179MDL00132055, see Exhibit 4942, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).

518 Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, 

Revision 07, HQS-HSE-PP-01, December 15, 2009, Safety Policies, Procedures and Documentation, BP-HZN2179MDL00132454, see Exhibit 4942, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).; Internal Company Document, Transocean. Asset Managment Handbook, Issue 01, Revision 00, 

HQS-OPS-HB-06, April 22, 2008, Physical Asset Management Implementation, TRN-INV-00160105, This 

document established key performance indicators (KPIs) “to evaluate performance against an agreed benchmark” 

in specified areas in order to “achieve compliance or realize performance improvement.” The first two categories 

of KPI’s focused on protecting assets, as well as improving performance. The third category focused on HSE 

matters, with a heavy emphasis on personal safety and related lagging indicators (some of which were termed 

leading indicators), and none of which were focused on process safety or major hazards.

519 Ibid., BP-HZN-2179MDL00132055.

520 In CSB interviews, one Transocean crew member from the Deepwater Horizon conveyed that another crew 

member wrote a START observation on him when he entered a particular location on the rig without wearing 

safety glasses. Crew members also provided positive examples of “good” START observations, such as being 

properly tied off or having all the correct safety gear for a job. 

000832
Macondo Investigation Report Volume 3 4/17/2016

144 

describe observed positive or negative work practices.521 Such reporting requirements are susceptible to 

underreporting due to the perceived negative potential consequences of candid self-reporting. This was 

true on the Deepwater Horizon, where some individuals reported hesitation about writing START 

observations.522 Crewmembers stated they did this out of a fear of discipline or reprisal for being 

observed breaking a safety rule and that completing the START cards according to the “one a day” rule 

resulted in unnecessary observations, which in turn diluted the efficacy of actual worker concerns.

523

Crewmembers also reported that discussions in rig safety meetings focused on the quantity of cards, not 

the quality of the content.524 Ultimately, management undermined the value of START card observations 

as indicators for risk management success by not addressing crew concerns and actively working to 

change the crew’s perceptions. 

 

521 In interviews, Transocean crew members conveyed to the CSB that they were given 15 minutes on each shift to 

fill out a START observation card; this requirement was also reflected in some of the publicly available interview 

notes, e.g., Internal Company Document, Transocean. Interviewing Form, June 24, 2010, p 5, TRN-INV00000300, see Exhibit 3339 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015). 

522 As Transocean workers conveyed in CSB interviews, “I’ve seen guys get fired for someone [writing] a bad 

START card about them, ... I’ve seen the people get fired for it;” “they wrote [a START card] on me and turned 

it in, and I was called into the office the next day and chewed up one side and down the other,” and “people [tried] 

not to rat people out so to speak, you know like you wanted to be helpful, [...] whereas some of the higher-ups in 

the office, they kind of wanted to weed out problems ...” 

523 Internal Company Document, Transocean. Lloyd's Register Safety Management Systems and Safety 

Culture/Climate Reviews: Deepwater Horizon, March 16, 2010, Closing Meeting, slide 5, TRN-INV-00016752, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-04261.pdf (accessed October 7, 

2015).; Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North 

America Division Summary Report, July 2, 2010, TRN-HCEC-00090580, see Exhibit 0929 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015).

524 Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North America 

Division Summary Report, July 2, 2010, TRN-HCEC-00090663, see Exhibit 0929 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip 

(accessed October 7, 2015).; Internal Company Document, Transocean. Lloyd's Register Safety Management 

Systems and Safety Culture/Climate Reviews: Deepwater Horizon, March 16, 2010, Closing Meeting, slide 5, 

TRN-INV-00016752, http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-04261.pdf 

(accessed October 7, 2015). 

000833
Macondo Investigation Report Volume 3 4/17/2016

145 

At the time of the Macondo incident, Transocean also identified key leading and lagging health, safety, 

environmental, and operational performance indicators (KPIs), which it used to set goals and targets for 

itself:

525

• Leading 

o Potential Severity Rate

o START Observations 

o HSE Training Compliance 

• Lagging

o Actual Severity Rate

o TRIR

o Serious Injury Case (SIC) 526

o Safety statistics (for categories of incidents, such as dropped objects527) 

For safety, the potential and actual severity rates listed are based upon a classification system for personal 

injuries (e.g., first aid, restricted work, extended time off of work, etc.). There were also severity rate 

classification systems for environmental and operational indicators based on releases (e.g., to the rig, 

atmosphere, or overboard and the extent of cleanup efforts) and loss of revenue or cost to repair.528

Transocean’s health, safety, and environmental 2009 goals and targets appear in Table 3-3.

529

 

525 Internal Company Document, Transocean. Performance Monitoring Audit and Assessment Procedures, Issue 03, 

Revision 00, HQS-CMS-PR-02, December 31, 2008, Performance Monitoring Audit and Assessment Plan, TRNMDL-00039491, see Exhibit 0927 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

October 7, 2015).

526 As defined by Transocean, “any injury resulting from a work-related incident that prevents the injured person 

from continuing on his next shift,” Internal Company Document, Transocean. Health and Safety Policies and 

Procedures Manual, Issue 03, Revision 07, HQS-HSE-PP-01, December 15, 2009, Annex, Definitions, p TRNHCEC-00005205, the publicly available version of the Transocean Health and Safety Policeis and Procedures 

Manaul does not include the annex of defitions, so a version provided to the CSB that does is beign cited here.

527 Dropped objects are a concern on rigs because they can result not only in injury, but also death if the mass and/or 

height from which the object is dropped is sufficient. In the oil and gas industry, dropped objects are among the 

top 10 causes of fatality and serious injury. See information provided by DROPS, an industrywide initiative 

focused on preventing dropped objects, http://www.dropsonline.org/assets/DROPS%20Intro.pdf (accessed 

December 20, 2015). 

528 Internal Company Document, Transocean. Field Operations Policies & Procedures Manuel, Issue 01, Revision 

00, HQS-POP-PP-01, August 8, 2009, Performance Management: Rig and Well Operation Management, TRNCSB-00016311.

529 This was completed under the auspices of the QHSE Steering Committee which met at least twice a year to 

review and set HSE goals and performance. Internal Company Document, Transocean. Health and Safety Policies 

and Procedures Manual, Issue 03, Revision 07, HQS-HSE-PP-01, December 15, 2009, QHSE Steering 

Committees, see Exhibit 4942, BP-HZN-2179MDL00132097, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).

000834
Macondo Investigation Report Volume 3 4/17/2016

146 

Table 3-3. Corporate Quality, Health, Safety and Environment (QHSE) Strategy and Target Goals Status 

as reported by Transocean.

530

Safety Target Goal Year to Date (October 2009)

Fatalities 0 4 

TRIR < 0.82 0.85

SIC Rate < 0.29 0.39

Potential Severity Rate < 30.00 45.31

Number of High Potential Dropped Objects < 129 137

Environmental Target Goal Year to Date (October 2009)

Loss of Containment Major Reports < 25 18

3.3.1 Transocean Recognized Need for Process Safety Performance 

Indicators 

Transocean senior leadership voiced dissatisfaction with the company’s development and use of leading 

indicators. In response to an email string between BP and Transocean senior leadership approximately 

eight months before the Macondo blowout, Transocean President Steven Newman forwarded his 

observations about Transocean’s use of leading indicators to several senior Transocean managers: 

I am not convinced at all that we have the right leading indicators. The leading indicators we 

report today are all just different incident metrics—they have nothing to do with actually 

preventing accidents. What if we asked our OIMs to report the number of tasks that proceeded 

without a think plan discussion? Their first response would obviously be zero—which would then 

be the start of an interesting conversation (how do you KNOW that?). This is by no means a 

scientifically measured leading indicator, but the nature of the discussion would get the OIMs 

thinking about the culture on the decks—and the only way they could really meaningfully answer 

the questions would be to get out on the decks.531 

 

530 Internal Company Document, Transocean. QHSE Steering Committee Meeting Minutes, October 19, 2009, TRNMDL-00039081, see Exhibit 0934 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

October 7, 2015).

531 Email from President, Transocean, Subject: FW: Prellmlnary thoughts and supplementary lnfo, September 25, 

2009, TRN-MDL-03999532, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX26032.pdf (accessed October 7, 2015).

000835
Macondo Investigation Report Volume 3 4/17/2016

147 

Newman’s comment echoes earlier sentiments expressed in this chapter, that “incident metrics” do not 

address the barriers and safety management systems meant to prevent or mitigate process safety events. 

His comment also recognizes the need to triangulate indicators information to meaningfully manage risk. 

For example, ensuring the rig crew completes a THINK plan discussion does not guarantee effective risk 

management. To fully assess whether THINK plans are driving an understanding of hazards and control 

measures connected to the task at hand, periodic walkthroughs to engage with the workforce directly or 

reviews of THINK plans might be necessary to determine exactly how the plans are used. This is 

particularly important, as THINK plans have been associated with numerous serious incidents and nearmisses (see Section 3.5.2.2).

One opportunity for such a review occurred when Transocean completed its Performance Monitoring 

Audit and Assessment (PMAA) of the Deepwater Horizon.532 The PMAA audit was intended to “evaluate 

performance of people in achieving the expectations and requirements described in the Company 

Management System.”533 Transocean’s expectations were to analyze at a minimum of every 30 months 

each component of the company, from the facilities, installations, and offices, up through business units, 

sectors, divisions, and the corporate level.

534 However, during the Deepwater Horizon’s last PMAA, 

THINK plans that addressed safety critical tasks were not assessed beyond an indication that they should 

mention the company’s management system more.535 As indicated previously (Section 1.8.4), several 

Deepwater Horizon TSTPs were vague and lacked well-specific hazards. 

Transocean PMAA procedures indicate that key performance indicators should be evaluated so that the 

PMAA team can determine if performance improvement is occurring.536 The health and safety indicators 

noted during the Deepwater Horizon PMAA were TRIR and SIC,537 reflecting corporate focus and 

 

532 Internal Company Document, Transocean. Performance Monitoring Audit and Assessment Procedures, Issue 03, 

Revision 00, HQS-CMS-PR-02, December 31, 2008, PMAA Policy and Procedure, TRN-MDL-00039467, see 

Exhibit 0927 http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_AdrianDepo_Bundle.zip (accessed October 7, 2015).; Internal Company Document, Transocean. Company Management 

System, Issue 04, Revision 05, HQS-CMS-GOV, November 30, 2009, Corporate Policies and Procedures, Level 1, 

TRN-MDL-00032866, see Exhibit 0925

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip (accessed 

October 7, 2015).

533 Internal Company Document, Transocean. Performance Monitoring Audit and Assessment Procedures, Issue 03, 

Revision 00, HQS-CMS-PR-02, December 31, 2008, PMAA Policy and Procedure, TRN-MDL-00039467, see 

Exhibit 0927 http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_AdrianDepo_Bundle.zip (accessed October 7, 2015).

534 Ibid., TRN-MDL-00039468 - TRN-MDL-00039476. 

535 Internal Company Document, Transocean. Management Summary of Corrective and Improvement Opportunities: 

Deepwater Horizon, July 2, 2009, Performance Monitoring, Audit and Assessment Management Principles, TRNMDL-01007259, see Exhibit 5766 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015).

536 Internal Company Document, Transocean. Performance Monitoring Audit and Assessment Procedures, Issue 03, 

Revision 00, HQS-CMS-PR-02, December 31, 2008, PMAA Policy and Procedure, TRN-MDL-90 see Exhibit 

0927 http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip

(accessed October 7, 2015).; 

537 Internal Company Document, Transocean. Management Summary of Corrective and Improvement Opportunities: 

Deepwater Horizon, July 2, 2009, Performance Monitoring, Audit and Assessment Management Principles, TRN000836
Macondo Investigation Report Volume 3 4/17/2016

148 

reinforcing the Transocean president’s concerns that the indicators being tracked were “just different 

incident metrics.”

3.3.2 Transocean Bonus Awards Insufficiently Focused on Performance 

Relating to Process Safety and MAP

In a 2009 Transocean “asset reliability” project, Lloyd’s Register found that individual performance 

contracts were underutilized and represented an “opportunity for improvement,” and that KPIs were 

“limited” as they focused on items like “downtime, overdue maintenance and money spent.”538

Transocean’s approach to safety through the calculation and payment of performance bonuses at the time 

of the Macondo incident reinforced Lloyd’s findings. 539 Transocean calculated upper management 

bonuses on three safety metrics: TRIR, the total potential severity rate (TPSR),

540 and high potential 

dropped objects (HPDO).541 In Transocean’s 2009 annual report to shareholders, safety performance was 

defined by a formula that relates to bonus calculations. Safety performance related to only 20 percent of 

any total bonus payment, while financial performance related to 70 percent, and “new builds” accounted 

for the final 10 percent. 

The variables used in Transocean’s bonus calculation formula do not distinguish between 

occupation/personal safety injuries and process safety injuries. Additionally, there is no mention of 

process safety, major hazards, or catastrophic risks. This type of bonus calculation formula did not 

provide for balanced safety goal-setting, nor did it lend itself to developing or implementing adequate 

process safety performance indicators which could boost a company’s ability to prevent catastrophic 

 

MDL-010072579, see Exhibit 5766 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015).

538 Internal Company Document, Transocean. Asset Reliability Project/Phase I: Discovery & Defintion, May 2009, p 

57, TRN-MDL-01134224, see Exhibit 5638 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Hart_Derek-Depo_Bundle.zip (accessed 

October 7, 2015). 

539 Transocean. Annual Report; 2009; Performance Award and Cash Bonus Plan, p 35. The bonus plan is described 

as “a goal-driven plan that gives participants, including named executive officers, the opportunity to earn annual 

cash bonuses based on performance measured against predetermined performance goals.” Id. at 34. The annual 

report explains that the bonus plan and the performance goals connected to it are set by the Board, through the 

Executive Compensation Committee, not the Health Safety and Environment Committee, in accordance with the 

company’s “safety vision” for “an incident-free workplace—all the time, everywhere,” stating: “The Committee 

sets our safety performance targets at high levels each year in an effort to motivate our employees to continually 

improve our safety performance towards this ultimate goal.” Id. at 35.

540 As defined by Transocean, “TPSR is a proprietary safety measure that we use to monitor the total potential 

severity of incidents and comprises 35% of this metric. Each incident is reviewed and assigned a number based on 

the impact that such incident could have had on our employees and contractors, and the total is then combined to 

determine the TPSR;” Transocean. Annual Report; 2009.

541 As defined by Transocean, “HPDO is a dropped object that has a potential of causing a serious injury (an injury 

in which the employee is out of work for six months or more) or a fatality. HPDO is calculated by multiplying the 

mass of the object by the height dropped and then applying an industry standard formula to determine potential 

severity. HPDO comprises 30% of this measure. The occurrence of a fatality can override the safety performance 

measure;” Transocean. Annual Report; 2009.

000837
Macondo Investigation Report Volume 3 4/17/2016

149 

accidents. Furthermore, Transocean’s 70 percent weighting toward financial goals broke down into three 

sub-elements: cash flow value add (relative to budget), overhead costs, and lost revenues. These

economic measures are arguably valid business measures, yet process safety measures are necessary to

indicate how those economic optimizations may affect the company’s ability to effectively manage the 

process safety risks. 

Without process safety indicators, the company may be rewarding organizational performance that 

weakens or masks its ability to effectively manage and control its major hazards. In fact, Transocean’s 

bonus calculation was configured to reward its top-level corporate executives with significant financial 

bonuses for the company’s “best year in safety” in 2010 despite the 11 fatalities onboard the Deepwater 

Horizon.542 These bonus calculations and awards raise questions about the validity of Transocean’s 

chosen safety performance indicators and metrics, and what the company was measuring and rewarding. 

This public expression of Transocean’s bonuses was the cause of widespread backlash by media, 

government, and the public, prompting an apology from Transocean’s CEO and the donation of the 

executives’ safety bonuses to the families of the 11 workers killed during the incident.543 

3.4 Advancing the Development and Use of Process Safety 

Performance Indicators

This section focuses on recent efforts to further develop and effectively manage safety performance 

indicators to prevent major accidents. 

 

542 Internal Company Document, Transocean. Proxy Statement Pursuant to Section 14(a) of the Securities Exchange 

Act of 1934; Definitive Proxy Statment, April 1, 2011, pp P-35, P-45. As stated in the document, “Based on the 

foregoing safety performance measures, the actual TRIR was 0.74 and the TPSR was 35.4 for 2010. These 

outcomes together resulted in a calculated payout percentage of 115% for the safety performance measure for 

2010. However, due to the fatalities that occurred in 2010, the Committee exercised its discretionary authority to 

modify the TRIR payout component to zero, which resulted in a modified payout percentage of 67.4% for the 

safety performance measure.” 

543 McMahon, J. Transocean Execs Keep Most of Their Bonuses. Forbes, April 6, 2011.

Process Safety Metrics Necessary to Counter Unintended Safety Consequences of 

Small Steps to Optimization 

“Drift into failure is marked by... small steps ... Constant organizational and 

operational adaptation around goal conflicts, competitive pressure and resource 

scarcity produces small, step-wise normalizations. Each next step is only a small 

deviation from the previously accepted norm, and [meanwhile] continued operational 

success is relied upon as a guarantee of future safety.”†

 

†

Dekker, S. Drift into Failure: From Hunting Broken Components to Understanding Complex 

Systems; Ashgate Publishing: Burlington, VT, 2011, p 179.

000838
Macondo Investigation Report Volume 3 4/17/2016

150 

3.4.1 CSB Efforts to Advance Understanding and Use of Process Safety 

Performance Indicators

On July 23-24, 2012, the US Chemical Safety and Hazard Investigation Board conducted a two-day 

public hearing in Houston, Texas focused on safety performance indicators.544 The CSB’s hearing 

brought together international regulators, workforce representatives, and industry groups, along with 

representatives of other high-hazard industries, where process safety indicators are monitored, with an eye 

toward exploring how companies and the regulator could expand and improve the use of safety 

performance indicators to manage risks and drive continual safety improvements.

The hearing underscored a growing recognition within the oil and gas industry that actively monitoring 

leading process safety indicators is critical for high-hazard safety management. The event outlined the 

challenges faced by industry and regulators in using safety performance indicators. It also illuminated the 

development and implementation of process safety indicators in offshore oil-producing jurisdictions 

outside the US and other high-hazard industries within the US. One speaker at the hearing noted that no 

“silver bullet” set of indicators ensures catastrophic accidents will never happen,545 but the hearing 

concluded that indicators effective in reducing the risk of a major accident event share several 

characteristics: 

• Indicators should measure the health of the company’s safety management system (SMS) and the 

specific barriers in place to prevent or mitigate major accident hazards.546 

• The amount of indicator data should suit the intended use, with enough data collected to facilitate 

long-term studies as well as intracompany or industrywide comparisons.547 

• Indicators should be statistically robust so that trends can be monitored not only for large changes 

or safety upsets (e.g., fire or explosion), but also smaller safety changes that may be a leading 

indicator for an underlying, latent problem, such as when a process upset triggers the functioning 

of a safety control and prevents a release of hazardous material, a fire, or explosion.548

 

544 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; 

http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed October 7, 2015). 

(including the agenda, the verbatim transcript of the proceedings, working papers submitted, and PowerPoint 

presentations and other materials from the proceedings are all available and included as part of the CSB’s record 

pertaining to the Macondo investigation).

545 Ibid.; testimony of Ian Whewell, Performance Indicators in Major Hazard Industries– An Offshore Regulator’s 

Perspective, p 135, http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015). 

546 Ibid.; testimony of Gunhild Eie, Performance Indicators for Major Accident Prevention, p 183,

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

547 Ibid.; testimony of Joe Stough, Overview of Leading Indicator and Usage, p 187,

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

548 Ibid.; testimony of Manuel Gomez and Kara Kane, Using Performance Indicators to Drive Improvement: CSB 

Overview and Summary of CSB Evaluation of ANSI/API Recommended Practice 754, pp 18, 25,

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

000839
Macondo Investigation Report Volume 3 4/17/2016

151 

• “An indicator is an indicator of something, not the phenomena itself;” therefore, other tools such 

as cultural surveys, sociological studies, and accident investigations, can be the most effective 

method to triangulate actual risk areas.549 

• Indicators should be “intuitive in the sense what is measured is considered intuitively by the 

workforce to be important for the prevention of major accidents.”550As major accidents are rare, a 

company, or even the personnel assigned to a particular facility or work crew, may have never 

experienced a major accident. Therefore, it may be difficult for employees and managers to 

understand the importance of accurately reporting specified indicator data without intuitively 

linking it to the major hazard risks. Moreover, having indicators that closely reflect actual hazard 

mechanisms may also “contribute to maintaining the awareness about the risk mechanisms.”551 

• The selected indicators should be actionable in terms of the necessary actions to improve some 

specific aspect of safety performance. To this end, once managers observe an undesirable trend, 

they “[should be able to] turn around and do something about it.”552 

• Avoiding too many indicators is important. Some organizations solve this problem by “rollingup” multiple indicators into combined indicators with more information available when 

desired.553

• Contractors should be required to provide data for company indicator programs, as they most 

often perform the bulk of the front-line work in deepwater drilling operations, including safety 

critical work capable of preventing major accidents, and they are often uniquely positioned to 

capture—and rely on—important safety data that can prevent accidents.554 

Finally, for an indicators program to be effective and ensure continual risk reduction of major accident 

events, upper management must be involved and act on the data. As one speaker cautioned at the CSB’s 

indicator hearing, 

“unless at board and senior management level there is a recognition and an understanding of the 

significance of the data and the data drives decision-making, then its collection becomes an 

ineffectual exercise and leads to cynicism. [Oil and gas industry leaders] should be able to 

demonstrate that they understand the role of major hazard risk controls and the significance of 

key performance indicators. In addition, to achieve a convincing safety culture at all levels in the 

organization, industry leaders must acknowledge their responsibility for the effective 

 

549 Ibid.; testimony of Oyvid Lauridsen, Trends in Risk Level Norwegian Petroleum Activity (RNNP), pp 147-148, 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

550 Ibid., p 180. 

551 Ibid. 

552 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Joe Stough, 

Overview of Leading Indicator and Usage, p 187, http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf

(accessed October 7, 2015).

553 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Martin 

Sedgwick & Angela Wands, The Implementation of Effective Key Performance Indicators to Manage Hazard 

Risks, p 86.; testimony of Gunhild Eie, Performance Indicators for Major Accident Prevention, pp 183 - 185,

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

554 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Martin 

Sedgwick & Angela Wands, The Implementation of Effective Key Performance Indicators to Manage Hazard 

Risks, p 92, http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

000840
Macondo Investigation Report Volume 3 4/17/2016

152 

management of major accident hazard risks. There must also be a recognition that the culture of 

the organization is important in ensuring that Board-level data is accurate and reflects reality, 

again, not what the Board or senior management would like reality to be.”555

3.4.2 Selection of Effective Performance Indicators556 

ANSI/API RP 754, Process Safety Performance Indicators for the Refining and Petrochemical 

Industries,

557 was created in response to findings and recommendations that came out of the CSB’s 

investigation of the BP Texas City onshore disaster. Specifically, the CSB found that BP—and the oil and 

chemical industries in general—did not have effective programs for developing and using process safety 

performance indicators. As such, the CSB recommended to API and the United Steelworkers that the two 

jointly develop a voluntary consensus standard for creating leading and lagging process safety indicators 

in the refining and petrochemical industries.558 Leading indicators are those that record performance 

before an incident occurs, such as monitoring open action items identified in an audit, while lagging 

indicators record the consequences of an unwanted event, such as a hydrocarbon release. The 

recommendation aimed to develop a standard that would provide guidance on how to develop key process 

safety indicators, to drive measurable facility, company-level, and industrywide improvement, and to 

make publicly available individual company and industrywide performance data after collection. 

API 754 served as a significant and positive step forward in establishing safety performance indicators, 

and was part of the development of the international recommended practice, Process Safety - 

Recommended Practice on Key Performance Indicators Report No. 456 (IOGP 456),559 generated by 

International Association of Oil & Gas Producers (IOGP). Both API 754 and IOGP 456 identify process 

safety indicators by four tiers:560 

 

555 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Ian Whewell, 

Performance Indicators in Major Hazard Industries– An Offshore Regulator’s Perspective, p 136,

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

556 The only U.S. guidance document specifically pertaining to offshore safety indicators is API RP 75, 

Recommended Practice for Development of a Safety and Environmental Management Program [SEMP] for 

Offshore Operations and Facilities. However, API RP 75 focuses on personal safety metrics such as “recordable 

injuries/illnesses,” “DART injuries/illnesses,” and the like, as well as infrequent, lagging safety performance 

indicators of infrequent incidents such as the “blow-out incident rate,” “fire/explosion incident rate,” and the 

“number of [oil] spills” suffered by a driller, among others. API Recommended Practice 75, 3rd ed. (2004, 

reaffirmed 2008), Recommended Practice for Development of a Safety and Environmental Management Program

for Offshore Operations and Facilities, Appendix E, pp 37 - 41.

557 API Recommended Practice 754, 1st ed., Process Safety Performance Indicators for the Refining and 

Petrochemical Industries, April 2010.

558 USCSB, 2007. Refinery Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, March 

2007, pp 25 – 26, 144 – 146, 149, 154 – 155, 159, 163, 165, 

http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 7, 2015). 

559 IOGP, Process Safety - Recommended Practice on Key Performance Indicators, Report No. 456, November 

2011.

560 API Recommended Practice, 754, 1st ed., Process Safety Performance Indicators for the Refining and 

Petrochemical Industries, April 2010; International Association of Oil & Gas Producers Recommended Practice, 

Process Safety - Recommended Practice on Key Performance Indicators, Report No. 456, November 2011.

000841
Macondo Investigation Report Volume 3 4/17/2016

153 

• Tier 1: A Loss of Primary Containment (LOPC) that results in the release of material with the 

greatest consequence, such as a fatality or large fire or explosion;

• Tier 2: An LOPC, but of lesser consequences than a tier 1 incident (e.g., no casualties, property 

damage less than $2,000, on a release of process chemical less than pre-defined reportable 

quantities). These events also play a “leading” role in preventing more serious events if the 

company uses them as a learning opportunity to improve its process safety performance;

• Tier 3: A challenge to a safety system, which results when exceeding defined process limits and a 

safety system is initiated to bring the system back to an accepted safe state (e.g., the activation of 

a shutdown system or a pressure relief device); 

• Tier 4: Performance of barriers and management system components, such as management of 

change (MOC) compliance, inspections, or timely training schedules.

Tiers 1 and 2 tend to be more lagging and infrequent, and they are more generally applicable throughout 

an industry, while 3 and 4 indicators tend to be more leading, frequent, and company specific. As both the 

API and IOGP guidelines indicate, monitoring process safety and barrier performance can be complex, 

requiring a combination of indicators, so the tiers help differentiate the frequency, severity, and timing 

(leading or lagging) of a monitored event or process. 

Figure 3-2. Process Safety Indicator Pyramid as identified by the American Petroleum Institute and the 

International Association of Oil & Gas Producers.561

 

561 API Recommended Practice, 754, 1st ed., Process Safety Performance Indicators for the Refining and 

Petrochemical Industries, April 2010, p 8; International Association of Oil & Gas Producers Recommended 

000842
Macondo Investigation Report Volume 3 4/17/2016

154 

At least two professional groups, the Oil and Gas UK’s Well Lifecycle Practices Forum (WLCPF)562 and 

the Center for Offshore Safety (COS),563 have been advancing initial efforts by API and IOGP by more 

clearly defining or tracking indicators for offshore drilling and well operations.564 For instance, COS 

expands the API RP 754 Tier 1 and 2 definitions, which COS refers to as Safety Performance Indicators 

(SPI) (Table 3-4), and publicly reports indicator data from its members:565

Table 3-4. COS definitions of SPI 1 and SPI 2 process safety events.566

SPI Number

1 2

SPI Definition

A. Fatality (one or more) A. Tier 2 (API RP 754) process safety event

B. Five of more injuries in a single event

B. Collision resulting in property or equipment 

damage > $25,000

C. Tier 1 (API RP 754) process safety event C. Crane or personal/material handling 

operations incident

D. Loss of well control D. Loss of station keeping resulting in a drive 

off or drift off

E. >$1 million direct cost from damage to 

or loss of facility, vessel and/or 

equipment E. Life boat, life raft, rescue boat event

F. Oil spill > 10,000 gallons (238 barrels)

 

Practice, Process Safety - Recommended Practice on Key Performance Indicators, Report No. 456, November 

2011, Section 2.2. 

562 The Well Lifecycle Practices Forum is a group of over 45 well operators and management companies established 

by Oil and Gas UK in 2010, which provides a forum for discussion and industry guideline development. See 

http://www.oilandgasuk.co.uk/knowledgecentre/Well_Life_Cycle_Practices.cfm for more information (accessed 

October 7, 2015). 

563 COS is an industry-sponsored group created in 2011 to focus exclusively on deepwater drilling in the Gulf of 

Mexico (Http://www.centerforoffshoresafety.org/, accessed October 7, 2015).

564 Oil and Gas UK Well Lifcycle Practices Forum. Guide to Drilling Process Safety Performance Measurement, 

Draft Form, Version 2. 

565 One major part of the COS mission, as stated on its webpage, is “compiling and analyzing key industry safety 

performance metrics.” The COS convened a committee aimed at developing an indicators program for use 

offshore. COS published its first indicators report in 2015 for the 2013 reporting yes; Annual Performance Report

for 2013 Reporting Year; April, 2015; 

http://www.centerforoffshoresafety.org/COS%202013%20Annual%20Performance%20Report.pdf (accessed 

October 7, 2015). COS published a second report for the 2014 reporting year: Annual Performance Report for 

2014 Reporting Year; September 21, 2015; 

http://www.centerforoffshoresafety.org/2015_COS_2nd%20APR_FINAL.pdf (accessed December 7, 2015). 

566 Center for Offshore Safety. Annual Performance Report for 2013 Reporting Year; April, 2015, Appendix 3; 

http://www.centerforoffshoresafety.org/COS%202013%20Annual%20Performance%20Report.pdf (accessed 

October 7, 2015).

000843
Macondo Investigation Report Volume 3 4/17/2016

155 

The WLCPF decided that Tier 1 and 2 indicators (blowouts or high potential blowouts where an incident 

almost occurred) were well defined, but decided that Tier 3 and 4 indicators need more clarification, so it 

was considering classifying Tier 3 indicators in four categories:567,568

1. Engineering Design and Execution of the Well 

a. Double Barrier principle compromised with or without an influx 

b. Dispensations from technical standards granted 

c. Deviations from well design parameters during operations 

d. Company defined exceedences of safe operational envelopes related to the well design 

2. Safety-critical Equipment on the Drilling Unit 

a. Operation with Rig Audit “Critical Items” outstanding 

b. Partial or complete failure of safety-critical well monitoring system 

c. Partial or complete failure of safety-critical rig equipment or systems in operation or 

during testing 

d. Operation of safety-critical systems outside their performance limitations 

3. Control of Work 

a. Noncompliance with or uncontrolled deviations from safety-critical standard operating 

procedures 

b. Noncompliance with or uncontrolled changes to detailed operations plans 

4. Personnel Competency 

a. Presence of incompetent or unqualified personnel at the work site 

b. Personnel inappropriately qualified for the task at hand 

The WLCPF also grappled with identifying effective Tier 4 indicators and recognized them as more 

difficult because testing organizational or human barriers is not as straightforward as is testing physical 

barriers. Since the health of organizational and human barriers is closely linked to an individual 

company’s safety management systems, the WLCPF is not suggesting specific Tier 4 indicators (like it 

does with Tier 3), but rather areas that a company can use to focus its own company-specific activities in 

defining its own parameters. These areas include six foci that may provide information on the health of 

the organization:569

1. HSE (or other) Audit Action Tracker – Receive reports on overdue items and number of closeouts. Include critical items from rig audits and outcomes from formal audits of HSE activities 

from global reviews, a local business unit, or team-based periodical reviews. 

2. Well Control Equipment, Personnel, Barrier Integrity Log – Monitor status of well control 

equipment certification, people qualifications, barrier integrity, and pressure tests. 

3. MOC & Program Changes –Review the register of changes, dispensations, or changes to identify 

common themes potentially requiring further action or review. 

4. Well Examination Report – Review on a quarterly basis summary statistics from the well 

examination process. Some organizations may do this as an annual formality. This report, if 

 

567 Oil and Gas UK Well Lifcycle Practices Forum. Guide to Drilling Process Safety Performance Measurement, 

Draft Form, Version 2, p 9. 

568 The WLCPF notes that in some cases, these indicators could be normalized against man hours worked, but that 

others would be best normalized on a rig-months or per-well basis. 

569 Oil and Gas UK Well Lifcycle Practices Forum. Guide to Drilling Process Safety Performance Measurement, 

Draft Form, Version 2, p 12. 

000844
Macondo Investigation Report Volume 3 4/17/2016

156 

submitted quarterly and reviewed by leadership, might provide valuable information concerning 

the health of the well examination process. 

5. Competency Assurance – Track activities and outcomes associated with a competency 

management program of company staff and contractors. 

6. Log of Minor Events – Review minor events, such as alarm systems switched off and related to 

barrier integrity, but which do not represent a threat to the primary barriers. 

The WLCPF draft guidance document suggests that the data collected on the 6 focus areas can be 

incorporated into a metric dashboard570 that summarizes safety status of an organization. The trends 

evident on the dashboard could then be used to identify areas for attention or interventions to reestablish 

safe operations determined by previously established targets, as part of a risk-based approach to maximize 

efforts for managing risk.571 Not all barriers necessarily provide metrics that can be assessed on the same 

time scales, and identifying slow moving and “real-time” barrier metrics will maximize indicator efforts 

to manage risks.572 

About ten years before API 754 and IOGP 456 were developed, Statoil defined a framework that 

identified four types of indicators, some of which correlate to the four-tier classification system created by 

API, but Statoil more specifically addressed the timescale of these indicators.573 Statoil not only 

distinguished lagging and leading metrics, but also between slow moving and real-time metrics. The 

timescale distinction summarized in Table 3-5 is useful in describing CSB indicator findings in 

connection with the Macondo incident described in the next section. 

 

570 Some companies create visual displays for the status of various process safety indicators. For instance, green 

could indicate a healthy barrier while yellow and rid could indicate barriers in need of attention. For example, see

Sedgwick, M. Process Safety Key Performance Indicators, CSB Public Hearing: Safety Performance Indicators, 

Houston, TX, July 24, 2012; 

http://www.csb.gov/UserFiles/file/Sedgwick%20%28Scottish%20Power%29%20PowerPoint%20-%20printed.pdf

(accessed October 7, 2015).

571 Pitblado, R. Real-Time Safety Metric and Risk-Based Operations, 11th International Symposium Loss Prevention, 

2004; p 5.

572 Kortner, H.; Sorum, M.; Brandstorp, J. M. Framework For Life-Cycle Assessment of Technical Safety Conditions 

at Statoil Operated Plants, ESReDA Seminar on Lifetime Management, Erlangen, Germany, November 5-6, 

2001. Cited in Pitblado, R. Real-Time Safety Metric and Risk-Based Operations, 11th International Symposium 

Loss Prevention, 2004; p 5.

573 Kortner, H.; Sorum, M.; Brandstorp, J. M. Framework For Life-Cycle Assessment of Technical Safety Conditions 

at Statoil Operated Plants, ESReDA Seminar on Lifetime Management, Erlangen, Germany, November 5-6, 

2001.

000845
Macondo Investigation Report Volume 3 4/17/2016

157 

Table 3-5. Four indicators as defined by Statoil in 2001.

574

Indicator Type 

as per Statoil

CSB Correlation with Tier Indicator 

System Developed by API

Description575

Lagging 

measures

Tiers 1 and 2

Statistical accumulations of actual incidents 

or near-miss events for a facility. Typically 

these are slow moving and make sense only 

over longer time periods (e.g., annual 

averages).

Leading 

measures

Tier 4

Measures of PSM management system 

elements that support environmental, health, 

and safety (EHS), such as management of 

change systems, training systems, etc. These 

are mainly assessed by 2-3 year audits. They 

are slow moving measures not well suited 

for day-to-day operational management. 

Barrier/RealTime measures Tier 3 and 4 (as defined by the WLCPF)

Measures of the status of EHS barriers from 

fully functional to seriously degraded or 

non-functioning. Suitable candidate for realtime measure.

Threat measures No Correlation

Measures of the degree of threat to the 

facility. These are typically EHS challenges 

at a rate higher than anticipated in the risk 

assessment that underlies the safeguarding 

system. These can be determined by 

monitoring / predicting weather, nearby ship 

traffic, work permit activity, contractors on 

board, etc. This is also a suitable candidate 

for real-time measure.

3.5 Process Safety Metrics Gleaned from the Macondo Blowout 

Operators and contractors look to industry-specific trade associations for good practice guidance and 

recommendations for all manner of operational concerns, including performance indicators. However, as 

efforts by the WLCPF group indicate, industry guidance pertaining to safety performance indicators could 

be further improved to provide practicable indicator suggestions. Benefiting from a perspective 

admittedly enlightened by hindsight, this section explores potential lead indicators that the Macondo well 

operations crew and onshore management could have used to manage risk.

 

574 Kortner, H.; Sorum, M.; Brandstorp, J. M. Framework For Life-Cycle Assessment of Technical Safety Conditions 

at Statoil Operated Plants, ESReDA Seminar on Lifetime Management, Erlangen, Germany, November 5-6, 

2001.

575 These descriptions come from Pitblado, R. Real-Time Safety Metric and Risk-Based Operations, 11th 

International Symposium Loss Prevention, 2004, p 5.

000846
Macondo Investigation Report Volume 3 4/17/2016

158 

3.5.1 Real-time Indicators for Safety Critical Elements 

Volume 2 identified barriers as safety critical elements (SCEs), tasks, or pieces of equipment that lead to 

a disproportionate level of protection against major accident events (MAE), and conversely whose failure 

can lead to an immense increase in risk for a MAE.576 In Volume 2, these safety critical elements appear

on a bowtie diagram which illustrates how a major accident might evolve through the failure of a series of 

technical, organizational, and operations barriers. (Figure 3-3 is another bowtie example depicting various 

barriers.) 

Figure 3-3. A Bowtie diagram model used by Statoil to track the health of specific barriers that are 

preventive or mitigative for major accident risks.577

As proposed in Volume 2, safeguarding an SCE’s effectiveness throughout its lifetime should begin by 

clearly identifying and distinguishing it from noncritical equipment and tasks.578 Standards should be 

developed to define the required performance of an SCE to reduce the risk of an MAE. Written assurance 

and verification activities should then define the needed activities to maintain SCE. Through this 

monitoring, improvements to performance gaps should be initiated to reestablish targets. 

These SCE activities are candidates for indicators that can be used to influence daily operations in real 

time as they coincide with WLCPF recommendations to develop Tier 3 indicators for safety critical 

equipment on the unit. For example, trends and analysis on SCE maintenance backlogs and SCE 

verification activity failures could provide information on the robustness of the safety critical elements. 

The Macondo incident demonstrated several instances when the emergency functions of the BOP 

intended to prevent and mitigate an MAE were not tested or properly maintained: 

1. Transocean and BP conducted routine inspections and weekly function testing of operational 

BOP components necessary for daily drilling operations, but these were insufficient to 

identify latent failures of the emergency systems (Volume 2, Chapter 5.0); 

 

576 Volume 2, Section 4.2.3.1, p 58. 

577 Eie, G. Performance Indicators for Major Accident Prevention, CSB Public Hearing: Safety Performance 

Indicators, Houston, TX, July 24, 2012, slide 5. 

http://www.csb.gov/UserFiles/file/Eie%20(Statoil)%20PowerPoint.pdf (accessed October 7, 2015). 

578 Volume 2, Chapter 5 presents the lifecycle in more detail. 

000847
Macondo Investigation Report Volume 3 4/17/2016

159 

2. For an extended time during the drilling process, the Deepwater Horizon BOP blind shear 

ram could not have reliably sheared the drillpipe used at Macondo during an emergency 

situation579 (Volume 2, Section 5.2.1); and

3. A miswired solenoid valve in the yellow pod and the deficient wiring in the blue pod needed 

to function the Deepwater Horizon BOP in an emergency system could not have passed the 

manufacturer’s factory acceptance testing procedures (Volume 2, Sections 5.3.1 and 5.3.2). 

These findings highlight the importance of clearly identifying safety critical functions and performance 

expectations during an emergency scenario of equipment that might also serve an operational function.580

Once identified, the appropriate assurance activities needed to test the safety critical functions must be 

defined, executed, and monitored as appropriate for deviations from the performance metrics. 

3.5.1.1 Well Kicks 

A kick is an indicator that the primary well barrier failed and secondary well control actions by the crew 

are needed. After a kick, if the crew does not recognize the need to activate the BOP or is delayed in 

activating it—as was the case with Macondo—then a gas-in-riser event or even a blowout can occur.581 

Transocean compiled a Well Control Events & Statistics report covering the years 2005 to 2009.582 In the 

report, Transocean reviewed data from various well types (e.g., development or exploration) during 

various phases of the drilling operations (e.g., abandonment or active drilling) to explore well control 

trends and compare previous years to 2009. Transocean noted 121 well control events in 2009 that 

spanned 32 different operators from various geographical locations. Of those 121 well events, 71 were 

categorized as kicks. In the report, Transocean identifies several potential indicators:583

• Kick volume – indicator of rig and crew performance in shutting in the well; 

• Kick intensity – indicator of operator’s accuracy in predicting pore pressure; and 

• Riser unloading events,584 which the Transocean report identified as the biggest concern.

A well kick falls under the Tier 3 definition provided in Section 3.4.2 because it represents a challenge to 

a safety system—the human actions to detect and activate the BOP and the original threat analysis to 

predict anticipated pore pressures. Although Tier 3 indicators are generally company-specific, this not the 

case for well kicks. The Transocean data demonstrates that well kicks are not an isolated problem which 

only BP or the Gulf of Mexico region face, but rather kicks happen under the supervision of many 

 

579 In manual mode, the Deepwater Horizon crew developed a multi-step work-around where the crew would fist 

close the Casing Shear Ram, move drillpipe stub clear, and then close the Blind Shear Ram to seal the well. The 

rig’s AMF/deadman automatic emergency system also relied upon the blind shear ram and was similarly 

impaired, but had no workaround as it could not close the casing shear ram before the blind shear ram.

580 For another example, see the diverter discussion in Section 1.2.1. 

581 See Chapter 2.0, which describes incidents when late kick detection occurred, but the BOP was able to seal the 

well.

582 Internal Company Document, Transocean. Well Control Events & Statistics 2005 to 2009, TRN-INV-00760054, 

http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05649.pdf (accessed June 24, 2015).

583 Ibid., TRN-INV-00760059. 

584 Riser loading events occur when riser fluids (e.g., drilling mud, sea water, or hydrocarbons from the well) are 

released onto the drilling rig. They can occur only on floating rigs using a subsea BOP.

000848
Macondo Investigation Report Volume 3 4/17/2016

160 

operators all around the world. Well kick data can be used as a safety benchmark for the offshore industry 

both intracompany and industrywide. For example, international analyses of offshore blowout and well 

release frequencies have been completed, like one by Lloyd’s Register that analyzed a SINTEF well 

release and blowout database585 for three international geographical regions.586 

3.5.2 Slow Moving Indicators for SMS Elements 

3.5.2.1 Emerging MOCs Themes

The WLCPF suggested monitoring MOC programs to identify common themes. Safety management 

program performance metrics are categorized as slow moving indicators in 3.4.2, implying that larger 

timeframes (i.e., a year or longer) are needed to assess safety trends. The CSB also observes that 

monitoring one SMS element will likely lead to learnings for other safety management systems. Both of 

these facts were evident for the Deepwater Horizon. 

3.5.2.1.1 MOC Indicators - Transocean 

The CSB examined Transocean-identified DWH MOCs completed during the seven years prior to the 

Macondo incident for changes to the blowout preventer (BOP). Transocean corporate policies mandate 

that all changes to safety critical systems, such as a BOP,587 should trigger a formal MOC and risk 

assessment.588 Table 3-6 lists 10 MOCs for the BOP from 2003 to 2009. A preliminary theme emerging 

from the table589 is that the BOP was not consistently identified as safety critical in the MOCs. Instead, 

only four MOCs identified it as such, and further, only four of the MOCs indicated that a risk assessment 

was required to complete the change.

 

585 See https://www.sintef.no/en/projects/sintef-offshore-blowout-database/ (accessed December 7, 2015).

586 Lloyd's Register. Blowout and Well Release Frequencies based on SINTEF Offshore Blowout Database 2009 

(Draft A); 80.005.003/2010/R3; Lloyd's Register: March 17, 2010; p BP-HZN-BLY00104032. See Exhibit 4156, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Baxter_John-Depo_Bundle.zip (accessed 

May 28, 2015).

587 Transocean identified the BOP as safety critical in its Major Accident Hazard Risk Assessment; Internal 

Company Document, Transocean. Major Accident Hazard Risk Assessment Deepwater Horizon, Revision 01, 

August 29, 2004, TRN-MDL-01184581, 

http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-02188.pdf (accessed October 7, 

2015).

588 Internal Company Document, Transocean. Field Operations Policies & Procedures Manuel, Issue 01, Revision 

00, HQS-POP-PP-01, August 8, 2009, Management of Change, TRN-CSB-0002251-0002260. 

589 Internal Company Document, Transocean. Managment of Change 2004 2005 2006 2009 Deepwater Horizon, 

TRN-INV-00758181; Internal Company Document, Transocean. Change Proposal SS-024, April 12, 2009, BPHZN-BLY00395154. 

000849
Macondo Investigation Report Volume 3 4/17/2016

161 

Table 3-6. Summary of MOCs documented by Transocean for the Deepwater Horizon BOP. 

ID # Date Subject

BOP identified 

as Safety 

Critical?

Indication of a 

Required Risk 

Assessment?

Description†

1 12/29/2003 Upper Annular (UA) Failure No No Hydraulic leak on the UA, so electronically locked.

Will rely on lower annular.

2 1/5/2004 BOP MOC for Horizon No No

Changes to the control and mechanical systems. 

Required modifications to installation drawings and 

operating procedures, vendor involvement, and 

engineering approval.

3 8/28/2004 LMRP failsafe panel removal No No

Removed unnecessary BOP components; required

modification of installation drawings, acceptance 

testing, and engineering approval.

4 11/21/2004 BOP Test Rams No Yes Converted the lowest pipe ram into a test ram.

5 2/6/2006 Auto Shear Circuit Not Working Yes Yes Autoshear circuit leaked, so disabled.

6 3/9/2006 18-3/4" Annular stripper packer No No Installed a different UA to allow for stripping of 6 

5/8" drillpipe which changed operating procedures.

7 1/11/2006 BOP Operation No No*

Yellow pod malfunctioning, so remainder of well 

drilled with the blue pod selected which changed

operating procedures.

8 3/5/2007 Software Modification Yes No

Software modification to address erroneous faults, 

required vendor involvement and acceptance testing 

upon completion.

9 10/29/2008 Auto Shear Circuit Not Working Yes Yes Autoshear circuit leaked, so disabled.

10 4/12/2009 Auto Shear Circuit Not Working Yes Yes Autoshear circuit leaked, so disabled.

† Definitions for technical terms used in this column appear in Volume 2 of the CSB’s Macondo investigation report.

*Six days after the facility manager signed this MOC (and original date of MOC), the technical manager noted, “Moot as BOP is on the deck at this point; 

however, a) This would normally require a risk analysis and b) steps must be taken to communicate this change to those who follow (placards on control panels, 

for example).”

000850
Macondo Investigation Report Volume 3 4/17/2016

162 

A review of the Deepwater Horizon MOCs for the autoshear emergency function points to another 

potential theme: the MOC process might have devolved into a check-the-box activity. Three MOCs from 

2006, 2008, and 2009 addressed leaks in the autoshear system590 (MOC # 5, 9, and 10 from Table 3-6). 

Each of the autoshear MOCs indicated a risk assessment was required to address disabling the system, 

and the later MOCs from 2008 and 2009 noted the previous situation(s) when the same issue arose.

591 The 

risk of operating without an autoshear for a finite period might be acceptable compared to (a) operating 

with a leak or (b) bringing the BOP to the surface for repair. But that risk management choice, the realtime well conditions, or the duration of operating without the autoshear are not indicated on any of the 

approved MOCs. 

A final theme emerges that the MOC process was documenting changes, but other safety management 

systems were not being updated to reflect the controls needed to mitigate the risks introduced by the 

changes. MOC #4 in Table 3-6 concerns the conversion of a pipe ram to a test ram.592 Pipe rams like 

those installed on the Deepwater Horizon BOP are designed to hold pressure from one direction and 

normally are installed to hold pressure coming up from the well, such as would be expected during a well 

kick. To save time and money during required subsea pressure tests of the BOP stack, BP requested that 

the lowest pipe ram in the Deepwater Horizon’s BOP be installed upside down to hold pressure from 

above. 593 A consequence of this change is the loss of a pipe ram for well control, leaving only two, so 

less redundancy. Despite the indication on the MOC that a risk assessment was needed, the CSB could 

not identify any Transocean-authored risk assessments concerning the test ram. For Transocean, the new 

hazards introduced by the conversion of the pipe ram to a test ram included new operational procedures 

and practices that would be required by the crew and third-party contractors. 

Hazards introduced by the new test rams procedures and practices were highlighted in a February 2010 

Transocean investigation report that documented an incident when the Deepwater Horizon well 

 

590 The autoshear system is a safety critical element designed to close the BOP’s blind shear rams and seal the well 

in the event the lower marine riser package (LMRP) is inadvertently disconnected from the wellhead. The 

disconnect could result from, for example, either an accidental push of the LMRP unlatch button on one of the rigbased BOP control panels or from a malfunction within the BOP control system. See Section 2.1, Volume 2 for 

more details.

591 Internal Company Document, Transocean, Change Proposal SS-15: Auto Shear Circuit Not Working, February 6, 

2006, TRN-INV-01262584, see Exhibit 4312, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Odenwald_Jay-Depo_Bundle.zip; Change 

Proposal SS-23: Auto Shear Circuit Not Working, October 29, 2008, TRN-INV-01595873.; Change Proposal SS23: Auto Shear Circuit Not Working, October 29, 2008, TRN-INV-01595873.; Change Proposal SS-24: Auto 

Shear Circuit Fluid Leak, April 12, 2009, BP-HZN-2179MDL00359935, see Exhibit 4610, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Odenwald_Jay-Depo_Bundle.zip; 

592 Internal Company Document, Transocean. Change Proposal SS-10: BOP Test Rams, November 21, 2004, TRNINV-01262577, see Exhibit 4309

http://www.mdl2179trialdocs.com/releases/release201304041200022/Odenwald_Jay-Depo_Bundle.zip (accessed 

October 7, 2015). 

593 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, August 17, 2011, see Keeton Designations Vol 1 p 43, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Keeton_Jonathan-Depo_Bundle.zip

(accessed October 7, 2015). 

000851
Macondo Investigation Report Volume 3 4/17/2016

163 

operations crew failed to close the test rams before beginning subsea pressure test procedures.594

Transocean’s investigation report noted that the Task Specific THINK Procedure for the subsea test did 

not explicitly require closing the test rams595 and that on two occasions, closing the test rams had been a 

step added to the procedure, but that not all test sheets were updated to include this critical step. 

3.5.2.1.2 Dispensation/MOC Indicators - BP

Internal company standards contain the boundaries, requirements, and practices that management agrees 

upon, essentially describing the risk an organization formally accepts for a process. For drilling and well 

operations, BP’s company standards appear in the Drilling and Well Operations Practice (DWOP) and 

related Engineering Technical Practices596 (ETPs). At the time of the Macondo blowout, BP stated that 

“deviations from the Drilling and Well Operations Practice and ETPs shall only be considered in 

exceptional circumstances.” 597 During the planning of the Macondo well, BP processed six MOCs for 

dispensations from the DWOP and seven more after drilling began. Actively monitoring the number of 

dispensations or MOCs for a well or a rig provides indications of possible safety issues to manage for 

MAE potential. 

First, several Macondo well MOCs completed by BP noted that the company standards in the DWOP and 

ETP were not appropriate for deepwater wells,598 implying that similar MOCs would be required for BP 

to drill other deepwater wells. An increase in dispensations from company standards may indicate that 

they need updating or expansion. The potential danger is clear. Relying on outdated company standards 

increases improvisation because the standards do not accurately represent the work conditions, and it 

perpetuates a lack of organizational controls for managing risk to acceptable levels commensurate with 

the company’s goals. One potential solution might be to develop an ETP that specifically addresses 

deepwater drilling.

Second, no one metric can define when an organization’s focus on the risk of a major accident event 

begins to drift, and will likely require a triangulated approach that includes reviewing the content of 

dispensations and MOCs. For example, some of the BP MOCs completed for Macondo describe 

conditions that could lead to burst casing, but then state, “This scenario has a very low probability of 

occurring.”599 Low probability still means some probability, a point highlighted in another Macondo 

 

594 Internal Company Document, Transocean. Deepwater Horizon BOP Test Rams, Feburary 9, 2010, TRN-MDL00481481, see Exhibit 1441, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Burgess_Mark-Depo_Bundle.zip (accessed 

October 7, 2015).

595 Transocean indicated that no one involved in the task actually reviewed the TSTP.

596 BP’s used Engineering Technical Practices (ETPs), Site Technical Practice (STPs), and Group Practices to define 

minimum engineering and operations corporate standards. 

597 Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, p A4, BP-HZN-BLY00034504, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX06121.pdf (accessed May 26, 2015).

598 For example: Internal Company Document, BP. DCMOC-09-0048: Kick tolerance less than 25 bbls with a 1.0 

ppg kick intensity, July 10, 2009.; Internal Company Document, BP. DCMOC-09-0049: Design Pore Pressure 

(DPP) requirements, July 10, 2009.

599 See text from MOCs for 22" and 16" casing burst designs, Internal Company Document, BP. Dispensation from 

Drilling and Well Opeartions Policy, BP-HZN-2179MDL00252262, BP-HZN-2179MDL0025226, see Exhibit 

000852
Macondo Investigation Report Volume 3 4/17/2016

164 

MOC where the requester stated, “This would certainly be a worst-case scenario; however, I have seen it 

happen so know it can occur.”600 Minimizing the probability of a worst-case scenario could lead those 

responsible for risk management to prematurely stop looking for controls to prevent or mitigate the 

unwanted consequences. 

3.5.2.2 Cross Reference Indicators Between the Operator/Drilling Contractor 

An independent 2009 Deepwater Horizon rig audit requested by BP601 observed: 

The TSTP which provides the core risk assessment procedure is only used if one is available for 

the job. It was evident that the extensive TSTP library was not being fully utilised. That said the 

written THINK plans reviewed were generally of an acceptable quality and personnel were seen 

to be actively involved during the THINK Planning process. 

 

6092 http://www.mdl2179trialdocs.com/releases/release201302281700004/Thierens_Henry-Depo_Bundle.zip

(accessed October 15, 2015). 

600 See text from MOC for 9-7/8” production casing collapse design; Internal Company Document, BP. Dispensation 

from Drilling and Well Opeartions Policy, BP-HZN-2179MDL00252277, see Exhibit 6092 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Thierens_Henry-Depo_Bundle.zip

(accessed October 15, 2015).

601 Internal Company Document, BP. Deepwater Horizon Follow Up Rig Audit, Marine Assurance Audit and Out of 

Service Period September 2009, September 2009, p 5, BP-HZN-I IT -0008875, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-000275.pdf (accessed October 7, 

2015).

Indicators Developed by BP Post-Macondo 

BP itself came to recognize potential safety performance indicators in the aftermath 

of Macondo. BP’s internal investigation team recognized an opportunity to initiate 

revisions to its safety performance indicator program. As a result, the team 

recommended the following improvements to the company:†

 

Establish D&C leading and lagging indicators for well integrity, well control 

and rig safety control equipment, to include but not be limited to: 

• Dispensations from DWOP. 

• Loss of containment (e.g., activation of BOP in response to a well 

control incident).

• Overdue scheduled critical maintenance on BOP systems.

Require drilling contractors to implement an auditable integrity monitoring 

system to continuously assess and improve the integrity performance of well 

control equipment against a set of established leading and lagging indicators. 

†

BP. Deepwater Horizon Accident Investigation Report; September 8, 2010; pp 184.

000853
Macondo Investigation Report Volume 3 4/17/2016

165 

The acceptable quality noted in the audit conflicts with observations made in this report on the Deepwater 

Horizon TSTPs as well as TSTPs associated with serious near-misses Transocean had recently 

experienced: 

• As a result of Transocean’s Sedco 711 incident, Shell recommended that TSTPs include loss of 

well barrier risks and well control implications.

602

• In connection with the M.G. Hulme incident, Transocean’s investigation report noted that the 

TSTP was not approved and did not adequately identify the hazards and cover risk mitigation and 

preventive controls.603 

• At Macondo, the TSTP for the negative test was general, lacking process parameters or other 

criteria to assist the crew in recognizing when the well began drifting outside safe conditions.604

Hindsight can be a powerful tool in examining the quality of risk assessment tools. Cross referencing 

findings in routine audits, either internal or client-requested, with those from incidents and near-misses, 

regardless of where they occurred, could provide a new perspective on what should be considered 

acceptable.

Improvements in the selection and use of process safety performance indicators are necessary to 

effectively reduce the risks of a major accident event offshore. BP, Transocean, and industry more 

broadly had access to data that provided insights into the performance of safety critical barriers and safety 

management systems before the April 20 blowout. Yet the focus from both companies—in audits, 

performance contracts, and award measures— was on personal safety without an equal and sufficient 

emphasis on major accident risks. 

3.6 Regulatory Requirements for Indicators Reporting 

At the time of the Macondo incident, MMS required operators to report primarily lagging and 

infrequently occurring events, such as losses of well control, fires, explosions, collisions, and incidents 

that damaged or disabled safety systems or equipment.605, 606 MMS also voluntarily collected from its 

lessees and operators information on the number of recordable injuries/illnesses of company and contract 

employees, DART607 injuries/illnesses of company and contract employees, notices of EPA 

noncompliance, and oil spills greater than one barrel annually, as well as the total volume for those 

 

602 See Section 2.2. 

603 Internal Company Document, Transocean. EAU Incident Investigation Report - M.G. Hulme, Jr. Well Control 

Incident - Riser Unloading, OER-MGH-09-005, March 26, 2009, p 12, TRN-INV-01143039, 

http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05650.pdf (accessed October 7, 

2015); see also Section 2.1. 

604 See Section 1.8.3. 

605 More detail is available in Volume 4, Section 4.3.

606 Oil and Gas and Sulphur Operations in the Outer Continental Shelf - Incident Reporting Requirements, 71 Fed. 

Reg. 19,640 (April 17, 2006). 

607 DART stands for Days Away from work, Restricted duty, and Transfer situations; US DOI MMS Performance 

Measures Data, MMS-131, http://www.ocsbbs.com/ntls/ntl2005-n02-formmms-131.pdf, (accessed October 7, 

2015). 

000854
Macondo Investigation Report Volume 3 4/17/2016

166 

reported spills.608 Appendix E of API 75, which was merely a voluntary recommended practice at the 

time of Macondo, recommended the collection of those same safety performance metrics, as well as fire, 

explosion, and blow-out incident rates, and Incidents of Noncompliance issued by MMS.609 Since these 

data reporting recommendations were voluntary, the regulator did not have access to a full range of data 

possible to assess industry performance, identify negative safety trends, or set targets for industry 

improvement. Post-Macondo, the potential for the US regulator to use safety performance indicator data 

to further advance safety offshore is recognized, with the regulator’s voluntary request becoming 

mandatory in February 2011 and the introduction of an anonymous near-miss reporting program, 

SafeOCS, in 2015.610 Volume 4 describes approaches BSEE might take to promote offshore safety 

improvements using indicator data it collects.611 

3.7 Conclusion

The imperative to prevent another offshore catastrophe supports efforts by industry to actively monitor 

safety performance indicators that capture barrier and safety management system health. This chapter 

highlights some of the more advanced work on the issue to suggest ways companies can effectively 

collect and use safety data to manage major accident hazards. Volume 4 of the CSB Macondo 

Investigation Report, describes in detail how the regulator can play an influential role in developing and 

using safety performance indicators. 

 

608 US DOI MMS Notice to Lessees and Operators of Federal Oil and Gas Leases on the Outer Continental Shelf: 

Performance Measures for OCS Operators and Form MMS-131, NTL2005-N02, https://ocsbbs.com/ntls/ntl05-

n02.asp, and US DOI MMS Performance Measures Data, MMS-131, http://www.ocsbbs.com/ntls/ntl2005-n02-

formmms-131.pdf, (accessed October 7, 2015). 

609 API Recommended Practice, 75, 3rd (2004, reaffirmed 2008) ed., Recommended Practice for Development of a 

Safety and Environmental Management Program for Offshore Operations and Facilities, Appendix E, pp 37-41.

610 https://near-miss.bts.gov/ (accessed January 15, 2015).

611 Section 4.3.

000855
Macondo Investigation Report Volume 3 4/17/2016

167 

4.0 Ineffective Risk Management Approaches at Macondo 

and the Challenges of the Multi-Employer Offshore Work 

Environment

Major process safety incidents such as the 1988 UK Piper 

Alpha (offshore production facility)612 and the 1989 

Phillips 66 Chemical Complex (petrochemical production 

facility)613 explosions were shaped by factors related to 

contractor management and ensuring safe operations in a 

multi-employer environment. At Piper Alpha, causal 

factors included deficiencies in contractor training and 

communication related to safety critical procedures as well 

as emergency response.614 For the 1989 Phillips 66 

incident, findings addressed dispersed responsibility for 

employee safety where one or more contractors were 

engaged in potentially hazardous activities at the 

worksite.615 In its Phillips 66 investigation report, OSHA 

compared the owner/contractor problem to threats that can 

arise from dividing safety responsibility at construction 

sites where procedures were not in place.616 Similar 

lessons presented themselves at Macondo, but with nuances specific to the offshore drilling industry. 

As detailed in Section 1.8, while BP designed the Macondo well, Transocean supplied most of the 

workforce and drilling equipment. Before drilling began, BP agreed to use Transocean’s Safety 

 

612 On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the coast of 

Scotland in the North Sea. A series of explosions and fire killed 167 workers and almost completed destroyed the 

platform. This incident became the deadliest accident in the history of the offshore industry.

613 On October 23, 1989, an explosion occurred at the Phillips 66 Company’s Houston Chemical Complex where 

high-density polyethylene plastic for milk bottles and other containers was produced, killing 23 workers and 

injuring 130 others. This was one of the worst industrial workplace accidents in the United States. 

614 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November, 1990; noted in several locations, including 

examples on pp 194, 213, 293, and 356. 

615 U.S. Department of Labor Occupational Safety and Health Administration, The Phillips 66 Company Houston 

Chemical Complex Explosion and Fire: Implementation for Safety and Health in the Petrochemical Industry, 

April 1990, p vii.

616 OSHA noted, “Following the L'Ambiance Plaza apartment complex collapse in Bridgeport, Connecticut, in April 

1987, in which 28 workers were killed, OSHA held the primary contractor responsible for not meeting the safety 

and health requirements at the site. It was the agency's position that the primary contractor, in its role of 

supervisor of the entire project, could have prevented those violations regardless of whether part of the work was 

subcontracted.” U.S. Department of Labor Occupational Safety and Health Administration, The Phillips 66 

Company Houston Chemical Complex Explosion and Fire: Implementation for Safety and Health in the 

Petrochemical Industry, April 1990, p 63. 

Chapter 4.0 Overview

This chapter examines various BP and 

Transocean policies for managing major 

accident risks during drilling operations. 

The chapter demonstrates how despite 

contracted rigs represent a majority of 

BP’s blowout risks and Transocean’s 

rigorous corporate management risk 

policies, neither company sufficiently 

managed major hazard risks at the 

Macondo well. 

000856
Macondo Investigation Report Volume 3 4/17/2016

168 

Management System (SMS) on the Deepwater Horizon.

617 For the workforce under the drilling 

contractor, consistently working within one safety management system should improve front-line

activities as the drilling rig moves from one well to another or as crew members work on wells managed 

by different operators. However, as Section 1.8 indicates, the interface of the safety management systems 

between the operator and the contractors, particularly the drilling contractor, can play an important role in 

bridging the natural gap between work-as-imagined in the drilling program and work-as-done by the well 

operations crew. To do so effectively, the interface must encompass fundamental hazard identification 

and both companies’ process safety risk management practices. 

At Macondo, BP and Transocean did not clarify hazard identification and risk management roles and 

responsibilities for safety critical activities contained within the temporary abandonment program. 

Consequently, while both companies had more rigourous corporate policies for risk management, neither 

assumed effective responsibility for ensuring their implementation at Macondo. This chapter addresses 

the corporate policies that establish the basis for BP and Transocean’s risk managment expectations.

4.1 BP and Transocean Risk Reduction Goal: ALARP

Companies need an effective, and realistic, risk reduction goal because they cannot eliminate every risk 

completely—absolute safety is not possible. The question then becomes, when are efforts to reduce the 

level of residual risk sufficient? This challenge led to reducing risk to a level as low as is reasonably 

practicable, or ALARP, an important concept to explore in risk reduction practices employed during the 

Macondo drilling project since both BP and Transocean had policies to apply ALARP principles.618 

 

617 Internal Company Document, BP. Transocean Drilling Contract for the Deepwater Horizon, 1998, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-004271.pdf (accessed May 27, 

2015).; Hearing before the Hearing before the U.S. District Court for the Eastern District of Louisiana under the 

Multi-District Litigation docket MDL No. 2179, June 29, 2011, see Mogford Designations Vol 2 pp 22-25, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Mogford_John-Depo_Bundle.zip (accessed 

October 7, 2015); Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, June 21, 2011, see Baxter Designations Vol 1 pp 26-27, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Baxter_John-Depo_Bundle.zip (accessed 

October 7, 2015). 

618 BP’s OMS Exploration and Production Drilling and Well Operations Practice (DWOP) states, “all risks shall be 

managed to a level which is as low as reasonably practical” or ALARP, Internal Company Document, BP. GP 10-

00 Drilling and Well Operations Practice, Issue 1, October 2008, "This document contains the practices that have 

been agreed by BP management as current and relevant for drilling and well operations.", p A-8, BP-HZNBLY00034518, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed 

May 26, 2015). Transocean policies require employees to manage risks to ALARP, which Transocean defines as 

“... requiring personnel to consider the various additional risk reduction measures (additional controls) and 

determine if the effort and cost of those measures justify the additional amount of risk reduction obtained” 

Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, Revision 

07, HQS-HSE-PP-01, December 15, 2009, Section 4 (Safety Policies, Procedures and Documentation), p BPHZN-2179MDL00132218, see Exhibit 4942, BP-HZN-2179MDL00132055, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).

000857
Macondo Investigation Report Volume 3 4/17/2016

169 

No prescribed methodology defines the type or number of barriers needed to demonstrate ALARP.619 The 

determination relies on informed judgments supported by a robust hazard analysis process that weighs the 

strengths and weaknesses of a range of potential barriers. Generally, proof that ALARP levels have been 

achieved is accepted when companies can show they adhere to generally recognized codes, standards, and 

relevant good practices.620 ALARP is also defined as “efforts to reduce risk [that are] continued until the 

incremental sacrifice (in terms of cost, time, effort,or other expenditure of resources) is grossly 

disproportionate to the incremental risk reduction achieved.”621 In practice, these efforts by the company 

are twofold. First, they are the initial identificaton and implementation of physical, operational/human, 

and organizational safety barriers to reduce the risk of a major accident as determined by a hazard 

analysis. Second, they are adherence to safety managment systems intended to ensure strong barriers 

throughout the lifetime of an operation. The success of these systems hinges on the risk management 

approach and corporate oversight of that approach to create a strong and supportive culture. Collaboration 

of this magnitude means actively monitoring for, and then addressing, barrier performance gaps 

appropriately. Thus, while an initial effort to address risk levels is necessary, the efforts should be 

continual and in response to various factors such as new technology developments, updated industry 

standards, or lessons learned from an incident.

ALARP is not required by the SEMS Rule. Despite its lack of presence, several widely recognized 

standards and guidelines recommend using ALARP. Specific to drilling, ALARP is recommended by the 

IADC, a trade association of which Transocean is a member.622 While this chapter details ALARP 

provisions stipulated in both BP and Transocean corporate policies to demonstrate inadequacies in their 

risk management approaches, Volume 4 expands the ALARP conversation and addresses the important 

role of the regulator in overseeing and verifying adequate risk reduction measures by industry in an 

ALARP environment. 

 

619 Executive, H. a. ALARP "at a glance", http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed October 7, 

2015), 2015.; NOPSEMA. Guidance Note: ALARP; N-04300-GN0166 Revision 6; June, 2015; pp 5-7. 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0166-ALARP.pdf (accessed October 7, 2015).

620 The Center for Chemical Process Safety (CCPS) identifies ALARP as an appropriate risk reduction approach in

their hazard identification and risk analysis guidance; Center For Chemical Process Safety. Guidelines for Risk 

Based Process Safety; John Wiley & Sons: Hoboken, NJ, 2007; see generally Chapter 9, Hazard Identification 

and Risk Analysis, pp 209-244.

CCPS is a not-for-profit industry alliance within the chemical engineering professional society - the American 

Institute of Chemical Engineers (AIChE) “that identifies and addresses process safety needs within the chemical, 

pharmaceutical, and petroleum industries, http://www.aiche.org/ccps/about (accessed February 28, 2015). CCPS’s 

mission is to “eliminate process safety incidents in all industries” but much of CCPS safety guidance has 

historically focused on onshore process safety issues, http://www.aiche.org/ccps/about/mission-vision (accessed 

February 28, 2015). Member companies include major oil companies such as BP, Chevron, ConocoPhillips, 

ExxonMobil, Total and Shell that manage process safety both on and offshore.

621 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; pp xxxvii.

622 With the exception of the US, regulators of the leading oil and gas producing countries of the world have 

recognized or adopted these guidelines. IADC Safety Case Guidelines web page detailing the 21 countries where 

the guidelines have been adopted or are pending adoption, http://www.iadc.org/iadc-hse-case-guidelines/ ; 

International Association of Drilling Contractors Health, Safety and Environment Case Guidelines for Mobile 

Offshore Drilling Units, January 2015, Issue 3.6, Part 4, pp 22-23.

000858
Macondo Investigation Report Volume 3 4/17/2016

170 

4.2 Contractor Safety Management Guidance Calls for Clear 

Definition of Roles and Responsibilities

The International Association of Drilling Contractors (IADC), the Center for Chemical Process Safety 

(CCPS),

623 and API guidance identify that keys to managing major process risk between a contracting 

company and a contractor are clear definition and communication of safety critical roles and 

responsibilities.624 IADC recommends that a drilling contractor identify in writing hazardous operations 

and barriers that likely fall under its responsibility, including running drillpipe into and out of a well, well 

testing, and displacing a well.

625 The objective of such an activity is to incorporate input from relevant 

stakeholders (like an operator) on the uncertainties and assumptions made when identifying risk reduction 

measures, and then communicating the information to the workforce.626 The IADC also identifies that a 

bridging document between the operator and contractor should describe “individual and collective 

stakeholder responsibilities during the various operational phases,”627 which include HSE management 

responsibilities and authorities628 as well as HSE critical activities and verification of effectiveness.629 

CCPS emphasizes that owners/operators need to “establish expectations, roles and responsibilities for 

safety program implementation and performance.”630 CCPS states that one key principle for 

owners/operators in contractor management is to “maintain high standards of safety performance during 

the conduct of the contracted services,” and it further asserts that the contracting company must 

implement a contractor management program to ensure safe operations.631 Maintaining a dependable 

process safety practice and ensuring consistent implementation require “compliance with specific 

company, facility or regulatory requirements. Responsibility for each associated work activity should be 

identified and designated, as appropriate to the company or contractor.”632 CCPS also states that most

companies require that contractor safety standards and practices be comparable to the owner/operator’s. 

 

623 Guidelines for managing risk have been produced by various authors including the CCPS and IADC. While the 

CCPS guidelines were not expressively written for offshore operations, they have recently been effectively 

implemented in drilling and well operations (Chajai, H.; Smith, C. Defining and Improving Process Safety for 

Drilling and Well Services Operations, IADC/SPE Drilling Conference and Exhibition, Fort Worth, TX, March 4 

- 6, 2014) As such, they complement the IADC guidelines for assessing policies and practices relevant to the 

Macondo incident.

624 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; p 365.

625 International Association of Drilling Contractors Health, Safety and Environment Case Guidelines for Mobile 

Offshore Drilling Units, January 2015, Part 4, Section 4.8, p 36. 

626 Ibid., Part 4, Section 4.8.1, p 37. 

627 Ibid., Part 2, Section 2.2.1, p 4.

628 Ibid., Part 2, Section 2.2.3.4, p 8.

629 Ibid., Part 6, Section 6.4, pp 6-7.

630 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007, p 367.

631 Ibid., p 368. 

632 Ibid., p 370. 

000859
Macondo Investigation Report Volume 3 4/17/2016

171 

API Recommended Practice 76,633 Contractor Safety Management for Oil and Gas Drilling and 

Production Operations, establishes owner/operator responsibilities for contractor safety performance, 

including drilling contractors, and advises that the “operator should identify the safety requirements and 

communicate them to the contractor.” 634 Where contractors have specialized expertise and knowledge of 

expected hazards, it is important that a determination be made “as to which individual or company will 

have the primary responsibility for implementing additional safety requirements applicable to their 

specialty.”635

4.3 Transocean did not apply its More Rigorous Corporate Risk 

Management Policies to the Deepwater Horizon and Macondo 

Well

This section shows that Transocean offered minimal internal guidance and unclear expectations of the risk 

management tools its personnel should use for an offshore operation or facility, and the more rigorous 

ones were not applied at the Macondo well. Transocean claims not to have used the more rigorous ones 

because US regulations did not require them.

636

Transocean’s rig crews manage risk with the THINK planning process (Section 1.8.3), a hierarchical 

approach with levels of risk assessment that depended on factors such as the complexity and potential 

safety impact of the task.637 As the complexity and severity of the potential risk increases, responsibility 

should shift from the rig crew to further up the organizational hierarchy, and the company should use 

more rigorous risk management approaches, including HAZOP/HAZID, Major Accident Hazard Risk 

Assessment (MAHRA; sometimes referred to as MHRA or Major Hazard Risk Assessment), and the 

Health Safety and Environmental (or safety) case and operations integrity case (OIC) (see Figure 4-1 and 

Table 4-1).

 

633 API RP 76 has been cited as a potentially helpful document in “developing guidelines for contractor selection” in 

API Recommended Practice 75 that was made mandatory in offshore regulations post-Macondo. See Volume 4, 

Section 2.1 for more discussion.

634 Note that API 76 has not been updated since 2007 or revised in the aftermath of the Macondo incident. API 

Recommended Practice 76, 2nd ed., Contractor Safety Management for Oil and Gas Drilling and Production 

Operations, November 2007 (, reaffirmed January 2013), p 1.

635 It should be noted that the language used in API RP 76 revolves around permissive “should” and not “shall” 

requirements. Also, API 76 has not been updated since 2007 or revised in the aftermath of the Macondo incident; 

API Recommended Practice 76, 2nd ed., Contractor Safety Management for Oil and Gas Drilling and Production 

Operations, November 2007 (reaffirmed January 2013), p 1. 

636 See text in Section 4.3.1.1.; Internal Company Document, Transocean. Investigations - Hazard Studies, July 29, 

2010, p TRN-INV-03403088.

637 Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, 

Revision 07, HQS-HSE-PP-01, December 15, 2009, Risk Management Think Planning Process, see Exhibit 4942, 

BP-HZN-2179MDL00132218 - 20, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015). 

000860
Macondo Investigation Report Volume 3 4/17/2016

172 

Figure 4-1. Transocean’s Levels of Risk Management. The higher level risk management approaches 

were applied to activities with greater complexity and severity of risk. 638

 

638 Ibid., BP-HZN-2179MDL00132220.

000861
Macondo Investigation Report Volume 3 4/17/2016

173 

Table 4-1. Shore-based risk management tools as identified and described in Transocean’s Health and 

Safety Policies and Procedures Manual-Level. 

Risk Management Tool Transocean Description639

Hazard Identification (HAZID)/ 

Hazard and operability (HAZOP)

A HAZID study is the structured, systematic risk assessment of an activity 

in order to identify the hazards associated with it. 

A HAZOP study is used to identify health, safety, and environmental 

hazards and operability issues for equipment or systems to reduce risks to 

ALARP. HAZOPs are primarily used during a design stage.

Major Hazard Risk Assessment 

(MAHRA)

Demonstrates that the company has identified the major hazards of an 

installation, qualitatively assessed the risk associated with those hazards, 

and identified the preventive and mitigating controls necessary to reduce 

the risk to ALARP. 

Safety Case

A summary of the installation, installation management, and company 

safety management system, showing the company has identified and 

evaluated all major hazards that may affect the installation and has 

appropriate means for controlling risks of those hazards.

Operation Integrity Case (OIC)

Assures that the company has identified major and other workplace 

hazards, assessed the risks associated with these hazards, and possesses 

the necessary controls to reduce the risk to as low as reasonably 

practicable. A person is assigned to each identified control. The OIC 

process is based on the Company Management System.

These tools, requiring varying levels of analysis and organizational responsibility, should assist in 

identifying and managing needed safeguards. For the Macondo well, scant evidence exists that 

Transocean used any of these risk management tools to adequately assess hazards and implement 

effective controls to manage loss-of-well control risks. 

4.3.1 Transocean Lacks Implementation Guidance for its Risk Management 

Tools 

The Transocean Health and Safety Manual (HSE Manual) in effect at the time of the incident provided 

little guidance on the selection of risk management tools and their requirements. For the higher level risk 

tools, Transocean merely states that every vessel in the fleet must have a current version of the MHRA, 

Safety Case, or OIC. 640 Of these three tools, Transocean does not describe which tool is required under 

given conditions except to say that countries such as the UK use the Safety Case to demonstrate that risks

are ALARP.641 While the Transocean HSE Manual indicates that these three tools should be used where 

the severity and complexity of risk “increases” (Figure 4-1), it provides no direction about their benefits 

for major accident prevention under different risk conditions. In April 2010, Transocean commissioned 

Lloyd’s Register to review its safety management systems.

642 Lloyd’s Register reported that Transocean’s 

 

639 Ibid., BP-HZN-2179MDL00132229. 

640 Ibid. 

641 Ibid. 

642 Internal Company Document, Transocean. An Independent Review of CMS and SMS, Client: Transocean, April 

9, p 11, 2010,TRN-INV-02825041.

000862
Macondo Investigation Report Volume 3 4/17/2016

174 

offshore workforce was confused about the risk management hierarchy and that the workers viewed the 

tools as poorly described and lacking guidance on “when and how [the tools] should be applied.” The 

report found that while Transocean’s risk management procedure required quantifying hazards and 

reducing risks to ALARP, the management system lacked a procedure to do so.

The various levels of Transocean’s risk management hierarchy were all intended to demonstrate that risks 

were reduced to ALARP.643 However, Transocean did not use the good practice test for ALARP for the 

Deepwater Horizon rig or the Macondo well project, which requires that the incremental sacrifice (in 

terms of cost, time, etc.) be grossly disproportionate to the incremental risk reduction achieved. Rather 

Transocean stated that ALARP “requires personnel to consider the various risk reduction measures 

(additional controls) and determine if the effort and cost of those measures justify the additional amount 

of risk reduction obtained.”644 By eliminating the gross disproportionality test, Transocean expressly 

allowed risk reduction to carry less weight and cost factors to play a greater role in the ALARP 

determination. 

BP notes that traditional risk assessments are not appropriate for managing the risk of low probability, 

high consequence major accident events, requiring instead a different strategy that does not lead to 

excluding them from further risk reduction efforts (see Section 4.4.1). 

4.3.1.1 Transocean Identified Risk Mitigation Tool Weaknesses Post Incident

Despite the high severity of known risks in exploring high pressure/high temperature wells in deep water, 

like Macondo, the only Transocean higher level risk management activity completed was a generic Major 

Hazard Risk Assessment (MHRA) for the Deepwater Horizon rig.645 While Transocean’s HSE Manual 

required a review and update of the MHRA,

646 the Horizon MHRA had not been revised since 2004, 

nearly six years before the Macondo incident. The purpose of the MHRA was to “demonstrate that 

adequate controls were in place so that HSE risks on the Deepwater Horizon can be considered both 

tolerable and ALARP.” The MHRA examined a number of hazards using a generic risk matrix that 

defined the categories of severity and likelihood.647 Ultimately, this led to a designation that a well 

 

643 Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, 

Revision 07, HQS-HSE-PP-01, December 15, 2009, Demonstrating Risks are ALARP, see Exhibit 4942, BPHZN-2179MDL00132229, http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_DanielDepo_Bundle.zip (accessed October 7, 2015). 

644 Ibid. 

645 Internal Company Document, Transocean. Major Accident Hazard Risk Assessment Deepwater Horizon, 

Revision 01, August 29, 2004, TRN-MDL-01184581, 

http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-02188.pdf (accessed October 7, 

2015).

646 Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, 

Revision 07, HQS-HSE-PP-01, December 15, 2009, Risk Management Think Planning Process, see Exhibit 4942, 

BP-HZN-2179MDL00132229, http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_DanielDepo_Bundle.zip (accessed October 7, 2015).

647 The likelihood categories were based on the subjective determination of the personnel involved. For a medium 

likelihood, an event such as a blowout would have had to occur on the Horizon. Low likelihood was assigned if 

the staff knew the event occurred in industry. The report has no justification for using the categories or the 

significant gap between “known to have occurred in the industry” and “occurs on this rig.” Based on this 

subjective approach, the MHRA concluded that while the consequences of a well blowout were judged to be 

000863
Macondo Investigation Report Volume 3 4/17/2016

175 

blowout was a “medium risk” for the Deepwater Horizon and required review, but Transocean did not 

issue recommendations for the well blowout hazard under its scheme.648 (See also Volume 2, Section 

5.1.1.) Despite the critical role of manual activation of the BOP in ensuring the BOP can act as a physical 

barrier against a well kick or blowout,649 Transocean has no record that it identified, evaluated, and 

implemented the necessary corresponding human and process controls. 

Post-incident, Transocean technical personnel concluded that the MHRA approach was less effective than 

what other countries require and observed an absence of a Macondo bowtie650 analysis to address safety 

barriers.651 A Transocean outside risk consultant agreed, noting that the use of MHRA is “not as good as 

the bowties,” in part as they are not “user friendly” and do not address barrier effectiveness or 

circumstances that could compromise barriers.652 The Transocean DWH Investigation team identified that 

regulatory requirements to undertake more in-depth analysis of major hazard events influenced the level 

of analysis actually conducted by the company.653 The comments from the Transocean investigation team 

portray the use of MHRA as a minimum compliance approach—Transocean will use the more effective 

approach only if the regulatory regime requires it. This minimal compliance approach undermines 

Transocean’s claim of reducing major accident risk to ALARP. If the same company recommends and 

uses a more effective risk management approach for the same activity, then the less rigorous approach 

clearly is not ALARP.

 

“extremely severe” based on the fact that no blowout had occurred on the Deepwater Horizon, the likelihood of 

occurrence was low.

648 Internal Company Document, Transocean. Major Accident Hazard Risk Assessment Deepwater Horizon, 

Revision 01, August 29, 2004, TRN-MDL-01184597 and TRN-MDL-01184589 - 91, 

http://www.mdl2179trialdocs.com/releases/release201303141200012/TREX-02188.pdf (accessed October 7, 

2015). 

649 Volume 2, Section 2.2. 

650 Bowtie diagrams are introduced in Volume 2, Section 4.2.1. A bowtie diagram (also referred to simply as a 

bowtie) is a visual tool that depicts the relationships between hazards, barriers, and the major accident events the 

barriers are intended to prevent. 

651 Internal Company Document, Transocean. Investigations - Hazard Studies, July 29, 2010, TRN-INV-03403088.

652 Email from Operations Manager, Marex, to Deepwater Horizon Investigation Team, Transcoean, Subject: FW: 

Champion's - Major Hazard Risk Assessment or Safety Case, May 13, 2010, TRN-INV-02872965. The email 

specifically states “barrier effectiveness, escalation.” ‘Escalation’ factors are commonly used to describe barrier 

threats, see Lewis, S.; Smith, K. Lessons Learned From Real World Application of hte Bow-tie Method, American 

Institute of Chemical Engineers 2010 Spring Meeting 6th Global Congress of Process Safety, San Antonio, TX, 

March, 2010.

653 Internal Company Document, Transocean. Investigations - Hazard Studies, July 29, 2010, p TRN-INV03403088.

000864
Macondo Investigation Report Volume 3 4/17/2016

176 

4.4 Post-Texas City Refinery Disaster, BP Developed but Macondo 

did not Benefit from the Robust Corporate Risk Management 

System 

The 2007 Baker Panel and CSB reports654 issued in the wake of the 2005 BP Texas City refinery accident 

led to a renewed global emphasis on process safety performance for many high-hazard industries and 

regulators beyond the oil refining sector. Two major lessons with broad implications from both reports 

were (1) the necessity to focus on process safety separate and distinct from personal safety and (2) the 

influential power of corporate leadership and organizational culture in driving continual process safety 

improvement.655 

The Baker Panel report recommended that BP implement “an integrated and comprehensive process 

safety management system that systematically and continuously identifies, reduces, and manages process 

safety risk.”656 BP agreed to adopt the Baker Report recommendations, establishing a Board reporting 

process to track progress to implementation. BP also responded to findings and recommendations from 

the CSB and Baker Panel by developing an overhaul of its corporate safety management system approach 

to its entire global operations. It termed this approach the BP Operating Management System Framework 

or OMS, which in 2008 replaced the business-wide HSE management system Getting Health, Safety, and 

Environment Right (GHSER).657 The BP Group Chief Executive Tony Hayward asserted “the operating 

management system (OMS) is fundamental to delivering safe and reliable operating activities in BP.”658 

The CSB Texas City report noted that GHSER, the OMS predecessor, listed “expectations” encompassing 

both personal safety and some limited process safety elements, but the reporting requirements to 

corporate leaders focused on personal safety, which weakened BP’s ability to prevent the Texas City 

incident.659 In contrast, OMS addresses both process and personal safety in its risk approach and included 

a larger collection of process safety-related policies and engineering and technical practices that 

represented, as a whole, a more structured and rigorous approach to major accident prevention. BP 

 

654 The Baker Panel. The Report of the BP US Refineries Independent Safety Review Panel; January, 2007; 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015).; USCSB, 2007. Refinery 

Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, 

http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 7, 2015), March 2007.

655 Hopkins, A. Failure to Learn - the BP Texas City Reginery Disaster; CCH Australia Limited: 2009; pp 63-64.

656 The Baker Panel. The Report of the BP US Refineries Independent Safety Review Panel; January, 2007; p xvi. 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015).

657 Internal Company Document, BP. The BP Operating Management System Framework, Part 1, An Overview of 

OMS, Version 2, November 3, 2008, BP-HZN-2179MDL00333196, see Exhibit 2352 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lynch_Richard-Depo_Bundle.zip (accessed 

October 7, 2015).

658 Ibid., p 2, BP-HZN-2179MDL00333198. 

659 USCSB, 2007. Refinery Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, p 149, 

http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 7, 2015), March 2007.

000865
Macondo Investigation Report Volume 3 4/17/2016

177 

explicitly approved these policies for implementation “across the BP Group”660 and intended to apply 

them to onshore and offshore operations, including drilling and completions.661 

Under OMS, BP required the systematic identification of process safety hazards, risk assessment, and risk 

reduction measures at the plant, process, and people levels.

662 OMS’s risk approach required an annually 

updated risk register that identified specific safety and environmental risk reduction measures.663

Implementing OMS was intended to include at least an annual gap assessment of the entity’s operations 

based on the OMS guidance and related standards at all levels of the organization.664 The standards 

included Group Engineering Technical Practices, which defined minimum engineering and operations 

process safety corporate standards for reducing risks, including Integrity Management,

665 a Hazard and 

Operability Study,

666 Inherently Safer Design,667 and Layers of Protection Analysis (LOPA).668 As the 

CSB shows in recently published investigation reports, policies like these have the potential of more 

robustly reducing process safety risk.669 Other risk management practices that BP required included BP’s 

 

660 BP Group management is the global corporate management responsible for business operations, including 

exploration and production (E&P). 

661 Internal Company Document, BP. Gulf of Mexico SPU Operating Plan (OMS Handbook), December 3, 2008, 

BP-HZN-2179MDL00333155, http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX002908.pdf (accessed October 7, 2015).

662 Ibid. 

663 Internal Company Document, BP. The BP Operating Management System Framework, Part 2, Elements of 

Operating including Group Essentials, Issue 2, November 3, 2008, see Exhibit 2352, BP-HZN2179MDL00333245, http://www.mdl2179trialdocs.com/releases/release201302281700004/Lynch_RichardDepo_Bundle.zip (accessed October 7, 2015).

664 Ibid. 

665 "This practice provides requirements for designing, constructing, operating and maintaining [...] floating 

structures throught their lifecycle. The intent is to prevent loss of containment, structural failure or unintended 

release of stored energy;" Internal Company Document, BP.

666 Internal Company Document, BP. GP 48-02 Hazard and Operability (HAZOP) Study, June 12, 2008, BP-HZNCSB00181666.

667 Internal Company Document, BP. GP 48-04 Inherently Safer Design (ISD), June 5, 2008, BP-HZNCSB00181764, “Inherently safer design (ISD) is a way of thinking differently from traditional hazard 

management. Instead of identifying hazards and adding layers of protection to prevent and minimise hazards, 

inherently safer design first challenges whether the hazard can be eliminated completely or reduced in severity.” 

668 Internal Company Document, BP. GP 48-03 Layers of Protection Analysis (LOPA), June 5, 2008, "This GP 

describes the method used to evaluate the effectiveness of independent protection layer(s) in reducing the 

likelihood or severity of an undesirable event." BP-HZN-CSB00181723.

669 USCSB, 2013. Final Investigation Report: Chevron Richmond Refinery Pipe Rupture and Fire, Richmond, CA, 

August 6, 2012, Report No. 2012-03-I-CA, http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-

04-17.pdf (accessed October 7, 2015), April 2013.; USCSB, 2014. Catashtrophic Rupture of Heat Exchanger, 

Anacortes, WA, April 2, 2010, Report No. 2010-08-I-WA, 

http://www.csb.gov/assets/1/7/Tesoro_Anacortes_2014-May-01.pdf (accessed October 7, 2015), May 2014.

000866
Macondo Investigation Report Volume 3 4/17/2016

178 

Major Accident Risk Process670 and the Drilling and Well Operations Practice (DWOP). 671 Both are 

detailed in this section. 

4.4.1 OMS Roll-out Lags Macondo Well Planning and Drilling—Related 

Safety Practices were not Effectively Applied at the Macondo Well 

BP pledged to implement OMS as a response to the Texas City recommendations across all operations. 

As indicated on the timeline in Figure 4-2 BP first announced OMS in 2006, with piloting of the new 

system beginning in 2007 and large company rollout in 2008.672 In 2008, BP CEO Tony Hayward stated 

at an annual general meeting for shareholders, “Our intense focus on process safety continues. We are 

making good progress in addressing the recommendations of the Baker Panel and have begun to 

implement a new Operating Management System across all of BP’s operations.”673 By 2009, BP 

announced rollout was 80% complete businesswide, and specifically in the Gulf of Mexico by December 

2009.674

 

670 Internal Company Document, BP. BP Group Engineering Technical Practices, Major Accident Risk (MAR) 

Process, GP 48-50, June 5, 2008, BP-HZN-2179MDL00407937, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-01734.pdf (accessed May 22, 2015).

671 Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, "This 

document contains the practices that have been agreed by BP management as current and relevant for drilling and 

well operations." BP-HZN-BLY00034504, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 2015).

672 See BP Sustainability Reviews from 2006 – 2008 at http://www.bp.com/en/global/corporate/sustainability/aboutour-reporting/Sustainability-report/sustainability-report-archive.html (accessed March 3, 2016). 

673 Hayward, T. Tony Hayward's speech at the 2008 Annual Genearl Meeting, Docklands, London, April 17, 2008; 

see Exhibit 6015, http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_AnthonyDepo_Bundle.zip (accessed 7 2015, October).

674 See BP Sustainability Reviews from 2008 – 2010 at http://www.bp.com/en/global/corporate/sustainability/aboutour-reporting/Sustainability-report/sustainability-report-archive.html (accessed March 3, 2016). 

000867
Macondo Investigation Report Volume 3 4/17/2016

179 

Figure 4-2. OMS Rollout at BP, 2006-2009. 

BP’s guidance indicates that the OMS requirements would be applicable to contractor-owned rigs,675 but 

the “delivery of HSSE [health, safety, security and environment] would be accomplished through the 

drilling contractor’s Safety Management System (SMS).”676,677 Even though BP did not require 

 

675 For example, BP’s Gulf of Mexico SPU, Drilling and Completions OMS Implementation Terms of Reference

states that “OMS is not an option; it is a requirement ... OMS applies to all operations and premises, controlled or 

owned by BP and sites operated or controlled on BP’s behalf ... For GoM D&C this document serves to define 

the activities planned for 2009 to ensure clarity around how OMS will apply to both BP-owned and contractoroperated and contractor-owned and operated rigs and further how the organization is currently conforming to 

OMS expectations.” Internal company document, BP, Gulf of Mexico SPU Drilling and Completions OMS 

Implementation Terms of Reference, February 13, 2009, BP-HZN-2179MDL00369586, see Exhibit 0784 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Grounds_Cheryl-Depo_Bundle.zip

(accessed October 7, 2015). 

676 Hearing before the Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, June 29, 2011, see Mogford Designations Vol 2 pp 22 - 25, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Mogford_John-Depo_Bundle.zip (accessed 

October 7, 2015); Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, June 21, 2011, see Baxter Designations Vol 1 pp 26 - 27, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Baxter_John-Depo_Bundle.zip (accessed 

October 7, 2015).

677 Internal Company Document, BP. Gulf of Mexico SPU Drilling and Completions The Way We Work, 2200-T2-

PM-RP-000001, May 12, 2009, p 24, BP-HZN-2179MDL00394896, 

000868
Macondo Investigation Report Volume 3 4/17/2016

180 

Transocean to directly apply OMS in lieu of its own management system, OMS expressly applied to BP’s 

drilling projects with contracted rigs in the GoM in two key ways: 

1. OMS applied to BP’s well drilling planning and execution activities, “performed under the 

control or supervision of BP, or on behalf of BP”; and678 

2. BP’s Drilling and Well Operations Practice (DWOP) requires a well control bridging document; 

thus, BP’s GoM Drilling and Completion (D&C) procedures required that the parties execute a 

bridging document to align BP and the drilling contractors’ safety management system.679

Consequently, while contractors do not have to adopt OMS verbatim, its associated technical practices do 

apply to contracted wells like Macondo. Unfortunately, as indicated in Figure 4-2, OMS requirements 

were just starting for D&C during the initial Macondo planning stages and when the well was first 

drilled.

680 The CSB found no evidence that BP retroactively initiated OMS elements at Macondo that 

could have impacted risk management at the well. The following sub-sections describe those OMS 

examples. 

4.4.2 Macondo Risk Analysis Lacked BP ALARP Requirements

Before Macondo, BP did not apply the Baker and CSB process safety lessons learned that led it to adopt 

OMS. Rather, it employed the pre-Texas City “Beyond the Best (BtB) Common Process” for contracted 

rigs.681 BtB was a commercial risk management approach for D&C projects that “focused on improving 

drilling and completions efficiency.”682 BtB had a typical project management stage-gate approach that 

 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lacy_Kevin-Depo_Bundle.zip (accessed 

October 7, 2015).

678 Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, 

Section 1.3, p A-4, BP-HZN-BLY00034514, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 2015).

679 Internal Company Document, BP. Gulf of Mexico SPU Drilling and Completions The Way We Work, 2200-T2-

PM-RP-000001, May 12, 2009, p 24, BP-HZN-2179MDL00394896, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lacy_Kevin-Depo_Bundle.zip (accessed 

October 7, 2015).; Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, 

October 2008, Section 15.2.17, p B-10, BP-HZN-BLY00034545, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 2015).

680 Additionally, as communicated in a CSB interview, “we [D&C] had just started this year [2010] with [OMS]. 

And we were in the process of rolling it out to the organization.”

681 Beyond the Best was developed in 2001 and was described as having “passed the test of time,” Internal Company 

Document, BP. Exploration and Production, Drilling and Completions, Beyond the Best Common Process, June 

2008, p 2, BP-HZN-2179MDL00333309, see Exhibit 6066 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_Anthony-Depo_Bundle.zip

(accessed October 7, 2015).; Internal Company Document, BP. GoM Drilling and Completions; GoM D&C 

Operating Plan/Local OMS Manual, 2200-T2-DM-MA-0001, November 1, 2009, p 22, BP-HZN-MBI00193469, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-06065.pdf (accessed October 7, 

2015).

682 Internal Company Document, BP. Exploration and Production, Drilling and Completions, Beyond the Best 

Common Process, June 2008, p 7, BP-HZN-2179MDL00333314, see Exhibit 6066 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_Anthony-Depo_Bundle.zip 

(accessed October 7, 2015).

000869
Macondo Investigation Report Volume 3 4/17/2016

181 

defined risk not in terms of process safety, but as “uncertain future events” which could have “an impact 

on the delivery of well objectives.”683 The outputs of the process were to be recorded in a risk register

where impact types could be categorized under safety and environment, but other commercial impact 

types were listed as well, such as cost and schedule.684 

The November 2009 version of the GoM Drilling and Completions Local OMS Manual recognized that 

the BtB risk management approach needed to align with OMS.

685 While BtB listed commercial impacts, 

BP’s Group Defined Practice (GDP) for Assessment, Prioritization and Management of Risk, GDP 3.1 – 

0001, issued in 2008, focused specifically on “Health, Safety, Security and Environmental (HSSE) and 

operating risks in projects.”686 The Group practice emphasized the implementation of risk reduction 

action plans with deliverables and timelines for completion. It recommended the hierarchy of controls to 

assess the effectiveness of risk reduction measures and referenced BP’s Layers of Protection Analysis 

practice as a tool.687 Post-incident, the former D&C Vice President and a senior process safety engineer 

acknowledged the BtB approach did not meet the requirements of examining the HSSE impacts in Group 

Defined Practice 3.1 and that the BtB risk register provided “limited direction.”688 

BP D&C was moving to the consistent use of a tool that examined HSSE risk, but the required transition 

to the new BP Risk Assurance Tool (BP RAT), occurred for GoM D&C after developing the Macondo 

well risk register. Thus the BtB tool was used.689 Also the risk management practices for the GoM 

 

683 Ibid., p 54, BP-HZN-2179MDL00333361. 

684 Internal Company Document, BP. Risk Register and Action Tracking Sheet for E&P Projects (Macondo), Risk 

Rating Matrix: Type of Impact, p 12, see Exhibit 4189 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed 

October 7, 2015). 

685 Internal Company Document, BP. GoM Drilling and Completions; GoM D&C Operating Plan/Local OMS 

Manual, 2200-T2-DM-MA-0001, November 1, 2009, p 22, BP-HZN-MBI00193469, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-06065.pdf (accessed October 7, 

2015). 

686 Internal Company Document, BP. GDP 3.1-0001 Assessment, Prioritization and Management of Risk, October 

14, 2009, pp 6, 16-17, BP-HZN-2179MDL00998896, see Exhibit 8013 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Yilmaz_Barbara-Depo_Bundle.zip

(accessed October 7, 2015).

687 Ibid. 

688 Hearing before the Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, May 4, 2011 pp 109-112, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Grounds_Cheryl-Depo_Bundle.zip

(accessed October 7, 2015).; Hearing before the Hearing before the U.S. District Court for the Eastern District of 

Louisiana under the Multi-District Litigation docket MDL No. 2179, April 17, 2013 pp 9305-9307, 

http://www.mdl2179trialdocs.com/releases/release201303141200012/O'Bryan_Patrick-Depo_Bundle.zip

(accessed October 7, 2015).

689 Hearing before the Hearing before the U.S. District Court for the Eastern District of Louisiana under the MultiDistrict Litigation docket MDL No. 2179, April 17, 2013 p 9306, 

http://www.mdl2179trialdocs.com/releases/release201303141200012/O'Bryan_Patrick-Depo_Bundle.zip

(accessed October 7, 2015).

000870
Macondo Investigation Report Volume 3 4/17/2016

182 

Strategic Performance Unit (SPU)690 were not scheduled to align with GDP 3.1-0001 until June 2010, 

after the Macondo accident.691 

When BP developed the Macondo risk register, its GoM D&C draft Risk Management Plan noted that 

using the BtB risk tool was a fragmented approach lacking consistency.692 The draft plan found 

significant issues with D&C’s use of BtB, including lack of a single point of accountability, no clear roles 

and responsibilities, and little understanding of what OMS entails and how it impacts the risk 

management process.693 The draft plan also noted that aggregating risks was difficult, a finding that 

would affect efforts to identify companywide process safety indicators (see Chapter 3.0).694 Similar to the 

lack of HSSE impacts listed in the Macondo risk register, the draft plan found in many cases that “major 

hazard and accident risks are not included in register and subsequently not addressed as expected.”695

Despite these findings, the Macondo risk register completed later that month was not reviewed or revised 

to address HSSE risk consistent with GDP 3.1-0001. 

The outputs of the risk register for the Macondo well were used to create a risk rating matrix. BP 

determined in the Macondo risk matrix that the impact of an uncontrolled well control event—just 

considering cost—would be “medium,”696 judged to be $1-3 million based upon the team’s subjective 

evaluation that comparable events were within their direct experience.697 However, the case was not a 

well control event involving a kick and blowout, but rather a lost wellbore due to an unspecified problem 

within the well, presumably due to stuck pipe or lost circulation; in fact, both did occur earlier in the 

Macondo well.

698 The risk register also listed PP/FG (pore pressure/fracture gradient) uncertainty as a 

 

690 BP divided its operating segments such as exploration and production into regional Strategic Performance Units 

or SPUs. The drilling of the Macondo well was conduct in BP’s Gulf of Mexico.

691 Internal Company Document, BP. Gulf of Mexico SPU, Operating Plan (OMS Handbook), Revision 1, 2000-T2-

OP-PL-0001, March 1, 2010, p 13, BP-HZN-2179MDL01160046, see Exhibit 3893 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Armstrong_Ellis-Depo_Bundle.zip

(accessed October 7, 2015).

692 The draft plan was based on interviews with D&C team leads and personnel responsible for managing risk; 

Internal Company Document, BP. Gulf of Mexico SPU; GoM D&C; Risk Management Plan; Assessment, 

Recommendations and Implementation Plan, Revision B, 2200-T2-PM-RP-000000, January 1, 2010, p 6, BPHZN-2179MDL01793825, see Exhibit 4165 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed 

October 7, 2015). 

693 Internal Company Document, BP. Gulf of Mexico SPU; GoM D&C; Risk Management Plan; Assessment, 

Recommendations and Implementation Plan, Revision B, 2200-T2-PM-RP-000000, January 1, 2010, pp 6-9, BPHZN-2179MDL01793825-28, see Exhibit 4165 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed 

October 7, 2015). 

694 Ibid., p 7, BP-HZN-2179MDL01793826. 

695 Ibid., p 7, BP-HZN-2179MDL01793826. 

696 Ibid., p 7, BP-HZN-2179MDL01793826. 

697 Ibid., p 7, BP-HZN-2179MDL01793826. 

698 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Chief Counsel's Report: The 

Gulf Oil Disaster; Feburary 17, 2011; p 59.

000871
Macondo Investigation Report Volume 3 4/17/2016

183 

risk, implying a possible kick,699 but one that would be controllable and therefore a “medium” risk for 

cost.

BP used an ALARP tool in the risk matrix to determine the need for risk reduction. For the moderate 

category, risk reduction was required only “where cost beneficial.”700 On that basis, BP accepted the well 

control risk for the Macondo project and proposed no additional actions. BP’s approach minimized the 

risk of an uncontrolled kick or blowout. Ultimately, there was no evaluation of barriers and their 

effectiveness to prevent or mitigate such events. Despite BP’s ALARP requirements, no documentation 

shows that BP performed any analysis that well control safeguards were effective and that safety risk was 

driven to as low as reasonably practicable.

BP had not yet applied its own OMS framework to its deepwater operations in the geologically difficult 

Gulf of Mexico, a clear example of failure to implement ALARP even to the risk level of its own safety 

standards. 

4.4.3 BP’s Major Accident Risk (MAR) Process was not Implemented 

BP determined that traditional strategies for managing risk did not adequately address high consequencelow frequency events, so it developed the MAR Process. Acknowledging resources to reduce risk are 

finite, the MAR process requires the company to prioritize efforts to continually drive down risk of 

accidents.701 The method for an MAR study starts by identifying and quantifying the likelihood of 

potential major accident events and their consequences.702 The MAR Process allows for risk assessment

across a group of multiple facilities.

703 For offshore operations, this includes risk scenarios like riser 

unloading events and blowouts.704 The goal of the MAR study is to evaluate preventive and mitigative

controls, and show that MAR is “on a steady decline.”705 Ultimately, the leader of each BP Operation, 

such as D&C, is accountable for ensuring a MAR study is completed, reviewed, and the results 

communicated to the appropriate level.706

 

699 See Volume 1, Section 2.1 for discussion of pore pressure/fracture gradient.

700 Internal Company Document, BP. Gulf of Mexico SPU; GoM D&C; Risk Management Plan; Assessment, 

Recommendations and Implementation Plan, Revision B, 2200-T2-PM-RP-000000, January 1, 2010, p 7, BPHZN-2179MDL01793826, see Exhibit 4165 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed 

October 7, 2015). 

701 Internal Company Document, BP. BP Group Engineering Technical Practices, Major Accident Risk (MAR) 

Process, GP 48-50, June 5, 2008, pp 9-10, BP-HZN-2179MDL00407945-46, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-01734.pdf (accessed May 22, 2015).

702 Ibid,, p 13, BP-HZN-2179MDL004074949. 

703 Ibid., p 17, BP-HZN-2179MDL004074953.

704 Ibid., p 24, BP-HZN-2179MDL00407960. 

705 Ibid, p 55, BP-HZN-2179MDL00407991. 

706 Ibid., p 12, BP-HZN-2179MDL00407948. 

000872
Macondo Investigation Report Volume 3 4/17/2016

184 

The MAR Process applied to contractors and required that an MAR study be conducted with the 

cooperation of the contractor.707 In January 2010, BP identified loss of well control, specifically 

blowouts, as one of the two highest MAR risks for D&C in the GoM and BP.708 While BP included 

Transocean’s Deepwater Horizon in the “high risk” category as part of its MAR review,709 BP did not 

apply the MAR process or perform an MAR study with the Deepwater Horizon or other contracted 

rigs.710 This inaction disregarded the fact that contracted rigs represented the greater percentage of BP’s 

well blowout risk (see Call-out Box). As a result, BP used the MAR approach to identify actions plans 

that included developing barrier effectiveness tools and identifying controls and recovery measures to 

prevent and respond to loss of well control events; however, these action plans only applied to BP-owned 

drilling rigs. 

If BP had worked with Transocean to develop an MAR study, it could have examined a Transocean 2009 

report that expressed riser unloading events as “the biggest concern” when identifying areas for 

improvement.711 Transocean experienced six such events in the previous year.712 Transocean’s report 

recommended preventing the riser unloading events by “treating every positive indicator as a kick, [and] 

shutting in the well quickly.”713 BP and Transocean could have used that analysis to improve well control 

planning, training, and response practices and continually reduce risk of a Macondo-type event. 

 

707 Internal Company Document, BP. BP Group Engineering Technical Practices, Major Accident Risk (MAR) 

Process, GP 48-50, June 5, 2008, p 9, BP-HZN-2179MDL00407945, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-01734.pdf (accessed May 22, 2015).

The practice states, “If BP relies on a contractor to perform work that would be subject to GRP STD 01 if 

performed by BP employees ... BP shall, after an appropriate risk assessment, endeavor to conduct a MAR study 

with the cooperation of the contractor/third party.” The drilling and completions work would be subject to GRP 

STD 01 and OMS if performed by BP personnel so the MAR process should apply to contracted drilling rigs.

708 Internal Company Document, BP. BP Gulf of Mexico SPU Annual Engineering Plan, Rev 0, January 15, 2010, p 

27, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-02910_NATIVE.pdf (accessed 

May 22, 2015).

709 Ibid. 

710 Testimony given in the U. S. Districk Court for the Eastern District of Louisiana under the Multi-District 

Litigation docket MDL No. 2179, July 21, 2011 pp 20-21, see Jassal Designations (BP GoM SPU D&C Integrity 

Engineer and risk management specialist), 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed 

May 22, 2015).

711 Internal Company Document, Transocean. Annual Report - 2009 Well Control Events & Statistics 2005 to 2009, 

p 7, TRN-INV-00760060, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-05649.pdf

(accessed May 22, 2015).

712 Ibid. 

713 Ibid. 

000873
Macondo Investigation Report Volume 3 4/17/2016

185 

4.4.4 Absent Reporting Requirements 

BP’s October 2008 E&P OMS Drilling and Well Operations Practice (DWOP) applied to well drilling 

and completions, requiring the DWOP to “form part of the contractual relationship between BP and the 

Contracted Rigs Represented Major Portion of BP’s Drilling Operation Loss of Well Control and 

Blowout Risk

In March 2010, BP described itself as the largest oil and gas operator in the Gulf of Mexico, 

possessing approximately 30% of the total deepwater GoM production. a This included 8 platforms, 

which were BP assets, and 22 other producing fields for which BP held some financial interest. In 

early 2010, BP stated that in the Gulf of Mexico Thunder Horse was the only BP-owned drilling rig 

and that the remaining rigs were contracted mobile offshore drilling units (MODUs) operated by 

Transocean.b

 Worldwide, BP was the most significant client for Transocean based on operating 

revenue in 2008c

 and Transocean managed three-fourths of the global MODU drilling operations for 

BP.d

 

The BP GoM Drilling and Completion SPU maintained responsibility for two major accidents risks: 

loss of well control and loss of drilling riser.e BP recognized that “[b]oth risks represent major 

exposure to GoM SPU with a severity level of D and above.” Severity levels were measured in terms 

of health, safety and environment. A Level D event was at the low end of the impact scale representing 

a “very major health/safety incident” with the potential for 3 or more fatalities. Level A was the most 

severe representing an event “comparable to the most catastrophic health/safety incidents ever seen in 

industry” with the potential for 100 or more fatalities. Because both risks involved activities 

conducted by drilling contractors, Transocean’s GoM well drilling and completion activities 

represented a major percentage of BP’s risk in these areas.

a Internal Company Document, BP. Gulf of Mexico SPU, Operating Plan (OMS Handbook), Revision 1, 2000-T2-OP-PL0001, March 1, 2010, BP-HZN-2179MDL01160037, see Exhibit 3893 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Armstrong_Ellis-Depo_Bundle.zip (accessed 

October 7, 2015). 

b Internal Company Document, BP. BP Gulf of Mexico SPU, Annual Engineering Plan 2009, Revision 0, 2010-T2-PMPR-2009, January 15, 2010, BP-HZN-2179MDL02206804 to BP-HZN-2179MDL02206805, see Exhibit 4170 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed October 

7, 2015).

c Internal Company Document, BP. 

d Internal Company Document, BP, Memo from BP’s GoM Vice President of Drilling and Completion: Transocean 

Improvement Plan, January 23, 2008, BP-HZN-CEC055713, see Exhibit 7205 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Baxter_John-Depo_Bundle.zip (accessed October 7, 

2015).

e Internal Company Document, BP, Drilling & Completions Recommended Practice, 2200-T2-RM-DC-000000, January 

20, 2010, BP-HZN-2179MDL00332282, see Exhibit 1975 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip (accessed October 

7, 2015). 

000874
Macondo Investigation Report Volume 3 4/17/2016

186 

service providers.”714 The DWOP required that the contractor’s safety management system “incorporate 

or be supplemented to address the requirements of the OMS framework.”715 The purpose of DWOP was 

to support BP’s goal of “no accidents, no harm to people and no damage to the environment.”716 Since BP 

considered the DWOP critical for conformance with its OMS framework, all staff and contractors had to 

be knowledgeable in the DWOP.717 However, the 2008 DWOP training was not initially rolled out to 

BP’s own GoM Well Site Leaders until April 14-15, 2010, just a week prior to the well blowout.718

While BP applied the DWOP to the Macondo well, in part by MOCs where BP personnel sought 

deviations from the DWOP, the company did not implement key substantive provisions of the DWOP 

related to Macondo causal factors. DWOP well control practices require completion of a well control 

incident report in BP’s Tr@ction electronic incident reporting system.719 The BP OMS framework 

requires incident investigation reports to identify system-level causes and to establish safety improvement 

action items with specific due dates tracked to completion.

720 However, BP did not issue in Tr@ction an 

investigation report related to the March 8, 2010 well control incident (described in Section 2.3). Similar 

to the Macondo blowout, that incident also involved a delayed response to a well kick.721 Post-incident, a 

BP Macondo Well Site Leader indicated that the “incident was not recorded in Tr@ction, as this was not 

the normal process in the Deepwater GoM.” He further indicated he “did not know that reporting this type 

of an incident was a requirement of DWOP.”722

 

714 Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, pp A4, A-7, BP-HZN-BLY00034504, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX06121.pdf (accessed May 26, 2015).

715 Ibid., p A-7. 

716 Ibid., p A-1.

717 Ibid., 1, A-4. 

718 Internal Company Document, BP. BP Incident Investigation Team - Note of Interview with John Guide, July 1, 

2010, p 7, BP-HZN-BLY00124223, see Exhibit 0153 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Sepulvado_Murry-Depo_Bundle.zip 

(accessed October 7, 2015).

719 Internal Company Document, BP. GP 10-00 Drilling and Well Operations Practice, Issue 1, October 2008, 

Section 15.2.12, p B-10, BP-HZN-BLY00034545, 

http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed May 26, 2015).

720 Internal Company Document, BP. The BP Operating Management System Framework, Part 2, Elements of 

Operating including Group Essentials, Issue 2, November 3, 2008, Section 4.4, Incident Management, p 32, BPHZN-2179MDL00333255, http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX45002.pdf (accessed October 7, 2015).

721 BP Wells Team Leader for the Deepwater Horizon in his interview with the BP investigation team acknowledged 

that BP did not initiate a formal investigation of the March 8 incident that included a significant delay in well kick 

response for 35-40 minutes. Internal Company Document, BP. BP Incident Investigation Team - Note of Interview 

with John Guide, July 1, 2010, p 12, BP-HZN-BLY00124228, see Exhibit 0153 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Sepulvado_Murry-Depo_Bundle.zip

(accessed October 7, 2015).

722 Internal Company Document, BP. BP Incident Investigation Team - Note of Interview with John Guide, July 1, 

2010, p 12, BP-HZN-BLY00124228, see Exhibit 0153 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Sepulvado_Murry-Depo_Bundle.zip

(accessed October 7, 2015). 

000875
Macondo Investigation Report Volume 3 4/17/2016

187 

4.4.5 BP did not implement OMS-required Application to Contracted Rigs 

through Contracts and Bridging Documents

BP’s Group OMS emphasized that OMS was “relevant to all projects as well as facilities, sites and 

operations” and included provisions on its application to contractors.723 BP identified that OMS: 

shall as needed, include and apply contract provisions such that the work is carried out in a way 

that supports and is consistent with BP’s application of OMS to BP’s Operating activities. Where 

such contract provisions are not included in an existing contract, BP shall endeavor to amend the 

contract as needed, immediately or on renewal. 

BP, however, did not amend its Deepwater Horizon contract with Transocean to ensure every drilling 

activity “supports and is consistent with” OMS. BP did not implement OMS provisions when it amended 

health and safety requirements in Deepwater Horizon contract on September 28, 2009.724 In fact, the 2009 

Amendment 38 included new safety management provisions introducing the outdated GHSER safety 

program.725 Elsewhere, BP developed HSSE contract provisions for offshore drilling units that included 

OMS requirements;

726 however, it did not apply these provisions to the Deepwater Horizon contract. The 

2009 amendment had no references to OMS, the DWOP, or other BP post-Texas City engineering 

technical practices. The contract did contain some process safety requirements described as “minimum 

conditions” attached as an Exhibit D, including the use of ALARP, the hierarchy of controls, risk 

assessment tools such as HAZID and HAZOP, and Major Accident Hazard Identification and 

Assessment. However, the listed requirements were not scheduled to apply until the renewal date of 

September 18, 2010, about five months after the Macondo incident.727 

BP and Transocean each had their own safety management systems, but they agreed that Transocean’s 

safety management systems would govern well drilling operations on the DWH, as supplemented by BP 

through a bridging document.728 Transocean’s Quality, Health, Safety, and Environment manager for 

North America asserted that a bridging document should provide “primacy” for operators and drillers in 

 

723 Internal Company Document, BP. The BP Operating Management System Framework, Part 4, OMS Governance 

and Implementation, Issue 2, November 3, 2008, Section 4, Applicability and Deviation Requirements, p 7, BPHZN-2179MDL00333144, see Exhibit 2352 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lynch_Richard-Depo_Bundle.zip (accessed 

October 7, 2015).

724 Internal Company Document, BP. Amendment No. 38 to Drilling Contract No. 980249, September 28, 2009, see 

Exhibit 1488, BP-HZN-CEC041519, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_Anthony-Depo_Bundle.zip

(accessed October 7, 2015). 

725 Ibid., BP-HZN-CEC041493 and BP-HZN-CEC041513. 

726 Internal Company Document, BP.

727 Internal Company Document, BP. Amendment No. 38 to Drilling Contract No. 980249, September 28, 2009, see 

Exhibit 1488, BP-HZN-CEC041519, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Hayward_Anthony-Depo_Bundle.zip

(accessed October 7, 2015).

728 Internal Company Document, BP/Transocean. Drilling Contract RBS-8D Semisubmersible Drilling Unit, 

Contract No. 980249, December 9, 1998, Section 3.0: Compatibility of HSE Management Systems, BP-HZNMB100021887-8, http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-004271.pdf

(accessed October 7, 2015). 

000876
Macondo Investigation Report Volume 3 4/17/2016

188 

determining which aspects of each companies’ safety management systems would govern.729 He stated, 

“[B]oth Transocean and BP have safety management systems. And we can’t run both systems onboard 

one vessel. So in general terms, one would have to be selected over another. And there are times when 

one group’s management system supersedes that of another and that would be clarified if it were the 

agreed wish of both parties use one management system . . . day-to-day. But [if] there is an issue or two 

that the other system was desired to be used, you could express those wishes in a bridging document.”730

For Macondo, the two companies created a five-page bridging document signed by senior managers from 

each organization. It sought to address gaps between BP’s and Transocean’s safety management systems. 

Ultimately, the resulting bridging document was only envisioned for personal safety issues without 

mention of process safety items, such as the TSTPs or SIDs (discussed in Section 1.8) or other measures 

aimed at major accident prevention.

731 For example, the heart of the bridging document, the HSE 

Management Systems Table, referenced only six issues, five of which focused on personal safety: 

• Fall Protection 

• Personal Protective Equipment 

• Travel 

• General Safe Work Practices 

• Incident Reporting 

• Dive Operations 

 

729 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, March 24, 2011 pp 177-178, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Canducci_Gerald-Depo_Bundle.zip

(accessed October 7, 2015).

730 Ibid., p 178. 

731 BP’s GoM SPU Drilling and Completions The Way We Work well project management guidance states that the 

GoM SPU “Safe Practices Manual” (SPM) would be bridged to the contractor’s safety management systems. BP 

described the SPM as containing “BP-approved standards for personal safety, MOC and industrial hygiene,” but 

the pre-Texas City manual first issued in 2002 contained little mention of process safety and no reference to the 

OMS framework. Internal Company Document, BP. Gulf of Mexico SPU Drilling and Completions The Way We 

Work, 2200-T2-PM-RP-000001, May 12, 2009, p 27, BP-HZN-2179MDL00394922, see Exhibit 0760 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lacy_Kevin-Depo_Bundle.zip (accessed 

October 7, 2015).

000877
Macondo Investigation Report Volume 3 4/17/2016

189 

The fifth issue, incident reporting, can cover both 

personal and process safety issues, but its utility 

depends largely upon what the receiver of that 

information does with the incident report (e.g., 

whether the information reported was used for 

learning and continual improvement or simply 

tallied and reported). 

Nothing in the bridging document distinguished 

process safety or MAP.

732

The bridging document notes some minimal process 

safety-type concepts in a section “Additional BP 

Requirements.” For example, the General Safety 

Work Practices had an additional requirement to 

conduct an MOC for any worker asked to work in 

excess of 28 continuous days within a 42-day 

period. Another addition, under Incident Reporting, 

required “All Serious Incidents (HIPO, DAFWC, 

Medical Treatment and Restricted Work) will be 

investigated and led by Transocean and supported 

by BP to identify root cause and corrective actions 

within 30 day time frame set forth in BP reporting 

guidelines.” But other than the HIPO category, 

these serious incidents typically capture personal 

safety events. All other additional BP requirements 

more plainly focused on personal safety (e.g., 

secondary fall protection requirements, respiratory 

protection program requirements, life vests, etc.). 

The bridging document also included a commitment 

to form an “HSE Steering Team” of representatives 

from both companies, with specific reference to the 

positions required for participation. They would 

meet quarterly to resolve “gaps across the different business units in the GoM operating area” to “review 

 

732 Even Section 4.0 of the bridging document itself, entitled “Revision Log,” confirms that the four documented 

updates to the bridging document focused on personal safety, with attention paid to items such as fall protection, 

scaffolding, electrical safety and hazardous materials, or rudimentary administrative matters such as a change in 

document custodian. Internal Company Document, BP/Transocean. BP Gulf of Mexico Transocean Offshore 

Deepwater Drilling Inc. North America HSE Management System Bridging Document, September 8, 2008, see 

Exhibit 0948, p 5, BP-HZN-BLY00076264, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Canducci_Gerald-Depo_Bundle.zip

(accessed October 7, 2015).

API Bulletin 97,† Well Interface Control 

Document Guidelines seek to help 

address deficiencies in the bridging 

process between leaseholders and drilling 

contractors. Included in the Bulletin are 

recommendations about what type of 

information should be shared between the 

leaseholder and the drilling contractor 

regarding well construction and rigspecific operating guidelines. The Bulletin 

intends to align the leaseholder’s safety 

and environmental management system 

(SEMS) with the drilling contractor’s safe 

work practices. Covered in this guidance 

is a recommended full informational 

exchange, along with other opportunities 

for alignment between the parties—a step 

forward compared to what occurred 

during the bridging process between BP 

and Transocean prior to drilling 

Macondo. However, API 97 is a Bulletin 

and not a recommended practice, and the 

language used in the Bulletin is permissive 

with the pervasive use of “should” 

denoting that its recommendations are at 

the discretion of the company.

†

American Petroleum Institute (API) Bulletin 97, Well 

Construction Interface Document Guidelines, First 

Edition, (November 2013), p. iii.

000878
Macondo Investigation Report Volume 3 4/17/2016

190 

and implement new programs” and to delete or change existing programs.733 However, the bridging 

document sets no dates for forming the HSE Steering Team and establishes no goals or objectives for 

reviewing safety surrounding well operations or making adjustments to anything as part of a continual 

improvement process. 

In the months leading to the Macondo blowout, BP became aware of bridging document problems. In 

February 2010, BP commissioned a work team to investigate the effectiveness of bridging documents 

used at contractor rigs.734 That team determined that most bridging documents were outdated or poorly 

understood and noted that many contractors’ supervisors had a poor understanding of their own safety 

management systems.735 

 

733 Internal Company Document, BP/Transocean. BP Gulf of Mexico Transocean Offshore Deepwater Drilling Inc. 

North America HSE Management System Bridging Document, September 8, 2008, see Exhibit 0948, p 3, BPHZN-BLY00076262, http://www.mdl2179trialdocs.com/releases/release201302281700004/Canducci_GeraldDepo_Bundle.zip (accessed October 7, 2015).

734 Hearing before the U.S. District Court for the Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, July 27, 2011 p 75, see Yilmaz Designations Vol 2 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Yilmaz_Barbara-Depo_Bundle.zip 

(accessed October 7, 2015). 

735 Internal Company Document, BP. Improving Control of Work within Drilling & Completions, Feburary 2010, 

slide 6, BP-HZN-MBI00109889, see Exhibit 0951 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Yilmaz_Barbara-Depo_Bundle.zip 

(accessed October 7, 2015). 

Multinational Audit of Safety Management Systems

The Macondo blowout prompted numerous international responses, including a multinational audit in 

the North Sea in 2012/2013 to assess the incorporation of organizational factors into operator and 

drilling contractor safety management systems.a A major conclusion from the audit was the lack of 

role clarity in bridging documents intended to identify and address potential gaps between the 

operator and drilling contractor’s safety management systems. The audit team found:

• The quality and content of the companies’ bridging documents varied; 

• Individuals directly affected by the bridging documents insufficiently verified their content; 

and 

• Client auditing of the drilling contractor’s safety management system was either nonexistent 

or focused upon equipment. 

The multinational audit focused on systems and standards, such as those found in well control 

manuals, and the audit’s findings are similar to ones presented in this report. 

a North Sea Offshore Authorities Forum (NSOAF). Multi-National Audit Human and Organisational Factors in Well 

Control 2012-2013; http://www.hse.gov.uk/offshore/nsoaf.pdf (accessed May 2016, 2015). Eleven audits of jack-up and 

semi-submersible rigs were completed in Netherlands, Denmark, Germany, Norway, and the UK during 2012/2013.

000879
Macondo Investigation Report Volume 3 4/17/2016

191 

4.5 BP Did Not Pursue Its 2008 Initiative to Engage GoM D&C 

Contractors in Risk and Barrier Management 

In May 2008, BP’s GoM Drilling and Completions (D&C) Leadership Group met with a new D&C Vice 

President to emphasize the importance of process safety and contractor engagement in preventing major 

accidents such as well blowouts. The intent of the meeting was to emphasize that deepwater drilling has 

special challenges that include reliance on manual crew intervention to prevent a major accident and 

contractor engagement for risk management.

736 

A BP presentation at the meeting, Major Accident and Risk Management, was prompted by findings and 

major themes expressed in the Baker Panel Report and recent major BP incidents, including:737

1. the importance of process safety culture that continually reduces risk; 

2. defined expectations and accountability; and 

3. the effective use of leading and lagging indicators. 

The presentation identified that the scope of BP’s risk management policy included major drilling projects 

where BP was the operator. The objectives included assessing and reducing risk through prevention and 

control measures using the Major Accident Risk Process with defined key management and engineering 

accountabilities.738 Tools included risk registers and process safety ETPs such as HAZOP and LOPA. 

Key to the presentation was the use of bowtie diagrams with identified independent barriers and controls 

and the maintenance of safety critical systems. The presentation identified top GoM Strategic 

Performance Unit (SPU) and D&C risks as safety, environmental, or reputational, with a focus on BP 

assets.

In response to the question about who is responsible for managing the risk, the leadership presentation 

answered, “Ultimately it is the BP Wells Team.”739 Another important question addressed was “How do 

we engage contractors to manage risk?”

The implication was that nearly two years before Macondo, the “Major Accident and Risk Management” 

presentation provided a structured, robust proposal for strengthening the engagement with contractors to 

manage risk. The presentation proposed reviewing with contractors existing bowties to identify additional 

hazards, causes, and barriers. It recommended updating bowties, MAR registers, and risk mitigation plans 

 

736 Internal Company Document, BP. GOM-D&C Major Hazard and Risk Management Leadership Action, 2008, 

Slide 3, see Exhibit 2952 http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_KalwantDepo_Bundle.zip (accessed October 7, 2015). 

737 Ibid., Slide 6. 

738 Internal Company Document, BP. GOM-D&C Major Hazard and Risk Management Leadership Action, 2008, 

Slide 23, see Exhibit 2952 http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_KalwantDepo_Bundle.zip (accessed October 7, 2015).; BP’s Major Accident Risk Process, GP 48-50, was an ETP 

approved for implementation across the BP Group; Internal Company Document, BP. GP 48-50 Major Accident 

Risk (MAR) Process, June 5, 2008, BP-HZN-2179MDL00407937, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/TREX-01734.pdf (accessed October 7, 

2015).

739 Internal Company Document, BP. GOM-D&C Major Hazard and Risk Management Leadership Action, 2008, 

Slide 19, see Exhibit 2952 http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_KalwantDepo_Bundle.zip (accessed October 7, 2015).

000880
Macondo Investigation Report Volume 3 4/17/2016

192 

with contractors as well as agreeing on the use of tools such as the BP risk register and the HAZID 

analysis.740 The presentation emphasized the need to agree on risk management roles and responsibilities. 

Two types of barriers were identified: those BP directly and indirectly controlled under a contract and 

those the contractor controlled. The presentation noted the importance of potentially modifying existing 

agreements with contractors to assure conformance with the safety requirements. The path forward with 

contractor engagement was to “review risks and determine if there are any additional risks, barriers, 

mitigations ... update register and bowties accordingly.”741 A responsibility matrix was presented for risk 

tasks, deliverables, and the role of the BP Wells Team and contractor (see Figure 4-3). The process 

intended to identify which barriers and controls BP and the contractor would manage and to demonstrate 

how they managed them. 

The promise of the more robust approach presented at the Leadership Action presentation was not 

fulfilled. In the same month as the D&C Leadership Group presentation, BP personnel proposed a work 

plan for future risk assessment activities, use of risk tools, and contractor engagement,

742 but little 

evidence exists that BP pursued the path forward for contractor engagement presented to BP’s D&C 

Leadership Team.

743,744 In fact, the use of bowties in the BP organization itself was not officially rolled 

out until January 2010,745 and no document shows that either BP or Transocean used bowties or allocated 

barrier responsibility for risk management or communication at the Macondo well. 

 

740 Internal Company Document, BP. GOM-D&C Major Hazard and Risk Management Leadership Action, 2008, 

Slide 52, see Exhibit 2952 http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_KalwantDepo_Bundle.zip (accessed October 7, 2015). 

741 Ibid., Slide 57. 

742 Email from Engineering Manager, BP, to Drilling Engineering Team Leader, BP, Subject: IM Bowties - Let's try 

and simplify, May 22, 2008, BP-HZN-2179MDL01002350, see Exhibit 4187 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip 

(accessed October 7, 2015). 

743 Hearing before the U. S. Districk Court for hte Eastern District of Louisiana under the Multi-District Litigation 

docket MDL No. 2179, July 21, 2011 pp 77-79, see Jassal Designations (BP GoM SPU D&C Integrity Engineer 

and Risk Management Specialist) 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Jassal_Kalwant-Depo_Bundle.zip 

(accessed May 22, 2015). 

744 Ibid., pp 78-79. 

745 Ibid., p 79.

000881
Macondo Investigation Report Volume 3 4/17/2016

193 

Figure 4-3. May 2008 BP D&C Teams and Contractor Engagement from the Major Hazard and Risk 

Management Presentation to the D&C Leadership group. The presentation, two years before the Macondo 

incident, envisioned a detailed allocation of risk and barrier management responsibilities between BP and 

the contractor. BP did not implement the responsibility matrix approach. 

4.6 Conclusion 

Both this chapter and Section 1.8 demonstrate that BP and Transocean detailed daily operational tools and 

overarching corporate policies regarding how to handle major accident risk in a number of key areas 

during drilling operations. Also, internal BP and Transocean policies required risks to be reduced to an 

ALARP level. Unfortunately, these policies did not translate to practices at Macondo despite the bridging 

process intended to clarify safety roles and responsibilities while identifying potential gaps in the 

operative safety management systems. Instead, personal safety considerations predominated over process 

safety and major accident prevention, and the bridging document failed to look ahead in a meaningful 

way toward major accident prevention. 

000882
Macondo Investigation Report Volume 3 4/17/2016

194 

A fundamental question emerges: How in the United States can BP, Transocean, or any company 

operating in the areas subject to BSEE jurisdiction be required to implement effective risk management 

practices? Volume 4 addresses this question in depth, but the basic answer is to enact regulatory 

requirements for more robust risk management approaches, including demonstrated risk reduction to 

ALARP and explicit safety accountability by all parties creating the risk. 

In the US, both the leaseholder/operator and the drilling contractor have well control responsibilities 

under offshore regulations.

746 But before the Macondo incident, the leaseholder/operator was held as the 

primary entity responsible for the safe conduct of offshore exploration and production in the US GoM. 

There was little, if any, history of citations against offshore contractors despite their legal responsibility

for well control actions.747

As Volume 4 details, post-Macondo, contractors such as Transocean and Halliburton were cited for a 

number of safety violations, and BSEE, the offshore regulator, asserted that drilling contractors and other 

well service providers can be cited for future safety violations.748 However, the key federal offshore 

safety regulations—the Safety and Environmental Management Systems (SEMS) Rule749 issued in the 

wake of the Macondo incident—does not directly apply to contractors, does not have a requirement for 

demonstrated risk reduction to an ALARP level (or similar), and does not clarify major hazard roles and 

responsibilities of the operators and drilling contractors when it comes to design and operational risk. 

 

746 This was true at the time of Macondo and present day, 30 C.F.R. § 250.400, 401.

747 BSEE. Inspection and Enforcement: Incidents of Noncompliance, http://www.bsee.gov/Inspection-andEnforcement/Enforcement-Programs/Incidents-of-Non-Compliance/ (accessed October 7, 2015). 

748 Notification of Incident(s) of Noncompliance, with respect to offshore operations in the Gulf of Mexico, off the 

coast of Louisiana. 00071 IBLA 2013-137 (District Supervisor, District Office, Bureau of Safety and 

Environmental Enforcement September 25, 2015).

749 30 C.F.R. § 250 Subpart S (2011).

000883
Macondo Investigation Report Volume 3 4/17/2016

195 

5.0 Corporate Governance, the Influence of Shareholders 

and Public Disclosure of Process Safety Information 

The importance of a corporation’s board of directors cannot 

be overstated, especially when the corporation is involved in a 

high-hazard industry such as offshore drilling. The BP and 

Transocean boards of directors demonstrated varying levels of 

effectiveness in efforts aimed at helping their respective 

companies avoid a catastrophic event like the Macondo 

blowout. Despite efforts to manage process safety and major 

accident risk, the two companies’ boards adopted governance 

approaches that emphasized personal safety and commercial 

risk without assuring process safety and major accident 

prevention. In part, these approaches are illustrated through a 

study of shareholder communications, required US Securities 

and Exchange Commission (SEC) 750 reporting, and other 

public information released by both companies. Some 

elements of this analysis are further explored in other chapters 

of Volume 3, including Chapter 2 (Organizational Learning), 

Chapter 3 (Indicators), Chapter 4 (Risk Management), and 

Chapter 6 (Safety Culture). This chapter primarily explores 

publicly available records and compares BP and Transocean’s corporate governance approaches with best 

practices in other international jurisdictions with active offshore drilling, illustrating broader offshore 

sector issues concerning corporate governance and securities disclosures that merit further discussion and 

improvements. 

As Macondo made clear, major accident events (MAEs) can interfere with drilling operations and 

production, damage reputation, and cause significant financial distress for a company with predictable, 

negative outcomes.751 Consequently, corporate boards of directors must act vigilantly in preventing 

MAEs from their position as the highest echelon of leadership within the company. It is in shareholders’ 

best interests to understand the relevant information needed to assess the companies in which they invest, 

and to benchmark the process safety performance of such companies. In doing so, shareholders would be 

positioned to better understand and question companies’ business decisions. They can both directly and 

indirectly help to ensure or improve process safety and major accident prevention efforts of companies 

engaged in offshore drilling and production. Thus, enhanced reporting not only benefits shareholders, but 

all stakeholders, including workers, the public, and the environment. 

 

750 The SEC is a Federal agency whose mission is “to protect investors, maintain fair, orderly, and efficient markets, 

and facilitate capital formation.” http://www.sec.gov/about/whatwedo.shtml (accessed October 7, 2015).

751 For example, reduction or elimination of dividend payments, inability to expand or otherwise initiate new profitmaking activities, necessity of selling productive assets to raise cash for risk contingencies and potential 

liabilities, decrease in share price. 

Chapter 5.0 Overview 

This chapter examines the corporate 

governance approaches by both BP 

and Transocean to demonstrate both 

companies’ efforts to manage 

personal safety and commercial risk 

without an equivalent focus on the 

effective management of barriers and 

safety management systems for 

preventing major accident events.

This chapter explores the influence of 

shareholders in managing process 

safety and advances in corporate 

governance in other international 

offshore regions. 

000884
Macondo Investigation Report Volume 3 4/17/2016

196 

This idea is especially important for a company like BP, which suffered several significant process safety 

incidents in a ten-year period including Grangemouth (2000), BP Texas City (2005), BP Prudhoe Bay 

(2006), and Macondo (2010). This string of MAEs in such a short time and across different business 

segments within the company’s worldwide operations raises a question as to whether the BP board of 

directors is sufficiently engaged in process safety matters, and even whether there is a corporate “failure 

to learn.”752 This is especially true in the BP Texas City incident, investigated independently by the CSB, 

and by the company itself through the BP US Refineries Independent Safety Review, the Baker Panel, an 

independent panel which examined BP’s US refineries and the company’s safety culture. Both reports 

recommended that the BP board deepen its commitment to adopt process safety policies, take preventive

actions, and monitor indicators.753 Despite BP board governance improvements since BP Texas City, 

serious problems remain that leave the company vulnerable to a Macondo-type of event. 

For its own part, Transocean’s board exhibited some of the same flawed approaches as BP, but exhibited 

less of a willingness to engage in self-reflection and the desire to make significant improvements 

concerning responsibility for the incident. 

This chapter also explains that SEC reporting requirements for companies like BP and Transocean impede 

shareholder efforts to examine process safety matters related to major accident prevention which could 

impact the investment worthiness of companies working offshore. Inconsistent or even sometimes 

obscure information emerges from such companies, if at all, in a sometimes cumbersome or more 

generalized narrative style that avoids more straightforward inclusion of a full slate of health and safety 

metrics and other critical process data (e.g., leading and lagging process safety performance indicators) 

across the spectrum of corporate operations and related risk activities. To be clear, both BP and 

Transocean appeared to satisfy SEC requirements in their disclosures in shareholder communications, and 

in required reporting with the Commission. Therefore, this chapter more generally explores the 

information shareholders need to monitor the process safety performance of companies with MAE 

potential. BP and Transocean are referenced as salient examples to show the weakness of the US 

regulatory reporting scheme relating to the disclosure of material MAE risks offshore. 

Lastly, this chapter describes the relationship between the regulator and the board of directors both in the 

US and other international regulatory drilling regimes. Various offshore oil and gas regulatory regimes 

adopted proactive approaches using audits, investigations, published guidance, and training to influence 

industry at the board level, whereas BSEE’s mechanisms for change today are still primarily focused on 

the facility/site level through permit approvals, dispensations, inspections, compliance audits, accident 

investigations, and citations stemming from enforcement activities. As a result, BSEE now has an 

 

752 Hopkins A. Failure to Learn – The BP Texas City Refinery Disaster; CCH Australia Limited: 2009. See also 

Reed S. & Fitzgerald A. In Too Deep; John Wiley & Sons: 2011, p. 156 (“The lessons learned at Texas City and 

Prudhoe Bay apparently had not reached the Gulf of Mexico.”)

753 The Baker Panel. The Report of the BP US Refineries Independent Safety Review Panel; January, 2007; p xvi. 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015); USCSB, 2007. Refinery 

Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, Recommendations 2005-4I-TXR11 to 2005-4I-TX-R13, http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 7, 2015), 

March 2007.

000885
Macondo Investigation Report Volume 3 4/17/2016

197 

opportunity to work with industry more proactively to strengthen the role of boards of directors and to 

improve corporate governance for publicly traded companies at work in US waters. 

5.1 Boards of Directors and Shareholders

5.1.1 What is Corporate Governance?

Corporate governance is broadly defined as "the system by which companies are directed and 

controlled," or "the whole set of legal, cultural, and institutional arrangements that determine what 

publicly traded corporations can do, who controls them, how that control is exercised, and how the risks 

and returns from the activities they undertake are allocated."754 Shareholders typically vote for individuals 

to serve on a corporation’s board of directors and expect them to serve as the highest echelon of an 

overall system of managerial activities as well as a means of checks and balances. Rooted in a series of 

fiduciary duties,755 once directors are in place, a board must act to protect the best interests of the 

company as a whole, ensuring its overall success. 

Historically, corporate boards have taken a hands-off approach to oversight. Chancellor of the Delaware 

Court of Chancery and judicial scholar on corporate governance William Allen explained: 

The conventional perception is that boards should select senior management, create incentive 

compensation schemes and then step back and watch the organization prosper. In addition, board 

members should be available to act as advisors to the CEO when called upon and they should be 

prepared to act during a crisis: an emergency succession problem, threatened insolvency or a 

management buy-out proposal, for example.756

Allen went on to challenge this view as inadequate, calling for boards of directors to play a more active 

role in ensuring the health of an organization: 

This view of the responsibilities of membership on the board of directors of a public company is, 

in my opinion, badly deficient. It ignores a most basic responsibility: the duty to monitor the 

 

754 Clarke, D. C. Nothing But Wind? The Past and Future of Comparative Corporate Governance; Am. J. Comp. L. 

2011, 75, p 59, citing The Committee on the Financial Aspects of Corporate Governance . The Financial Aspects 

of Corporate Governance; “the Cadbury Report,” 1992; 

http://www.icaew.com/~/media/corporate/files/library/subjects/corporate%20governance/financial%20aspects%2

0of%20corporate%20governance.ashx (accessed October 7, 2015). See generally: The Financial Reporting 

Council. The UK Approach to Corporate Governance; October, 2010; https://www.frc.org.uk/OurWork/Publications/Corporate-Governance/The-UK-Approach-to-Corporate-Governance.aspx (accessed October 

7, 2015).

755 “A fiduciary duty is a legal duty to act solely in another party's interests. Parties owing this duty are 

called fiduciaries. The individuals to whom they owe a duty are called principals ... A fiduciary duty is the 

strictest duty of care recognized by the US legal system. Examples of fiduciary relationships include those 

between a lawyer and her client, a guardian and her ward, and a director and her shareholders.” (emphasis added)

Legal Information Institute, Cornell University Law School, http://www.law.cornell.edu/wex/fiduciary_duty

(accessed October 7, 2015). 

756 Martin Lipton & Jay W. Lorsch, A Modest Proposal for Improved Corporate Governance, The Business Lawyer, 

Vol. 48 (November 1992) pp 61-62, citing Chancellor William T. Allen, Redefining the Role of Outside Directors 

in an Age of Global Competition, presented at Ray Garrett, Jr., Corporate and Securities Law Institute, 

Northwestern University, Chicago (April 1992).

000886
Macondo Investigation Report Volume 3 4/17/2016

198 

performance of senior management in an informed way. Outside directors should function as 

active monitors of corporate management, not just in crisis, but continually. They should have an 

active role in the formulation of the long-term strategic, financial, and organizational goals

of the corporation and should approve plans to achieve those goals. They should as well engage 

in the periodic review of short and long term performance according to plan and be prepared to 

press for correction when in their judgment there is need.757 

The “informed way” implies that if a company goal is to avoid major accident events, boards must be 

equipped with adequate and timely information to question and hold management accountable, or even to 

assert a course of correction when such challenge is needed. To perform this role, however, at least some 

number of board members must have adequate levels of relevant education, training, and professional 

experience to allow them to assess the sufficiency of the information they receive and to challenge 

executive management, if necessary. This especially applies to independent directors.758 In this role, 

boards as a whole, by committees or through individual directors playing specialized leadership roles, can 

help to shape corporate activity at the highest level (e.g., policies, communications, strategic goals and 

objectives, mergers and acquisitions, indicators, compensation and incentive pay programs). These 

decisions help to shape the corporation’s overall culture and the degree to which that culture is focused on 

safety and major accident prevention. (See Chapter 6.) 

5.1.2 The Role of Shareholders and their Influence on Corporate Governance

When shareholders become dissatisfied with corporate performance or governance, they can lobby for 

change either through direct dialogue with the board of directors, for instance, by speaking during open 

corporate meetings or filing formal shareholder proposals for shareholder vote.759 These activities, 

referred to as “shareholder activism,” can result in significant change, such as redirecting a company’s 

business strategy (e.g., financial restructuring, spin-offs, acquisitions, increasing dividends) or affecting 

the organization’s behavior as a corporate citizen (e.g., proposals concerning labor practices, political 

spending, lobbying, social issues, environmental issues).760 Activists are typically single minority 

 

757 Martin Lipton & Jay W. Lorsch, A Modest Proposal for Improved Corporate Governance, The Business Lawyer, 

Vol. 48 (November 1992) pp 61-62, citing Chancellor William T. Allen, Redefining the Role of Outside Directors 

In an Age of Global Competition, presented at Ray Garrett, Jr., Corporate and Securities Law Institute, 

Northwestern University, Chicago (April 1992).

758 In defining an independent (also called a non-executive) director, the NYSE notes: "no director qualifies as 

'independent' unless the board of directors affirmatively determines that the director has 'no material relationship' 

with the listed company, either directly or as a partner, shareholder or officer of an organization that has a 

relationship with the company," while the NASDAQ requires that an independent director “must not be an officer 

or employee of the company or its subsidiaries or any other individual having a relationship that, in the opinion of 

the company's board of directors, would interfere with the exercise of independent judgment in carrying out the 

responsibilities of a director.” See generally Larkin, G. Just What is an Independent Director Anyway? The 

Conference Board, September 10, 2010, available at http://tcbblogs.org/governance/2010/09/10/just-what-is-anindependent-director-anyway/.

759 Cossin, D.; Caballero, J. Shareholder Activism Background Literature Review; IMD Global Board Center: July, 

2013, pp 5-6.

760 PwC. Shareholder Activisim: Who, What , When and How?; March, 2015, p 2-4.

000887
Macondo Investigation Report Volume 3 4/17/2016

199 

investors with large block holdings in a company, or institutional investors with majority holdings,761

such as mutual, pension, or hedge funds. Labor unions and nonprofit organizations also engage in 

shareholder activism.762 Activism occurs because a public company is, after all, owned by its 

shareholders. Regardless of the size of holdings, shareholders are always free to sell their shares, and nonshareholders can refrain from purchasing shares. Such decisions to sell or to refrain from buying can 

effectively weaken companies that investors deem to be poor investment choices, decisions which can be 

prompted through informed decision-making relating to a company’s poor process safety practices or 

other insufficient efforts aimed at major accident prevention, among other issues. Thus, whether through 

activism or marketplace decisions to buy or sell, shareholders have demonstrated that they have influence. 

Scholars acknowledge this reality, and note that a number of such “social controls” can 

indirectly influence industrial safety performance, such as laws and norms for corporate 

governance that cause companies to inform shareholders and potential investors about corporate 

activities so they can make informed decisions about financial risks. If the activities are 

hazardous, these sources of financial support may need to be convinced that their financial risks 

are held to acceptable levels by evidence of effective safety management, which thereby makes it 

necessary for companies to develop and implement codes of conduct and safety management 

practices that adhere to industrial standards and comply with government regulations.

Similarly, corporate governance principles also establish management accountability to these 

financial stakeholders, and cause companies to take the pragmatic step of securing insurance 

coverage for losses and liabilities which could arise from accidents and other mishaps. This 

induces companies to maintain their safety performance at a level sufficient to convince insurers 

to provide sufficient coverage at affordable rates. Thus, “corporate governance is not only a legal 

concept but is also embedded in organizational theory.” It creates a linkage between financial risk 

and risks to health, safety, property and the environment and can be an important promoter of 

safety management.763

Numerous high profile organizations, including Yahoo, Staples-Office Depot, Target, and eBay have 

recently been affected by shareholder activist efforts.764 Currently, a number of active shareholder 

resolutions face several major US corporations that focus on issues such as climate change, energy, water 

scarcity, and sustainability reporting.765 

 

761 Cossin, D.; Caballero, J. Shareholder Activism Background Literature Review; IMD Global Board Center: July, 

2013, p 5.; PwC. Shareholder Activisim: Who, What , When and How? March, 2015, pp 2-4.

762 Cossin, D.; Caballero, J. Shareholder Activism Background Literature Review; IMD Global Board Center: July, 

2013, p 5.

763 Lindoe, P; Baram, M; Renn, O, Risk Governance of Offshore Oil and Gas Operations, Cambridge University 

Press, 2014; pp 36-37; citing OECD (2012) Corporate Governance for Process Safety. OECD: Paris; CERES; 

Swiss Re (2011) Operational Hazards in the Oil and Gas Industry. Zurich; and De Groot, C (2009), Corporate 

Governance as a Limited Legal Concept. Wolters Kluwer Law & Business: Amsterdam, p. 128.

764 Jay, M. Dow-DuPont-Activist Investors story. AP, December 14, 2015, http://finance.yahoo.com/news/agitatorsbehind-dow-dupont-yahoo-214607644.html (accessed December 16, 2015).

765 “Ceres tracks shareholder resolutions filed by our investor network participants on sustainability-related issues 

that companies are facing, focusing on climate change, energy, water scarcity, and sustainability reporting. These 

resolutions are part of broader investor efforts encouraging companies to address the full range of environmental, 

social and governance issues. The resolutions are filed by some of the nation’s largest public pension funds, 

foundations, and religious, labor and socially responsible investors. Many of the investors are members of Ceres’ 

000888
Macondo Investigation Report Volume 3 4/17/2016

200 

Recent examples of successful shareholder activism involve two chemical manufacturers (DuPont Co. 

and Dow Chemical Co.), and even BP itself. Dow and DuPont recently announced a merger of the two 

companies to create one new company worth more than $120 billion, after which, the company will split 

into three separate companies.766 The companies’ chief executives worked with activist investors, 

including the Trian Fund Management LP (Trian), to plan and execute the deal.767 As observed by Chris 

Davis, a lawyer who advises activists, “Seven months ago, DuPont had beaten Trian in a proxy fight, a 

victory some thought could mark a pushback on activism’s rise. Now, Trian looks vindicated. America’s 

corporate landscape is being permanently reshaped under the influence of two of its pre-eminent 

activists.”768 

In the case of BP, CCLA Investment Management formally led an effort to form a coalition of investor 

groups called “Aiming for A.” Their proposal, Strategic Resilience for 2035 and Beyond, sought to 

influence BP, as well as Dutch oil and gas major Royal Dutch Shell, to adopt a strategic approach to the 

challenges posed by climate change and the desire to lower carbon emissions. The coalition put forward 

this resolution “to address our interest in the longer term success of the Company, given the recognised 

risks and opportunities associated with climate change.”769 The shareholders requested annual reporting 

about “ongoing operational emissions management ... low-carbon energy research and development 

(R&D) and investment strategies; relevant strategic key performance indicators (KPIs) and executive 

incentives; and public policy positions relating to climate change.” BP’s board of directors supported the 

resolution, and after 98% in-favor vote, the resolution passed. One member group of the coalition, the 

Church of England, recently noted on its website that the positive reception offered by both BP and Shell 

in an area like this is “completely unprecedented,”770 while a spokesperson for another member of the 

coalition, the Chair of the Local Authority Pension Fund Forum said: "This development from BP is a 

clear example of the effectiveness of shareholder engagement backed by investor commitment ... taking 

an active approach to long-term risk, sustainability and carbon management issues has benefits both for 

our beneficiaries and for our underlying investments."771

These examples demonstrate the potential shareholder influence on a board of directors.

 

Investor Network on Climate Risk (INCR),” http://www.ceres.org/investor-network/resolutions (accessed 

December 17, 2015).

766 Benoit, D. Dow, DuPont Deal Cements Activists’ Rise. The Wall Street Journal, December 11, 2015, 

http://www.wsj.com/articles/dow-dupont-deal-cements-activists-rise-1449882586 (accessed December 16, 2015).

767 Ibid. 

768 Ibid. 

769 Ceres. Investor Network > Sharehodler Resolutions > BP Report Annually on Carbon Asset Risk Mitigation , 

http://www.ceres.org/investor-network/resolutions/bp-report-annually-on-carbon-asset-risk-mitigation (accessed 

December 17, 2015).

770 BP Board Advises Shareholders to Support Resolution on Climate Change at 2015 AGM, 

https://www.churchofengland.org/media-centre/news/2015/02/bp-board-advises-shareholders-to-supportresolution-on-climate-change-at-2015-agm.aspx (accessed March 2, 2016).

771 Ibid. 

000889
Macondo Investigation Report Volume 3 4/17/2016

201 

5.1.3 Corporate Governance Risk Management and Sustainability 

Informed oversight activities by a board of directors includes questioning management about significant 

risks challenging the company and its ongoing viability in worst-case scenarios. These concerns involve a 

concept of “corporate sustainability.” At its core, sustainability means that the corporation will remain 

viable and profitable for its shareholders while providing jobs for employees and products or services 

needed within the broader economy, but it is also inclusive of other factors reflective of a progressive 

society. For example, the “Dow Jones Sustainability Indexes (DJSI) defines corporate sustainability as ‘a 

business approach that creates long-term shareholder value by embracing opportunities and managing 

risks deriving from economic, environmental and social developments.’”772

Thus, sustainability can involve an assessment of how environmental stewardship and social policies 

affect long-term viability of the corporation as it aligns social and environmental demands with the need 

for profitability, products, and services, and the ability to provide healthy and safe jobs for employees.

At the macro level, risk assessment and management types of activity by boards of directors is termed 

enterprise risk management (ERM), the process by which a firm determines the major risks it faces and 

the risk management strategies it deploys to face those risks (e.g., acceptance, mitigation, transfer, 

elimination).773 ERM is undeniably a critical board function.

 

772 Center for Resilience, Ohio State University, available at http://www.resilience.osu.edu/CFRsite/resilienceandsustainability.htm (accessed on March 8, 2016).

773 According to the leading ERM framework, designed by the Committee of Sponsoring Organizations of the 

Treadway Commission (COSO), ERM “is a process, effected by an entity’s Board of Directors, management and 

other personnel, applied in strategy settings and across the enterprise, designed to identify potential events that 

may affect the entity, and manage those risks to be within its risk appetite, to provide reasonable assurance 

regarding the achievement of the entity objectives.” Committee of Sponsoring Organizations. Enterprise Risk 

Management – Integrated Framework, Executive Summary; September, 2004, p 2.

000890
Macondo Investigation Report Volume 3 4/17/2016

202 

The Committee of Sponsoring Organizations (COSO) asserts that boards of directors should: 

discuss with senior management the state of the entity’s enterprise risk management and provide 

oversight as needed. The board should ensure it is apprised of the most significant risks, along 

with actions management is taking and how it is ensuring effective enterprise risk management. 

The board should consider seeking input from internal auditors, external auditors, and others.774

 

774 Committee of Sponsoring Organizations. Enterprise Risk Management—Integrated Framework, Executive 

Summary; September, 2004; pp 6-7.

Enterprise Risk Management

According to the Committee of Sponsoring Organizations,†

 the four broad categories of ERM focus 

are strategy, operations, reporting, and compliance. They include eight specific activities: 

1. Internal Environment – This activity encompasses the tone of an organization and sets the 

basis for how an entity’s people view and address risk, including risk management philosophy 

and risk appetite, integrity and ethical values, and the environment in which they operate. 

2. Objective Setting – Objectives must exist before management can identify potential events 

affecting their achievement. Enterprise risk management ensures management has in place a 

process to set objectives and that the chosen objectives support and align with the entity’s 

mission and are consistent with risk appetite.

3. Event Identification – The entity must identify internal and external events affecting 

achievement of its objectives, distinguishing between risks and opportunities. Opportunities 

are channeled back to management’s strategy or objective-setting processes.

4. Risk Assessment – The entity analyzes risks, considering likelihood and impact as a basis for 

determining how to manage them, and they assess risks inherently and residually. 

5. Risk Response – Management selects risk responses—avoiding, accepting, reducing, or 

sharing risk—developing a set of actions to align risks with the entity’s risk tolerances and 

risk appetite. 

6. Control Activities – Management establishes and implements policies and procedures to help 

ensure the effective risk response.

7. Information and Communication – The entity identifies, captures, and communicates relevant 

information in a form and timeframe that enable people to carry out their responsibilities. 

Effective communication also occurs in a broader sense, flowing down, across, and up the 

entity.

8. Monitoring – Ongoing management activities and separate evaluations monitor of the entire 

enterprise’s risk management and makes modifications as necessary. 

† COSO describes its mission on its website. “The Committee of Sponsoring Organizations’ (COSO) mission is to 

provide thought leadership through the development of comprehensive frameworks and guidance on enterprise risk 

management, internal control and fraud deterrence designed to improve organizational performance and governance and 

to reduce the extent of fraud in organizations.” http://www.coso.org/aboutus.htm (accessed October 7, 2015).

000891
Macondo Investigation Report Volume 3 4/17/2016

203 

A growing trend among US boards of directors is a greater readiness to engage whenever and wherever 

appropriate to ensure management is effectively leading and managing the many areas of a corporation’s 

business activities.775 The rationale for that development has been long in the making, but is 

straightforward: “By acting early and effectively, directors may prevent small problems from growing 

into a major crisis.”776 In terms of ERM responsibilities, the role of boards “has become increasingly 

challenging as expectations for board engagement are at all-time highs.”777 COSO recently opined about 

corporate failures during the last financial crisis, but the statements have broader applicability across the 

gamut of corporate risk: 

The benefit of hindsight has shown us that boards have a difficult task in overseeing the 

management of increasingly complex and interconnected risks that have the potential to devastate 

organizations overnight. At the same time, boards and other market participants are receiving 

increased scrutiny regarding their role ... Boards are being asked—and many are asking 

themselves—could they have done a better job in overseeing the management of their 

organization’s risk exposures.778

So whether through managing a CEO and executive management team, audit and oversight, or 

establishing corporate goals and objectives or other high-level policies (such as compensation systems 

and bonus structures), the role of a company’s board of directors is multifaceted and ongoing. It is not 

enough to set certain goals and objectives or to delegate such activities to the CEO and the senior 

management team. Instead, the board must at least monitor the company’s performance with an eye 

toward policies they have implemented, to ensure they take appropriate actions and achieve anticipated

results. Perhaps for this reason, Bob Dudley, shortly after taking over as CEO at BP, instigated a review 

of BP’s compensation practices, especially incentive pay, out of potential concern that the company was 

incentivizing behaviors contrary to corporate safety goals. Dudley said: “BP is reviewing its 

compensation practices so that they are aligned with BP’s corporate safety goals. While safety has long 

been a component of the company’s performance incentives plan, going forward, all compensation 

structures are being reviewed to ensure that safety-first behavior is appropriately and permanently 

incentivized across all of BP’s businesses.”779 Mr. Dudley further explained he took this step “to be 

absolutely clear that safety, compliance and operational risk management is BP’s number one priority.”780

The rationale for board engagement in risk management and corporate sustainability in the offshore 

drilling sector takes on even more urgency, especially with the benefit of hindsight of a disaster like 

Macondo. As examples in this chapter indicate, economic, legal, and reputational damages of the 

magnitude caused by such catastrophic accidents threaten both a company’s short-term performance and 

 

775 Bussey, J. Governance Grows Up: Governance Grows Up in American Baord Rooms. The Wall Street Journal, 

October 12, 2010, pp 1, 5. 

776 Lipton, M.; Lorsch, J. W. A Modest Proposal for Improved Corporate Governance; The Business Lawyer 1992, 

48, p 62. 

777 Committee of Sponsoring Organizations. Effective Enterprise Risk Oversight: The Role of the Board of 

Directors; 2009; p 1.

778 Ibid. 

779 BP. BP’s COMMITMENT TO SAFETY, p 1, December 13, 2010.

780 Ibid., p 3. 

000892
Macondo Investigation Report Volume 3 4/17/2016

204 

long-term viability.781 In effect, a board of directors’ oversight and strategic leadership are vital for 

process safety and issues concerning major accident events. To be clear, micromanagement is not 

suggested or appropriate; rather, an engaged board willing and able to meet its oversight responsibility is 

the key. Boards of directors must be knowledgeable about the major accident risks in a company’s 

operations, and they must insist on access to relevant information to play an active role in overseeing 

management of those risks and to ensure those risks are communicated appropriately to shareholders and 

regulators. 

5.1.4 The Business Case for Effective Process Safety Oversight

The Organization for Economic Cooperation and Development (OECD) is an intergovernmental 

organization with representatives from 34 industrialized countries in North and South America, (including 

the US), Europe, and the Asia and Pacific region, as well as from within the European Commission. 

OECD meets as a body to coordinate and harmonize policies, discuss issues of mutual concern, and 

collaborate to respond to international problems. 

In June 2012, through its “Environment, Health and Safety Chemical Accidents Program,” OECD 

published the guidance Corporate Governance for Process Safety: Guidance for Senior Leaders in High 

Hazard Industries. OECD instructs “Good process safety management needs the active involvement of 

senior leaders, and it is important that they are visible within their organisation, because of the influence 

they have on the overall safety and organisational culture.”782 The document outlines a business case in 

favor of effective process safety management. Noting significant international incidents such as 

Bhopal,783 BP Texas City, and Buncefield,784 OECD asserts that a growing tide of corporate social 

responsibility is emerging around the globe, and that regulators, shareholders of companies in high-hazard

 

781 Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012; pp 7-8. 

http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-sec-disclosure-by-major-oil-gascompanies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 2015).

782 Organisation for Economic Co-operation and Development (OECD). Corporate Governance for Process Safety: 

OECD Guidance for Senior Leaders in High Hazard Industries; June, 2012; p 9. 

http://www.oecd.org/chemicalsafety/chemical-accidents/corporate%20governance%20for%20process%20safetycolour%20cover.pdf (accessed October 7, 2015). Note, some existing guidance is unclear whether a term like 

“senior leadership” includes the board of directors (including independent directors), or is limited to the executive 

leadership team, or others further down the management chain. Many best practices in this area apply equally well 

to all levels of leadership, and some are more particularized; however, it is clear that as one considers the 

corporate hierarchy, the higher the level of leadership, the more appropriate it becomes to apply a higher scope of 

duties.

783 On December 3, 1984, a methyl isocyanate (MIC) release at the Union Carbide insecticide plant in Bhopal, India 

resulted in an estimated 3,800 people that died within days, and tens of thousands that were injured. Eventually, 

the release killed tens of thousands of people. See http://www.csb.gov/on-30th-anniversary-of-fatal-chemicalrelease-that-killed-thousands-in-bhopal-india-csb-safety-message-warns-it-could-happen-again-/?pg=4 (accessed 

June 17, 2015). 

784 On December 11, 2005 a large vapor cloud explosion and multiple tank fires occurred after the overfilling of a 

tank when unnoticed. The explosion injured 43 people, damaged 22 additional tanks at the site, and $1.5 billion 

damage in a commercial and residential property; Johnson, D. The Potential for Vapour Cloud Explosions: 

Lessons from Buncefield; Journal of Loss Prevention in the Process Industries 2010, 23, pp 921-927.

000893
Macondo Investigation Report Volume 3 4/17/2016

205 

industries, and citizens alike are all expecting more of business leaders in the modern business 

environment.785 Businesses can suffer if they do not meet those expectations. Corporate leaders are

expected to manage the risks posed by their businesses alongside other critical factors within their 

businesses, with severe consequences for failure to do so.786

Similar to the work of COSO, OECD reminds that major accidents are just like other significant business 

risks, especially when considering the integrated nature of many high-hazard businesses.787 OECD 

explains that good corporate governance in process safety is not just about avoiding potential negative 

effects. Key commercial benefits of good process safety management include (1) less downtime and 

higher plant/facility availability, (2) easier-to-forecast maintenance budgets, (3) longer lifespans for 

plants/facilities and equipment, (4) improved efficiency and flexibility in operations, (5) enhanced 

employee, stakeholder-regulator relationships, and (6) improved access to capital and insurance at more 

attractive rates or premiums.788 Stated differently, good process safety equates to good business. 

 

785 Organisation for Economic Co-operation and Development (OECD). Corporate Governance for Process Safety: 

OECD Guidance for Senior Leaders in High Hazard Industries; June, 2012; pp 8-9. 

http://www.oecd.org/chemicalsafety/chemical-accidents/corporate%20governance%20for%20process%20safetycolour%20cover.pdf (accessed October 7, 2015).

786 BP Plc., CEO Bob Dudley recently likened the Macondo blowout to a near-death experience, “Sometimes it takes 

a near death experience to radically change a company;” US Gulf oil spill nearly ruined BP, says chief Bob 

Dudley. BBC News, January 2, 2016, http://www.bbc.com/news/uk-35210450 (accessed January 15, 2016).

787Organisation for Economic Co-operation and Development (OECD). Corporate Governance for Process Safety: 

OECD Guidance for Senior Leaders in High Hazard Industries; June, 2012, pp 8-9. 

http://www.oecd.org/chemicalsafety/chemical-accidents/corporate%20governance%20for%20process%20safetycolour%20cover.pdf (accessed October 7, 2015).

788 Ibid., pp 9-10. 

000894
Macondo Investigation Report Volume 3 4/17/2016

206 

5.1.5 The Need for Better Reporting Illustrated by Consequences Stemming 

from the Macondo Blowout

The messages to shareholders in annual reports illustrate what a board of directors and senior 

management team consider necessary to demonstrate the investment value of the company. These reports 

include a domestic company’s 10-K report,789 a foreign issuer’s 20-F report,790 and any company reports 

produced for the benefit of shareholders and the public, such as BP’s sustainability reports, or annual 

board performance reports. US reporting regulatory requirements apply to foreign companies, such as BP 

(United Kingdom) or Transocean (Switzerland), whose stock trades in US markets as American 

Depositary Shares or American Depositary Receipts.791 

 

789 10-K reports are comprehensive annual financial reports required by the SEC, the requirements for which are 

detailed in the Securities and Exchange Act of 1934. http://www.investopedia.com/terms/1/10-k.asp (accessed 

October 7, 2015). 

790 20-F reports are comprehensive annual financial reports required by the SEC from “foreign private issuers” who 

issue equity shares available in US markets, the requirements for which are detailed in the Securities Exchange 

Act of 1934. See http://www.investopedia.com/terms/s/sec-form-20-f.asp (accessed October 7, 2015). 

791 BP Shares trade as American Depositary Shares rather than American Depositary Receipts, which are similar 

instruments. See http://www.bp.com/en/global/corporate/investors/shareholder-information/managing-yourshares---ads-holders.html. Transocean shares trade as American Depositary Receipts. 

Commitment to Safety, Sustainable Profits

In the UK, international utility giant Scottish Power demonstrates that a commitment 

to safety can be part of a strategy toward increased and sustainable profits and total 

shareholder value—key goals of any high performing corporate board of directors. 

Judith Hackitt, Chair of the UK HSE, recently cited Scottish Power as an example of 

a company whose board has “led the way” in demonstrating commitment to safety 

and reliability from the top to the bottom of the organization, and throughout the 

process delivered real benefits in terms of both safety and profitability.a With a formal 

governance model that involves monthly meetings on reviewing process safety 

dashboard information from the facility level up to the board itself, the company 

started to “establish ownership and accountability for process safety management” 

and to foster a corporate culture intentionally designed “to ensure people are always 

thinking about what could go wrong and never complacent.”b

 

a Hackitt, J. Why Corporate Governance and Why Now?, Conference on Corporate Governance for 

Process Safety, Paris, France, June 14-15, 2012; 

http://www.hse.gov.uk/aboutus/speeches/transcripts/hackitt140612.htm (accessed October 7, 2015).

b CSB. CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012, p 86 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015); Sedgwick, 

M.; Wands, A. The Implementation of Effective Key Performance Indicators to Manage Major Hazard 

Risks, CSB Sfaety Performance Indicator Public Hearing, Houston, TX, July 23, 2012. slide 4. 

http://www.csb.gov/UserFiles/file/Sedgwick%20%28Scottish%20Power%29%20PowerPoint%20-

%20printed.pdf (accessed October 7, 2015).

000895
Macondo Investigation Report Volume 3 4/17/2016

207 

BP and Transocean are required to communicate relevant information to shareholders about major hazard 

risks, especially where information about risks are determined to be material. Failure to do so could lead 

to liability under Section 10(b) of the Securities Exchange Act of 1934.792 Failure to disclose material 

information could also lead to potential civil liability arising from shareholder litigation.793 The theory in 

this type of litigation is that insufficient disclosure prevents shareholders from understanding the risk they 

are taking by purchasing shares at what essentially is an artificially high share price, because the risk 

associated with the companies’ activities could not adequately be factored into the market’s assessment of 

share prices.

In a relevant example, following Macondo, BP shares fell in value by over 48% between April 20, 2010 

and June 25, 2010.794 The slide in share value was compounded by BP’s need to set aside money for 

anticipated litigation costs related to the accident, in both criminal and civil contexts. These funds were to 

be generated by suspending regular shareholder dividend payments as well as the sale of potentially 

lucrative oil fields to competitors at a time of rising oil prices.795 Other costs continue to mount, including 

a negotiated $18.7 billion dollar settlement the company reached with the US government,796 along with 

 

http://deepwater.com/investor-relations.html. See generally

http://www.investopedia.com/ask/answers/06/adrvsads.asp (all sites accessed October 7, 2015). 

792 Codified at 15 U.S.C. § 78j(b); see also 17 C.F.R. § 240.10b-5, “Employment of Manipulative and Deceptive 

Practices,” which states, in part: “It shall be unlawful for any person, directly or indirectly, by the use of any 

means or instrumentality of interstate commerce, . . . (b) To make any untrue statement of a material fact or to 

omit to state a material fact necessary in order to make the statements made, in the light of the circumstances 

under which they were made, not misleading . . ." (Emphasis added.)

793 Although factual allegations in a complaint cannot be presumed as true, and can only be accepted as fact after 

litigation on the merits, shareholder litigation pending against both BP and Transocean asserts safety disclosure 

failures relative to the Macondo blowout. See Alameda County Retirement Association v. BP which asserts, inter 

alia, that shareholder-plaintiffs lost millions of dollars on their BP investments as a result of false and misleading 

statements made by the defendants regarding the extent of BP’s commitment to a “safety first” approach to oil 

drilling and a “profits first” corporate culture. See Consolidated Complaint, ¶ 2, Case No.: 12-CV-01256, 12-CV01261, 12-CV01614. Similarly, a suit against Transocean by shareholder-plaintiffs Thomas Yuen and Sumni Ahn 

accused Transocean of misrepresenting a string of failures involving blowout preventers. This class action suit 

alleged that false claims by management caused the price of Transocean stock to rise artificially due to a lack of 

understanding of actual risks, and then to plunge when the truth was later revealed. See Complaint – Class Action, 

¶¶ 1, 6 Case No: 2:10-CV-01467-JCZ-SS. The common underpinning of these suits is the fact that the risk of a 

subsea blowout was well understood by industry, making such information inherently “material,” defined as “of 

such a nature that knowledge of the item would affect a person’s decision-making process.” Black’s Law 

Dictionary, 7th ed. (1999); see also TSC Industries v. Northway, 426 U.S. 438, 449 (1976) (must be a substantial 

likelihood that the reasonable investor would view the disclosure of an omitted fact as having significantly altered 

the "total mix" of available information in a manner that shareholders would consider relevant to the buying and 

selling of stocks). 

794 Alameda County Retirement Association v. BP, Consolidated Complaint, ¶¶ 399-402, Case No.: 12-CV-01256, 

12-CV-01261, 12-CV01614.

795 BP. Annual Report and Form 20-F 2011, p 103 http://www.bp.com/content/dam/bp/pdf/investors/bp-annualreport-and-form-20f-2011.pdf (accessed December 17, 2015); See also, 

http://dealbook.nytimes.com/2012/09/10/bp-said-to-be-in-talks-to-sell-gulf-of-mexico-assets-for-6-billion/?_r=0

(sales in the Gulf of Mexico and sales pending in Russia); http://articles.latimes.com/2010/jul/12/nation/la-na0712-oil-spill-bp-20100712 (Alaska).

796 http://www.bloomberg.com/news/articles/2015-07-02/bp-said-to-settle-2010-gulf-oil-spill-claims-with-u-s-states. 

This settlement was approved by the judge presiding over the case on April 5, 2016; see 

000896
Macondo Investigation Report Volume 3 4/17/2016

208 

ongoing environmental remediation costs and marketing costs related to rebuilding BP’s image with the 

American public. The possibility remains of more adverse judgments stemming from other pending legal 

actions.797 BP’s 2014 annual report noted that potential costs related to the Macondo blowout still could 

not be fully estimated, and “they have had and could continue to have a material adverse impact on the 

group’s business, competitive position, financial performance, cash flows, prospects, liquidity, 

shareholder returns and/or implementation of its strategic agenda, particularly in the US.”798 Transocean 

had a similar statement in its own annual report that indicated “the Macondo well incident could result in 

increased expenses and decreased revenues, which could ultimately have a material adverse effect on us

... we are currently unable to estimate the full impact the Macondo well incident will have on us.”799

Issues of required disclosures in the case of BP and Transocean must, however, be kept in proper context. 

For its part, based on annual reports filed in 2011 for the 2010 performance year, BP was recognized by 

public interest group Ceres as having provided shareholders with “good” disclosures relating to deepwater 

drilling risks in four of five categories among the world’s ten largest publicly-owned oil and gas 

companies.800 

As this chapter explains, more could have been disclosed but disclosure was not required, in light of 

controlling SEC regulation or other accompanying guidance. Moreover, as Ceres found even in a postMacondo world, none of the world’s ten largest publicly traded oil and gas companies produced 

“excellent” disclosures with respect to climate change and deepwater drilling risks; yet, these companies 

continue to make extensive capital investments in extracting oil and gas and expanding deepwater 

exploration and production efforts. In doing so, they are “posing significant risks to investors and 

stakeholders.”801 To that end, Ceres called on investors to push for better quality disclosure from oil and 

gas companies, and for securities regulators to “keep close tabs” on the quality of corporate disclosures of 

 

http://www.cnbc.com/2016/04/05/us-judge-approves-bp-settlement-for-2010-gulf-of-mexico-oilspill.html?__source=facebook%7Cbusiness%7Clink%7C040416%7C5AM%7Cjudge-approves-bp-settlement. 

797 For example, on December 11, 2015 Acciones Colectivas de Sinaloa filed a class action lawsuit against BP 

seeking compensation for environmental damage sustained in Mexico as a consequence of the 2010 oil spill; 

Rodriguez, J. C. Mexico Files Class Action Lawsuit Against BP plc (ADR) over Deepwater Horizon Spill. 

Law360, December 11, 2015, http://www.law360.com/articles/737080/bp-hit-with-class-action-in-mexico-overdeepwater-horizon (accessed January 15, 2015).

798 BP Annual Report and Form 20-F 2014, p 228. http://www.bp.com/content/dam/bp/pdf/investors/bp-annualreport-and-form-20f-2014.pdf (accessed December 17, 2015). 

799 Transocean. Annual Report, 2014, pp AR15-AR16.

800 For its 2010 annual report, Ceres recognized BP for “Good Disclosures” with respect to Safety & Environmental 

Statistics, Drilling Risk Management, Safety R&D, and Corporate Governance on Drilling, while it recognized BP 

for “Fair Disclosures” relating to Spill Response. Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? 

An Analysis of SEC Disclosure by Major Oil & Gas Companies on Climate Risk & Deepwater Drilling Risk; 

CERES: August, 2012; pp 1-3. http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-secdisclosure-by-major-oil-gas-companies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 

2015).

801 Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012; pp i, 1, 4-5. 

http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-sec-disclosure-by-major-oil-gascompanies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 2015).

000897
Macondo Investigation Report Volume 3 4/17/2016

209 

those companies working offshore in the extractive industry with specific regard to deepwater drilling 

risks, while “prodding companies that continue to fall short.”802 

Ceres’ recognition of companies with better reporting is further tempered by the fact that “even the best 

reporting provided narrative discussions of deepwater drilling policies and actions, without providing 

investors sufficient metrics to evaluate the success of new policies designed to reduce the risks of 

accidents.”803

5.2 BP and Transocean: Corporate Governance and Communication 

of Process Safety and Major Accident Prevention Information

BP and Transocean boards of directors met requirements for disclosing material information about safety, 

but neither board effectively communicated process safety performance in the form of leading indicator 

data and lagging metrics of sufficient scope and frequency, which could have provided greater depth 

concerning the safety of drilling operations. As this section describes, shareholder communications and 

other public information about board activities and corporate risk demonstrate missed opportunities by 

BP’s and Transocean’s boards to communicate additional information from the highest level to focus their 

companies’ efforts on safety in a manner that could help to minimize the potential for a catastrophic event 

like the one on April 20, 2010. The rationale underpinning this critique is straightforward. In business, 

“your measurement system will determine what your staff will pay attention to.”804 On the executive 

level, “Leaders create cultures by what they systematically pay attention to.”805 In effect, a successful 

corporate safety program aimed largely at personal safety provides little insight into how well the 

company is controlling, mitigating, and managing major hazards and catastrophic risk, especially in the 

area of process safety risk. As described in Section 3.1, it could even lull observers from all levels of a 

company—and even shareholders—into a false sense of security over major hazards. 

5.2.1 A Case Study of Board Involvement Demonstrated in Shareholder 

Communications 

BP and Transocean both publicly reported health and safety information about risk and the sustainability 

of operations to shareholders in annual reports for many years. An analysis of BP board communications 

before and after the BP Texas City disaster in 2005, and of BP and Transocean communications before 

and after the Macondo disaster, illustrate an evolving focus and approach to process safety and major 

 

802 Ibid., p i.

803 Ibid., p 2.

804 Eves, D.; Gummer, J. Questioning Performance: Essential Guide to Health, Safety and the Environment ; IOSH 

Services Ltd: Wigston, United Kingdom, 2011, p 103 (as attributed to Peter Drucker). HSE also commissioned 

research into the types of KPIs a company could select, which investment institutions would likely regard as 

significant, with obvious implications for a company’s access to capital, and simultaneously an easy way for 

directors to drive safety and profit. See id. at p 106. 

805 Schein, E. H. Organizational Culture and Leadership, 4th ed.; Jossey-Bass: San Francisco, CA, 2010, as cited in 

Ellis, G. Process Safety Begins in the Board Room. Chemical Processing, March 21, 2013, 

http://www.chemicalprocessing.com/articles/2013/process-safety-begins-in-the-board-room/?show=all (accessed 

October 7, 2015). 

000898
Macondo Investigation Report Volume 3 4/17/2016

210 

accident prevention communications from BP’s board of directors’ perspective, and a somewhat more 

static and traditional approach taken by Transocean. 

5.2.1.1 BP Shareholder Communications Before and After BP Texas City

Following the BP Texas City disaster, the Baker Panel found a “substantial gulf” between the information 

management reported to the BP board of directors and the reality in the field, where company personnel 

were generating process safety information and making operational decisions which had major accident 

risk implications for the company. Specifically: 

BP’s Board of Directors has been monitoring process safety performance of BP’s operations based on 

information that BP’s corporate management presented to it. A substantial gulf appears to have 

existed, however, between the actual performance of BP’s process safety management systems and 

the company’s perception of that performance. Although BP’s executive and refining line 

management was responsible for ensuring the implementation of an integrated, comprehensive, and 

effective process safety management system, BP’s Board has not ensured, as a best practice, that 

management did so. In reviewing the conduct of the Board, the Panel is guided by its chartered 

purpose to examine and recommend any needed improvements. In the Panel’s judgment, this purpose 

does not call for an examination of legal compliance, but calls for excellence. It is in this context and 

in the context of best practices that the Panel believes that BP’s Board can and should do more to 

improve its oversight of process safety at BP’s five US refineries.806 

Consider that following the Texas City disaster, BP was assessed $50 million in penalties for felony 

safety violations leading to the event. BP’s sustainability report in 2005, issued after Texas City, 

communicated the message that the company was learning from its mistakes and working toward safer 

performance.807 In particular, the report commented in detail on BP’s response to the Texas City disaster 

with its own investigations, a “fundamental” review of its safety systems and processes, and a whole host 

of new measures and investments to “maintain the safety of our people and the integrity of our plant.”808 

In fact, little changed in BP’s management of Texas City. When OSHA re-inspected the facility 2009, 

OSHA found “439 instances of ‘willful’ violations, most or all of which were designated with gravity of 

10 on a scale of 1 to 10.”809 OSHA issued notices of violations in response to several significant 

 

806 The Baker Panel. The Report of the BP US Refineries Independent Safety Review Panel; January, 2007, p XV. 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015). 

807 BP. Making energy more-Sustainability Report 2005; pp 3-4. 

http://www.bp.com/content/dam/bp/pdf/sustainability/group-reports/bp_sustainability_report_2.pdf (accessed 

October 7, 2015).

808 United States Department of Labor. Fact Sheet on BP 2009 Monitoring Inspection, 

https://www.osha.gov/dep/bp/Fact_Sheet-BP_2009_Monitoring_Inspection.html (accessed December 15, 2015).; 

Sanford, L. Lessons on Corporate "Sustainability" Disclosure from Deepwater Horizon; New Solutions 2011, 21, 

p 202. 

809 OSHA. Inspection: 311962674 - BP Products North America, Inc., 

https://www.osha.gov/pls/imis/establishment.inspection_detail?id=311962674&id=310266085#311962674; US 

Department of Labors OSHA issues record-breaking fines to BP, 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=NEWS_RELEASES&p_id=16674 

(accessed October 7, 2015). 

000899
Macondo Investigation Report Volume 3 4/17/2016

211 

remaining safety concerns.810, 811 By August 12, 2010, BP still had not addressed these issues fully. For its 

failure to act, BP negotiated yet another agreement with OSHA to pay a $50.6 million penalty for ongoing 

failure-to-abate violations—the largest penalty ever paid in the history of OSHA enforcement.812

Shareholders, for their part, received little in the way of specifics, despite a narrative-style summary of 

the ongoing issues and their resolution. 

BP’s 2009 annual report, issued before Macondo, carried another important message to shareholders. 

Opening with a letter from Carl-Henric Svanberg, the Chairman of the BP’s board, the company made it 

clear that it remained ready and able to take on the risks presented by its operations. He noted: 

Risk remains a key issue for every business, but at BP it is fundamental to what we do. We 

operate at the frontiers of the energy industry, in an environment where attitude to risk is key. The 

countries we work in, the technical and physical challenges we take on and the investments we 

make – these all demand a sharp focus on how we manage risk. We must never shrink from 

taking on difficult challenges, but the board will strive to set high expectations of how risk is 

managed and remain vigilant on oversight.813 

CEO Tony Hayward’s own letter in the 2009 annual report paralleled the Chairman: 

Our priorities have remained absolutely consistent—safety, people and performance—and you 

can see the results of this focus with improvements on all three fronts. This year we have 

increased emphasis on operational efficiency, with a particular focus on compliance and 

continuous improvement. Achieving safe, reliable and compliant operations is our number one 

priority and the foundation stone for good business. This year we achieved a reported recordable 

injury frequency of 0.34, an improvement of 20% over 2008. In Refining and Marketing reported 

major incidents have been reduced by 90% since 2005. All our operated refineries and 

petrochemicals plants now operate on the BP operating management system (OMS), which 

governs how BP’s operations, sites, projects and facilities are managed. In Exploration and 

Production 47 of our 54 sites completed the transition to OMS by the end of 2009, and I expect 

all BP operations to be on OMS by the end of 2010.This represents good progress and we must 

remain absolutely vigilant.814

Together, these letters communicated the company’s willingness to operate at the “frontiers” of the 

energy sector, essentially willing to take on bigger risks for bigger rewards. Macondo represented just this 

 

810 “Our information indicates that for some identified hazards, BP has not specified or allocated the specific layers 

of protection needed and for other identified hazards where BP has specified the layers of protection it will use to 

control the hazards, the specified instrument controls have not been installed or are not operational.” From 

Sanford, L. Lessons on Corporate "Sustainability" Disclosure from Deepwater Horizon; New Solutions 2011, 21, 

p 202.

811 OSHA warned in September 2009 that its audit identified “systemic deviations from the industry standards” and 

further noted that “areas of concern included a failure, four years after the blast, to complete a determination of 

which alarm functions in each unit were critical to process safety.” From Sanford, L. Lessons on Corporate 

"Sustainability" Disclosure from Deepwater Horizon; New Solutions 2011, 21, p 202.

812 Sanford, L. Lessons on Corporate "Sustainability" Disclosure from Deepwater Horizon; New Solutions 2011, 21, 

p 199. To be clear, these violations were not the same issues that led to the Texas City disaster, but instead were 

violations occurring afterward due to the failure of BP to implement needed fixes. 

813 BP 2009 Annual Report, letter from Carl-Henric Svanberg, Chairman of the Board, p 3. 

814 BP 2009 Annual Report, letter from Tony Hayward, Group CEO, p 6.

000900
Macondo Investigation Report Volume 3 4/17/2016

212 

kind of risk/reward, referred to as the “well from hell,”815 and presenting BP and Transocean numerous 

operational challenges, while promising a significant payoff of potential hydrocarbon reserves. The letters 

also sought to communicate a sense of safety to investors, presenting not only the board’s perspective on 

safety in general, but even some specific safety results deemed important from the perspective of the 

CEO. The remainder of the report, however, provided little in the way of process safety, major hazards, 

and process safety indicators—perhaps because no express regulatory requirement existed for the 

reporting of such information, and because BP’s industry peers do not report the same type of 

information. 

5.2.1.2 BP Shareholder Communications Before and After Macondo

In its 2009 annual shareholder report, four years after BP Texas City but one year before Macondo, BP 

included only three indicators which the company described as having to do with safety: Recordable 

Injury Frequency (RIF), oil spills, and greenhouse gas emissions. As noted in Chapter 3 and as Hayward 

touts in his letter, BP achieved strong results with respect to personal safety as measured by RIF. The BP 

workforce (employees and contractors) achieved a RIF of “0.34, significantly below 2008 and 2007 levels 

of 0.43 and 0.48, respectively.” Oil spills, which were defined as spills of one barrel or more, also showed 

a reduction from the two prior years, down from 340 in 2007, 335 in 2008, and 234 in 2007. In contrast, 

greenhouse gas emissions were up in 2009 from levels as reported in 2007 and 2008, which the company 

attributed to “increases in operational activity” in various regards. This is the type of data upon which 

shareholders could assess BP’s performance in personal safety issues impacting the company’s 

workforce. These two limited lagging indicators on oil spills and greenhouse gas emissions illustrate 

environmental concerns and give some indication of process safety management results.

At the same time, however, safety data also illustrates the area of potential improvement open to BP, 

notwithstanding the current absence of a regulatory requirement for more. The company provided no 

leading process safety indicators that could have given shareholders or the regulator insight into specifics 

about process safety issues or major accident prevention.816 While BP discussed both personal and 

process safety concepts and issues throughout the report, the absence of meaningful indicator data 

weakens the effectiveness of the communication. It gave no KPI or metrics-driven discussions relating to 

success in process safety management issues, especially for offshore drilling and production. 

In another example, similar to the phrasing noted in Hayward’s letter and the “90% reduction in major 

incidents,” the Exploration and Production section noted, “We also achieved improvements in the number 

of process safety-related incidents and a significant reduction in the number of spills.”817 These statistics 

 

815 See http://www.nytimes.com/2014/09/05/business/bp-negligent-in-2010-oil-spill-us-judge-rules.html?_r=0

(referencing exploration and production challenges “in the deep waters of the Gulf of Mexico, where high 

pressures and temperatures in the wells test the most modern drilling technologies.”) See also in re: Oil Spill by 

the Oil Rig “Deepwater Horizon” in the Gulf of Mexico on April 20, 2010, Findings of Fact and Conclusions of 

Law, Judge Barbier, ¶56 (“Drilling the Macondo well did not go smoothly. Some called it the “well from hell.”); 

and exhibit TREX-22924, “Macondo Was the Well from Hell,” (timeline showing challenges in drilling 

Macondo), available at http://www.mdl2179trialdocs.com/releases/release201304041200022/D-3126.pdf. 

816 BP. Annual Report and Accounts; 2009; p 15. http://www.bp.com/content/dam/bp/pdf/investors/bp-annualreport-accounts-2009.pdf (accessed October 15, 2015).

817 Ibid., p 12.

000901
Macondo Investigation Report Volume 3 4/17/2016

213 

are not particularly illuminating to shareholders, even from a lagging indicators perspective. Although on 

its face a 90% reduction in major incidents is a positive development, a reader cannot know the number of 

major incidents that actually occurred, how near-misses were handled in terms of data collection, or 

whether these incidents had a common causation. Also absent were the operational goals for this area, 

leaving a shareholder uncertain as to whether BP met its objectives in this area. Missing as well is any 

attempt to benchmark the number of major incidents against industry standards. 

In contrast, in the Refining and Marketing section of the report, BP provides some financial indicators 

about specific industry benchmarks.818 In terms of safety, Refining and Marketing again repeated the 90% 

reduction of “reported major accidents” as well as the previously noted reduction of oil spills and RIF and 

the absence of workplace fatalities for the year.819 Some improvement in the area of reporting would be 

helpful because BP appeared to be tracking matters like reported major accidents internally, so bringing 

that type of data into its annual reports would cost little, but could add much by way of transparency. 

In deeper consideration of BP’s indicators chosen for report, oil spills and greenhouse emissions are 

lagging indicators, providing shareholders and the regulator with little more than notice of events that 

already occurred, rather than including any specific mention of near-misses or the myriad of more 

sophisticated leading process safety indicators that are frequently tracked and trended offshore which, if 

disclosed, could have provided readers with far better insights into major process safety issues. Such 

indicators could have included, for example, data pertaining to challenges to barriers, problems with 

barriers discovered during inspections, overdue inspections and audits, well kick frequency, response time 

to well kicks, and the like. 

Ceres also cited the improvement in BP’s 2010 report over its previous edition in its study on the 

disclosures made by companies engaged offshore, as well as the limitations in that reporting, noting, 

“BP’s and several other companies deepwater drilling disclosure improved significantly after Macondo. 

As explained above, however, even the best narrative-style reporting relative to offshore operations, 

without the addition of indicators, KPIs, or metrics, cannot provide the basis to understand and evaluate 

the impact of policies and procedures designed to reduce the risk of accidents.”820 This finding by Ceres 

corroborates the CSB’s findings, which is that although BP described issues concerning process safety 

risk in narrative form, it provided little about significant process safety performance indicators before or 

immediately after Macondo. 

In a positive development, post-Macondo, BP’s communication from its board to its shareholders evolved 

through more transparent and complete reporting related to major hazards. Only briefly in its 2010 annual 

 

818 Such benchmarks include refining margin and refining availability percentage. See BP. Annual Report and 

Accounts; 2009; p 18. http://www.bp.com/content/dam/bp/pdf/investors/bp-annual-report-accounts-2009.pdf

(accessed October 15, 2015).

819 BP. Annual Report and Accounts; 2009, p 21. http://www.bp.com/content/dam/bp/pdf/investors/bp-annualreport-accounts-2009.pdf (accessed October 15, 2015).

820 Coburn, J., Salmon, R., Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012, p 2. 

http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-sec-disclosure-by-major-oil-gascompanies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 2015).

000902
Macondo Investigation Report Volume 3 4/17/2016

214 

report, and then more fully its 2011-2014 reports,821 BP’s communications with shareholders began to 

provide even more information relating to the company’s safety performance. For example, the 2011 

report emphasized work on a wide swath of corporate activity aimed at improving safety, including 

coverage of numerous and significant critical safety issues. The report highlighted categories of key 

accomplishments, such as safety and operational risk, upstream restructuring, operational review, values 

and behaviors, individual performance and reward, contractor management, technology, and joint 

ventures not operated by BP.822 The core of the report, the “Business Review—BP in More Depth” 

section, included detailed subsections on topics such as risk factors, safety and operational risks, and 

environmental and social responsibility.823 It also included a special section detailing ongoing issues in

the Gulf of Mexico cleanup efforts.824 Most of this type of information would benefit the entire sector in 

publicly traded companies’ annual reports. 

5.2.1.3 Transocean Shareholder Communications Before and After Macondo

The year before Macondo, in the Chairman’s and CEO’s joint letter to shareholders accompanying 

Transocean’s 2009 annual report and proxy statement, the company related a corporate message focused 

on personal safety: “Unfortunately, despite our continued focus on safety and operational excellence and 

our best-ever total recordable incident rate of 0.77 incidents per 200,000 hours worked, four of our 

employees suffered fatal accidents while working on our rigs in 2009.”825 Transocean related no other 

safety performance indicators or other metrics-driven safety data in this public disclosure, with no 

specific reference to process safety or major accident prevention. 

In Transocean’s 2009 annual report to shareholders, Transocean defined safety performance through a 

formula that related to bonus calculations used to reward individual executives and employees. However, 

safety performance translated to only 20 percent of any total bonus payment, while financial performance 

related to 70 percent, and “new builds” accounted for the final 10 percent. Thus, per the public 

transmission of information in its annual report, Transocean intended to incentivize financial performance 

and new building activity versus safety in an 80/20 split. Moreover, for the 20 percent allocation to safety 

performance, the report indicated that a total score on this component is computed by reference to three 

variables: (1) Total Recordable Injury Rate, (2) Total Potential Severity Rate, and (3) High Potential 

Dropped Objects, with the total score used to calculate employee bonus payments.826

The variables used in Transocean’s bonus calculation formula were mainly personal safety statistics 

relating to the higher frequency—and typically lower consequence—events that most often result in a 

 

821 BP. Annual reporting archive, http://www.bp.com/en/global/corporate/investors/results-and-reporting/annualreport/annual-reporting-archive.html (accessed December 17, 2015), 2015. 

822 BP. Annual Report and Form 20-F 2010; p, 36. http://www.bp.com/content/dam/bp/pdf/investors/bp-annualreport-and-form-20f-2010.pdf (accessed October 2015, 2015).

823 Ibid., p, 59-72. 

824 Ibid., p, 76-79. 

825 Transocean. Annual Report, 2009, 2009 Letter to the Shareholders, p 1. 

826 Transocean. Annual Report, 2009. The three variables comprised 35%, 35%, and 30 % of the measure 

respectively. TRIR is described in Section 0. TPSR is a proprietary measure used to monitor the total potential 

severity of incidents, and High Potential Dropped Objects are dropped objects that could cause serious injury 

resulting in an employee being out of work for six or more months.

000903
Macondo Investigation Report Volume 3 4/17/2016

215 

single person injury, but could potentially include a fatality. 827 However, there was no mention of process 

safety, major hazards or issues of catastrophic accidents, which represent the potential for numerous 

serious injuries/fatalities, as well as large scale damage to property or the environment. By choosing these 

measures, the Transocean board of directors did not provide for appropriate process safety goal-setting. 

Instead, Transocean’s 70 percent weighting toward financial goals broke down into three sub-elements: 

(1) cash flow value add relative to budget, (2) overhead costs, and (3) lost revenues,828 each of which 

provides incentives to push drilling along faster, without an accompanying set of factors or overarching 

philosophical approach to help employees meet company goals safely. 

Transocean’s 2010 annual report is largely the same, with the exception of the company’s 

acknowledgment of the Macondo disaster and a promise to produce a publicly available investigation 

report as well as a “risk assessment” for shareholders regarding the risks to the company presented by 

Macondo in terms of business interruption, lawsuits, and the like.829 Conversely, BP initiated its own 

investigation, publicly releasing a report on September 8, 2010.830 Notably, no accounting from 

Transocean’s Health, Safety and Environment Committee831 appeared in the report, despite the inclusion 

of reports by other standing committees of the board of directors, including the Audit and Executive 

Compensation committees on unrelated matters. In addition, notwithstanding the sinking of the 

Deepwater Horizon, the deaths of 11 workers, and a massive oil spill, Transocean also disclosed bonuses 

for the company’s “best ever” year in safety.832

Transocean’s 2011 report appeared similar in content to the 2010 version, although it mentions 

Transocean’s overall findings and conclusions of its investigation of the Macondo well blowout.833

However, the annual report’s summary of the investigation focuses only on the safety shortcomings of BP 

 

827 Transocean. Annual Report; 2009, “Performance Award and Cash Bonus Plan,” p 35. The bonus plan is 

described as “a goal-driven plan that gives participants, including named executive officers, the opportunity to 

earn annual cash bonuses based on performance measured against predetermined performance goals.” Id., p 34. 

The annual report explains that the bonus plan and the performance goals connected to it are set by the Board, 

through the Executive Compensation Committee—not the Health Safety and Environment Committee—in 

accordance with the company’s “safety vision” for “an incident-free workplace—all the time, everywhere,” 

stating: “The Committee sets our safety performance targets at high levels each year in an effort to motivate our 

employees to continually improve our safety performance towards this ultimate goal.” Id., p 35.

828 Transocean. Annual Report; 2009, pp 34-35. 

829 Ibid., pp 34-35. 

830 BP. Deepwater Horizon Accident Investigation Report; September 8, 2010. 

831 Transocean. Annual Report, 2010, pp 27. Despite the Macondo disaster and the loss of the Deepwater Horizon 

and eleven employees, the HSE Committee met only once in 2010. In contrast, the Corporate Governance 

Committee met 4 times, the Finance/Benefits Committee met 4 times, the Executive Compensation Committee 

met 5 times, and the Audit Committee met 17 times. Id., p 28.

832 Ibid., p 44. This public expression of Transocean’s bonuses was the cause of widespread backlash by media, 

government and the public alike, prompting an apology from Transocean’s CEO. See, e.g., McMahon, J. 

Transocean Executives Get Bonuses for “Best Year in Safety” Despite Gulf Oil Disaster. Forbes, April 4, 

2011.“Notwithstanding the tragic loss of life in the Gulf of Mexico, we achieved an exemplary statistical safety 

record as measured by our total recordable incident rate and total potential severity rate. As measured by these 

standards, we recorded the best year in safety performance in our Company’s history, which is a reflection on our 

commitment to achieving an incident free environment, all the time, everywhere.”

833 Transocean. Annual Report, 2010, p 5.

000904
Macondo Investigation Report Volume 3 4/17/2016

216 

in its role as operator and the party that was legally responsible as the leaseholder, from Transocean’s 

perspective. There is no mention of Transocean internal safety lapses or other deficiencies and no lessons 

learned for improving the safety of its offshore drilling operations. The 2011 report also lacks any 

discussion of process safety management issues, major hazards, or catastrophic risk beyond mentioning 

the formation of a risk management subcommittee that would help the Transocean audit committee to 

analyze risk for the company in varied settings. In any event, such support would prove fruitless with no 

apparent application of process safety principles or adequate consideration of MAP and related 

operational risk. The substance surrounding the work of that subcommittee, however, was not explained. 

In a positive development, Transocean recently updated its most current compensation scheme. Its 2014 

annual report includes process safety considerations as part of the overall individual calculations for 

employees. Now, 30 percent of compensation relates to safety, and the measurement is based on “process 

safety events” that the company is treating as indicators with potential for a major accident event in their 

fleet’s operations.834 According to the report, Transocean is using standard industry definitions to describe 

the “process safety events,” but limited to incidents involving fire, explosion, release of a hazardous 

substance with serious injury or fatality, major structural damage, serious injuries/fatalities, and 

uncontrolled release of hazardous fluids. 

5.3 Historical BP Corporate Governance Issues

During its investigation of the 2005 explosion at the BP Texas City refinery, the CSB found that BP 

exhibited ineffective corporate leadership and oversight of refinery operations, which cascaded from the 

company’s board of directors through successive layers of corporate management, creating a safety 

culture vulnerable to catastrophe.835 

The CSB’s report in that case made specific reference to the existing Turnbull Guidance adopted by the 

UK’s Financial Reporting Council. It also referenced guidance in the UK Health and Safety Executive’s 

report on the BP Grangemouth refinery and provided references to other HSE directives to make clear the 

existing health and safety responsibilities that a corporate board of directors must meet in major accident 

prevention.836 In detail, the CSB report stated:

Directors should, at least annually, review systems of control including risk management, 

financial, operational, and compliance controls that are the key to the fulfillment of the 

company’s business objectives. The HSE has prepared guidance for directors in order to help 

them ensure that the health and safety risks arising from their organizations’ activities are 

properly managed. Directors should be fully aware of their corporate responsibilities in relation to 

the control of major accident hazards.837 

 

834 Transocean. 2014 Extraordinary General Meeting Definitive Proxy Statement; Schedule 14A; March 23, 2015; p 

P-28. http://phx.corporateir.net/External.File?item=UGFyZW50SUQ9NTUxMDI5fENoaWxkSUQ9MjQ1NDY1fFR5cGU9MQ==&t=1

(accessed October 7, 2014). 

835 USCSB, 2007. Refinery Explosion and Fire, Texas City, TX, March 23, 2005, Report No. 2005-04-I-TX, pp 187-

191. http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 7, 2015), March 2007. 

836 Ibid., pp 189-190. 

837 Ibid., p 190. 

000905
Macondo Investigation Report Volume 3 4/17/2016

217 

The CSB’s report noted that at the time of the BP Texas City incident, no independent member of the 

board of directors had a background in refinery operations and process safety management. Thus, no 

then-serving member had the professional background necessary to discern whether the board as a whole 

had received all necessary information, and whether the information received from management reflected 

appropriate consideration of the process safety impacts on corporate decisions. As a result, the CSB 

recommended that BP “Appoint an additional non-executive member of the Board of Directors with 

specific professional expertise and experience in refinery operations and process safety. Appoint this 

person to be a member of the Board Ethics and Environmental Assurance Committee.”838 At the time of 

the Macondo blowout, BP had still not met the express terms of this recommendation, and no independent 

member of the board of directors on April 20, 2010 had a background in refinery operations and process 

safety.

839 Similarly, no then-serving independent board member of the company’s Safety, Ethics and 

Environment Assurance Committee (SEEAC) committee had a professional background in offshore 

drilling relevant to the major accident risks undertaken at a well like Macondo. 

Of course, these are difficult issues, but a legitimate question can be posed as to whether the presence of 

an independent board member with a background in process safety and refining operations could have 

helped to inform the board of emerging safety issues at BP Texas City, and whether an independent board 

member with process safety and offshore drilling and production experience could have provided more 

effective board oversight for major accident risk management at Macondo. One example relates to the 

Orange Book, discussed earlier. BP established the Orange Book after hiring Duane Wilson, the board’s 

retained process safety expert. Chapter 3 noted the limitations of the Orange Book process safety

indicators. This data is provided to the SEEAC in the form of quarterly reports. The SEEAC, and even 

the Board as a whole, would be in a disadvantageous position with this limited safety information without 

a fellow board member with the experience and knowledge to parse through the information, identify any 

limitations, and ask insightful process safety questions of its corporate personnel. SEEAC members 

lacking an educational and professional experience in process safety within the refining or drilling sector

could find themselves wholly reliant on an employee of the company to identify for them potential gaps

in the information. Refining and drilling are two critical areas that represent the most significant business 

risks facing the company. Thus, adequate representation of those sectors in conjunction with process 

safety are critical for informed board decision-making. Despite several other actions intended to improve 

board function, BP’s board remained less effective in oversight and risk mitigation than it might 

otherwise have been. Governance experts agree that oversight and risk management are among a board’s 

chief obligations, and any actions to improve board function in these areas should be encouraged. 

This challenge is not unique to BP. The safety committee of Pike River Coal Company was chaired by the 

company’s CEO, an executive board member with an extensive background in iron mining; however, he 

 

838 Ibid., p 190.

839 Instead, the company chose to take a number of alternative actions in light of the CSB recommendation, along 

with the Baker Panel’s recommendations. For example, the company (1) hired an outside expert to advise the 

board on process safety matters for a fixed term of five years; (2) created the Group Operational Risk Committee 

(GORC) at the highest level within the company to help understand and manage risk; (3) created the Orange Book 

in an attempt to communicate both leading and lagging indicators directly to the Board of Directors in general and 

the SEEAC in particular; and (4) reinvigorated the SEEAC through an expansion of the committee’s role and 

authority with respect to assessing health and safety risk of all types.

000906
Macondo Investigation Report Volume 3 4/17/2016

218 

lacked experience in coal mining, which posed unique hazards, and the company proved unable to steer 

clear of disaster in that case. (See callout box.)

In addition, board members without industry-specific knowledge may assess inadequate information 

without realizing its profound impact on process safety and the company’s sustainability. They may not 

readily detect critical correlations between seemingly tangential issues and process safety and major 

accident prevention. This shortcoming makes it difficult for boards to decide wisely on policy or strategy. 

For example, Chapter 3 discusses BP management employee’s individual performance contracts, which 

focused primarily on operational success measures such as drilling speed and well completions, and 

safety was rewarded in a lower percentage than other measures of operational success. Even where safety 

was mentioned, it related primarily to personal safety indicators, such as Recordable Injury Frequency 

and Days Away from Work Case Frequency. Without understanding the implications of this model, board 

members were not positioned to foresee potential shortcomings, and could not challenge this construct. 

Board decisions on setting corporate goals and objectives cascade through the organization through a 

traditional management-by-objective methodology.840 Thus, board decisions based on incomplete 

information could guide a company’s actions towards less safe operations in a push for target 

completions.841 In sum, board involvement and oversight of process safety management and major 

accident prevention can serve to sharpen a company’s focus on safety. Various tools, described in Section 

5.5, aim to improve levels of operational safety while boosting overall corporate performance.842 

 

 

840 See, e.g., Drucker, P. The Practice of Management; Harper & Row: New York, 1954 (establishing “management 

by objective” as the management theory most capable of driving execution in business through the balancing of 

competing corporate needs with goal-setting). However, critics of “management by objective,” including business 

scholars such as W. Edwards Deming, actually argued against management by objective, stating that a lack of 

understanding of contextual environment and other interrelated systems commonly results in the misapplication of 

objectives by managers and companies, and that setting production targets encourages resources to be allocated to 

meet those potentially arbitrary production targets through whatever means necessary, which can result in poor 

quality or other negative consequences. Deming, E. Out of the Crisis. 

841 In re: Oil Spill by the Oil Rig “Deepwater Horizon” in the Gulf of Mexico on April 20, 2010, Report of Expert 

Witness Patrick Hudson, PhD., pp 23-29 (describing BP’s decision to continue a strategy rooted in “loss 

avoidance” and a culture that “continued to encourage excessive risk taking in pursuit of commercial targets.”)

842 Martin Sedgwick & Angela Wands, The Implementation of Effective Key Performance Indicators to Manage 

Major Hazard Risks, testimony presented by Martin Sedgwick Head of Engineering ScottishPower/Iberdrola 

Group on July 23, 2012 at the CSB’s public meeting, “CSB Public Meeting: Safety Performance Indicators,” 

transcript pp 85-86, http://www.csb.gov/about/publichearing.aspx. See also Martin Sedgwick & Angela Wands, 

The Implementation of Effective Key Performance Indicators to Manage Major Hazard Risks, pp 2-3, 8, Figures 

10-12 (2012), presented by Martin Sedgwick Head on July 23, 2012.

000907
Macondo Investigation Report Volume 3 4/17/2016

219 

Corporate Governance “Underlying Cause” of Pike River Coal Mine Disaster –International 

Lessons for the Offshore Industry

Accident investigations from the entire spectrum of all high-hazard industries present opportunities 

for lessons learned that cross industry-specific boundaries. For example, accidents in coal mining, 

nuclear energy production, chemical manufacturing, oil refining, natural gas production, and even air 

travel all create learning opportunities for those who wish to avoid similar events. Many lessons from 

a variety of industrial accidents can be used to improve the safety of offshore drilling. For example, 

following the Pike River Coal Mine disaster in New Zealand that killed 31 people, the Royal 

Commission, which investigated the disaster, issued a 400-plus page report along with a series of 

associated safety recommendations.a

 Three of those recommendations focused on good corporate 

governance—something found to be lacking at the board level in that particular case and which the 

Royal Commission identified as an underlying cause of the disaster. 

The key failing of the Pike board of directors centered around the company’s rush to begin producing 

coal before it was ready to do so safely, particularly because this company was new, and this was its 

only coal mine. The board tried to make the mine productive as quickly as possible to staunch the flow 

of heavy borrowing for funding initial mine operations. The Royal Commission concluded that Pike 

had “not completed the safety systems and infrastructure needed to safely produce coal.”

The Royal Commission found that the Pike board provided ineffective oversight in risk management, 

internal reporting, and legal compliance, and that the board over-relied on management to bring to its 

attention significant safety issues; meanwhile, the board lacked efficient mechanisms to ensure 

management was meeting critical health and safety requirements. For example, the board did not 

know about the results of an insurance risk survey, which disclosed several significant safety risks, 

including the risk of methane gas explosion—the cause of the fateful disaster that claimed so many 

lives. Content to rely on management’s assurances about safety, including statements about methane 

gas being “more a nuisance and daily operational consideration than a significant problem or barrier 

to operations,” the board was not well positioned to hold management accountable or to act 

correctively. Instead the board remained “distracted by the financial and production pressures that 

confronted the company.” In addition to the tragedy of 31 miners killed in the blast, the company itself 

was believed to have been reduced instantly to “worthless” when it closed the mine and stopped 

production indefinitely. The court placed the company in receivership.b Eventually, the mine was sold, 

but its new owner has not yet conceived of a way to reopen the mine safely, whether for commercial 

mining, or just to recover the remaining 29 bodies of the 31 employees killed who remain entombed 

inside. 

At the time of the incident, Pike’s board had six members, but none of them were found to have any 

underground coal mining experience. The Chairman of the board had experience in metalliferous 

mining, but no professional experience with coal mining. In fact, shortly before the incident, the board 

realized there was a knowledge gap and undertook a search to find new board members to replace 

retiring board members who had underground coal mining experience. This is not unlike BP’s SEEAC 

committee’s lack of experience in offshore drilling, and BP’s resistance to the CSB’s 2007 BP Texas 

City recommendation that BP add an independent board member with professional training and 

experience in refinery operations and process safety management in light of the findings of that 

accident.

000908
Macondo Investigation Report Volume 3 4/17/2016

220 

.

The Royal Commission also found that the Pike board worked in a dysfunctional manner. It 

had three committees, one which focused on Health, Safety and Environment (HSE) 

consisting of two individuals: the Chairman and one board member who had professional 

training as a mechanical engineer. The HSE committee was tasked specifically with ensuring 

that “Pike provided a safe workplace, monitoring compliance with environmental consents, 

permits and agreements, and reviewing projects,” but it was not specifically asked to look at 

major hazards or to provide oversight on issues of catastrophic risk, notwithstanding Pike’s 

operations in underground coal mining, a high-hazard industry with well-known and 

significant potential for disaster. At the time of the explosion, the HSE subcommittee had not 

met for 13 months despite being chartered to meet at least once every six months, and no HSE 

committee meetings were scheduled for 2011. 

The HSE committee also had little knowledge of major legal compliance problems derived over the 

course of eight site visits by a leading mine safety consultant, and was only vaguely aware of a 

number of serious incidents in the months leading up to the fateful explosion. The committee also 

lacked an appreciation of the dangers associated with certain conditions at the mine, such as not 

having remote gas monitoring systems observable in the control room and inadequate ventilation 

systems combined with documented incidents where levels of methane gas reached its lower explosive 

limit within the mine.

In light of these failings, the Royal Commission made the following recommendations: 

• Recommendation 5: The statutory responsibilities of directors for health and safety in the 

workplace should be reviewed to better reflect their governance responsibilities.

• Recommendation 6: The health and safety regulator should issue an approved code of 

practice to guide directors on how good governance practices can be used to manage health 

and safety risks.

• Recommendation 7: Directors should rigorously review and monitor their organization’s 

compliance with health and safety law and best practice. 

The Royal Commission’s findings pertaining to the Pike River Coal board of director’s failures being 

an underlying cause of the disaster, and the recommendations intended to prevent recurrence of 

similar circumstances in the future, apply equally well to the formulation of corporate governance 

policy, guidance, and best practices in the offshore drilling environment in the Gulf of Mexico in the 

post-Macondo world. 

a Royal Commission on the Pike River Coal Mine Tragedy; Wellington, New Zealand, October, 2012; Volume 1: pp 12, 13, 

18, Volume 2: 46, 50, 5-55. http://pikeriver.royalcommission.govt.nz/vwluResources/Final-Report-VolumeOne/$file/ReportVol1-whole.pdf and http://pikeriver.royalcommission.govt.nz/vwluResources/Final-Report-Vol2-Part1-

only/$file/Report-Vol2-Part1-only.pdf (accessed October 7, 2015).

b Behrmann, E. Pike River Coal’s Future ‘Bleak’ After Mine Blasts. Bloomberg Business, November 24, 2010, 

http://www.bloomberg.com/news/articles/2010-11-24/pike-river-coal-s-future-bleak-after-new-zealand-mine-blast (accessed 

October 7, 2015).; NZ Oil and Gas. Receivers appointed for PRCL. Scoop Business Independent News, December 13, 2010, 

http://www.scoop.co.nz/stories/BU1012/S00406/receivers-appointed-for-prcl.htm (accessed October 7, 2015).

000909
Macondo Investigation Report Volume 3 4/17/2016

221 

5.4 US Financial Regulation Absent Regarding HSE Reporting

US securities laws and regulations contain numerous requirements for disclosure of material information 

to shareholders, whether the company issuing shares is a domestic or foreign company, so long as they 

issues shares in some form on US exchanges for trading. Most of these requirements are general, 

requiring interpretation of the company and its counsel as to whether a specific issue must be reported. 

Few specific data points relevant to a company’s health, safety, and environment operations are 

specifically required for disclosure to shareholders of companies trading in the US under regulations 

promulgated by the SEC pursuant to the Securities and Exchange Act of 1933 or 1934, Sarbanes-Oxley, 

Dodd-Frank, or any other existing financial law or regulation.843 

The obligation of companies to disclose information in shareholder reports or other communications 

includes not only the specifics required by SEC disclosure forms, but also the often more relevant 

requirement to disclose any other information necessary to prevent the disclosed information from being 

misleading. Yet, a recent investigation by Ceres, an internationally recognized public interest firm 

comprising representatives from over 100 institutional investment firms and other private sector 

organizations, found that “companies making extensive capital investments related to [environmental] 

climate change and deepwater drilling are failing to adequately disclose their substantial material risks in 

those areas.”844 In fact, the Ceres study showed that “based on the annual financial filings submitted in the 

first quarter of 2011 by ten of the world’s largest oil and gas companies, [the Ceres investigation] finds 

that none of them provided high quality reporting of their [environmentally-related] climate change and 

deepwater drilling risks and opportunities.”845 This is true despite the unique and numerous exposures to a 

variety of risk heightened by the “massive capital employed in the extractive industries and the 

importance of natural resource access and management to the national security and strategic objectives of 

the United States,”846 along with broader worldwide markets. 

Notwithstanding this exposure, “the SEC’s guidance for disclosure in these areas does not yet require 

complete, and therefore completely accurate, assessment of companies’ climate or deepwater drilling 

performance or risks.”847 This absence of a regulatory requirement limits the potential for increasing 

 

843 Regulation S-K, Item 103, a securities regulation enforced by the US Securities and Exchange Commission, 

presents a small but under-enforced exception. Item 103 requires disclosure of certain environmentally related 

legal proceedings where anticipated penalties could result in monetary sanctions of over $100,000. However, as 

one legal commentator observed, based on the US EPA’s own findings as well as a study by the University of 

Arkansas, documented noncompliance in this area by US corporations is as high as 74%.

844 Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012, p i. 

http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-sec-disclosure-by-major-oil-gascompanies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 2015).

845 Ibid. 

846 Bugala, P. Materiality of disclosure required by the Energy Security through Transparency Act; Calvert 

Investments: 2010; http://www.calvert.com/NRC/literature/documents/10003.pdf (accessed October 7, 2015).

847 Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012; p i. 

http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-sec-disclosure-by-major-oil-gascompanies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 2015).

000910
Macondo Investigation Report Volume 3 4/17/2016

222 

shareholder knowledge, and thus is an inherent limit on safety because shareholders are not equipped with 

the information needed to benchmark companies against one another, or to challenge decisions by 

corporate management or boards. 

However, the SEC does require disclosure of trends, events, and other uncertainties in the management 

discussion and analysis (MD&A).848 According to the SEC, one of most critical responsibilities includes 

“communicating with investors in a clear and straightforward manner,” not just for technical disclosure 

requirements or a recitation of financial statements in narrative form, but to share information about the 

company as seen through the eyes at the top of the corporate hierarchy and that is “informative and 

transparent”849 for the benefit of shareholders. One area for improvement by most Fortune 500 

companies, the SEC’s Division of Corporate Finance found, is “the focus and content of MD&A 

(including materiality, analysis, key performance measures and known material trends and 

uncertainties).”850 In fact, the SEC emphasized that: 

• companies should identify and discuss key performance indicators, including nonfinancial 

performance indicators, that their management uses to manage the business and that would be 

material to investors;

• companies must identify and disclose known trends, events, demands, commitments, and 

uncertainties that are reasonably likely to have a material effect on financial condition or 

operating performance; and

• companies should provide not only disclosure of information responsive to MD&A 

requirements, but also an analysis that is responsive to those requirements by explaining

management’s view of the implications and significance of that information851

These rules may have particular relevance to significant safety issues for offshore drilling, especially as 

shareholders appear to be pressing the SEC to articulate more clearly for companies the requirements 

concerning materiality about disclosures of enterprise risk issues. In response, the SEC is starting to seek 

greater disclosures from companies in these areas.852 

 

848 17 C.F.R. § 299.303. See also “Interpretation: Commission Guidance Regarding Management’s Discussion and 

Analysis of Financial Condition and Results of Operations,” Release Nos. 33-8350; 34-48960; FR-72 (December 

29, 2003), p 1: “Information provided in the MD&A by companies are “intended to elicit more meaningful 

disclosure in MD&A in a number of areas, including the overall presentation and focus of MD&A with general

emphasis on the discussion analysis of known trends, demands, commitments, events and uncertainties, and 

specific guidance on disclosures about liquidity, capital resources and critical accounting estimates.”

849 “Interpretation: Commission Guidance Regarding Management’s Discussion and Analysis of Financial Condition 

and Results of Operations,” Release Nos. 33-8350; 34-48960; FR-72, (December 29, 2003), pp 1-2.

850 Ibid., p 2.

851 Ibid., p 2.

852 Heller, M. SEC Encouraging Firms to ‘Tell Their Story’ in MD&A. November 25, 2014, 

http://ww2.cfo.com/auditing/2014/11/sec-encouraging-firms-tell-story-mda/ (accessed October 7, 2015). In 

addition to recommending a balanced summary of key challenges, drivers and risks, the SEC has recently been 

encouraging companies to disclose known trends and uncertainties, quantify components of overall changes in 

financial statement line items, and enhance their explanation and analysis of the factors causing those changes. 

000911
Macondo Investigation Report Volume 3 4/17/2016

223 

Case in point: After Macondo, the SEC corresponded with both BP and Transocean about statements they 

made pertaining to safety, insurance coverage, oil spill containment, and the like.853 Although helpful or 

even necessary under some circumstances, this type of back-and-forth dialogue could be minimized or 

avoided by enhanced SEC reporting requirements concerning what the securities regulator considers to be 

material information for companies engaged in offshore drilling (e.g., leading and lagging safety 

performance indicators, other related metrics such as KPI’s relating to health, safety and the environment, 

safety culture survey results, etc.), while helping shareholders and the investing public at large with 

enhanced information about the investment worthiness of companies engaged offshore, at least in terms 

of process safety and major accident prevention efforts.

That is why, rather than focusing on the individual companies involved in Macondo where compliance 

requirements appear to have been met, another option is a regulatory change at the SEC, requiring 

enhanced disclosure of drilling risks as a means of advancing the public policy interest of offshore drilling 

safety. This could be accomplished in the same manner that the Dodd-Frank Act now requires expanded 

disclosures about mine safety pursuant to Section 1503 of that legislation.854 Such disclosures could track 

those required of mining, with the addition of various leading and lagging safety performance indicators 

relevant to offshore, as well as records of citations or other enforcement activities. All of these records 

could better inform shareholders while causing boards, senior executives, and legal counsel to highlight 

results in these areas in annual reports, all of which have the potential to boost process safety 

performance.

Along these lines, in December 2010, the California and Pennsylvania state treasurers, whose pension 

funds had been affected by investments in companies offshore at the time of Macondo, requested that the 

National Oil Spill Commission make a recommendation to the SEC to develop new guidance specifically 

focused on deepwater drilling disclosures, and subsequently asked the SEC to take steps to improve 

existing reporting in this area.855 This request dovetails with a similar filing by the Social Investment 

Forum,856 which requested that the SEC (1) require all issuers to report annually on a comprehensive set 

 

853 BP corresponded with the SEC at least 13 times between August 10, 2010 and September 29, 2013, on matters 

ranging from disclosures about safety to issues pertaining to the oil spill, containment, and remediation. For an 

examples, see letter of August 6, 2010 to H. Roger Schwall of the SEC Re: BP plc, Form 20F for Fiscal Year 

Ended December 31, 2009 (the “Form 20F”), filed March 5, 2010, File No. 00106262; and letter of September 19, 

2013 to H. Roger Schwall of the SEC BP p.l.c. Form 20F for the Fiscal Year Ended December 31, 2012 filed 

March 6 2013 File No. 00106262. Similarly, Transocean engaged with the SEC in about the same fashion with 

respect to safety disclosures during a similar period. See letter OF September 23, 2014 to Peggy Kim of the SEC 

Re: Transocean Ltd. Revised Preliminary Proxy Statement on Schedule 14A, filed March 26, 2013, File 

No.053533; letter of September 23, 2014 to Karl Hiller of the SEC Re: Transocean Ltd. Form 10K for Fiscal Year 

ended December 31, 2013 filed February 27, 2014; and Response Letter of September 2, 2014 File No. 053533.

854 See The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, 124 Stat. 1376 

(2010).

855 Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012, p 7, 

http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-sec-disclosure-by-major-oil-gascompanies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 2015). 

856 The Social Investment Forum (now called US SIF), or The Forum for Sustainable and Responsible Investment “is 

the US membership association for professionals, firms, institutions and organizations engaged in sustainable, 

responsible, and impact investing. US SIF and its members advance investment practices that consider 

000912
Macondo Investigation Report Volume 3 4/17/2016

224 

of sustainability indicators using the Global Reporting Initiative’s reporting guidelines, and (2) issue new 

interpretive guidance that would clarify requirements relating to short- and long-term sustainability risks 

in the Management Discussion and Analysis section of the 10-K.857 Such indicators could already be 

implicated under applicable SEC guidance, which requires disclosure of “key performance indicators 

including non-financial performance indicators, that ... management uses to manage the business, and 

that would be material to investors.”858

Additional help for greater transparency with respect to health and safety issues may also come from 

another source as well: the Sustainability Accounting Standards Board (SASB), an independent nonprofit 

organization whose mission “is to develop and disseminate sustainability accounting standards that help 

public corporations disclose material, decision-useful information to investors.”859 Part of SASB’s 

mission is to help define materiality of sustainability metrics for determining what information belongs in 

a company’s SEC-required reports, across numerous industries and sectors. The SASB stated that its 

work involves “revealing the value of material information about companies’ environmental stewardship, 

social policies and corporate governance,” and that its mission is to develop and disseminate 

sustainability accounting standards that help public corporations disclose material, decision-useful 

information to investors. SASB describes its decisions regarding which criteria are material as evidencebased, meaning it established standards for what they were able to find evidence of financial materiality. 

SASB created health, safety, and emergency management reporting standards for both onshore and 

offshore operations, though currently SASB standards recommend different metrics for the two. For 

onshore activities, SASB references API RP 754 Tier 3 challenges to safety systems indicator rates, as 

well as a discussion of measuring operations discipline and management system performance data 

through reporting of a Tier 4 indicator (see Section 3.4.2). As indicated in Chapter 3.0, Tier 3 and 4 

indicators also can be developed for offshore operations. Adding these types of reporting requirements, as 

well as other potential indicators (e.g., specific metrics that relate to safety culture) could make SASB’s 

recommendations more informative to shareholders, which in turn could drive major accident prevention. 

5.5 The Offshore Regulator’s Role – An International Perspective

In other countries with active offshore drilling, regulators are engaging corporate boards of directors on 

process safety by (1) conducting audits and investigations with a specific focus on factors that can inform 

 

environmental, social and corporate governance criteria to generate long-term competitive financial returns and 

positive societal impact.” http://www.ussif.org/about. 

857 Letter from Lisa Woll, CEO of SIF to the Honorable Mary L. Schapiro, Chairman of the US Securities and 

Exchange Commission, July 21, 2009, p 2.

858 Coburn, J.; Salmon, R.; Grossman, D. Sustainable Extraction? An Analysis of SEC Disclosure by Major Oil & 

Gas Companies on Climate Risk & Deepwater Drilling Risk; CERES: August, 2012; p 9, citing 2003 SEC 

MD&A Guidance at p. 3. http://www.ceres.org/resources/reports/sustainable-extraction-an-analysis-of-secdisclosure-by-major-oil-gas-companies-on-climate-risk-and-deepwater-drilling-risk/view (accessed October 17, 

2015).

859 http://www.sasb.org/sasb/vision-mission/ (accessed October 7, 2015). SASB’s vision is also instructive: “SASB 

envisions a world where a shared understanding of corporate sustainability performance allows companies and 

investors to make informed decisions that drive value and improve sustainability outcomes.”

000913
Macondo Investigation Report Volume 3 4/17/2016

225 

management teams and boards of directors to drive major accident prevention, and (2) providing training 

and a number of good practice documents. These efforts can help corporate boards to take a more active 

oversight role in HSE matters and to ensure adequate protections against hazards and risks are in place for 

their companies. 

Conversely, US regulators have not yet promulgated good practice guidance and training materials on 

corporate governance with specific reference to process safety, major hazards, or catastrophic risk in the 

offshore environment. BSEE can learn from these other jurisdictions, following up on its new safety 

culture policy guidance, by fashioning its own broader guidance on good practice in corporate 

governance, and then by engaging boards of directors through training and other initiatives. BSEE is best 

positioned to work with other government agencies, industry, labor, environmental groups, and interested 

stakeholders on creating guidance for the offshore industry in the US. 

5.5.1 Norway: Management Findings from Audits and Investigations 

In Norway, the Petroleum Safety Authority (PSA) studied serious drilling, production, and refining 

incidents of all types, especially offshore. PSA’s audits and investigations led to a number of important 

findings and suggested practices that advance major accident prevention and safety improvement 

offshore, some focusing on corporate governance. For example, PSA’s work demonstrated that a 

management team’s focus on safety—complemented by the involvement and oversight provided by its 

board of directors—makes a significant difference in a company’s safety performance in major accident 

prevention. Specifically, “Experience confirms that management of major accident risk is part of a 

continuous interplay between actions that permeate all the activities and are integrated in the way the 

management runs the activities, also at the company [Board] level.”860 

Drawing from its history of offshore investigations, PSA initiated a study to review past incidents and 

surveys of 11 major offshore operators. PSA distilled important factors that can inform management 

teams and boards of directors to drive major accident prevention in their organizations, many of which 

echo the CSB’s findings in Volume 3. They include: 

1. Clarity in the distribution of responsibilities concerning prevention of major accidents, 

including among various levels of corporate leadership; 

2. Knowledge of and attention to major accident risk inherent in the company’s activities, 

including major accident risk associated with change processes;

3. Capacity and competency in the organization regarding handling the risk of major accidents; 

4. Ability to learn from serious incidents; and 

5. Ability to effectively self-evaluate the overall work needed to reduce the risks of major 

accidents.861

 

860 Petroleumstilsynet (Petroleum Safety Authority Norway). Managing the Risk of Major Accidents in a 

Governance Perspective; http://www.ptil.no/getfile.php/PDF/REB-TX-17303-

tilsyn%20styring%20storulykkesrisiko%20samlerapport-eng%20%28endelig%20versjon%29.pdf (accessed 

October 7, 2015). 

861 Ibid., pp 3-4. 

000914
Macondo Investigation Report Volume 3 4/17/2016

226 

PSA also found other factors that could positively influence major accident prevention through effective 

board oversight. One key finding was understanding that “links between different processes and goals are 

under-estimated, including safety-related consequences of cost reductions, organisational changes and 

incentive schemes.”862 Boards of directors can make a priority of monitoring management of 

organizational changes, in light of a board’s fiduciary duties and the scope of information that should be 

available to boards for their high level oversight. Another pair of related findings focused on the 

commonalities of high-reliability organizations, including an organization’s attention to “so called weak 

signals of hazardous conditions and their approach to uncertainty, complexity, redundancy and learning,” 

including the use of activities such as resilience engineering, and an “emphasis on the connections 

between different processes ... which together can affect the organization’s ability to monitor, predict and 

interpret factors that are important for major accident risk.”863 Again, board oversight can guide a 

corporation’s CEO and senior management team along appropriate pathways through varied means, 

seeking the right balance between competing factors (e.g., production pressures versus safety, etc.) in a 

suitable enterprise risk framework.

PSA repeatedly identified the need for clarity in managerial roles because different functions, tasks, 

disciplines, and operations each have their own particular role and importance in safety. PSA noted that 

phrases such as “responsibility rests with the line” are too ambiguous to ensure that line managers 

understand the risk they are accountable for, or that they have the information they need to handle that 

particular risk, and the means to handle relevant responsibilities. Based on PSA’s work in this area, the 

CSB finds that individual directors working collectively would benefit from the same role clarification 

within the corporate framework so that they can play an appropriate role in their company for the risks 

they face. The obligation for safety rests with the board, which must ensure safety responsibilities are 

divided and managed appropriately throughout all managerial levels, and which the board must monitor 

and assess.

PSA also noted that in many of its investigations following major accidents, organizations had been 

“confronted with clear and repetitive symptoms of deterioration of safety-critical barriers,” but the 

“information was not recognized as alarming and/or was not adequately handled.” PSA found that much 

of this phenomena stemmed from two possible causes: (1) faulty assumptions (e.g., safe historical 

performance which appeared to provide reliable information about risk, so that a decline in the number of 

incidents by itself unreasonably became an indicator of the robustness of barriers that are preventing 

accidents), or (2) “systematic under-estimations” of the importance that a myriad of potential changes 

could have on corporate safety ranging from new investments, procurements, alliances, mergers, change 

processes, inadequate safety margins, or even an exaggerated confidence at the company level in the 

systems or barriers standing in the way of a major accident. Boards of directors are perfectly situated to 

monitor all of these issues though effective and ongoing oversight, in a management of change capacity, 

provided they are engaged, have all relevant information, and are positioned to test or, if needed, to 

challenge management’s words and actions. 

 

862 Ibid., p 7. 

863 Ibid., p 7. 

000915
Macondo Investigation Report Volume 3 4/17/2016

227 

5.5.2 United Kingdom: Guidance and Training

In the UK, seminal guidance jointly published by that country’s Health and Safety Executive and the 

Institute of Directors & Health and Safety Executive offers three essential principles that corporate boards 

of directors must heed to drive effective corporate governance in health and safety:

1. Boards must take ownership of health and safety from the top down using a strong downward 

communication and management approach that demonstrates the board is leading the 

initiative in an active and visible manner, and that health and safety is integrated into the 

business from the highest level in terms of how management and safety decisions are made. 

2. Boards must engage the workforce in promoting and achieving safe and healthy conditions, 

creating the means for effective upward communication with employees, while providing 

high-quality training aimed toward safe operations. 

3. Boards must identify and manage key health and safety risks, seeking and following

competent advice, and then monitoring, reporting, and reviewing safety performance. In a 

recommended good practice, at least yearly, HSE indicates that each board member should 

seek to understand and record all relevant data, including auditing results and conclusions 

from relevant reports, and ensure the information is communicated in the company’s annual 

reports to investors and stakeholders.864

 

864 Insititute of Directors, Health and Safety Executive. Leading Health and Safety at Work: Actions for directors, 

board members, business owners, and organisations of all sizes; INDG417(rev1), June, 2013, p 1. 

http://www.hse.gov.uk/pubns/indg417.pdf (accessed October 7, 2015). Many of these same ideas have also been 

captured and expanded on separately in another helpful treatise produced by IOSH, the chartered body for health 

Major Accidents and Corporate Integrity

The Norwegian oil company Statoil, an example of strong corporate governance, 

provided helpful testimony at the CSB’s two-day safety performance indicators event 

in July 2012. According to Statoil’s Vice President of HSE Competence Centre, the 

company’s CEO recently noted that the two top threats to Statoil are major accidents 

and a loss of [corporate] integrity.a Along those lines, three of Statoil’s top four focus 

areas for HSE are Leadership and Compliance to our Governing [Governance] 

System, Improved Risk Management, and Simplification and Harmonization of Work 

Processes and Governing System.b Based on the testimony presented, these activities 

suggest healthy corporate governance, competent ERM, active efforts aimed at 

nurturing of a robust safety culture, and a sustainable company overall. 

a Eie, G. Performance Indicators for Major Accident Prevention, CSB Public Hearing: Safety 

Performance Indicators, Houston, TX, July 24, 2012, slide 2. 

http://www.csb.gov/UserFiles/file/Eie%20(Statoil)%20PowerPoint.pdf (accessed October 7, 2015).

b Ibid., pp slide 3; see also Statement of Statoil delivered by Guhild Holtet Eie at CSB Public Hearing: 

Safety Performance Indicators, Houston, TX, July 23-24, 2012, p 184. 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

000916
Macondo Investigation Report Volume 3 4/17/2016

228 

To implement this guidance, HSE lays out a multi-step series of elements in the form of desired “core 

actions,” which include planning, delivering, monitoring, and reviewing a company’s health and safety 

performance, with each step having a number of key components recommended to create full board 

engagement. HSE explains that these core actions are to be effected through a series of good practices 

which are practical, actionable steps that help to aim a board’s actions toward an increasingly safer 

company. This and other guidance provides boards with an action-oriented checklist by which directors 

can methodically consider their corporation’s performance in HSE matters, both good and bad, with an 

eye toward continual improvement.865 

Combined, these factors can spark board discussion and engagement during oversight activities and 

management of executive performance, as well as the fuller scope of corporate activities more generally. 

By doing so, boards can be challenged to think through worst-case scenarios of instances when leadership 

may fall short in meeting responsibilities, or even where regulators may need to step in to address issues 

of compliance that management did not handle appropriately. 

In 1999, the UK’s FRC adopted guidance for risk management and internal controls, Internal Control: 

Guidance for Directors on the Combined Code,

866 commonly referred to as the Turnbull Guidance, 

advising on oversight responsibilities, decision-making activities, and communications expected of 

corporate boards of directors across the full spectrum of corporate activity. The Turnbull Guidance also 

helps directors understand their obligations under existing British law.867 

In addition to detailing the many critical areas for board member involvement and direction, the Turnbull 

Guidance and requirements of its Combined Code enshrined in British law notes that board members may 

have to play an even more significant role in certain areas, depending on the nature of a corporation’s 

business operations. This approach recognizes the need for “a degree of flexibility ... boards must see 

 

and safety professionals in the U: Eves, D.; Gummer, J. Questioning Performance: Essential Guide to Health, 

Safety and the Environment ; IOSH Services Ltd: Wigston, United Kingdom, 2011.

865 See generally Leading Health and Safety at Work: Actions for directors, board members, business owners, and 

organisations of all sizes; INDG417(rev1); June, 2013; http://www.hse.gov.uk/pubns/indg417.pdf (accessed 

October 7, 2015); see also Health and Safety Executive. Leadership for the Major Hazard Industries; 

INDG277(rev1); September, 2011; http://www.hse.gov.uk/pubns/indg277.pdf (accessed October 7, 2015)., a 

booklet produced for senior leadership to help them achieve “continuous improvement in health and safety;” Eves, 

D.; Gummer, J. Questioning Performance: Essential Guide to Health, Safety and the Environment ; IOSH 

Services Ltd: Wigston, United Kingdom, 2011, explaining that directors must communicate its attitude and 

expectations around health and safety, the articulated intention of going “beyond compliance” and the desire for a 

level of HSE performance that delivers cost savings in accident prevention and reduction in lost days, the board’s 

position that HSE is a business risk to be managed, and the board’s recognition that it needs to know how the 

company is managing HSE functions to uphold the company’s reputation.

866 The Institute of Chartered Accountants. Internal Control Guidance for Directors on the Combined Code; The 

Institute of Chartered Accountants: London, England, September, 1999; 

http://www.ecgi.org/codes/documents/turnbul.pdf (accessed October 7, 2015).

867 Accomplishment of HSE recommended “good practices” and compliance with the Turnbull Guidance is in accord 

with the “UK Corporate Governance Code,” maintained and enforced by the UK’s Financial Reporting Council, 

the UK analog to the United States’ Securities and Exchange Commission. See The Financial Reporting Council. 

The UK Approach to Corporate Governance; October, 2010; https://www.frc.org.uk/OurWork/Publications/Corporate-Governance/The-UK-Approach-to-Corporate-Governance.aspx (accessed October 

7, 2015). 

000917
Macondo Investigation Report Volume 3 4/17/2016

229 

good governance as a means to improve their performance, not just a compliance exercise. To be effective 

it [governance] needs to be implemented in a way that fits the culture and the organization of the 

company. This can vary enormously . . . depending on factors such as size, ownership, structure and 

complexity of activities.”868 

Additionally, the Turnbull Guidance cautions boards that assembling a list of risks for the board’s 

attention and action is a “multidimensional” exercise.869 The guidance pointedly asks directors, “Are the 

significant internal and external operational, financial, compliance and other risks identified and assessed 

on an ongoing basis? (Significant risks may, for example, include those related to market, credit, liquidity, 

technological, legal, health, safety and environmental, reputation, and business probity issues.)”870

Turnbull makes clear that where such issues are present, it is incumbent upon the board members to play 

a larger role than might otherwise be expected of a board member at a company that does not face those 

same risks. The updated Turnbull Guidance (2005)871 continues to instruct directors to drive health and 

safety from the top of the organization, thereby protecting their respective companies from all manner of 

harm, including catastrophic risk. 

To facilitate existing UK corporate legislation’s effectiveness, and to complement written guidance and 

training materials, the UK provides corporate boards of directors with other sources of best practices and 

training materials through partnerships with trade groups and professional associations. For example, at a 

2012 conference on corporate governance, Judith Hackitt, Chair of the UK HSE spoke of the agency’s 

“Process Safety Leadership Programme” aimed at board and senior executive level, along with its 

“Principles of Process Safety Leadership,” that industry had “enthusiastically adopted.” 872 This model is 

touted as a successful alternative to the more traditional approach of introducing tougher legislation in the 

face of challenges. Despite calls for more stringent regulation, a voluntary partnership between 

government and industry in the UK is being pursued, but as Ms. Hackitt warned, “If you believe, as I 

think you do, that a voluntary approach is preferable to regulation then demonstrate that you can deliver 

 

868 The Financial Reporting Council. The UK Approach to Corporate Governance; October, 2010, p 6. 

https://www.frc.org.uk/Our-Work/Publications/Corporate-Governance/The-UK-Approach-to-CorporateGovernance.aspx (accessed October 7, 2015). 

869 Belcher, A. Corporate Risk Managment and Legal Strategy. In Legal Strategies: How Corporations Use Law to 

Improve Performance; Masson, A., Shariff, M. J., Eds.; Springer-Verlag Berlin Heidelberg: New York, 2010; p 

262. Citing Turnbull Guidance and its various focus areas envisioned for corporate boards of directors. 

870 The Institute of Chartered Accountants. Internal Control Guidance for Directors on the Combined Code; The 

Institute of Chartered Accountants: London, England, September, 1999; Appendix, p 13. 

http://www.ecgi.org/codes/documents/turnbul.pdf (accessed October 7, 2015).

871 Financial Reporting Council. Internal Control-Revised Guidance for Directors of the Combined Code; The 

Financial Reporting Council: London, October, 2005; https://www.frc.org.uk/getattachment/5e4d12e4-a94f-4186-

9d6f-19e17aeb5351/Turnbull-guidance-October-2005.aspx (accessed October 7, 2015). Based on the information 

gathered by this group, the FRC found that “respondents considered that substantial improvements in internal 

control instigated by application of the Turnbull guidance have been achieved without the need for detailed 

prescription as to how to implement the guidance,” all through the use of a “principles-based approach [that] has 

required boards to think seriously about control issues and enabled them to apply the principles in a way that 

appropriately dealt with the circumstances of their business.”

872 Hackitt, J. (HSE Chair) Why Corporate Governance and Why Now?, Conference on Corporate Governance for 

Process Safety, Paris, France, June 14-15, 2012, 

http://www.hse.gov.uk/aboutus/speeches/transcripts/hackitt140612.htm (accessed October 7, 2015).

000918
Macondo Investigation Report Volume 3 4/17/2016

230 

and don't take too long to do it.”873 Hackitt also commented on the fact that major hazards industries 

within the UK are starting to deliver training to executives and board members on process safety 

management.874 

The UK’s tripartite Step Change for Safety also contributed with similar initiatives. Step Change for 

Safety hosted a number of informational trainings and discussions focused on good governance and safety 

leadership, which benefited leaders at all levels in industry, including boards and senior management.875

In parallel, the UK’s Chemical Industries Association876 also created guidance for boards of directors in 

effective process safety leadership within the UK’s chemical industry. This guidance includes 

establishing:

• A board champion for process safety, ensuring discussion at all board meetings to review 

performance and set priorities;

• Communication of process safety policies, stressing the importance set by the board and the 

role of people at all levels in protecting against major hazards;

• Visibility of board-level management (e.g., visiting control rooms, making presentations on 

major hazard risks);

• Use of effective leading and lagging process safety performance indicators to allow boardlevel monitoring;

• Board-endorsed formalized process safety improvements plan for ensuring continuous 

improvement; and 

• Outward-looking approaches taken by the company, and the board itself, including a crossindustry approach to learning and sharing the lessons from incidents.877

 

873 Hackitt, J. (HSE Chair) Why Corporate Governance and Why Now? Conference on Corporate Governance for 

Process Safety, Paris, France, June 14-15, 2012, 

http://www.hse.gov.uk/aboutus/speeches/transcripts/hackitt140612.htm (accessed October 7, 2015).

874 Hackitt, J. (HSE Chair) Why Corporate Governance and Why Now? Conference on Corporate Governance for 

Process Safety, Paris, France, June 14-15, 2012, 

http://www.hse.gov.uk/aboutus/speeches/transcripts/hackitt140612.htm (accessed October 7, 2015).

875 https://www.stepchangeinsafety.net/about-step-change-safety/previousevents. 

876 The Chemical Industries Association includes primarily chemical and pharmaceutical companies, as well as some 

drilling services and petrochemical companies, http://www.cia.org.uk/AboutUs/AboutCIA.aspx (accessed October 

7, 2015). 

877 Chemical Industries Association. Best Practice Guide: Process Safety Leadership in the Chemicals Industry; 

Chemical Industries Association: London, 2008, in Ellis, G. Process Safety Begins in the Board Room. Chemical 

Processing, March 21, 2013, http://www.chemicalprocessing.com/articles/2013/process-safety-begins-in-theboard-room/?show=all (accessed October 7, 2015). 

000919
Macondo Investigation Report Volume 3 4/17/2016

231 

Case Study: Board of Directors’ Vital Role

Under the auspices of the Health and Safety Commission, the HSE published a series of case studies 

demonstrating the vital role of directors in ensuring that risks are properly managed in all types of 

companies and industries.a Of particular note is the case study on Amec, a UK company that serves 

the oil and gas, clean energy, environment and infrastructure, and mining markets.b According to 

HSE’s case study, Amec’s corporate governance includes:

• One of the company’s directors having the necessary experience in petrochemicals, oil 

and gas, and gas pipelines across the company’s many business lines and in operations 

around the globe;

• A corporate approach to safety that is rooted in major accident avoidance; 

• Board-level training initiatives including a variety of health and safety training courses 

germane to high-hazard industries, as well as the creation of company-specific programs 

such as Amec’s SHAPE (Safety and Health in Amec Process & Energy) program with a 

specific emphasis on process safety;

• A deep commitment for the Director who leads safety oversight and other initiatives on 

behalf of the board, which includes: 

o monthly safety briefings at Board meetings, 

o real-time updates on safety incidents that are occurring, 

o his or her own personal performance contract with safety goals that are available 

for all the company to see on the company’s intranet, 

o personal site visits at least once per month, 

o operational safety reviews for all businesses quarterly, 

o an annual review of each business that specifically covers HSE and sustainability, 

o sit-down discussions during all site visits with local management teams focused 

on safety, 

o a companywide safety, health, and environment conference every two years; and

• Consistent corporate policies, as well as: 

o procedures for hazard identification, risk assessment, and controls, 

o documented plans and objectives, 

o a clear management structure with established responsibilities, 

o competence assurance and training, 

o excellent communications and timely notifications, 

o established operating procedures, document control, performance indicators, 

o investigations and documentation of findings, and 

o an audit system, management reports and management reviews. 

a McMahon, A.; Shaw, J.; Cash, B.; Wright, M.; Antonelli, A. Case studies that identify and exemplify Boards of Directors 

who provide leadership and direction on occupational health and safety; Research Report 499; Greenstreet Berman Ltd: 

Reading, Berkshire pp 26-47. http://www.hse.gov.uk/research/rrpdf/rr499.pdf (accessed October 7, 2015); Health and 

Safety Executive. Case Studies-Successful Leadership, http://www.hse.gov.uk/leadership/casestudies.htm (accessed 

October 7, 2015).

b http://www.amecfw.com/aboutus/at-a-glance (accessed October 7, 2015).

000920
Macondo Investigation Report Volume 3 4/17/2016

232 

5.6 Conclusion

Board engagement in major accident risk management has the potential to make companies safer, 

assuming boards receive all relevant information needed to inform decision-making, and the board 

members are empowered to use the information for the benefit of the company. Good communication of 

those efforts could also then ensure that shareholders receive critical information to hold management, 

and even the board itself, accountable for a company’s safety performance. Thus, a collateral benefit of 

improved corporate transparency creates an additional layer of safety oversight that comes from the 

informed self-interest of the corporations’ shareholders. Good safety practices and oversight then become 

self-reinforcing from an additional perspective as the company’s equity owners continually obtain 

information needed to monitor their boards and their companies’ safety performance. Transparent 

reporting rounds out the system of checks and balances needed to maximize effective corporate 

governance, and thus sustainability. 

With appropriate guidance and increased board engagement through interactions with the regulator, more 

effective board governance can be encouraged, which can translate into a more mature and robust 

corporate safety culture for companies, with the result being improved major accident prevention fostered 

by continuous and effective oversight. Additionally, future modifications to existing SEC regulation or 

other guidance could better guide the entire offshore industry toward greater transparency, helping to 

focus boards more specifically on process safety and major hazard risks, leading to shareholders 

empowered with sufficient information to help guide their own decision-making and potential advocacy 

efforts. Meanwhile, BSEE is well positioned to begin to engage with the US offshore industry, as the 

agency’s international counterparts are doing, to promote major accident prevention through yet another 

established mechanism. 

000921
Macondo Investigation Report Volume 3 4/17/2016

233 

6.0 Culture for Safety: Focus and Response 

“A strong safety culture cannot eliminate all accidents, 

especially in technologically complex and dynamic 

industries such as deepwater drilling. There is always a risk 

that an accident will happen. Strong safety cultures can 

reduce the likelihood of accidents and the severity of 

accidents should they occur.”878 For this reason, the CSB 

addresses culture—as it relates to Macondo, and more 

broadly to major accident prevention—as part of the human 

and organizational analysis presented in this volume. 

Throughout Volumes 2 and 3, the CSB Macondo report 

addresses technical, organizational and operational barrier 

failures that were intended to create multiple layers of 

defense so that no single barrier became an exclusive line of defense. James Reason describes how culture 

affects such a defense-in-depth879 approach: “Because of their diversity and redundancies, the defensesin-depth will be widely distributed throughout the system. As such, they are only collectively vulnerable 

to something that is equally widespread. The most likely candidate is safety culture. It can affect all 

elements in a system for good or ill.”880 

This evidence given in these CSB volumes reveals that the BP and Transocean organizational cultures did 

not promote process safety. Both companies exhibited organizational behaviors and practices depicting an 

overarching focus on personal safety without equal attention to managing the barriers and control systems 

for preventing major accident events. Furthermore, evidence suggests both companies had an 

organizational focus more akin to minimal compliance with US regulations. To various degrees, both 

companies exhibited the following organizational behaviors that were detrimental to process safety: 

• Poor adherence to their own corporate major hazard management policies, which contained more 

stringent risk reduction responsibilities than regulations stipulated (Chapters 1.0 and 4.0); 

• Inadequate consideration for human and organizational factors in work planning, risk assessment, 

and incident investigations (Chapters 1.0 and 2.0); 

• Inadequate individual performance contracts and bonus structures with limited inclusion of 

process safety goals (Chapter 3.0);

• Inadequate development and usage of relevant process safety performance indicators (Chapter 

3.0); 

• Failed efforts aimed toward bridging major risks (Chapter 4.0); and

• Boards of Directors not sufficiently engaged in process safety (Chapter 5.0). 

 

878 Expert report of Kathleen M. Sutcliffe, October 17, 2011, for the United States District Court for the Eastern 

District of Louisiana, MDL No. 2179, Section: J, re. Oil Spill by the Oil Rig “Deepwater Horizon” in the Gulf of 

Mexico, on April 20, 2010, p 92.

879 Defense-in-depth is discussed in the CSB Macondo Investigation Report, Volume 2, Section 4.2, pp 51-52.

880 Reason, J. A Life in Error 2013, p 81. 

Chapter 5.0 Overview 

This chapter briefly explores the issue 

of culture, highlighting the challenges 

through a review of relatively recent 

safety culture surveys conducted by 

BP and Transocean. Measuring and 

influencing safety culture is a 

challenge that continues to deserve 

industry and regulator attention.

000922
Macondo Investigation Report Volume 3 4/17/2016

234 

This chapter briefly defines culture as a concept that needs to be understood, along with some of the 

underlying complexities in interpreting and working with culture. To illustrate these challenges, the 

chapter describes a number of safety culture assessments conducted of BP and Transocean both preceding 

and post-incident. The chapter then discusses how culture can be influenced from the top of an 

organization and addresses efforts BSEE implemented to encourage a focus on a culture for safety 

offshore. 

6.1 Assessing Culture and whether it Promotes Process Safety

Organizational culture refers to the characteristics of the environment, such as the values, rules and 

common understandings that influence employees’ perceptions and attitudes. A culture for process safety 

refers to those environmental characteristics that influence employees’ perceptions and attitudes about the 

importance the organization places on process safety.

881 Many aspects of an organization’s culture are 

unstated, underlying, and often operate at a subconscious level. As such, efforts to assess and change 

culture are challenging.

882 Frequently depicted visually as an iceberg, only a small portion of culture is 

actually observable (Figure 6-1). Examples of these artifacts include the proclaimed values of the 

company, the messages it communicates to its management, workforce, and the public; the policies it 

establishes and the practices it implements; and the organizational behaviors it exhibits in its daily 

operation. But underneath the water’s surface are the shared values and assumptions that might not be so 

readily apparent—the norms, attitudes, actual values, shared understandings, and basic assumptions that 

drive employee behavior and performance.883 Change must occur throughout the entire iceberg for culture 

to be impacted.

 

881 Haber, Sonja, Culture for Safety, Human Performance Analysis, Corp., February 17, 2016. CSB Learning 

Seminar.

882 Schein, Edgar H. 2004. Organizational Culture and Leadership, 3rd ed., Jossey-Bass: San Francisco, CA, pp 25-

37.

883 Haber, Sonja, Culture for Safety, Human Performance Analysis, Corp., February 17, 2016. CSB Learning 

Seminar.

000923
Macondo Investigation Report Volume 3 4/17/2016

235 

Figure 6-1. Visual representation of organizational culture, based on Edgar Shein's levels of culture.

884

The observable artifacts tell only one piece of the culture story, but they are the outcomes of the shared 

understandings and fundamental assumptions. They can provide clues of disparities between proclaimed 

cultural values and actual shared values. Therefore, culture is expressed not only in the stated goals, 

policies, procedures, and practices that a company formally adopts to enhance process safety, but also in 

the actual commitment by leaders, management, and the workforce to meet those corporate requirements. 

This commitment impacts “how the organization behaves when no one is watching” 885 and influences 

decisions by personnel at all levels of the organization.

Comparing what actually happens in the organization to the proclaimed values and stipulated corporate 

policies provides insights into the unstated values of the organization that influence daily worker actions 

and decisions. Incongruences between the proclaimed values and the actual practices give evidence that 

 

884 Schein, Edgar H. 2004. Organizational Culture and Leadership, 3rd ed., Jossey-Bass: San Francisco, CA, pp 25-

37.

885 American Institute of Chemical Engineers (AICHE). Safety Culture: What is at Stake?; Safety Science 2015, 77, 

pp 102-111.

000924
Macondo Investigation Report Volume 3 4/17/2016

236 

what is being said is not necessarily indicative of the actual culture and the basic assumptions at the 

organization’s core. The practice(s) reflect the actual values.886 With this perspective, the CSB examines a 

number of culture assessments of BP and Transocean in the next section. 

6.2 Culture Assessments of BP and Transocean

In the years leading up to the Macondo incident, both BP and Transocean commissioned reviews of their 

respective safety cultures. For BP, the review took the form of the Baker Panel commission, which was 

prompted by an urgent CSB recommendation in response to the 2005 BP Texas City explosion.887 In that 

post-incident safety culture assessment, the Baker panel noted five fundamental observations concerning 

BP’s safety with respect to its US refineries:

1. BP had not provided effective process safety leadership to establish a focus on process safety as a 

core value, rather emphasizing personal safety; 

2. BP had not established a positive, trusting, and open environment with effective lines of 

communication; 

3. BP had not always ensured it identified and provided resources, both financial and human,

required for strong process safety performance; 

4. BP did not effectively incorporate process safety consideration into management decisions; and 

5. BP did not instill a common, unifying culture among its various refineries.

Arriving at these conclusions, the Baker panel employed a multifaceted approach that included (but was 

not limited to) a process safety culture survey of the BP refinery workforce and interviews with corporatelevel management. 

A culture/climate review of Transocean’s North American Division (including the Deepwater Horizon) 

was commissioned by the company months before the Macondo incident, after the company experienced 

four separate fatality incidents.888 The review determined that, in some respects, the company displayed 

evidence of a relatively strong culture for safety:

889

Overall, [...] Deepwater Horizon was relatively strong in many of the core aspects of safety 

management. The strong team culture onboard Deepwater Horizon and the levels of mutual trust 

evident between crews means that the rig safety culture was deemed to be robust, largely fair, and 

inclusive, which was contributing to a 'just culture.'... The findings from the [...] review 

 

886 Wilkinson, P., 2016, Culture: Values and Practices – can you have one without the other? p 2, available at the 

csb.gov website; Hopkins, A., 2005. Safety, Culture and Risk, CCH Australia Ltd, pp 6-11

887 The Baker Panel. The Report of the BP US Refineries Independent Safety Review Panel; January, 2007, p 94. 

http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015). 

888 Internal Company Document, Transocean, Transocean Launches Evaluation Safety and Processes and Culture, 

October 21, 2009, TRN-MDL-04335708. 

http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX-52646.pdf (accessed October 8, 

2014).

889 Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North America 

Division Summary Report, July 2, 2010, see Exhibit 0929, TRN-HCEC-00090579, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015).

000925
Macondo Investigation Report Volume 3 4/17/2016

237 

indicated that the overwhelming majority of participants felt empowered with regard to safety on 

the rig. In particular, almost everyone felt they could raise safety concerns and these issues would 

be acted upon if this was within the immediate control of the rig. Supervisor support for 

legitimate safety concerns was praised on a number of occasions, and it was clear that issues were 

elevated (when appropriate) via line management structures. In short, individuals reported that 

they could confidently approach rig management with any safety concerns they may have, 

knowing that, if their concern is justified, they will receive full backing.

Yet a disparity between rig culture and the larger organization was also identified. The review followed 

the positive statements about culture by noting, “It must be stated at this point, however, that the 

workforce felt that this level of influence was restricted to issues that could be resolved directly on the rig, 

and that they had little influence at Divisional or Corporate levels.”890 This finding alludes to the 

influential role of leadership from the highest levels on culture, particularly on important issues like 

communication, trust, and engagement throughout the organizational hierarchy. The review went on to 

describe several safety issues, including management and communication of change and the complexities 

and inconsistencies with implementation of the various risk management policies. Section 4.3 highlighted 

a number of specific disparities between corporate policy and worksite practice. 

Post-Macondo, BP commissioned another safety culture assessment of its organization, which concluded 

that “BP succeeded in creating a well elaborated safety culture,”891 citing evidence that the company 

regularly and continuously reflects on safety performance and the causes of incidents, makes efforts to 

learn from them in real time in both formal and informal ways, and encourages learning and continuous 

improvements in safety in the programs, policies and procedures it has implemented. 892 While this 

professional assessment of safety culture certainly identified strong points in the organization, in its 

attempt to examine how the safety culture is enabled, enacted, and elaborated,

893 it did not assess whether 

the company’s policies for risk management and operational success were followed at Macondo. 

A culture that truly promotes safety extends beyond workers’ perceptions, espoused values, and 

documented policies. As described in Section 6.1, a culture for safety is characterized not only by goals, 

policies, and procedures, but by the company’s commitment to them and what it actually does. Chapters 

1.0 and 4.0 describe many situations where the company did not initiate or uphold safety policies meant 

to manage major accident hazards. For example, Transocean’s planning and risk management processes 

 

890 Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North America 

Division Summary Report, July 2, 2010, see Exhibit 0929, TRN-HCEC-00090579, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015).

891 Expert report of Kathleen M. Sutcliffe, October 17, 2011, for the United States District Court for the Eastern 

District of Louisiana, MDL No. 2179, Section: J, re. Oil Spill by the Oil Rig “Deepwater Horizon” in the Gulf of 

Mexico, on April 20, 2010, p 70.

892 Ibid., 70.

893 The culture assessor defines these terms as the three elements of a strong safety culture: “(1) it is enables, 

meaning that the organization and its leaders emphasize safety and create a positive safety climate; (2) it is 

enacted, meaning that members of the organization put the organization’s safety policies and procedures into 

practice; and (3) it is elaborated, meaning that the organization rigorously reflects on its safety performance and 

seeks to improve its policies and procedures as a result.” Expert report of Kathleen M. Sutcliffe, October 17, 

2011, for the United States District Court for the Eastern District of Louisiana, MDL No. 2179, Section: J, re. Oil 

Spill by the Oil Rig “Deepwater Horizon” in the Gulf of Mexico, on April 20, 2010, p 5.

000926
Macondo Investigation Report Volume 3 4/17/2016

238 

at Macondo lacked implementation, yet the safety culture survey indicated a belief that “the THINK 

process was sound and contributed to safe working practices.” The Deepwater Horizon crew also 

indicated they felt good about safety on the rig, but the metric the crew judged this performance on was 

the Lost Time Incident (LTI) personal safety metric. In fact, the crew indicated the LTI rate was a “key 

driver in raising awareness and promoting safe behaviors.” 894 Akin to the LTA metric described in 

Section 3.1 895 LTI is an indication of good personal safety but conveys little about process safety 

performance. 

Furthermore, it is commendable that BP can cite policies and efforts to investigate incidents,896 but as 

Chapter 2.0 describes, the focus and type of investigation conducted will influence the lessons derived. If 

the focus is on technical matters, without exploration into the human and organizational factors, and 

without a systemic approach, as was the case, for example, with the March 8 kick, then the lessons 

derived will reflect that limitation. A culture that values process safety must examine such issues for 

future prevention. As another example, BP’s Macondo investigation did not include an analysis of 

management and organizational factors that contributed to the incident,

897 thus choosing not to explore 

that avenue of potential learning that might have revealed systemic deficiencies. If an incident on the 

scale of Macondo does not evoke action to explore systemic causes, what does that convey about the 

underlying values of the organization? Sound process safety risk awareness and management is a focus 

throughout this report, and Transocean’s positive pre-incident safety culture assessment findings suggest 

that sufficient information on the culture of the organization cannot be derived without effectively 

addressing all levels of culture, including identifying the underlying basic assumptions. Then the 

company must strive to support those values and basic assumptions in practice.

898 

6.3 Influencing a Culture for Process Safety from the Top

The manner in which culture change is accomplished is multifaceted and beyond the scope of this 

investigation; however, this discussion is mindful that “Companies have found that if safety and health 

values are not consistently and (constantly) shared at all levels of management and among all employees, 

any gains that result from declaring safety and health excellence a “priority” are likely to be shortlived.”899 “Shared” does not mean that all employees have the same level of influence on culture, or the 

 

894 Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North America 

Division Summary Report, July 2, 2010, see Exhibit 0929, TRN-HCEC-00090587, TRN-HCEC-00090598, 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015).

895 In company documents, Transocean referred to this metric as the total recordable injury rate (TRIR), but the crew 

referred to the safety metric in terms of LTIs rather than the TRIR. See Section 0 for the introduction to TRIR.

896 Expert report of Kathleen M. Sutcliffe, October 17, 2011, for the United States District Court for the Eastern 

District of Louisiana, MDL No. 2179, Section: J, re. Oil Spill by the Oil Rig “Deepwater Horizon” in the Gulf of 

Mexico, on April 20, 2010.

897 BP, Deepwater Horizon Accident Investigation Report, September 8, 2010, p 12 and Appendix A. 

898 Wilkinson, P., 2016, Culture: Values and Practices – can you have one without the other? p 2, available at the 

CSB.gov website.

899 Quoted in The Report of the BP US Refineries Independent Safety Review Panel; January, 2007, p 23, footnote 

19. http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed October 7, 2015).

000927
Macondo Investigation Report Volume 3 4/17/2016

239 

actual authority to get things done. Indeed, “implementing practices is a leadership responsibility and 

requires great care to avoid unintended consequences, as well as active monitoring900 to verify they are 

applied as intended.”901 Thus, a company’s most senior leadership, starting at the board of directors, plays 

the pivotal role in influencing a culture that robustly promotes process safety. Cases show that actual 

practices repeated by a group over time, when enforced and verified by an authoritative entity, can lead to 

a culture change.902 Institutional actions offer deep insight into a corporate culture: “critical controls to 

prevent a major incident are just another way of describing important organisational practices.”903 

The relationship between major accident prevention and organizational culture has been recognized 

across the full spectrum of high-hazard industries, including offshore drilling, aviation safety, 

underground mining, and nuclear power. For more than 25 years, the US Nuclear Regulatory Commission 

has been refining its safety culture expectations for organizations performing or overseeing regulated 

nuclear activities.

904 It defines safety culture as the “core values and behaviors resulting from a collective 

commitment by leaders and individuals to emphasize safety over competing goals to ensure protection of 

people and the environment.”905 

In light of the DWH incident and repeated calls for promoting a culture for safety offshore, BSEE 

released its Safety Culture Policy Statement, announcing expectations “that individuals and organizations 

performing or overseeing activities regulated by BSEE establish and maintain a positive safety culture 

commensurate with the significance of their activities and the nature and complexity of their 

organizations and functions.” 906 

 

900 For a description of “Active Monitoring” in the context of major accidents, although the principles have wider 

application, see: http://www.csb.gov/assets/1/7/Wilkinson_Active_Monitoring.pdf Accessed 31 December 2015.

901 Wilkinson, P., 2016, Culture: Values and Practices—can you have one without the other? p 3, available at the 

CSB.gov website.

902 Andrew Hopkins gives the example of legal requirements for seatbelts in vehicles; this practice was initially 

rejected and challenged, seen as a burden. Over time, as financial consequences for not wearing them became 

prevalent, it gradually became habitual to wear one. Now wearing seatbelts is perceived to be sensible. Hopkins, 

Andrew, Why safety cultures don’t work, Future Media Training Resources, p 1.

903 Wilkinson, P., 2016, Culture: Values and Practices—can you have one without the other? p 3, available at the 

CSB.gov website.

904 [Online]; http://www.nrc.gov/about-nrc/safety-culture/sc-policy-statement.html#dev (accessed October 7, 2015).

905 76 Fed. Reg. 34773-34778 (June 14, 2011). 

906 BSEE, Safety Culture Policy Statement, http://www.bsee.gov/Safety/Safety-Culture-Policy/ (accessed October 7, 

2015). 

000928
Macondo Investigation Report Volume 3 4/17/2016

240 

BSEE’s Safety Culture Policy Statement is a commendable first step. It could be improved by explicitly 

acknowledging the role that all levels in an organization play in influencing how the culture promotes 

process safety, including the role of the board of directors. This includes ownership of process safety risk 

from the top down, with the board leading and supporting the initiative, engaging the workforce to 

promote health and safety, and identifying key performance safety indicators to monitor efforts. 

Future BSEE culture efforts could also require that companies formally assess their organizational 

cultures and whether the culture has sufficient focus on process safety. Culture assessments have the 

potential to identify the safety perceptions of employees and the commitment of individuals from all 

levels of the organization to the formally-adopted corporate process safety goals, policies, procedures, and 

practices. A variety of culture assessment methods can be used to explore willingness to report incidents 

and near-misses, the effectiveness of workforce participation efforts, and organizational drifts from safety 

policies and procedures. The assessment results can be the basis of conversation between the industry, 

BSEE’s Safety Culture Policy Statement 

According to BSEE, the following characteristics “typify a robust safety culture”:

† 

1. Leadership Commitment to Safety Values and Actions. Leaders demonstrate a commitment to 

safety and environmental stewardship in their decisions and behaviors; 

2. Hazard Identification and Risk Management. Issues potentially impacting safety and 

environmental stewardship are promptly identified, fully evaluated, and promptly addressed 

or corrected commensurate with their significance;

3. Personal Accountability. All individuals take personal responsibility for process and personal 

safety, as well as environmental stewardship;

4. Work Processes. The process of planning and controlling work activities is implemented so that 

safety and environmental stewardship are maintained while ensuring the correct equipment 

for the correct work;

5. Continuous Improvement. Opportunities to learn about ways to ensure safety and environmental 

stewardship are sought out and implemented;

6. Environment for Raising Concerns. A work environment is maintained where personnel feel free 

to raise safety and environmental concerns without fear of retaliation, intimidation, 

harassment, or discrimination;

7. Effective Safety and Environmental Communication. Communications maintain a focus on 

safety and environmental stewardship; 

8. Respectful Work Environment. Trust and respect permeate the organization with a focus on 

teamwork and collaboration; and 

9. Inquiring Attitude. Individuals avoid complacency and continuously consider and review existing 

conditions and activities in order to identify discrepancies that might result in error or 

inappropriate action. 

† BSEE, Safety Culture Policy Statement, http://www.bsee.gov/Safety/Safety-Culture-Policy/ (accessed October 7, 2015).

000929
Macondo Investigation Report Volume 3 4/17/2016

241 

workforce/management, and the regulator to create, “a qualitative shift in industry and regulatory safety 

cultures from the minimalist compliance ... to the philosophy of best practice and continuous 

improvement.”907 While companies can employ assessment approaches specific to their own safety 

management systems and policies, it would be useful for BSEE to work with industry, workforce, and 

culture experts to develop culture assessment methods that can be used industrywide to gain further 

insights into safety perceptions offshore. Creating and using such validated methods will allow for 

collecting information to support improvements, not only within each organization, but also broadly 

across the US offshore industry. 

6.4 Conclusion

There will be situations when “individual behavior [i]s inconsistent with the organization’s commitment 

to safety.”908 However, one individual did not cause the Macondo event. A multitude of decisions and 

actions up and down the organizational chains of both companies impacted the events of April 20, 2010, 

and those decisions and actions are influenced by the invisible and often unstated basic assumptions and 

shared values of the involved companies. 

Identifying incongruities between proclaimed values and the actual basic assumptions and values of the 

organization is one step toward understanding and working with culture. Culture assessments could be a 

useful tool to help organizations understand their culture and whether it adequately promotes safety. This 

information would also be useful for regulators in helping to identify potential issues and their mitigation 

in the interest of accident prevention. The assessments need to be conducted with a multifaceted approach 

that (1) addresses worker perceptions, (2) delves into the context of those perceptions as they relate to the 

values of the organization, d an(3) identifies the basic assumptions of the organization. The information 

must be assessed in conjunction with an examination of how the artifacts (e.g. actual practices) reflect 

those values and assumptions. 

All levels of culture require monitoring and modification for change to occur. Indicators monitoring the 

actual implementation of process safety policies and practices can shed light on where actual practices 

differ from stated policies and values—a first step for an organization to identify potential conflicts. 

Having a better understanding of their organizational culture, management, the workforce, and the 

regulator can take proactive steps to remediate inadequacies while reinforcing effective practices, thus 

driving more sustainable, long-term safety improvements. 

 

 

907 Department of Industry, Science, and Resources: Offshore Safety and Security, Petroleum and Electricity 

Division, Report of the Independent Review Team, Australian Offshore Petroleum Safety Case Review, FebruaryMarch 2000 Stakeholder Survey, http://www.industry.gov.au/resource/Documents/upstreampetroleum/safety/Australian_Offshore_Petroleum_Safety_Case_Review_Feb-Mar_2000.pdf (accessed March 2, 

2015).

908 Expert report of Kathleen M. Sutcliffe, October 17, 2011, for the United States District Court for the Eastern 

District of Louisiana, MDL No. 2179, Section: J, re. Oil Spill by the Oil Rig “Deepwater Horizon” in the Gulf of 

Mexico, on April 20, 2010, p.91.

000930
Macondo Investigation Report Volume 3 4/17/2016

242 

7.0 Volume 3 Conclusion

Chapter 1.0 describes how, due to the tightly coupled interdependencies, complex systems like offshore 

drilling operations are susceptible to performance variability and organizational drift, and the adaptability 

and flexibility of the humans within the system determine operational success. To successfully minimize 

undesirable consequences, therefore, industry must shift from correcting individual “errors” identified 

post-incident to a systematic approach for managing human factors. Such a risk management approach 

would include a proactive process for assessing human factors for major accident prevention, 

concentrated focus on minimizing the gap between work-as-imagined and work-as-done, and a concerted 

effort to improve the non-technical skills of both workforce and management. 

Major catastrophes, fortunately, are infrequent. For this reason, investigations of those rare events, and 

the more frequent near-misses, provide critical insight into potential safety gaps for those operating 

offshore. Yet, as Chapter 2.0 highlights, organizational learning poses many challenges for industry, 

including the effective culling and disseminating of lessons between operators and leaseholders, the 

successful sharing of those lessons across global corporations, and the still all-too-frequent focus on 

technical causes without sufficient focus on systemic and organizational factors. Actual implementation 

of corrective actions, and not just dissemination of incident facts and findings, is imperative, and the 

regulator has an opportunity to influence companies in this endeavor. 

History has repeatedly proven that personal safety indicators are inaccurate predictors for major accident 

events. Chapter 3.0 demonstrates that, at the time of the Macondo incident, both BP and Transocean 

collected, measured, and rewarded personal safety metrics and, correspondingly, both companies 

achieved low personal worker injury rates. However, process safety did not receive the same attention 

from either company. Further work is needed on developing and implementing effective performance 

metrics that indicate the health of major accident barriers and the safety management systems meant to 

ensure their reliability. While Chapter 3.0 provides suggested potential indicators based on findings from 

the CSB’s Macondo investigation, appropriate process safety KPIs for the individual company and 

industrywide needs additional focus from numerous stakeholders, including management, workforce, and 

regulators.

Chapter 4.0 demonstrates how the complexities of multi-party risk management in the offshore industry 

led to vaguely established safety roles and responsibility between the operator (BP) and the drilling 

contractor (Transocean). Ultimately, while both companies had corporate policies for risk management, 

neither BP nor Transocean assumed responsibility for implementing those policies at Macondo, and no 

regulatory requirements or oversight ensured that such policies were upheld and that the major accident 

risks inherent in their operations were effectively managed. 

Chapter 5.0 explores the influential role of corporate governance in deciding what and how safety is 

managed throughout the organizational hierarchy, as well as the influential role shareholders and the 

regulator could have in ensuring corporate boards are conversant in the major hazards influencing their 

business.

Chapter 6.0 uses the numerous examples of operational practices of both BP and Transocean from 

preceding chapters to illustrate that both companies were perpetuating a culture of minimal compliance. 

Both companies exhibited failures to follow internal risk management policies, safety management 

000931
Macondo Investigation Report Volume 3 4/17/2016

243 

system programs and provisions for risk reduction to ALARP, despite organizational requirements to do 

so. 

As a result of the analyses presented in this volume, and in pursuit of major accident prevention, Chapter 

8.0 lists several recommendations addressing human factors, corporate governance, safety performance 

indicators, and culture. 

The analyses presented in this volume provide the evidentiary foundation for the regulatory analysis 

presented in Volume 4. These two final volumes work in tandem to argue for further safety improvements 

to industry risk management practices through additional regulatory provisions and authorities that place 

the onus of major accident prevention squarely on industry while improving the oversight capabilities of 

the regulator.

000932
Macondo Investigation Report Volume 3 4/17/2016

244 

8.0 Recommendations

Volume 3 issues one recommendation to the American Petroleum Institute (CSB2010-I-OS-R5), three 

recommendations to the US Department of Interior (CSB-2010-10-I-OS-R6 and –R8), one to the 

Sustainability Accounting Standards Board (CSB-2010-10-I-OS-R9), and one to the Ocean Energy Safety 

Institute (CSB-2010-10-I-OS-R10). 

CSB2010-10-I-OS-R5 Recommends Augmenting API 75 to include the various process safety 

concepts and major accident prevention (MAP) management systems

American Petroleum Institute

Based on the analysis presented in the CSB Macondo investigation report, Volumes 3 and 4, and the 

requirements listed in R11, revise Recommended Practice 75, Development of a Safety and 

Environmental Management Program for Offshore Operations and Facilities, 3rd ed., May 2004 

(reaffirmed May 2008), to require a specific focus on major accident prevention and address the following 

issues: 

a. Incorporate the following listed safety management system issues as explicit program elements 

and include language throughout API 75 regarding each element’s explicit and defined 

applicability to all of the other existing program elements:

1. Human factors program requirements for the design, planning, execution, management, 

assessment, and decommissioning of well operations for the prevention of major 

accidents, as well as in the investigation of accidents and near-misses;

2. Corporate governance and Board of Director responsibilities for major accident risk 

management; 

3. Workforce involvement and engagement in all aspects of the SEMS program;

4. Contractor oversight and effective coordination for major accident prevention; and 

5. Leading and lagging key performance indicators that drive major accident prevention.

b. Define and expand the roles and responsibilities for major accident prevention among the primary 

parties engaged in offshore drilling and production (i.e., the leaseholder/operator and 

owner/drilling contractor) by expanding applicability of this standard to the parties with primary 

control over major hazard operations and day-to-day activities and thus best positioned to 

implement and oversee a safety and environmental management system (SEMS) program to 

control major accident hazards. 

c. Incorporate into the Principles section of the document, as well as within the Setting Objectives 

and Goals section, as overarching provisions for the overall successful implementation and 

execution of a SEMS program:

1. Management of major accident risk to As Low As Reasonably Practicable or similar riskreduction target; 

2. Use the hierarchy of controls for identifying, establishing, and implementing barriers 

meant to prevent or mitigate major accident hazards.

000933
Macondo Investigation Report Volume 3 4/17/2016

245 

CSB2010-10-I-OS-R6 Recommends Development of Human Factors Guidance for Major 

Accident Prevention 

United States Department of Interior

Drawing upon best available global standards and practices, develop guidance to assist industry in the 

incorporation of human factors principles into the systematic analysis of their major accident hazards, 

development of their SEMS programs, and in the preparation of their major hazards report 

documentation. This standard shall provide guidance on topics including, but not limited to, safety critical 

task assessment and the development and verification of non-technical skills. Include the participation of 

diverse expertise in the development of the standard including industry, workforce, and subject matter 

expert representatives.

CSB2010-10-I-OS-R7 Recommends Development of Corporate Governance Guidance and the 

Engagement of Corporate Boards and Executives for Risk Management 

and Major Accident Prevention 

United States Department of Interior

Drawing upon best available global standards and practices, develop guidance addressing the roles and 

responsibilities of corporate board of directors and executives for effective major accident prevention. 

Among other topics, this standard shall provide specific guidance on how boards and executives could 

best communicate major accident safety risks to their stakeholders, as well as corporate level strategies to 

effectively manage those risks. 

CSB2010-10-I-OS-R8 Recommends Regulatory Requirements for Safety Culture Improvements 

United States Department of Interior

Expand upon the principles of the BSEE Safety Culture policy and establish a process safety culture 

improvement program for responsible parties as defined in R11(a) that periodically administers process 

safety culture assessments and implements identified major accident prevention improvements. The

process safety culture improvement program shall include a focus on items that measure, at a minimum, 

willingness to report incidents and near-misses, effectiveness of workforce participation efforts, 

organizational drift from safety policies and procedures, and management involvement and commitment 

to process safety. 

CSB2010-10-I-OS-R9 Recommends Strengthening and Finalizing the Sustainability Accounting 

Standards Board’s Oil & Gas Exploration & Production Sustainability 

Accounting Standard (Provisional, dated June 2014) 

Sustainability Accounting Standards Board

000934
Macondo Investigation Report Volume 3 4/17/2016

246 

Update, strengthen, and finalize the SASB’s provisional Oil & Gas Exploration & Production 

Sustainability Accounting Standard by enhancing standard NR0101-18. Expand recommended coverage 

of “Process Safety Event rates for Loss of Primary Containment of greater consequences” in accordance 

with the findings of this report. Specifically, this expanded coverage shall:

a. Recommend the disclosure of additional leading and lagging indicators and emphasize the greater 

preventive value of disclosure of a company’s use of leading indicators to actively monitor the 

health and performance of major accident safety barriers and the management systems for 

ensuring their effectiveness. Specifically add:

1. Indicators addressing the health of safety barriers to be communicated to the workforce, 

and to shareholders in required SEC disclosures, and also to be made readily available to 

the regulator. 

2. Guidance emphasizing and promoting the concept that personal safety metrics such as 

those captured in NR0101-17 (total recordable injury rate, fatality rate, near-miss 

frequency rate) are important but separate from leading and lagging process safety 

performance indicators, which better correlate to major accident prevention. 

• Accomplish this communication within NR0101-18. 

• Supplement this effort within the SASB’s Oil & Gas Exploration & Production 

Research Briefs, based on the findings of this report as well other current safety 

scholarship that demonstrates the lack of correlation between personal safety 

efforts and process safety and major accident prevention initiatives.

CSB2010-10-I-OS-R10 Recommends further study to advance industry’s understanding of the 

gas-in-riser hazard.

Ocean Energy Safety Institute

Conduct further study on riser gas unloading scenarios, testing, and modeling and publish a white paper 

containing technical guidance that communicates findings and makes recommendations for industry 

safety improvements.

000935
Macondo Investigation Report Volume 3 4/17/2016

247 

By the

U.S. Chemical Safety and Hazard Investigation Board 

 Vanessa A. Sutherland

 Chairperson

Manuel Ehrlich

 Member

 Rick Engler

 Member

 Kristen Kulinowski

 Member

 

Date of Board Approval: April 17, 2016 

000936
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

VOLUME 4

REPORT NO. 2010-10-I-OS

4/17/2016

DRILLING RIG EXPLOSION AND FIRE AT THE 

MACONDO WELL 

(11 Fatalities, 17 Injured, and Serious Environmental Damage) 

DEEPWATER HORIZON RIG

MISSISSIPPI CANYON 252, GULF OF MEXICO

KEY ISSUES: APRIL 20, 2010

• US OFFSHORE SAFETY REGULATION DURING AND AFTER MACONDO

• ATTRIBUTES OF AN EFFECTIVE REGULATOR AND REGULATORY SYSTEM

000937
Macondo Investigation Report Volume 4 4/17/2016

2 

[This page left intentionally blank.]

000938
Macondo Investigation Report Volume 4 4/17/2016

3 

Contents

ACRONYMS AND ABBREVIATIONS ..................................................................................................... 7

REGULATORY OVERSIGHT OF U.S. OFFSHORE OIL AND GAS OPERATIONS: A CALL FOR 

MORE ROBUST AND PROACTIVE REQUIREMENTS ....................................................................... 10

VOLUME 4 – INTRODUCTION .............................................................................................................. 11

1.1 Approach to Analysis ..................................................................................................................... 12

1.2 Attributes of an Effective Regulatory Model ................................................................................. 13

2.0 REVIEWING INTERNATIONAL REGULATORY MODELS .................................................. 18

2.1 History of Safety and Environmental Management Systems Offshore in the US ......................... 18

2.1.1 The Outdated API Offshore Safety Management System Approach................................ 20

2.2 Purpose of the Regulations and Role of the Regulator .................................................................. 22

2.3 An Alternative Regulatory Model: The Safety Case ..................................................................... 23

2.4 Managing Major Accident Hazards in the US ............................................................................... 26

3.0 INADEQUATE POST-MACONDO SAFETY MANAGEMENT REGULATIONS .................. 28

3.1 SEMS: No Goal-Setting Risk-Reduction Standard ....................................................................... 29

3.1.1 The Use of Standards and Guidance in ALARP-based Regulatory Regimes ................... 33

3.1.2 Insufficient US Alternative Legal Mechanisms to Drive Continual Safety Improvements

 35

3.1.3 Ineffective Regulatory “Workarounds” ............................................................................ 37

3.1.4 Recent BSEE-proposed Regulatory ALARP-type Language ........................................... 38

3.2 SEMS Activity-Based Requirements: A Compliance-Based Mentality ........................................ 39

3.3 Safety Responsibility Offshore ...................................................................................................... 43

3.3.1 Offshore Regulatory Ambiguity and Industry/Stakeholder Response .............................. 45

3.3.1.1 Post-Macondo BSEE Efforts to Hold Contractors Responsible for Safety ... 48

3.3.1.2 Stakeholders Attempt to Fill Responsibility Gap with Voluntary Guidance 50

3.3.2 Other Regimes’ Focus on Safety Responsibilities of Operator/Lessee and Drilling 

Contractor 51

3.3.3 Conclusion ........................................................................................................................ 54

3.4 Insufficient SEMS Worker Participation Provisions ..................................................................... 54

3.4.1 Post-Macondo/SEMS Worker Participation Provisions ................................................... 56

3.4.2 Insufficient and Limited SEMS Worker Participation Provisions .................................... 57

3.4.3 No SEMS Provisions for Worker-Elected Safety Representatives ................................... 59

000939
Macondo Investigation Report Volume 4 4/17/2016

4 

3.4.4 No SEMS Requirement for Contractor Participation ....................................................... 62

3.4.5 SEMS Stop-Work Authority Impact on Worker Liability ................................................ 63

3.4.6 Inadequate SEMS Requirements to Protect Workers from Retaliation ............................ 64

3.4.7 No SWA Worker-Requested Regulatory Provision in Regulation ................................... 67

3.4.8 No SEMS Safety Committees or Tripartite Safety Forums Provision .............................. 68

3.4.9 Conclusion ........................................................................................................................ 70

4.0 US OFFSHORE REGULATOR CHALLENGE IN EFFECTIVE OVERSIGHT ........................ 71

4.1 No Required Review of Major Accident Hazard Documentation Before Hazardous Work Begins

 72

4.2 Regulatory Safety Oversight Audits and Initiatives ...................................................................... 77

4.2.1 Challenges of Relying on Third-Party Audits in the GoM ............................................... 79

4.3 Regulatory Use of Safety Performance Indicator Data .................................................................. 80

4.3.1 Roadblocks to Regulatory Improvements in Data Collection and Analysis ..................... 81

4.3.2 Inadequate Use of Safety Performance Indicators ............................................................ 85

4.4 Transparency of Offshore Safety ................................................................................................... 89

4.4.1 Regulatory Approaches to Transparency .......................................................................... 90

5.0 INSUFFICIENT AND INADEQUATE STAFF FOR APPROPRIATE OVERSIGHT ............... 95

5.1 Models for Building a Competent Regulator ................................................................................. 95

5.1.1 UK Offshore Safety Directive Regulator .......................................................................... 95

5.1.2 US Government Incentives to Build Competent Staff ...................................................... 97

5.2 Disproportionate Regulator Resources for Gulf of Mexico Offshore Activity .............................. 98

5.3 The Deficit in Regulator Technical Competency and Credibility ............................................... 101

5.4 Post-Macondo Efforts to Improve Competency .......................................................................... 102

5.5 Insufficient Regulatory Funding Mechanism for Securing Staff ................................................. 103

5.5.1 Ineffectual Funding Appropriations for Offshore Activity ............................................. 104

5.5.2 Industry Funding of International Offshore Regulators .................................................. 107

5.6 The Importance of an Independent Regulator .............................................................................. 109

5.6.1 The Minerals Management: The Safety Versus Revenue Conflict ................................. 109

5.6.2 BSEE Organizational Structure ...................................................................................... 111

5.6.3 Critical BSEE Drilling Permit Concerns ........................................................................ 114

5.6.4 Historical Recognition for Separating Safety Oversight from Resource Development .. 115

5.6.4.1 Creation of the Mine Safety and Health Administration ............................. 115

000940
Macondo Investigation Report Volume 4 4/17/2016

5 

5.6.4.2 Creation of the Nuclear Regulatory Commission ....................................... 115

5.6.4.3 Creation of the UK HSE Offshore Division ................................................ 116

6.0 CONCLUSION ............................................................................................................................ 117

7.0 RECOMMENDATIONS ............................................................................................................. 118

APPENDIX A: INTERNATIONAL OFFSHORE INCIDENTS AND THE US RESPONSE ................ 122

Alexander Kielland and Regulatory Change in Norway ........................................................................... 122

Ocean Ranger and Regulatory Change in Canada .................................................................................... 123

Piper Alpha and Regulatory Change in the United Kingdom ................................................................... 124

Montara and Regulatory Change in Australia ........................................................................................... 125

History of Regulatory Change in the US .................................................................................................. 126

000941
Macondo Investigation Report Volume 4 4/17/2016

6 

Figures and Tables

Figures 

Figure 3-1. Transocean’s Well Delivery Process as defined by Transocean corporate polices. ................. 44

Figure 4-1. Department of Interior organization chart: at the time of the April 20, 2010, Macondo incident 

and currently. .................................................................................................................................... 113

Tables

Table 3-1. Current and BSEE proposed language for § 250.107, What must I do to protect health, safety, 

property, and the environment? .......................................................................................................... 39

Table 4-1. Abridged list of reportable incidents to BSEE from § 250.188. ................................................ 82

000942
Macondo Investigation Report Volume 4 4/17/2016

7 

Acronyms and Abbreviations

AB Accreditation Body 

ACOP Approved Code of Practice 

AEC Atomic Energy Commission

ALARA As Low As Reasonably Achievable

ALARP As Low As Reasonably Practicable

ANSI American National Standards Institute

AOC Acknowledgement of Compliance 

API American Petroleum Institute

ASME American Society of Mechanical Engineers

ASP Audit Service Provider 

ASTM American Society for Testing and Materials

BAST Best Available and Safest Technology 

BOEM Bureau of Ocean Energy Management

BOEMRE Bureau of Ocean Energy Management, Regulation, and Enforcement

BOP Blowout Preventer 

BSEE Bureau of Safety and Environmental Enforcement 

CCPS Center for Chemical Process Safety

C.F.R. Code of Federal Regulations 

COMAH Control of Major Accident Hazards

COS Center for Offshore Safety

CSB U.S. Chemical Safety Board 

CUPA Certified Unified Program Agency 

DAFW Days Away From Work

DNFSB Defense Nuclear Facilities Safety Board

DNV Det Norske Veritas

DOI Department of Interior 

DWH Deepwater Horizon

EPA Environmental Protection Agency

EPP Employee Participation Plan 

000943
Macondo Investigation Report Volume 4 4/17/2016

8 

FRC Financial Reporting Council 

GAO US Government Accountability Office 

GASCET Guidance for the Topic Assessment of Major Accident Hazard Aspects of Safety Cases 

GoM Gulf of Mexico 

HSE Health Safety Executive (of the United Kingdom) 

IADC International Association of Drilling Contractors 

INC Incident of Noncompliance 

INPO Institute of Nuclear Power Operations 

IPD Interim Policy Document 

IRF International Regulators’ Forum 

ITL Information to Lessee

JSA Job Safety Analysis 

LCM Loss Circulation Material

LTI Lost Time Incident

MBI Marine Board of Investigation

MDL Multi-District Litigation

MESA Mining Enforcement and Safety Administration 

MMS Minerals Management Service

MOA Memorandum of Agreements 

MOC Management of Change

MODU Mobile Offshore Drilling Unit 

MSHA Mine Safety and Health Authority 

NAE National Academy of Engineering 

NOPSA National Offshore Petroleum Safety Authority; formally NOPSEMA (of Australia)

NOPSEMA National Offshore Petroleum Safety and Environmental Management Authority 

NRC Nuclear Regulatory Commission

NTL Notice to Lessee

OCS Outer Continental Shelf

OCSLA Outer Continental Shelf Lands Act 

OECD Organization for Economic Co-operation and Development

OESAC Ocean Energy Safety Advisory Committee

000944
Macondo Investigation Report Volume 4 4/17/2016

9 

OIAC Offshore Industry Advisory Committee 

OIM Offshore Installation Manager 

ONRR Office of Natural Resources Revenue

OOC Offshore Operators Committee

OSDR Offshore Safety Directive Regulator 

OSHA Occupational Safety and Health Administration

OTC Offshore Technology Conference 

PHMSA Pipeline and Hazardous Materials Safety Administration 

PINC Potential Incident of Noncompliance 

PSA Petroleum Safety Authority

PSM Process Safety Management

RIF Recordable Injury Frequency 

ROP Reactor Oversight Process

SEC Securities and Exchange Commission

SEMP Safety and Environmental Management Program 

SEMS Safety and Environmental Management System

SHE Safety, Health and Environment 

SMS Safety Management System

SOP Standard Operating Procedure 

SWA Stop Work Authority 

TRB Transportation Research Board 

TPSR Total Potential Severity Rate

TRIR Total Recordable Injury Rate

UK United Kingdom 

US United States

USCG United States Coast Guard

UWA Ultimate Work Authority 

WCS Well Construction Standards 

WEST Workforce Engagement Support Team 

WOMP Well Operations Management Plan 

000945
Macondo Investigation Report Volume 4 4/17/2016

10 

Volume 4 

Regulatory Oversight of U.S. 

Offshore Oil and Gas Operations: A 

Call for More Robust and Proactive 

Requirements 

000946
Macondo Investigation Report Volume 4 4/17/2016

11 

Volume 4 – Introduction 

In the aftermath of the Macondo incident, the US offshore safety regulations for drilling and completions 

activities on the outer continental shelf have been reviewed, debated, and revised.1 Amid several 

reorganizational efforts, the Department of Interior established the Bureau of Safety and Environmental 

Enforcement (BSEE) in October 2011 to oversee safety of the US offshore oil and gas operations.2

BSEE’s immediate predecessor, the Bureau of Ocean Energy Management, Regulation & Enforcement, 

(BOEMRE),3

 promulgated the Safety and Environmental Management Systems (SEMS) rule in October 

2010,4

 requiring the previously voluntary practices in the American Petroleum Institute's (API) 

Recommended Practice 75 (API 75).5

 After BSEE’s creation, the agency amended SEMS in 2013 to 

further its initiative for performance-based6 regulations to “reduce the occurrence of accidents, injuries, 

and spills during oil and gas activities on the Outer Continental Shelf (OCS).”7

 In April 2015, BSEE 

proposed well control regulations that it identified as the “most substantial rulemakings in the history” of 

offshore safety in the United States.8

 Most recently, on December 7, 2015, BSEE announced the launch 

of a pilot Risk-Based Inspection Program to complement its existing inspections and audits with the goal 

of more efficiently and effectively managing the limited inspection and auditing resources of the agency.9

 

In support of these endeavors, BSEE has made efforts over the last five years to educate its staff and 

 

1 See Appendix A for a history of offshore US oil and gas safety regulation. Including pre-Macondo events. 

2 http://www.bsee.gov/About-BSEE/BSEE-History/index/ (accessed January 19, 2016). 

3 BOEMRE replaced the Minerals Management Service (MMS) shortly following the Macondo incident in 2010.

4 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 75 Fed. Reg. 63609 (Final Rule, October 15, 

2010) (to be codified at 30 C.F.R. Part 250).

5 API Recommended Practice 75, 3rd ed., Recommended Practice for Development of a Safety and Environmental 

Management Program for Offshore Operations and Facilities, May 2004 (Reaffirmed May 2008).

6 The US Nuclear regulatory commission defines performance-based regulation as “a regulatory approach that 

focuses on desired, measurable outcomes, rather than prescriptive processes, techniques, or procedures. 

Performance-based regulation leads to defined results without specific direction regarding how those results are to 

be obtained;” http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-based-regulation.html (accessed 

January 19, 2016).

7 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety and Environmental 

Management Systems, 78 Fed. Reg. 20423 (Final Rule, April 5, 2013) (to be codified at 30 C.F.R. Part 250); 

While the original SEMS rule became effective on November 15, 2010, this subsequent enhancement effective June 

4, 2013 is referred to as SEMS II. SEMS II incorporated additional safety requirements that addressed stop work 

authority, ultimate work authority, employee participation plans, guidelines for reporting unsafe work conditions, 

job safety analyses, and independence of accredited audit service providers. Unless otherwise stated, when the 

CSB refers to SEMS, it is addressing both the original SEMS rule and the subsequent SEMS II revisions; see also, 

BSEE. Safety and Environmental Management Systems (SEMS) Fact Sheet; http://www.bsee.gov/BSEENewsroom/BSEE-Fact-Sheet/SEMS-II-Fact-Sheet/ (accessed March 21, 2016). 

8 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Blowout Preventer Systems and 

Well Control, 80 Fed. Reg. 21504 (Proposed Rule, April 17, 2015) (to be codified at 30 C.F.R. Part 250). 

9 Bureau of Safety and Environmental Enforcement to Launch Pilot Risk-Based Inspection Program for Offshore 

Facilities. December 7, 2015. http://www.bsee.gov/BSEE-Newsroom/Press-Releases/2015/Bureau-of-Safety-andEnvironmental-Enforcement-to-Launch-Pilot-Risk-Based-Inspection-Program-for-Offshore-Facilities / (accessed 

December 21, 2015). 

000947
Macondo Investigation Report Volume 4 4/17/2016

12 

engage in dialogue with industry, regulatory bodies, and safety experts worldwide to improve its function 

as the regulator of offshore safety.

While the acknowledging these positive efforts, the CSB concludes that the SEMS regulations do not 

provide BSEE with an adequate framework for major accident prevention, and an improved approach is 

needed to reduce the risk of another Macondo-like event. SEMS does not utilize goal-setting, meaning the 

reduction of risks to a goal such as “as low as reasonably practicable” (ALARP). In addition, 

notwithstanding the implementation of SEMS, BSEE audit findings suggest that a culture of minimal 

regulatory compliance continues to exist in the Gulf of Mexico and risk reduction continues to prove 

elusive.10 Ultimately, the offshore regulatory changes made thus far do not sufficiently place the onus on 

industry to reduce risk or empower the regulator to ensure proactive and effective industry management 

and control of major hazards. 

1.1 Approach to Analysis

The CSB’s preventive mission as a federal agency is to reduce chemical hazards as broadly as possible 

(e.g., through recommendations that will effect national preventive changes). The CSB, therefore, focuses 

its recommendation efforts on changing national legislation, regulation, voluntary consensus standards, 

and industry recommended practices. As a result of an investigation or study, the CSB may issue 

“proposed rules or orders” to regulators such as the EPA Administrator and the Secretary of Labor “to 

prevent or minimize the consequences of any release of substances that may cause death, injury or other 

serious adverse effects on human health or substantial property damage as the result of an accidental 

release.”11 The CSB’s investigative analytical approach, therefore, must look beyond technical and 

management system causes. 

The CSB approach to regulatory analysis and recommendations starts with an examination of key 

investigative findings and an analysis of whether the applicable regulatory and enforcement regime 

manifests weaknesses or gaps that were causally related to the incident. The CSB formulates 

recommendations that, if effectively implemented, work to prevent or reduce the similar incidents or 

hazards to as great an extent as possible. For example, key findings in Volumes 3 and 4 of the Macondo 

Report show that the US offshore regulator lacks effective use of key process safety indicators and 

guidance addressing corporate boards of directors and human factors focused on major accident 

prevention. The CSB report analysis shows that addressing these significant gaps could help reduce the 

risk of similar incidents. 

 

10 See Section 4.2 and Bureau of Safety and Environmental Enforcement. BSEE Priorities Regarding SEMS, 

Offshore Technology Conference, Houston, TX, 2015; 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Speeches/2015/OTC%202015%20Mtg%20SEMS%

20Presentation.pdf (accessed December 19, 2015).

11 42 USC sec. 7412(r)(6)(c)(ii). 

000948
Macondo Investigation Report Volume 4 4/17/2016

13 

1.2 Attributes of an Effective Regulatory Model

Various international models for offshore safety regulation can be used to compare and contrast what the 

US regulator has adopted since Macondo. No one approach is an undisputed panacea for all accidents, 

partly because prevention requires active and sustained participation in risk reduction from industry, the 

workforce, and the regulator. Ultimate responsibility for preventing incidents and protecting workers and 

the public always remains with the employers and parties who create or control major accident risk. Yet 

regulatory systems have an important role to play in establishing sufficient requirements, guidance, and 

Throughout Volume 4, the CSB refers to “the regulator” or “offshore regulations” to indicate either 

MMS or BSEE and their respective safety regulations for drilling and completions activities on the 

outer continental shelf. As indicated in the figure below, MMS evolved into BSEE after the Macondo 

incident occurred. In reality, several regulatory bodies oversee the offshore oil and gas industry, 

including the US Coast Guard (USCG), the Bureau of Ocean Energy Management (BOEM), and the 

Environmental Protection Agency (EPA), but the CSB generally limits its discussion to MMS and 

BSEE due to its specific authority over the safe conduct of offshore drilling and completion 

operations. 

000949
Macondo Investigation Report Volume 4 4/17/2016

14 

oversight to establish a floor of practice that if covered employers implement effectively works to reduce

major incidents. 

As part of the agency’s investigative approach, the CSB frequently compares international regulatory 

regimes from what existed at the worksite under investigation to examine the strengths and weaknesses of 

different models and methodologies. 12 It would be incorrect, however, to assume that an effective model 

found in some other international jurisdiction could necessarily be imported to the US with no allowance 

for important variances that may exist among cultures, existing legal and regulatory structures, political 

systems, as well as numerous and varied industry stakeholder interests and levels of involvement. To that 

end, the CSB reviews international regulatory models to identify various attributes that could strengthen 

the current US offshore regulatory environment. This helps clarify key attributes that could provide more 

effective safety regulation for addressing identified gaps and weaknesses. Recent CSB reports used this 

approach, such as those analyzing the 2010 Tesoro Anacortes and 2012 Chevron Richmond refinery 

incidents, and have identified attributes from other regulatory regimes to address causal regulatory gaps 

related to the incidents. 13 Those attributes related to the Macondo incident causal factors include: 

Continual Risk Reduction to Levels As Low As Reasonably Practicable (ALARP)

The intention of a goal-based, risk-reduction regulatory framework is to eliminate or sufficiently 

minimize the risks in an operation. Although risk can never be completely eliminated, any such 

framework must continually strive toward this goal. With major accident hazards, the key question 

becomes: Is there anything more that can be done to reduce the risk? ALARP is a standard familiar to 

industry in other global offshore regimes, and even in other high-hazard industries in the US. In such 

regimes, the government sets the goal, and the duty holder demonstrates how it will meet that goal 

through submitted documentation. The regulator then holds the duty holder accountable to execute that 

 

12 In the investigation of a 1999 fire that killed four workers at the Tosco Avon refinery in Martinez, California, the 

CSB report identified features and attributes from the UK HSE’s regulatory guidance related to safe piping and 

equipment opening in process plants that supported the analysis and recommendations in the report. See USCSB, 

2001, Refinery Fire Incident, Martinez, CA, February 23, 1999, Report No. 99-014-I-CA, Section 3, pp 31-44, 

March 2001, http://www.csb.gov/assets/1/19/Tosco_Final_Report.pdf (accessed March 25, 2016). 

In the 2002 CSB Hazard Investigation Report, Improving Reactive Hazard Management, the CSB concluded that the 

UK HSE and European Union utilize a comprehensive “all hazards” approach to reactive hazard management

with regulatory requirements based upon a facilities’ written analysis of specific hazards and needed controls 

rather than limited to an approach that only reviews listed chemicals based upon their inherent instability. Those 

regulatory attributes buttressed CSB’s recommendations that called upon EPA and OSHA to base reactive hazard 

coverage upon classifications beyond a list that would include combinations of chemicals and process specific 

conditions. See USCSB, 2002, Improving Reactive Hazard Management, Section 8.1.3, pp 83-84, October 2002, 

http://www.csb.gov/file.aspx?DocumentId=355 (accessed March 25, 2016).

13 USCSB, 2013. Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire, Richmond, CA, August 6, 

2012, Report No. 2012-03-I-CA, April 2013, 

http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf (accessed January 

25, 2016). 

USCSB, 2014. Catashtrophic Rupture of Heat Exchanger, Anacortes, WA, April 2, 2010, Report No. 2010-08-IWA, May 2014, http://www.csb.gov/assets/1/7/Tesoro_Anacortes_2014-May-01.pdf (accessed October 7, 2015).

000950
Macondo Investigation Report Volume 4 4/17/2016

15 

plan. The regulator will work with duty holders to obtain the necessary improvement if their work raises 

significant safety concerns at any point in the lifecycle of the hazardous operation.

The post-Macondo US offshore regulatory framework still does not provide goal-setting, risk-reduction 

requirements for oil and gas operations in the same manner as ALARP, though that may change, in part, 

if the well control rule BSEE recently proposed is adopted.14 

Regulator Adaptability 

The regulator has the tools to encourage industry to adopt new technologies and safer practices without 

additional rule-making. Such improvements may result from learnings from major accidents that occur 

within jurisdictional waters or internationally. The regulator must be capable of assessing the duty 

holders’ chosen methods to assure that they remain adequate in terms of good practice and achieve a 

satisfactory level of safe operation. 

Safety Responsibility is Maintained by those that Control or Create the Risk 

Liability, and thus responsibility, for safety resides with the companies (“duty holders”) that have the 

most direct control over the design, management, and execution of hazardous activities being undertaken. 

For example, an operator is responsible for the safe design of a well, while the drilling contractor supplies 

most of the workforce and infrastructure, resulting in control over the primary drilling operations and well 

response actions.

Active Worker Participation

Past CSB investigations have consistently identified the important role workers and their representatives 

play in major accident prevention. A fundamental element in effective safety management for major 

accident prevention is active and meaningful participation from the regulator, industry, and labor. Each of 

these entities provides unique and essential insights, so denying their effective participation removes 

critical voices in health and safety matters. Recognizing this operating principle, the United Kingdom 

(UK) and Norway established tripartite systems of industry, the regulator, and the workforce to deal with 

safety and health issues. Yet, the US offshore framework does not endow the workforce with a legally 

empowered voice on matters concerning safety. Similarly, US offshore regulations do not support a more 

traditional tripartite arrangement like those in other high-hazard industrial settings, domestically and 

internationally, where the regulator, industry, and workforce all play important roles. 

Required Written Safety Documentation by Duty Holders

Duty holders submit or make available to the regulator documentation that analyzes all major hazards; the 

risks associated with those hazards; and the technical, operational, and organizational controls to reduce 

those risks to ALARP or a similar goal. Also included is a description of the safety management systems 

 

14 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Blowout Preventer Systems and 

Well Control, 80 Fed. Reg. 21504 (Proposed Rule, April 17, 2015) (to be codified at 30 C.F.R. Part 250). 

000951
Macondo Investigation Report Volume 4 4/17/2016

16 

to continually monitor and respond to health and safety hazards. These documents become the basis for 

regulator audits to confirm that duty holders are following their own stated practices. 

Regulatory Assessment and Verification 

Regulators have a number of proactive tools at their disposal to evaluate and monitor safety performance.

These include preventive assessments to verify that a company’s technical and safety management 

practices are aligned with their written safety documentation, controlling regulations, industry standards, 

and good practice guidance before hazardous work begins, as well as audits and inspections to review the 

on-going effectiveness of a company throughout the lifecycle of the hazardous operation. 

Regulator uses Process Safety Indicators that Drive Performance

The aim of collecting and using safety performance indicators is to publicly identify safety trends and to 

establish initiatives for industry to meet higher performance levels. An effective safety indicators program 

allows for regulatory focus on key indicators, target-setting to drive industry improvements, and issuespecific regulatory program initiatives. 

Regulator Transparency

Through real-time publication of appropriate indicators, inspection results, and safety documentation, a 

regulator prompts companies to reduce risk. These safeguards illuminate for all stakeholders the 

companies that are experiencing superior safety results because of improved technologies or enhanced 

operational methodologies, and they can help companies with weaker safety performance to improve. 

Such transparency can also spur workforce and public pressure on companies to improve safety, 

protecting the lives of workers and the offshore environment. 

Independent, Qualified, and Adequately Funded Regulator 

An independent, technically qualified, and adequately resourced regulator is necessary to ensure that 

regulatory oversight does not devolve into an exercise in compliance-checking and paperwork. The

regulator must be able to vigorously question and dialogue with industry regarding the offshore hazards, 

barriers, and safety management systems industry members have established to manage those hazards. 

This final volume builds on Volume 3 analysis to support the conclusion that the offshore safety 

management regulations, specifically the SEMS Rule, do not adequately employ rigorous approaches to 

process safety management and major accident prevention. Despite the restructuring of the US offshore 

regulatory system and new safety management regulations for drilling and completion operations, critical 

gaps remain. Current safety management regulations fail to establish goal-oriented risk reduction 

measures for preventing major incidents; do not adequately support a tripartite system of industry, 

workforce, and regulator collaborating to improve safety; do not feature adequate proactive audits and 

inspections by the regulator; and do not sufficiently use leading and lagging safety performance indicators 

to avoid major accidents and influence ongoing safety improvements. The regulatory attributes identified 

000952
Macondo Investigation Report Volume 4 4/17/2016

17 

in this final volume of the CSB’s Macondo investigation series highlight the important roles of the 

regulator, industry, and workforce in a goal-setting, risk-reduction regime. 

000953
Macondo Investigation Report Volume 4 4/17/2016

18 

2.0 Reviewing International Regulatory Models 

Volumes 2 and 3 of the CSB’s Macondo Investigation Report demonstrate that the incident would have 

been less likely to occur if BP and Transocean had implemented modern process safety good practices 

applicable to offshore (e.g., those concerning safety critical barrier identification and management, human 

factors, safety performance indicators of barrier health and safety system reliability, ALARP, and 

corporate governance of major accident hazards). While Transocean and BP had adopted some of these 

process safety concepts into their corporate policies, they did not apply them at Macondo. This disregard 

of their stated commitments reveals a culture of minimal compliance with regulations and demonstrates 

the need for regulatory action to prevent such an approach. 

Before Macondo, offshore US regulations did not address safety management systems and risk 

management, relying instead on voluntary participation by operators to adopt safety and environmental 

management programs. Since Macondo, BSEE has promulgated SEMS, which incorporates by reference 

API’s Recommend Practice for Development of a Safety and Environmental Management Program for 

Offshore Operations and Facilities. Process safety management good practice has advanced considerably 

since API 75 was first published, but those advances are not reflected in the recommended practice, and 

consequently not in SEMS. 

After reviewing the regulatory history of safety management systems offshore in the US, this chapter

introduces a regulatory model referred to as the “safety case regime,” which has been widely 

recommended post-Macondo in numerous investigation reports. Volume 4 examines the safety case

models used in the UK and Australia as well as the regulatory model adopted in Norway to review how 

the attributes identified in Section 0 might be implemented in the US to address regulatory gaps and 

weakness highlighted by the Macondo incident. 

2.1 History of Safety and Environmental Management Systems 

Offshore in the US 

In 1991, the then-US offshore regulator, MMS, proposed a regulatory model for offshore safety 

management, the Safety and Environmental Management Program (SEMP). 15 SEMP was to address key 

points such as written management policies, procedures, training, accident prevention and investigation, 

and corrective action plans. Some industry commenters requested that MMS wait until the voluntary API 

75 standard was published before making a decision, while some recommended MMS simply set safety 

goals for the industry rather than promulgating regulations.16 Ultimately, MMS did not promulgate SEMP 

regulations, but after helping to develop API 75, MMS requested that offshore operators17 voluntarily 

adopt the principles contained in it once published.18 

 

15 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 56 Fed. Reg. 30400 (Notice, July 2, 1991). 

16 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 59 Fed. Reg. 29277 (Notice, June 30, 1994).

17 ‘Operators’ as referenced in US offshore regulations refer explicitly to the leaseholders of the well; this term does 

not include drilling contractors or other well service providers.

18 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 59 Fed. Reg. 29277 (Notice, June 30, 1994). 

000954
Macondo Investigation Report Volume 4 4/17/2016

19 

API 75 recommended that OCS operators have a safety and environmental management program for their 

operations that included elements such as: 19

• safety and environmental information; 

• hazards analysis;

• management of change;

• safe work practices

• training;

• assurance of quality and mechanical integrity of critical equipment; 

• and audit of safety and environmental management program elements. 

Rather than ensuring continual safety improvement and evaluation of the effectiveness of safeguards 

through more rigorous requirements (e.g., using language such as “shall”), the standard relied upon 

permissive language such as “should” and “recommends.” For example, API 75 only permissively stated 

that owners and operators “should,” rather than “shall,” require that program elements be documented and 

reviewed to assure they continued to be suitable, adequate, and effective.

20

On June 30, 1994, MMS published a notice in the Federal Register stating that it would closely monitor 

the voluntary adoption of API 75 by OCS operators for two years.21 In another notice published in the 

Federal Register on July 18, 1996, MMS stated that it collaborated with API to conduct an annual series 

of surveys to gauge how well OCS operators were implementing SEMP through API 75.22 The MMS 

stated that surveys conducted in January 1995 and January 1996 showed OCS operators “well on their 

way to implementing SEMP plans,” and if progress similar to this were maintained, the MMS expected 

that many of these companies’ SEMP plans would be “fully implemented in the field within the next 1-2 

years.”23 As MMS continued to collect information, it deferred deciding for a mandatory or voluntary 

adoption of the SEMP by OCS lessees. 

Throughout the 1990s and 2000s then, MMS monitored the voluntary adoption of SEMP, but it was not 

until 2006 that MMS again addressed making SEMP, and potentially elements addressed by API 75, a 

regulatory requirement.24 At that time, MMS published a study of 310 incident that resulted in 13 

fatalities and 97 injuries.

25 MMS’s analysis indicated that the contributing causes to the majority of these 

incidents were associated with four SEMP elements: hazards analysis, management of change, 

mechanical integrity, and operating procedures. MMS observed, “requiring operators to implement 

 

19 API Recommended Practice, 75, 3rd ed., Recommended Practice for Development of a Safety and Environmental 

Management Program for Offshore Operations and Facilities, May 2004 (Reaffirmed May 2008). 

20 Ibid., p 2. 

21 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 59 Fed. Reg. 29277 (Notice, June 30, 1994).

22 Safety and Environmental Management Program (SEMP) on the Outer Continental Shelf (OCS), 61 Fed. Reg. 

37493 (Notice, July 18, 1996).

23 Ibid.

24 Oil and Gas and Sulphur in the Outer Continental Shelf (OCS)—Safety and Environmental Management Systems, 

71 Fed. Reg. 29278 (Advanced Notice of Proposed Rulemaking, May 22, 2006). 

25 Ibid.

000955
Macondo Investigation Report Volume 4 4/17/2016

20 

these critical elements of an integrated safety management system could address MMS’s concerns 

with performance and ultimately improve safety and environmental compliance on the OCS.”26

This proposal was not without strong opposition. The Offshore Operators Committee (OOC),27 a large 

industry group comprising major oil company representatives of which BP is a member, conducted a 

workshop in September 2009.28 The OOC resisted making SEMP a required regulation. Instead, OOC 

compared MMS’s proposal to adopt API 75 as regulation to the potential damage from a hurricane: “Both 

are disruptive to operations and are costly to recover from!”29 OOC also asserted that MMS failed to 

understand that the existing voluntary programs for safety and environmental protections were effective, 

that the industry’s safety record continued to improve without the need for prescriptive regulation. OOC 

asserted that the “recordkeeping” envisioned in SEMP/SEMS did nothing to keep people safe, thereby 

making the implementation of SEMS unnecessary.30 OOC concluded that offshore safety could be most 

improved through the continued use of voluntary safety programs that allowed the “various operators the 

opportunity to style their programs to fit their corporate culture and operations” and the need to “modify 

worker behavior.”31 Ultimately, it was only after the consequences of Macondo were fully realized did 

safety and environmental management systems become a regulatory requirement. 

2.1.1 The Outdated API Offshore Safety Management System Approach 

API 75 was, in part, based upon API 750, “Management of Process Hazards,” whose safety focus is for 

the “prevention of catastrophic releases of toxic and explosive material.” API 75, though, lacks the 

explicit purpose of preventing major hazard accidents and instead encompasses offshore safety and 

environmental protection in general.32 As generally discussed in Volume 2, the low probability of major 

accidents can lead to low perception of risk. As a result, offshore drillers may not assess major accident 

scenarios and identify controls to prevent or mitigate them.

33 Both BP and Transocean illustrated this 

lapse at Macondo. For example, BP’s risk matrix for Macondo did not consider potential blowouts, but 

 

26 Ibid.

27 According to the Offshore Operators Committee Mission Statement, available on its website: “The Offshore 

Operators Committee (OOC) is a non-profit organization comprised of any person, firm or corporation owning 

offshore leases and any person, firm or corporation engaged in offshore activity as a drilling contractor, service 

company, supplier or other capacity that desires to participate in the work of OOC or the Offshore Operators 

Committee...The Committee's activities are focused on providing its member operators with information and 

technical support that will assist them in conducting their offshore activities in a manner that will promote sound 

safety and environmental operational practice.” See “About the OOC” at http://www.offshoreoperators.com 

(Accessed March, 26, 2016). 

28 OOC. Offshore Operators Committee SEMS Feedback, September 2, 2009; 

http://big.assets.huffingtonpost.com/MMS-2008-OMM-0003-0030.3.pdf (accessed March 26, 2016).

29 Verret, A. MMS Expectations, Offshore Operators Committee SEMS Feedback, September 2, 2009; 

http://big.assets.huffingtonpost.com/MMS-2008-OMM-0003-0030.3.pdf (accessed March 26, 2016).

30 Parker, W. Closing Statement, Offshore Operators Committee SEMS Feedback, September 2, 2009; 

http://big.assets.huffingtonpost.com/MMS-2008-OMM-0003-0030.3.pdf (accessed March 26, 2016).

31 Parker, W. Closing Statement, Offshore Operators Committee SEMS Feedback, September 2, 2009; 

http://big.assets.huffingtonpost.com/MMS-2008-OMM-0003-0030.3.pdf (accessed March 26, 2016).

32 API Recommended Practice, 750, 1st ed., Management of Process Hazards, January 1990. 

33 Volume 2, Section 4.1.

000956
Macondo Investigation Report Volume 4 4/17/2016

21 

rather other more probable well control issues such as a stuck pipe or lost circulation.34 In the case of 

Transocean, safety critical procedures identified and addressed personal safety hazards or relatively minor 

spills rather than potential loss of well control events.35

API 75 states that operators should develop SEMP documentation addressing 11 management program 

elements such as hazard analysis, management of change, incident investigation, and audits.36 While the 

11 elements are important safety management systems, they fall short of the more rigorous approach

taken by the Center for Chemical Process Safety (CCPS), which details additional elements that include 

process safety culture, management review and continual improvement, workforce involvement, and 

measurement and metrics.37 These key topics and others are either missing or not effectively addressed in 

API 75. Moreover, language of the SEMP/SEMS guidelines weakens their impact. API 75 does not 

recommend a specific safety goal such as preventing accidents or controlling hazards, nor does it 

reference a risk goal such as ALARP. 

The provisions listed in API 75 for each management program element are typically activity-based,

38

meaning that the mere completion of an activity does not necessarily focus on the effectiveness of 

accident prevention measures, or necessarily result in actual risk reduction. For example, the hazard 

analysis element in API 75 states the purpose of the analysis is “to identify, evaluate, and where 

unacceptable, reduce the likelihood and/or minimize the consequences of uncontrolled releases and other 

safety or environmental incidents.”39 Without a risk-reduction requirement such as ALARP, this 

formulation leaves what is “unacceptable” entirely to the discretion of owners/operators, rendering the 

regulator powerless to proactively question or intervene, even if the owners/operators’ efforts seem 

minimal or insufficient. 

Both API RP 750 and API 75 were first issued early in the development of process safety principles. API 

750 is no longer published, and although API 75 was reaffirmed in 2008 and 2013, has not been updated 

since 2004. Neither reflects current process safety principles described throughout Volume 3, yet API 75 

is a cornerstone of offshore US safety regulations requiring operators to “develop, implement, and 

maintain a safety and environmental management system (SEMS) program [that addresses] elements 

described in American Petroleum Institute’s Recommended Practice for Development of a Safety and 

Environmental Management Program for Offshore Operations and Facilities.” 40 

 

34 Volume 3, Section 4.4.2.

35 Volume 3, Sections 1.8.2 - 1.8.4.

36 API Recommended Practice, 75, 3rd ed., Recommended Practice for Development of a Safety and Environmental 

Management Program for Offshore Operations and Facilities, May 2004 (Reaffirmed May 2008).

37 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007. 

38 The CSB coined the term “activity-based” in its Chevron regulatory report; USCSB, 2013. Regulatory Report: 

Chevron Richmond Refinery Pipe Rupture and Fire, Richmond, CA, August 6, 2012, p 9, Report No. 2012-03-ICA, April 2013, http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf

(accessed January 25, 2016). 

39 API Recommended Practice, 75, 3rd (2004, reaffirmed 2008) ed., Recommended Practice for Development of a 

Safety and Environmental Management Program for Offshore Operations and Facilities, p 7.

40 30 C.F.R. § 250.1900 (2016). 

000957
Macondo Investigation Report Volume 4 4/17/2016

22 

2.2 Purpose of the Regulations and Role of the Regulator

Offshore safety regulators exist, in part, to hold industry accountable for health, safety, and environmental 

protection standards in their offshore operations, and to address other issues not necessarily related to 

safety, such as licensing, revenue collection, and environmental protection and stewardship. Due to the 

dangers posed by high-hazard offshore oil and gas operations, the US government has an interest in 

establishing minimum safety standards and outside verification mechanisms to oversee that industry 

follows those standards to benefit of workers and the environment. The catastrophic potential for injuries, 

deaths, or damage that could result without an effective regulator cannot in good conscience be tolerated, 

and companies may not always choose to operate with appropriate protections unless the government 

requires it. At a minimum, offshore regulations explain to industry and the public the boundaries and 

expectations for those protections. These offshore resources are to some extent considered held in public 

trust, so another of the regulator’s key tasks relates to effective stewardship of the deepwater assets 

themselves. Moreover, the regulator must act on environmental protection issues, driven by the growing 

need to safeguard the natural environment and the interest of all stakeholders as it grants operators and 

drillers a public license to extract offshore resources safely for the benefit of the corporation and the 

overall US economy.

Regulators can conduct oversight responsibilities through varied mechanisms, both proactively and 

reactively, to influence industry safety improvements. Regulators can challenge safety claims that 

industry makes and assure their implementation of safety management systems in general through 

inspections, audits, and incident investigation. Some regulatory attributes inherently provide a regulator 

with more tools or position the regulator to provide more effective—and even more proactive—oversight 

in high-hazard industries like offshore drilling. 41 

 

41 See Section 0 for a summary of these regulatory attributes, though they will be discussed more in depth 

throughout Volume 4.

000958
Macondo Investigation Report Volume 4 4/17/2016

23 

2.3 An Alternative Regulatory Model: The Safety Case

Following the Macondo blowout, numerous widely circulated official investigative reports recommended

broad improvements to the US offshore regulatory regime. Many specifically promoted adopting a 

fundamentally different regulatory model for deepwater drilling in the outer continental shelf region of 

the US, the “safety case.” They included:

• The National Commission on the BP Deepwater Horizon Oil Spill (National Commission) which 

stated, “The Department of the Interior should develop a proactive, risk-based performance 

approach specific to individual facilities, operations and environments, similar to the ‘safety case’ 

approach in the North Sea. ... Require operators to develop a comprehensive ‘safety case’ as part 

of their exploration and production plans—initially for ultra-deepwater (more than 5,000 feet) 

areas, areas with complex geology, and any other frontier or high-risk areas—such as the 

Arctic.”42

• The National Academy of Engineering (NAE), along with the National Research Council (NRC), 

examined the probable causes of the Macondo explosion, fire, and oil spill, recommending that 

the US “fully implement a hybrid regulatory system that incorporates a limited number of 

prescriptive elements into a proactive, goal oriented risk management system for health, safety, 

and the environment.” 43

• Det Norske Veritas (DNV), one of the leading classification and certification bodies operating 

worldwide, asserted, “The current safety regime for the US Gulf of Mexico is largely a 

prescriptive regulation with no requirement for safety cases to be performed.... an offshore safety 

regime based on a performance-based regulation requiring safety cases including risk assessments 

supplemented by required or recommended specific prescriptive regulation for selected areas is 

the most effective regime model.”44 

• The Department of Interior recommended several improvements concerning its offshore safety 

regime, including specific reference to the safety case model: “The Department Will Adopt 

Safety Case45 Requirements for Floating Drilling Operations on the OCS ... based on IADC 

[International Association of Drilling Contractors] Health, Safety and Environmental Case 

Guidelines for Mobile Offshore Drilling Units (2009).”46 The DOI further recommended: 

 

42 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deepwater: The Gulf Oil 

Disaster and the Future of Offshore Drilling - Report to the President; Janurary, 2011; pp 252-253.

43 National Academy of Engineering and National Research Council. Macondo Well Deepwater Horizon Blowout: 

Lessons for Improving Offshore Drilling Safety; December 14, 2011; p 90. 

44 Pitblado, R.; Bjerager, P.; Andreassen, E. An Effective US Offshore Safety Regime; Det Norske Veritas: 22 2010, 

July; p 3. http://www.dnvusa.com/Binaries/1008-001%20Offshore%20Update_Key%20aspects_tcm153-

430982.pdf (accessed March 16, 20106).

45 DOI defines the safety case as follows: “A safety case is a comprehensive and structured set of safety 

documentation to ensure the safety of a specific vessel or equipment. This documentation is essentially a body of 

evidence that provides a basis for determining whether a system is adequately safe for a given application in a 

given environment;” Department of Interior. Increased Safety Measures for Energy Development on the Outer 

Continental Shelf; May 27, 2010; p 27. 

46 Department of Interior. Increased Safety Measures for Energy Development on the Outer Continental Shelf; May 

27, 2010; p 27.

000959
Macondo Investigation Report Volume 4 4/17/2016

24 

“Finalize a rule that would require operators [on the OCS] to develop a robust safety and 

environmental management system for offshore drilling operations,” which DOI described as “a 

comprehensive, systems-based approach to safety and environmental management that 

incorporates best practices from around the globe.”47 

• The United States Coast Guard (USCG) recommended that it “work with BOEMRE to evaluate 

the benefits of shifting to a “Safety Case” approach similar to that used in the North Sea, a 

method in which there is a more holistic approach to safety.48 

These recommendations reflect a logical progression of a regulatory approach seen throughout the history 

of offshore oil and gas regulation. It makes sense for society to protect its interests through appropriate 

regulation if an industry, such as offshore oil and gas exploration and production is capable of 

endangering the lives or safety of workers or creating significant health and safety or environmental risk 

to its citizens. Such a regulatory regime could be: (1) a state-run, nationalized industry centrally 

controlled by the government; (2) a prescriptive licensing and approval regime with audits and 

inspections and penalties for failure to comply with regulations; or (3) a safety case type of regime where 

the company proposes to conduct its activities and then explains its major accident hazards assessment 

and control plan to the regulator, typically (but not always) for acceptance before commencing drilling 

exploration or production operations. 

Some prescriptive regulation is typically present in a safety case regime, such as technical requirements 

for equipment, but overall, the safety case approach refers to a goal-setting, risk-reduction approach 

intended to drive the risk of a major accident event to as low as reasonably practicable. Upon drilling a 

new well, this begins in the project development stage, when the leaseholder has a duty to demonstrate to 

the regulator that the risks of its design are ALARP, and how it will reassess any significant changes to 

maintain risk levels. The well design inherently defines what operational risks drilling contractors will 

manage and how they will implement, monitor, and maintain effective barriers (also referred to as 

controls) for each of those risks. Ultimately, the drilling contractor submits for the offshore regulator’s 

acceptance its “case” concerning the controls it has implemented to maintain operational safety. 

A key advantage of this type of a goal-setting regulatory approach, in contrast to a regulatory scheme 

based on compliance with prescriptive requirements, is the freedom or flexibility it provides companies to 

control risks, and to be able to rely on good practice using their own preferred methods to achieve safe 

operation. This flexibility is particularly necessary for both the regulator and the company in situations 

affecting unique scenarios on the cutting edge of technology where good engineering practice continues 

to develop, such as Arctic operations. In fact, as explained by offshore expert Peter Wilkinson, “[o]ne of 

the main benefits [of the safety case model] is not the finished product, but the actual process of preparing 

 

47 Ibid., pp 27- 28. 

48 As offshore safety regulators in the US, BOEMRE and USCG formed a Joint Investigation Team to investigate 

the Deepwater Horizon disaster. BOEMRE and the USCG published separate reports addressing their respective 

areas of safety responsibility; USCG, Report of the Investigation into the Circumstances Surrounding the 

Explosion, Fire, Sinking and Loss of Eleven Crew Members Aboard the Mobile Offshore Drilling Unit Deepwater 

Horizon in the Gulf of Mexico, April 20-22, 2010, Volume 1, MISLE Activity Number 3721503; p 127.

http://www.uscg.mil/hq/cg5/cg545/dw/exhib/DWH%20ROI%20-%20USCG%20-%20April%2022,%202011.pdf

(Accessed March 26, 2016).

000960
Macondo Investigation Report Volume 4 4/17/2016

25 

the safety case and having to identify hazards and review the installation design, construction and 

operation.”49 

A regulatory model like the safety case regime, however, demands that the regulator play a fundamental 

role in ensuring that industry continually strives to reduce risks to ALARP. This means the regulator is 

instrumental in using a variety of means to ensure good practices exist across the sector. Put simply, the 

regulator sets the goals (e.g., drive the risk as low as reasonably practicable), reviews a company’s 

proposed written case for safety in terms of its operations and management of hazards, and then ensures 

that a company performs as promised in meeting stated goals. If the regulator has concerns about a 

company’s safety case or operational performance, then it has the resources and other tools to understand 

the company’s position through direct engagement. The regulator can then can either accept the 

company’s case, or alternatively initiate efforts to obtain necessary improvement. According to 

Wilkinson, the safety case regime even helps make regulators more effective. He noted: “safety cases 

make it possible for the regulator’s interventions to be more effective because the safety case should 

identify the critical safety issues and the regulator’s interventions can concentrate on these.”50 These 

interventions reach far beyond complying with items on a checklist or maintaining completed 

documentation about required tasks that the operators and drillers performed.51 So a duty holder’s

systematic analysis of major hazards documenting the risks, control measures and safety management 

systems meant to ensure their effectiveness is a necessary improvement in the US offshore environment. 

This would be the case whether the BSEE adopts an entire safety case system or imports to the US 

attributes from safety case regimes to fill regulatory gaps. 

The safety case model is not a form of self-regulation. The regulator’s acceptance of a safety case does 

not constitute approval, in the traditional sense, that somehow the burden of maintaining safe operations 

shifts from the regulated to the regulator. Instead, acceptance is more akin to a comprehensive review of 

the operator’s or driller’s submitted safety case by the regulator. The regulator’s acceptance of the safety 

case implies that the submitter’s proposed documentation satisfactorily proposes good practice relating to 

identified hazards. Thereafter, the burden of operating safely continues to remain on the parties 

undertaking the risk, and the regulator will hold those parties to the submitted standards in the written

cases for safety. 

The regulator in a goal-setting, risk reduction regime must cultivate a sophisticated and nuanced 

approach, remaining nimble and playing different roles in different circumstances. The regulator’s role 

ranges from one of challenging industry to establish sound safety strategies, and enforcing the 

prescriptive aspects of the existing system—as well as each duty holder’s written case for safety—to 

partnering with operators and guiding industry toward continual improvements in offshore drilling 

safety.52 This volume explains why the regulator must be independent and have adequate resources, 

 

49 Shaw, S. What’s the Case for a US Version of the Safety Case?; April 2, 2014; http://www.erm.com/en/newsevents/platform/whats-the-case-for-a-us-version-of-the-safety-case/ (accessed March 26, 2016). 

50 Ibid. 

51 Ibid. 

52 Wilkinson, P. Creating a New Offshore Petroleum Safety Regulator, Presentation to IADC, Australian Petroleum 

Production & Exploration Association Conference, March 25, 2003; p 5 

http://www.nopsema.gov.au/assets/document/IADC-Annual-General-Meeting.pdf (accessed March 26, 2016). 

000961
Macondo Investigation Report Volume 4 4/17/2016

26 

including necessary funding and a strong workforce with sufficient technical expertise, interpersonal 

skills, credibility, and authority to work alongside industry for continual improvement.53 

While safety case type approaches were practiced by the UK and Australia before Macondo, 

recommendations for a safety case regime in response to the Macondo blowout also occurred 

internationally.54 On September 23, 2013, based on its own independent studies, the European 

Commission implemented Safety of Offshore Oil and Gas Operations Directive that was “broadly based” 

on the preexisting UK offshore safety regime and related requirements, including preparation of a written 

case for safety.55 This direct response to Macondo was in recognition of the more than 1,000 oil and gas 

production facilities offshore in the oceans surrounding EU member countries. 

2.4 Managing Major Accident Hazards in the US

The CSB concludes that while adopting the SEMS regulation was an improvement for offshore US 

regulations, it remains inadequate for major accident prevention in offshore drilling, and BSEE is not 

fully empowered to accomplish its mission as the offshore regulator. 

To illustrate by analogy, the current SEMS model in many ways parallels the Occupational Safety and 

Health Administration (OSHA) onshore Process Safety Management (PSM) regulation for fixed 

industrial facilities, which the CSB has studied extensively in its 17-year operating history.56 The CSB 

has found that the onshore PSM approach used to regulate petroleum refineries in the US relies on a 

regulatory framework that duty holders can satisfy by “checking the box” when completing a variety of 

required safety-related activities, such as a process hazard analysis or management of change. Yet 

compliance with those requirements can still fail to improve safety. The activity may not adequately 

identify major hazards or control major accident events, in part, because the regulatory requirement lacks 

targeted risk-reduction, goal-setting requirements, and accommodations for a proactive regulator to 

engage with the facility. As such, the PSM approach has devolved into an activity-based, reactive 

regulatory climate. Activity-based approaches run contrary to longstanding onshore process safety good 

practice that advocates for the ultimate goal of continual risk reduction. In 1992, CCPS emphasized “after 

identifying hazards and analyzing effects of those hazards, a management system should be in place to 

assure that all practical steps have been taken to reduce the risks.”57 

Despite the improvements to the US offshore regulatory scheme, as with onshore, there is no riskreduction goal of ALARP or equivalent. In addition, the current US offshore regulatory framework 

emphasizes the regulator’s role to a reactive one rather than encourage meaningful proactive engagement 

 

53 Ibid., p 3. 

54 Norway has a regulatory model that reflects many of the attributes in Section 0, but distinct differences exist 

between its regulatory model and that in the UK and Australia. Some of those differences are described 

throughout this volume.

55 http://www.hse.gov.uk/offshore/directive.htm (accessed January 26, 2016). 

56 For example, the CSB investigated major industrial accidents such as the 2005 BP Texas City explosion and fire, 

which resulted in 15 fatalities and 180 injuries; the 2010 heat exchanger catastrophic rupture at Tesoro Anacortes 

Refinery, which led to seven fatalities, and the Chevron Richmond Refinery pipe rupture and fire, which caused 

worker injuries and over 15,000 local residents to seek medical attention. See, www.csb.gov. 

57 CCPS. Plant Guidelines for Technical Management of Chemical Process Safety; American Institute of Chemical 

Engineers: New York, NY, 1992; p 67.

000962
Macondo Investigation Report Volume 4 4/17/2016

27 

among the regulator, industry, and workforce. The outcome, therefore, may be similar to the PSM 

approach in which offshore operators may comply with SEMS requirements and communicate this 

compliance to the regulator, but they are not adequately or effectively identifying and controlling hazards 

or implementing good practice. 

000963
Macondo Investigation Report Volume 4 4/17/2016

28 

3.0 Inadequate Post-Macondo Safety Management 

Regulations

The offshore oil and gas industry is subject to legal requirements from a variety of regulators, including 

the US Environmental Protection Agency (EPA),58 Bureau of Ocean Energy Management (BOEM),59 US 

Coast Guard (USCG), and BSEE. Specific to safety, the Outer Continental Shelf Lands Act (OCSLA) 60

gives broad authority to the USCG and BSEE to regulate activities that affect the safety of life and 

property on facilities and vessels operating on the Outer Continental Shelf. The USCG and BSEE have 

signed Memoranda of Agreements (MOAs) to assign responsibilities between the two agencies for 

inspecting and overseeing systems and sub-systems on Mobile Offshore Drilling Units (MODUs)61 and 

other fixed OCS facilities.62 For example, on MODUs like the Deepwater Horizon, BSEE has lead 

regulatory oversight on systems related to drilling and completion activities, and the USCG has lead 

oversight of fire suppression systems. While the CSB acknowledges the dual regulatory role in 

maintaining safety on the OCS, the analysis contained in this report focuses on BSEE’s regulatory 

responsibility because many of the systems for which the USCG has lead oversight (e.g., station keeping, 

fire protection, emergency evacuation plans, etc.) were not causal to the initial well release and explosion 

which were the focus of the CSB’s investigation. 

This chapter demonstrates that despite changes post-Macondo, US offshore safety regulations still do not 

provide an adequate safety management framework for major accident prevention. Without a continual 

risk-reduction goal like ALARP, the SEMS regulations are not as agile in driving ongoing industry 

improvement, especially because the US regulatory regime lacks mechanisms for rapidly adapting to 

 

58 For example, 40 C.F.R. Part 122. See also Memorandum of Understanding Between the Environmental Protection 

Agency and the Department of the Interior Concerning the Coordination of SPDES Permit Issuance with the 

Outer Continental Shelf Oil and Gas Lease Program. 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Publications_Library/001_1984-MOU.pdf (accessed 

Feburary 26, 2016).

59 “BOEM promotes energy independence, environmental protection and economic development through 

responsible, science-based management of offshore conventional and renewable energy and marine mineral 

resources,” http://www.boem.gov/About-BOEM/ (accessed Feburary 26, 2016).

60 43 U.S.C. § 1331 et seq.

61 As defined by 46 U.S.C. § 2101 15(a), a MODU is “a vessel capable of engaging in drilling operations for the 

exploration or exploitation of subsea resources.”

62 USCG and BSEE. Subject: Mobile Offshore Drilling Units (MODUs). Memorandum of Agreement between the 

Bureau of Safety and Environmental Enforcement - U.S. Department of the Interior and the U.S. Coast Guard - 

U.S. Department of Homeland Security; BSEE/USCG MOA: OCS008; June, 4 2013; 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Publications_Library/MOA_OCS08_MODUs_signed_06.04.2013.pdf (accessed Feburary 26, 2016); 

USCG and BSEE. Subject: Fixed Outer Continental Shelf (OCS) Facilities. Memorandum of Agreement between 

the Bureau of Safety and Environmental Enforcement - U.S. Department of the Interior and the U.S. Coast Guard 

- U.S. Department of Homeland Security; BSEE/USCG MOA: OCS008; September, 19, 2014; 

http://www.bsee.gov/uploadedFiles/BSEE/International_and_Interagency_Collaboration/Interagency/Agreements

/MOA-2014-USCG-Fixed%20OCS%20Facilities.pdf (accessed Feburary 26, 2016);

000964
Macondo Investigation Report Volume 4 4/17/2016

29 

ongoing advances in technology and safety practices.63 This shortcoming results in weak, performancebased requirements that lead to the activity-based approach in which both industry and regulator can 

become preoccupied with the completion and documentation of activities without necessarily 

demonstrating that the implemented safety management activities can effectively control hazards and 

minimize risks. Moreover, SEMS regulations apply explicitly to the operator, whose SEMs program is 

intended to manage all the activities of third-party contractors. Finally, BSEE’s safety management 

regulations do not adequately provide for worker participation throughout the lifecycle of hazardous 

operations. 

To that end, companies’ current SEMS plans may therefore not be adequate for major accident prevention 

because SEMS regulations: 

• lack a risk-reduction methodology to drive continual improvement (e.g., ALARP); 

• fail to facilitate the regulator’s ability to require companies to make safety changes based on 

lessons learned from major incidents and newly identified hazards;

• lack a requirement for documented demonstration that the safety management system elements as 

implemented will reduce risk to the targeted level;

• favor of activity-based requirements;

• fail to focus specifically on process safety for major accident prevention, instead seeking to 

address health and safety matters as a general proposition;

• lack sufficient focus on human factors/safety critical task analysis requirements for each element;

• misapply legal responsibility for safety solely to operators even though contractors also create or 

control risk; 

• lack clarity on the major accident safety responsibilities of key parties, such as operators and 

drilling contractors, for safety critical tasks; and 

• do not adequately address the important role of workers and their representatives in safety 

management. 

This chapter describes approaches taken by other international regimes that offer alternative means to 

ensure that those who control risk are responsible for managing it.

3.1 SEMS: No Goal-Setting Risk-Reduction Standard 

A performance-based regulatory approach with a goal of reducing risk to ALARP increases both the 

industry’s and regulator’s flexibility. For industry, performance regulations provide freedom to conduct 

its work as it determines best as long as it can demonstrate the chosen methods will work consistently

with good practice. Good practice, however, is not a static concept; in fact, it will evolve with time.64 In 

some cases, standards for what is ALARP for a particular activity do not exist, so they will need to be 

developed to adequately control risks. As new technology is developed or costs of previously developed 

technologies decrease, the standard for “reasonably practicable” will change. Consequently, an ALARP 

approach provides the regulator with the flexibility to make ALARP judgements, keep what constitutes 

 

63 See Section 3.1.1.

64 UK HSE. Principles and Guidelines to assist HSE in its judgements that duty-holders have reduced risk as low as 

reasonably practicable, http://www.hse.gov.uk/risk/theory/alarp1.htm (accessed March 1, 2016). 

000965
Macondo Investigation Report Volume 4 4/17/2016

30 

good practice under review, and influence the industry to adopt new practices. To that end, a credible, 

well-resourced regulator would have a full range of tools needed to advise and, if necessary, to challenge 

a company’s assertion that its risk-reduction practices satisfy ALARP. 

Pertinent to ALARP, the Baker Panel65 notes in its 2007 report (“the Baker Report”) on BP and its 

process safety performance following the 2005 BP Texas City disaster that an effective process safety 

management system builds on an “improvement cycle” that “should include, in practice, continual 

reduction of process risk and improvements in safety performance according to some measurable 

criteria.”66

The Baker Panel defined “continuous improvement” as 

• improving controls for process hazards, including process safety knowledge and competence of 

workers; 

• improving process safety leadership of supervisors; 

• improving process engineering to identify and design to remove or mitigate the effects of process 

hazards; 

• extending legal compliance to reducing risks through best practices; 

• extending mere compliance with internal standards to learning from operating experiences, 

incident and near-miss investigations, hazard studies, audits, and other assessments to improve 

those internal standards; and 

• identifying and implementing not only those external standards that must be observed, but also 

those that represent best practices that can lead to process safety excellence.67

While offshore SEMS regulations require companies to identify hazards and manage safety,68 they do so 

without a goal either the industry or regulator can work toward, such as maintaining good practice as an 

ALARP approach would. Therefore, the US still lacks a goal-setting risk-reduction standard in its 

offshore regulatory scheme to encourage continual improvement and adaptability. 

Volume 3 of this report describes ALARP as the level at which further risk reduction, through 

incremental sacrifice (in terms of cost, time, effort, or other expenditure of resources) becomes grossly 

disproportionate to the incremental risk reduction achieved.69 In practice, prescriptive legislation is easier 

to comply with and for regulators to enforce compliance (e.g., by inspecting or auditing by checking 

boxes concerning requirements contained on a list), whereas goal-setting legislation is a more challenging 

regime to operate.

70 But, the goal-based ALARP requirements demand more effort by the company to 

 

65 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an 

independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety 

culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their 

findings and recommendations, see http://www.csb.gov/assets/1/19/Baker_panel_report1.pdf (accessed January 

25, 2016). 

66 Ibid., p 166. 

67 Ibid. 

68 30 C.F.R. § 250.1900. 

69 Volume 3, Section 4.1. 

70 The BSEE SEMS section Chief spoke on this issue. “We need to emphasize that compliance requires operators to 

demonstrate that they are implementing SEMS as a performance-based standard and not just checking off items 

on a list;” OTC: BSEE reports 100% SEMS compliance after first cycle. Oil & Gas Journal; Slocum, M., Ed., 

000966
Macondo Investigation Report Volume 4 4/17/2016

31 

ensure risks are reduced to targeted levels, and they empower the regulator to drive further improvements 

over time. 

The UK, Norwegian, and Australian offshore regulators have all adopted ALARP-type goals. The UK’s 

Health and Safety Executive (HSE) has produced much guidance concerning ALARP. The agency’s 

guidance on ALARP for onshore facilities explains that to achieve the goal of ALARP, the risk reduction 

measures to prevent major accidents should at least be “relevant good practice.”71 The duty holder must 

demonstrate that the good practice is relevant and up to date, and must review risks and risk reduction 

measures as circumstances, technology, knowledge, and information evolve.72 When assessing whether 

risks are reduced to ALARP, companies in the UK weigh the risk “against the measures necessary to 

eliminate the risk. The greater the risk ... the less will be the weight to be given to the factor of cost.”73 

In Norway, the Petroleum Safety Authority (PSA) regulates offshore safety74 and ensures that companies 

adapt to safety and technological advances through its performance-based approach to regulatory 

oversight.75While Norwegian regulations do not specifically reference ALARP, they do require 

companies to choose the technical, operational, and organizational solutions that offer the best results, 

provided the costs are not significantly disproportionate to the risk reduction achieved.76 For instance, the 

regulations call on “the operator and others participating in the activities” to address the goal of 

operational safety through any effective method, as opposed to requiring specific actions.77 This approach 

ensures that duty holders are primarily responsible for determining the best methods to mitigate the risks 

they create, which in turn helps the regulator ensure that safety practices keep pace with advances in 

industry. 

The Australian National Offshore Petroleum Safety and Environmental Management Authority 

(NOPSEMA) requires companies to reduce risks to the health and safety of people onboard offshore 

facilities to a level as low as reasonably practicable.78 NOPSEMA explains that to do this, the company 

 

May 7, 2015, http://www.ogj.com/articles/2015/05/otc-bsee-reports-100-sems-compliance-after-first-cycle.html

(accessed March 26, 2016). 

71 UK HSE. Guidance on ALARP Decisions in COMAH. 

http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed January 5, 2016). 

72 Ibid. 

73UK HSE. Principles and guidelines to assist HSE in its judgements that duty-holders have reduced risk as low as 

reasonably practicable. http://www.hse.gov.uk/risk/theory/alarp1.htm#P4_129 (accessed January 5, 2016). 

74 See http://www.psa.no/about-us/category877.html (accessed March 26, 2016).

75 See Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), 

http://www.ptil.no/framework-hse/category403.html (accessed March 26, 2016). 

76 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore 

Facilities (The Framework Regulations), Section 11 Risk Reduction Principles, http://www.ptil.no/frameworkhse/category403.html#_Toc282603288 (accessed March 26, 2016).

77 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore 

Facilities (The Framework Regulations), Section 7 Responsibilities pursuant to these regulation, 

http://www.ptil.no/framework-hse/category403.html#_Toc282603288 (accessed March 26, 2016).

78 NOPSEMA. ALARP Guidance Note; N-04300-GN0166, Rev 6; June, 2015; 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0166-ALARP.pdf (accessed March 26, 2016).

000967
Macondo Investigation Report Volume 4 4/17/2016

32 

“has to show, through reasoned and supported arguments, that there are no other practical measures that 

could reasonably be taken to reduce risks further.”79 

In the US offshore, the OCSLA states that it “shall be the duty of any holder of a lease or permit under 

this subsection to (1) maintain all places of employment within the lease area or within the area covered 

by such permit in compliance with occupational safety and health standards and, in addition, free from 

recognized hazards to employees of the lease holder or permit holder or of any contractor or subcontractor 

operating within such lease area.”80 Although it can be argued that this duty supports implementing a 

goal-setting regulatory requirement like ALARP, BSEE has yet to explicitly adopt such a requirement 

within its regulatory scheme or the SEMS rule. This may change with the proposal of new well control 

regulations described in Section 3.1.4. 

The SEMS rule states that operators “through your management, are responsible for the development, 

support, continued improvement, and overall success of your SEMS program.”81 At specified intervals 

and at least annually, US operators are required to review their SEMS programs to determine if the 

program “continues to be suitable, adequate and effective (by addressing the possible need for changes to 

policy, objectives, and other elements of the program in light of program audit results, changing 

circumstances and the commitment to continual improvement) and document the observations, 

conclusions and recommendations of that review.”82But without a benchmark such as ALARP in place

establishing goals for risk reduction, this can become a documentation exercise that does not actually 

result in the reduction of risk.

Performance-based regulatory regimes already exist in the US. The US Nuclear Regulatory Commission 

(NRC) was an early adopter of the performance-based approach to regulation. The NRC defines 

performance-based regulation as “approach that focuses on desired, measurable outcomes, rather than 

prescriptive processes, techniques, or procedures” but does not specify precisely how to achieve the 

results.83 According to the Commission, performance-based regulations permit licensees to “have 

flexibility to determine how to meet the established performance criteria in ways that encourage and 

reward improved outcomes.”84 Under this approach, a regulator focuses on whether the goal of as low as 

reasonably achievable, or ALARA (see callout box), has been achieved in “processes, procedures, and 

judgments” related to both design and operational risk85 For design risk, quantitative judgements are more 

likely, but when operational risk is addressed, qualitative factors become more important. “What is 

essential, for ALARA practiced at any level, is that the choices be fully documented, together with the 

criteria which have [been relied on to make] those choices. When the criteria are qualitative, it is more 

 

79 Ibid. 

80 43 U.S.C. § 1348 (b).

81 30 C.F.R. § 250.1909.

82 30 C.F.R. § 250.1909 (d).

83 US Nuclear Regulatory Commission. Performance-based regulation, http://www.nrc.gov/reading-rm/basicref/glossary/performance-based-regulation.html (accessed January 19, 2016).

84 US Nuclear Regulatory Commission. Background and Staff Guidance on Performance-Based Regulation, 

http://www.nrc.gov/about-nrc/regulatory/risk-informed/concept/performance.html (accessed January 19, 2016). 

85 Fassò, A.; Rokni, S. Operational Radiation Protection in High Engery Physics Accelerators. Implemenation of 

ALARA in Design and Operations of Accelerators; SLAC-PUB-13800; SLAC National Accelerator Laboratory: 

May, 2009; p 7. http://www.slac.stanford.edu/cgi-wrap/getdoc/slac-pub-13800.pdf (accessed March 26, 2016).

000968
Macondo Investigation Report Volume 4 4/17/2016

33 

likely that subjective judgments play a large role, but those judgements must be equally recorded [as they 

are for quantitative judgements].” 86 

3.1.1 The Use of Standards and Guidance in ALARP-based Regulatory 

Regimes 

For the most part, the goal-setting regulations in the UK, Norway, and Australia do not use prescriptive 

requirements to follow either national or international or industry standards. Where prescription is used, it 

is in connection with, for example, the areas to be covered in hazard analysis documentation or the 

frequency of examination and testing of lifting equipment.87 Both the UK HSE and Norway PSA publish 

regulatory topic guidance to advise duty holders on how to achieve compliance with their respective 

regulations. For example, the UK has an Approved Code of Practice (ACOP) for preventing fire, 

explosion, and emergency response on offshore installations.88 It is not mandatory to follow the guidance 

in an ACOP, but HSE has indicated “if you do follow the guidance you will normally be doing enough to 

 

86 Ibid., pp 6-7. 

87 Whewell, I. Former Director, UK HSE Offshore Division, Personal communication, July 6, 2011.

88 UK HSE. Prevention of fire and explosion, and emergency response on offfshore installations; L65; HSE: 2012; 

http://www.hse.gov.uk/pUbns/priced/l65.pdf (accessed March 2, 2016).

In the US, the nuclear industry provides a model of continual risk reduction. Similar 

to ALARP, the target is “as low as reasonably achievable” (ALARA). The Nuclear 

Regulatory Commission’s Reactor Oversight Process (ROP), its primary 

performance-based regulation, is the means by which it achieves its mission of public 

health and safety in commercial nuclear power plant operations.a The ROP uses 

seven “cornerstones,” such as mitigating systems and barrier integrity, to monitor 

three performance areas (reactor safety, radiation safety, and security safeguards).b

Licensee performance data, inspection plans, quarterly assessments, and assessment 

and inspection responses are tied to each performance area and several cross-cutting 

objectives, such as worker involvement and human performance.c Licensees may 

choose their own methods to meet overarching performance goals, which are guided 

by their duty to reduce risks to ALARA.d

 The Commission has stated that this 

flexibility is one of the main reasons its regulatory philosophy encourages continual 

improvement.e

 

a US Nuclear Regulatory Commission. Reactor Oversoght Process (ROP), 

http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/ (accessed March 26, 2016). b US Nuclear Regulatory Commission. Reactor Oversight Process; December, 2006; p 2. 

http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed March 26, 2016). c Ibid., p 3.

d US Nuclear Regulatory Commission.. Guidance for Performance - Based Regulation; NUREG/BR0303; December, 2002; p 1. http://www.nrc.gov/reading-rm/doccollections/nuregs/brochures/br0303/br0303.pdf (accessed March 26, 2016). e US Nuclear Regulatory Commission. Background and Staff Guidance on Performance-Based 

Regulation, http://www.nrc.gov/about-nrc/regulatory/risk-informed/concept/performance.html

(accessed January 19, 2016).

000969
Macondo Investigation Report Volume 4 4/17/2016

34 

comply with the law.”89 A duty holder can also comply with the law if it demonstrates that alternative

measures are likely to be just as effective as those specified in the ACOP. ACOPs tend not to refer to 

specific technical standards, but describe the way of achieving a specific outcome. ACOPs are being used 

less as they can have the effect of discouraging technical progress and innovation.

HSE also publishes guidance with every set of regulations it produces, giving the duty holder advice on 

interpreting the legislation and information on how to achieve compliance.90 Following this guidance is 

not mandatory, but like ACOPs, in most cases an inspector will accept that if the duty holder follows the 

guidance, it complies with the requirement. 

Guidance published HSE’s Energy Division comes in a variety of forms:

91 leaflets, books on its 

webpages, advisory notices,92 and research reports. While the latter is not strictly guidance, research 

reports represent available knowledge on hazards and risks, and duty holders would be expected to take 

into account the latest research in forming their hazard and risk control strategies. Although HSE does not 

publish lists of approved technical and other standards, some are referenced in the guidance HSE 

publishes. The best example is in Guidance for the Topic Assessment of Major Accident Hazard Aspects 

of Safety Cases (GASCET).

93 Ultimately, while industry good practices can form the basis for hazard 

assessments, the duty holder is required to effectively identify and control risks as lessons are learned, 

technology improves, and information is shared.94 The key question for assessing major hazard risk is 

whether anything more can be done to reduce risk.95 While technical guidance like GASCET helps relate 

assessors’ technical judgements to good practice, it does not cover all major accident event hazards poised 

offshore. For instance, GASCET identifies basic well design and equipment hazards,96 but it does not 

identify guidance and standards for the assessment of well conditions and operational activities, such as 

those occurring at Macondo at the time of the blowout. In effect, assessors and industry will rely on the 

general ALARP guidance previously described to assess the adequacy of organizational and operational 

barriers identified in Volumes 2 and 3. 

Norway’s offshore regulator publishes guidelines on how to achieve the requirements in its provisions.97

When using a recommended standard in a regulatory guideline, the “party can normally assume that the 

 

89 UK HSE. Legal status of HSE guidance and ACOPs, http://www.hse.gov.uk/legislation/legal-status.htm (accessed 

March 3, 2016). 

90 Whewell, I. Former Director, UK HSE Offshore Division, Personal communication, July 6, 2011.

91 UK HSE. Guidance, http://www.hse.gov.uk/guidance/index.htm (accessed March 2, 2016). 

92 UK HSE. Safety alerts and notices, http://www.hse.gov.uk/offshore/notices/sn_index.htm (accessed March 2, 

2016). 

93 UK HSE. GASCET (Guidance for the topic assessment of the major accident hazard aspects of safety cases), 

http://webcommunities.hse.gov.uk/connect.ti/gascet/view?objectId=62036 (accessed March 2, 2016).

94 Ibid. 

95 UK HSE. Guidance on Risk Assessment for Offshore Installations; Offshore Information Sheet No. 3/2006; 

http://www.hse.gov.uk/offshore/sheet32006.pdf (accessed March 2, 2016).

96 The main hazard sources identified in GASCET are intermediate formations, reservoir-introduced fluids, 

explosive, radioactive sources, pressure vessels, and dropped objects.

97 PSA. Guidelines Reguarding the Framework Regulations, http://www.psa.no/framework/category408.html

(accessed March 2, 2016). 

000970
Macondo Investigation Report Volume 4 4/17/2016

35 

regulatory requirements have been met.”98 If a party wants to adopt an approach not specified in the 

guideline standards, the party must document how the same level of health, safety and environmental 

protection is achieved.99 The regulatory guidelines are mostly technical in nature,

100 but parties must 

demonstrate “strategies and principles that form the basis for design, use and maintenance of barriers, so 

that the barriers' function is safeguarded throughout the offshore or onshore facility's life” for operational 

and organizational barriers not addressed in the guideline standards.101 

In Australia, NOPSEMA does not endorse any ACOPs or standards.102 NOPSEMA has clarified its stance 

on good practice, “the term ‘good practice’ in NOPSEMA guidance documentation therefore is taken to 

refer to any well-defined and established standard or codes of practice adopted by an 

industrial/occupational sector, including ‘learnings’ from incidents that may yet to be incorporated into 

standards. Good practice generally represents a preferred approach; however, it is not the only approach 

that may be taken. While good practice informs, it neither constrains, nor substitutes for, the need for 

professional judgement.”103

3.1.2 Insufficient US Alternative Legal Mechanisms to Drive Continual Safety 

Improvements 

The OCSLA calls upon the Secretary of the Interior to promulgate safety regulations that include “the use 

of the best available and safest technologies which the Secretary [of the Interior] determines to be 

economically feasible, wherever failure of equipment would have a significant effect on safety, health, or 

the environment.”104 But these requirements do not apply if the Secretary of the Interior determines that 

the safety improvements do not justify the costs of implementing the technology.105 

A BSEE regulation calls for using the “best available and safest technology (BAST) whenever practical 

on all exploration, development, and production operations” 106 ... “in general, we consider your 

compliance with BSEE regulations to be the use of BAST.”107 Limiting BAST to compliance with BSEE 

 

98 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore 

Facilities (The Framework Regulations), Section 24 Use of recognized standards, http://www.psa.no/frameworkhse/category403.html#_Toc357595254 (accessed March 26, 2016).

99 Ibid. 

100 For a summary, see OGP. Regulators' use of standards; Report No. 426; OGP Standards Committee: March, 

2010; p 33 and Annex F1. 

101 Regulations Relating to Management and the Duty to Provide Information in the Petroleum Activities and at 

Certain Onshore Facilities (The Management Regulations), Section 5, Barriers,

http://www.psa.no/management/category401.html#_Toc377975494 (accessed March 26, 2016).

102 NOPSEMA. Guidance Note: ALARP; N-04300-GN0166, Revision 6; June, 2015; p 6. 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0166-ALARP.pdf (accessed March 2, 2016).

103 Ibid

104 43 U.S.C. § 1347 (b).

105 43 U.S.C. § 1347(b). The Supreme Court explained that this provision of the OCSLA is one in which Congress 

has imposed two independent requirements: that an administrative action be “feasible” and that it is justified by a 

balancing of costs and benefits. Indus. Union Dep’t., AFL-CIO v. Am. Petroleum Inst., 448 U.S. 607, 709 n. 27 

(1980).

106 30 C.F.R. § 250.107(c).

107 30 C.F.R. § 250.107(d).

000971
Macondo Investigation Report Volume 4 4/17/2016

36 

regulations, however, undermines the potential impact of requiring the use of the best available and safest 

technology not required in the BSEE regulatory scheme.

The BSEE Director may require additional measures to ensure using BAST to avoid equipment failure 

that would have a significant effect on safety, health, or the environment, so long as it is “economically 

feasible” and “the benefits outweigh the costs.”108 Nevertheless, the cost-benefit analysis needed to meet 

this requirement results in a high burden of proof on the regulator to require operators to do something not 

specifically stated in the regulations. It differs from the continual improvement mechanism of the North 

Sea and Australian regimes, which require companies to monitor new developments and continually drive 

risks to ALARP.

109

30 C.F.R. § 250.198 is an example of a BSEE regulation that incorporates certain standards by reference, 

yet it is also an example of not being easily adaptable. The effect of incorporation by reference is that the 

incorporated documents are treated as if they were published in the Federal Register as part of the 

underlying regulation.110 The incorporated material, like any other properly issued regulation, has the 

force and effect of law.111 Some of the documents incorporated into that regulation include ANSI/ASME 

Codes, API Recommended Practices, ASTM Standards, American Welding Society Codes, and American 

Gas Association Reports. The regulation states that the documents incorporated in the rule are limited to 

the edition cited, but that BSEE will publish any changes to such documents in the Federal Register 

before amending the rule. Yet the regulation also states that BSEE may change the version of a document 

referenced in this rule without an opportunity for public comment if the agency determines the revisions 

would result in safety improvements or represent new industry standard technology and they do not 

impose undue costs on the affected parties.112 The aim of this rule, to be able to adapt BSEE requirements 

to changing practices and technology without having to go through the rulemaking process, could 

therefore be subverted if a party challenges BSEE’s finding that revisions do not impose “undue costs.” 

This situation leaves updating the regulation to the more traditional process, which is time-consuming, 

burdensome, and often difficult, even where the regulated matters are far less complex. 

Finally, BSEE regulations have a provision for alternative procedures or equipment, but the requirements 

to receive approval are vague in comparison to the guidelines international regulatory regimes have 

provided their own assessors.113 Currently, to receive approval, “you must either submit information or 

give an oral presentation to the appropriate Regional Supervisor. Your presentation must describe the site-

 

108 30 C.F.R. § 250.107(d).

109 Reducing to ALARP does not assure the best risk controls available are reasonably practicable. According to the 

UK HSE, “it is only if the cost of implementing these new methods of control is not grossly disproportionate to 

the reduction in risk they achieve that their implementation is reasonably practicable. For that reason, we accept 

that it may not be reasonably practicable to upgrade an older plant and equipment to modern standards. However, 

there may still be other required measures to reduce the risk ALARP: for example, partial upgrades or alternative 

measures;” UK HSE, Some fallacies about ALARP, http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed 

March 26, 2016). 

110 Update of Revised and Reaffirmed Documents Incorporated by Reference, 75 Fed. Reg. 22219 (Final Rule, April

28, 2010).

111 30 C.F.R. § 250.198(a)(3); Update of Revised and Reaffirmed Documents Incorporated by Reference, 75 Fed. 

Reg. 22219 (Final Rule, April 28, 2010).

112 30 C.F.R. §§ 250.198(a)(2)(i)-(ii).

113 30 C.F.R. 250.141 

000972
Macondo Investigation Report Volume 4 4/17/2016

37 

specific application(s), performance characteristics, and safety features of the proposed procedure or 

equipment.”114 As HSE has indicated, among other benefits, guidelines provide “transparency to the 

assessment decisions and criteria” and “a basis for consistency in the assessment process and its 

outcomes.”115 BSEE does not yet provide such guidance to its intended audience. 

3.1.3 Ineffective Regulatory “Workarounds” 

Since US offshore regulations do not have an effective continual safety improvement requirement, 

rulemaking is required to change any part of an existing regulation that may become outdated or 

irrelevant after new safety information emerges. Since the rulemaking process is onerous, BSEE 

sometimes communicates safety messages to offshore lessees through Notices to Lessees (NTLs),

116

Information to Lessees (ITLs),

117 and Safety Alerts.118 NTLs are “formal documents that provide 

clarification, description, or interpretation of a regulation or OCS standard; provide guidelines on the 

implementation of a special lease stipulation or regional requirement; provide a better understanding of 

the scope and meaning of a regulation by explaining BSEE interpretation of a requirement; or transmit 

administrative information”.

119 ITLs are “formal documents that provide additional information and 

clarification, or interpretation of a regulation, OCS standard, or regional requirement, or provide a better 

understanding of the scope and meaning of a regulation by explaining BSEE interpretation of a 

requirement”.

120 Safety Alerts are used to inform industry of the circumstances surrounding an incident or 

a near-miss and to provide “recommendations that should help prevent the recurrence of such an incident 

on the OCS.”121

These documents may be helpful in providing guidance for regulatory compliance, but the NTLs, ITLs, 

and Safety Alerts themselves cannot expand upon what BSEE regulations require, and BSEE has no 

ability to force operators or contractors to comply with the guidance in these documents. For instance, in 

2000, MMS issued a Safety Alert urging offshore lease holders to install a backup mechanism for 

activating subsea blowout preventers.122 In the Safety Alert, MMS stressed that a secondary activation 

system was an “essential component” of any rig’s emergency response system. Although having a backup 

 

114 30 C.F.R. 250.141(c)

115 UK HSE. GASCET (Guidance for the topic assessment of the major accident hazard aspects of safety cases), 

http://webcommunities.hse.gov.uk/connect.ti/gascet/view?objectId=62036 (accessed March 2, 2016).

116 BSEE. Notices to Lessees and Operators, http://www.bsee.gov/Regulations-and-Guidance/Notices-to-Lesseesand-Operators/ (accessed March 2, 2016). 

117 BSEE. Information to Lessees and Operators, http://www.bsee.gov/Regulations-and-Guidance/Information-toLessees-and-Operators/ (accessed March 2, 2016). 

118 BSEE. Current Safety Alerts, http://www.bsee.gov/Regulations-and-Guidance/Safety-Alerts/Safety-Alerts/

(accessed March 2, 2016). 

119 BSEE. Notices, Letters, and Information to Lessees and Operators (NTL)s, http://www.bsee.gov/Regulationsand-Guidance/Notices-to-Lessees/index/ (accessed March 2, 2016).

120 Ibid. 

121 BSEE. Current Safety Alerts, http://www.bsee.gov/Regulations-and-Guidance/Safety-Alerts/Safety-Alerts/

(accessed March 2, 2016). 

122 BSEE. MMS Safety Alert: Accidental Disconnect of Marine Drilling Risers; Safety Alert No. 186; March 2, 

2000; http://www.bsee.gov/uploadedFiles/BSEE/Regulations/Safety_Alerts/Safety%20Alert%20No%20186.pdf 

accessed March 26, 2016).

000973
Macondo Investigation Report Volume 4 4/17/2016

38 

activation system for BOPs should have been a best safety practice, BSEE’s use of the Safety Alert could 

not require operators to install such backup systems because it was not contained in a regulation. Thus, 

Safety Alerts and Notices can provide useful guidance on a short-term basis, but because they are not 

incorporated into regulation, they cannot require timely adaptation of best safety practices.

3.1.4 Recent BSEE-proposed Regulatory ALARP-type Language

In April 2015, BSEE proposed new regulations that it described as “most substantial rulemakings in the 

history” of offshore safety in the United States.123 As part of these regulations, BSEE introduced ALARPtype language to “reduce risks to the lowest level practicable” that if adopted, could empower BSEE with 

a more proactive regulatory authority. Table 3-1 lists some of the current language in § 250.107 and 

BSEE’s proposed changes. 

BSEE explained the proposed regulations were intended to consolidate equipment and operational 

requirements with a focus on blowout preventer equipment, well design, well control, casing, 

cementing, real-time well monitoring, and subsea containment. Just has described in Section 3.1.1, 

few standards exist for assessing well conditions and operational activities that form the basis of 

organizational and operational barriers intended to prevent a major accident. So, while BSEE and industry 

may be able to rely on good practice to guide the judgment on technical barriers, demonstrating that 

organizational and operation barriers reduce risks to the lowest level practicable will be a continual 

improvement process based on company’s SEMS program. 

As Volume 3 documents, neither BP nor Transocean effectively implemented their numerous 

programs to manage safety at Macondo. Furthermore, their indicators tended to be lagging instead of 

leading; thus, they did not sufficiently monitor the real-time health and effectiveness of the physical 

barriers and safety management systems to prevent a major accident. Therefore, a provision to 

“reduce risks to the lowest level practicable” will empower BSEE to challenge the efforts and claims 

that risks are being managed by companies’ and require that more be done if necessary. 

 

123 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Blowout Preventer Systems and 

Well Control, 80 Fed. Reg. 21504 (Proposed Rule, April 17, 2015) (to be codified at 30 C.F.R. Part 250). 

000974
Macondo Investigation Report Volume 4 4/17/2016

39 

Table 3-1. Current and BSEE proposed language for § 250.107, What must I do to protect health, safety, property, 

and the environment?

Current Proposed

 (a) You must protect health, 

safety, property, and the 

environment by: 

 (1) Performing all operations in a 

safe and workmanlike manner; and 

 (2) Maintaining all equipment 

and work areas in a safe condition. 

Paragraph (a) of this section would be revised to include a 

general performance-based requirement that operators 

utilize recognized engineering practices that reduce risks 

to the lowest level practicable during activities covered by 

the regulations and conduct all activities pursuant to the 

applicable lease, plan, or permit terms or conditions of 

approval. Recognized engineering practices may be drawn 

from established codes, industry standards, published peerreviewed technical reports or industry recommended 

practices, and similar documents applicable to 

engineering, design, fabrication, installation, operation, 

inspection, repair, and maintenance activities. This risk 

reduction objective is used in other regulatory programs 

and is consistent with BSEE’s goal of taking a more riskbased approach in its regulations. This risk reduction 

principle has also been included in a recently published 

industry document (API Bulletin 97) which addresses 

drilling, completion, and workover activities. 

Does not currently exist. 

Proposed paragraph (e) would be added to clarify BSEE's 

authority to issue orders when necessary to protect health, 

safety, property, or the environment. The first sentence 

authorizes BSEE to issue orders to ensure compliance with 

the regulations. The second sentence clarifies that BSEE 

may order that operations of a component or facility be 

shut-in because of a threat of serious, irreparable, or 

immediate harm to health, safety, property, or the 

environment posed by those operations or because the 

operations violate law, including a regulation, order, or 

provision of a lease, plan, or permit.

3.2 SEMS Activity-Based Requirements: A Compliance-Based 

Mentality

Although intended to deliver features of a performance-based regime, the SEMS rule does not drive 

improved safety performance as do the NRC or other international offshore regimes. SEMS requires 

000975
Macondo Investigation Report Volume 4 4/17/2016

40 

operators to develop and implement a safety and environmental management system that incorporates 

several safety elements typically found in SMS models, including hazard analysis, management of 

change, operating procedures, and incident investigations. It directs operators to address all required 

elements and “maintain a safety and environmental management system.”124 But the SEMS rule does not 

contain a risk-reduction goal or target that would provide the regulator with the tools to drive continual 

risk-reduction at offshore facilities. It does not function like a strong performance-based regulation 

because completing these actions does not necessarily result in a reduction of risk. Directives such as 

“maintain,”125 “comply,”126 and “manage”127 do not suggest what must be achieved with safety elements. 

In contrast, a goal-setting, risk-reduction, performance-based regulation would include a target (ALARP) 

and would specify what should be accomplished in order to meet the requirements of existing good 

practice.

Nor does SEMS require the operators to document recognized methodologies, rationales, and conclusions 

to claim that safeguards to control hazards will be effective. Rather, SEMS requires that facilities 

“manage” identified hazards,128 with no further requirement regarding how far the operator must go to 

control those hazards. This is, in fact, weaker language than OSHA’s PSM regulation, which specifically 

requires that hazards be controlled.129 Terms such as “manage hazards” and “resolve recommendations” 

are activity-based, as they do not include a performance-based requirement to control hazards or prevent 

major accidents.130 In fact, this formulation allows for managing hazards and resolving recommendations 

without determining that action be taken. Therefore, companies may conduct a weak or inadequate hazard 

analysis and not identify or manage the appropriate safety critical tasks and equipment—yet still comply 

with the regulation.131 

Volume 2 highlights that while the SEMS regulations Rule promotes safety and environmental protection, 

it lack requirements for companies to explicitly address potential major accident events.132 By identifying 

potential MAEs, companies can draw clear linkages between barriers created by safety critical tasks and 

equipment and the major accident hazards they are designed to prevent or mitigate.133 As part of the 

process to reduce MAE risk to ALARP, companies could explicitly demonstrate the adequacy of the 

barriers and the distribution of the types of controls implemented (e.g., engineering, procedural, or 

administrative), among other factors.134 

 

124 30 C.F.R. § 250.1900. 

125 Ibid. 

126 30 C.F.R. § 250.1901.

127 Ibid. 

128 30 C.F.R. § 250.1911(a). 

129 29 C.F.R. § 1910.119(e)(1). 

130 The CSB Macondo Investigation Report Volume 2, Section 6.1.1 details this point.

131 Volume 2 of this report concludes the SEMS regulations are insufficient in guaranteeing safety performance 

improvements throughout the SCE lifecycle.

132 Volume 2, Section 4.1.

133 Volume 2, Section 4.2.3.

134 Volume 2, Section 4.2.3.

000976
Macondo Investigation Report Volume 4 4/17/2016

41 

BSEE incident investigation regulations are another example of activity-based requirements. Under 

SEMS requirements, operators must “establish” investigation procedures to “identify” contributing 

factors (human or otherwise) and “recommend” changes as a result of findings.135 Companies must also 

“establish” corrective action plans based on the findings for investigations. BP actually met these 

requirements when it investigated the March 8, 2010 kick at Macondo, exemplifying the weakness of the 

current regulatory language.136 During BP’s investigation, Transocean identified the need to improve 

hazard recognition among the crew,137 but neither BP nor Transocean examined Transocean’s safety 

management systems meant to prevent a lack of hazard awareness. So while a human factor was 

“identified” as causal to the incident—delayed crew well kick response—only technical recommendations 

resulted from the investigation rather than effectively addressing the identified need to improve kick 

response—a causal factor in the Macondo incident. Ultimately, SEMS language requires an activity of 

conducting an investigation, but not implementing effective recommendations to reduce risk to a targeted 

level. Therefore, companies can still be in compliance with regulations without actually reducing risk 

when investigating incidents and resolving recommendations. 

Critics have voiced their concern over the lack of robust performance-based, risk-reduction requirements 

in SEMS. The safety management subcommittee of BSEE’s own advisory group, the Ocean Energy 

Safety Advisory Committee (OESAC), stated that the SEMS regulation, although well-intended, is 

essentially a prescriptive rule “promotes the idea that operators only have to meet the minimal 

requirements in order to comply with the regulations.”138 Similarly, the International Association of 

Drilling Contractors (IADC) called the SEMS rules “overly prescriptive” in its comments to BSEE.139

IADC urged BSEE to “consider a wholesale re-write of 30 C.F.R. Subpart S to make it more goal-setting 

and less prescriptive.”140 Without sufficient goal-setting, risk-reduction features, a regime risks losing 

focus on risk reduction because companies are doing only the activities the rule requires—which may not 

be the safest practicable action.

IADC’s position should carry some weight in this debate. The IADC HSE Case Guidelines have been 

required for use in 10 countries and are recognized as best practice in 10 additional countries, some of 

which had regulations pending to require adoption or use of the Guidelines, suggesting more jurisdictions 

are moving toward ALARP-type risk-reduction approaches.141

 

135 30 C.F.R. § 250.1919.

136 Volume 3, Section 2.4.

137 Ibid. and Email from Macondo Rig Manager, Transocean, to Wells Team Leader, BP, Subject: Hazard 

Recognition, 18 March, 2010, BP-HZN-2179MDL00289217, 

http://www.mdl2179trialdocs.com/releases/release201305171200030/TREX-000684.pdf (accessed October 7, 

2015).

138 OESAC. Safety Management System Enchancement Reccomendation; SMS SC – Vector #2 Recommendation; 

April 10, 2012; p 4.

139 IADC. Re: Revisions to Safety and Environmental Management Systems (SEMS); Docket ID BOEM; November 

11, 2011; pp 4-5. http://www.bsee.gov/uploadedFiles/IADC%2011-11-2011.pdf (accessed March 26, 2016).

140 Ibid. 

141 Countries having required use of the guidelines by force of regulation include Australia, Cuba, Denmark, Faeroe 

Islands, Germany, Ireland, the Netherlands, New Zealand, Norway, and the United Kingdom, while Angola, 

Canada, Brazil, India, Malaysia, Oman, Qatar, Senegal, South Africa, and Trinidad & Tobago have recognized the 

000977
Macondo Investigation Report Volume 4 4/17/2016

42 

Australia provides another example of a regulation requiring a performance-based hazards analysis, in 

contrast to BSEE’s hazards analysis requirement in the SEMS rule. In Australia, safety case assessments 

must provide a “well-considered, detailed description of a suitable and sufficient formal safety 

assessment.”142 In that analysis, the duty holder must evidence an understanding of “the factors that 

influence risk and the controls that are critical to controlling risk, the magnitude and severity of 

consequences arising from major accident events for the range of possible outcomes, and the likelihood of 

potential major accident events.”143 These requirements are more nuanced, but similar in spirit, to the US 

SEMS requirement to “identify, evaluate, and manage the hazards involved in the operation,”144 to 

“control technology applicable to the operation,145 and to “evaluate possible safety and health effects on 

employees and potential impacts to the human and marine environments, which may result if the control 

technology fails.”146 

In contrast, the Australian regime also requires hazard analyses to clarify linkages between hazards, 

control measures, and the potential major accident events.

147 This is how Australian duty holders show 

that their chosen control measures will manage the risks to ALARP. Australia requires a prioritized list of 

actions in the hazard analysis to reduce risks to ALARP.148 Because the SEMS rule is not accompanied 

by an ongoing duty to reduce risks to ALARP (or another appropriate goal-based target), the hazards 

analyses could be outdated (i.e., the controls could be ineffective or may not reduce risks to a practicable 

level) but still comply with the rule, which must be updated “when an internal audit is conducted to 

ensure that it is consistent with your facility’s current operations.”149 

In Australia and the UK, the hazard analysis is a key component of a safety case document, which the 

regulator must accept before obtaining a license to operate. In these regimes, the regulator proactively 

reviews the operator’s identified hazards and risk-reduction strategies to ensure that risks are reduced to 

the required standard. The regulator may require the installation of a missing control or barrier if it would 

further reduce risks to ALARP. Moreover, during the UK safety case acceptance process, the regulator 

often questions the hazard and risk analyses, and if necessary, updates or changes them if discovered to be 

insufficient, thus creating robust industry/regulator interaction before hazardous activities begin.150

 

guidelines as best practice. Recent regulatory changes may have affected the status afforded the Guidelines by 

these countries. See http://www.iadc.org/iadc-hse-case-guidelines/ (accessed March 26, 2016). 

142 NOPSEMA. Guidance Note: Hazard Identification; N- 04300-GN0107, Rev. 5; December, 2012; p 7. 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0107-Hazard-Identification.pdf (accessed March 

26, 2016). 

143 Ibid. 

144 30 C.F.R. § 250.1911(a).

145 30 C.F.R. § 250.1911(a)(1)(iii).

146 30 C.F.R. § 250.1911(a)(1)(iv).

147 NOPSEMA. Guidance Note: Hazard Identification; N- 04300-GN0107, Rev. 5; December, 2012; p 7. 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0107-Hazard-Identification.pdf (accessed March 

26, 2016).

148 Ibid. 

149 30 C.F.R. § 250.1911(a).

150 Discussed in more detail in Section 4.1.2.

000978
Macondo Investigation Report Volume 4 4/17/2016

43 

3.3 Safety Responsibility Offshore 

Volume 3 introduced two categories of well risk: design and operational.151 The operator’s well design 

and drilling program are the basis for the drilling and well control operations undertaken by a drilling 

contractor and other well services providers. The well design is the first opportunity to assess hazards and 

ensure risks are reduced to ALARP. Once the well design has been determined, the operator then holds 

the primary responsibility to plan the work and apply the ALARP principle in selecting the contractor and 

rig. The well operator should review hazards throughout the lifecycle of the well, from initial spudding to 

final abandonment, and assess any significant changes to ensure well design risks remain ALARP. While 

the well operator controls design risk, the drilling contractor has the most direct control over the 

management of day-to-day operations, and a primary responsibility for the overall safety of the drilling 

installation and the personnel onboard.152 The combination of facility and wellsite specific conditions 

could increase the risk or complexity of various drilling operations. Therefore, an integral second 

opportunity arises to assess hazards and ensure operational, organizational, and technical control 

measures are sufficient to reduce risks to ALARP, namely a review of the hazards in the facility’s 

activities, equipment, personnel, and drilling and well control operations provides. 

By illustration, Figure 3-1 depicts Transocean’s corporate well delivery process, beginning with the 

development of a Well Construction Plan in conjunction with the operator (referred to as the “Customer” 

in Figure 3-1) that was considered a key component of the development, communication, and execution 

of a well plan. The process depicted in Figure 3-1 is a joint endeavor, and as such, the control of major 

accident risk requires the operator and the drilling contractor to play a role in managing risk. Central to 

this effort are the safety management systems the parties use to plan, conduct, and monitor well design 

and operational risk. While these safety management systems will overlap in some cases, they will each 

have their own focus and attributes. 

 

151 Volume 3, Section 1.8.1.

152 As stated in Transocean’s Well Control Handbook, “The OIM is responsible for overall safety of the Installation 

and all personnel onboard,” Internal Company Document, Transocean. Well Control Handbook, Issue HQS-OPSHB-01, Revision 00, July 22, 2011, Well Planning Considerations, Exhibit 5781, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Braniff_Barry-Depo_Bundle.zip (accessed 

October 7, 2015).

000979
Macondo Investigation Report Volume 4 4/17/2016

44 

Figure 3-1. Transocean’s Well Delivery Process as defined by Transocean corporate polices.

153

Despite this, SEMS applies explicitly to the operator, and drilling contractors are not required to develop 

and implement a SEMS program.

154 Instead, an operator’s SEMS program is intended to manage all the 

activities on an offshore facility, including those of the operator and any third-party contractors. The Rule 

states that operators have sole responsibility for creating and managing their SEMS program, even though 

contractors “may adopt appropriate sections of the operator’s SEMS program.”155 This exclusion goes 

against a basic tenet of managing safety within high-hazard operations: those that create or have the 

 

153 Volume 3 provides evidence to indicate that Transocean did not follow its own internal well delivery process. 

This figure was taken from a document not publicly available (Field Operations Policies & Procedures Manual), 

but a similar figure and supporting text can be found in Transocean’s Performance and Operations Policies and 

Procedures Manual which is publically available: Performance and Operations Policies and Procedures ManualLevel L1A, Issue #1, Revision # 00, April 19, 2010, Section 2 (Planning and Reporting), Subsection 1 (Well 

Construction Planning), TRN-MDL-00607022. 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Rose_Adrian-Depo_Bundle.zip Exhibit 

1474 (accessed January 28, 2015). 

Internal Company Document, Transocean. Field Operations Policies & Procedures Manual, Issue 01, Revision 

00, HQS-POP-PP-01, August 8, 2009, Performance Management: Rig and Well Operation Management, TRNCSB-0002274-TRN-CSB-00023200.

154 As stated by BSEE, “[BSEE] does not regulate contractors; we regulate operators;” Oil and Gas and Sulphur 

Operations in the Outer Continental Shelf, 75 Fed. Reg. 63609 (Final Rule, October 15, 2010) (to be codified at 

30 C.F.R. Part 250).

155 The rule exempts contractors from primary responsibility for compliance by stating that operators must document 

contractor selection criteria, obtain and evaluate information about the contractor’s safety and environmental 

performance, and ensure that contractors have their own written safe work practices. 30 C.F.R. § 250.1914.

000980
Macondo Investigation Report Volume 4 4/17/2016

45 

greatest control of the risks associated with a particular activity are responsible for managing them.156

Members of BSEE’s own advisory committee, the Ocean Energy Safety Advisory Committee, pointed 

out the dangers of this gap in contractor coverage in the SEMS Rule, which the committee described as 

“very confusing.”157 In fact, the committee recommended in April 2012 that BSEE address the 

jurisdiction the SEMS Rule covers158 as well as the responsible party.159 

Section 3.3.1 of this chapter describes the difficulties BSEE has had in holding contractors responsible for 

safety. Section 3.3.2 describes international regulatory obligations placed on both operators and drilling 

contractors to conduct a risk assessment of all major hazards, define the systems and barriers to control 

those hazards, and demonstrate their effectiveness throughout the drilling process.

3.3.1 Offshore Regulatory Ambiguity and Industry/Stakeholder Response 

BP and Transocean had corporate polices for risk management that reflected their roles in the Macondo 

project, but neither company ensured the policy implementation, which could have minimized the gap 

between Transocean’s work-as-done by BP and work-as-imagined.

160 Instead, a lack of clarity regarding 

hazard identification and risk management roles and responsibilities resulted in significant safety gaps, 

leaving the companies vulnerable to a major accident. Clarifying these roles and responsibilities is 

important because contractors compose an estimated 80% of offshore workers performing drilling and 

well completion activities.

161 In the case of Macondo, only 8162 of the 126 individuals on the rig at the 

time of the blowout were BP employees, while 79 were Transocean employees, 25 were other third-party 

 

156 UK HSE. Planning to do business in the UK offshore oil and gas industry; October, 2011; p 2. 

http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed March 26, 2016); NOPSEMA, What is a safety 

case, http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed March 26, 2016).

157 “As currently written the SEMS regulations state that only Operators are responsible for developing and 

implementing a SEMS program. In fact the preamble for the SEMS regulations specifically states, “This final rule 

does not require that a contractor have a SEMS program;” OESAC. Safety Management System Enchancement 

Reccomendation; SMS SC – Vector #2 Recommendation; April 10, 2012; p 3.

158 The Committee explained that the term “system,” when used in conjunction with the term “safety management 

system,” typically represents a complete structure such as vessel or a fixed facility, and therefore encompasses all 

operations, processes, activities and systems that make up each structure. The BSEE SEMS regulations do not 

follow this logic because they apply only to operators and cover only operations and activities that fall under 

BSEE jurisdiction.

159 OESAC. Safety Management System Enchancement Reccomendation; SMS SC – Vector #2 Recommendation; 

April 10, 2012; p 13.

160 Volume 3, Section 1.8 illustrates the gap between Transocean’s work-as-imagined and work-as-done at 

Macondo.

161 MMS made this observation in 2003, and then it was reiterated after Macondo by the National Commission on 

the BP Deepwater Horizon Oil Sill and Offshore Drilling: Oil and Gas and Sulphur Operations in the Outer 

Continental Shelf—Incident Reporting Rule, 68 Fed. Reg. 40585 (Proposed Rule, July 8, 2003) and National 

Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, A Competent and Nimble Regulator: 

A New Approach to Risk Assessment and Management, Staff Working Paper No. 21, p 7. 

162 Two of the individuals from BP were not part of the crew, but visiting management (the Vice President of 

Drilling & Completion and the Drilling & Completions Operations Manager.)

000981
Macondo Investigation Report Volume 4 4/17/2016

46 

well providers, and 14 were caterers.163 Despite the high reliance on contractors, a historical examination 

of MMS citations and regulatory action leading up to the Macondo blowout reveals that the regulator did 

not hold all employers accountable to this responsibility.164 The data show that MMS chose to limit 

responsibility for safety (and other potential liability) to the operator/lessee. 

In the aftermath of Macondo, BSEE issued Incidents of Noncompliance (INCs) to two contractors, 

Transocean (drilling contractor) and Halliburton (provider of cementing services), for violations of 

regulations leading to the Macondo incident.165 This was the first time in the history of the agency or its 

predecessors that such action was taken against the drilling contractor and another well service provider. 

The INCs issued to Transocean were resolved in a 2013 consent decree, in which BSEE agreed not to 

pursue enforcement if Transocean paid $400 million in fines and met certain health and safety 

conditions.166 This consent decree does not affect BSEE’s overall ability to issue INCs because it did not 

address their validity vis-à-vis Transocean. Halliburton appealed its INCs, and the Interior Board of Land 

Appeals will consider that appeal after the District Court litigation (MDL) has concluded.167

Although BSEE started citing contractors under 30 C.F.R. § 250.107(a) pursuant to the agency’s authority 

under the OCSLA, ambiguity still exists in US legislation and regulations regarding contractor 

accountability for safety. In a congressional hearing about the release of the Joint Investigation Team final 

report in October 2011, former Director Bromwich cited 43 U.S.C. §1350(b), as the provision in the 

Outer Continental Shelf Lands Act (OCSLA) that supports expanding BSEE enforcement oversight of 

contractors. OCSLA § 24(b), codified at 43 U.S.C. §1350(b), states: 

[e]xcept as provided in paragraph (2), if any person fails to comply with any provision of this 

subsection, or any terms of a lease, license, or permit issues pursuant to this subsection, or any 

regulation or order issued under this subsection after notice of such failure and expiration of any 

reasonable period allowed for corrective action, such person shall be liable for a civil penalty of 

not more than $20,000 for each day of the continuance of such failure. 

 

163 Internal Company Document, Transocean. Personnel On-Board as of 20 Apr 2010 17:09:15, April 20, 2010, 

TRN-MDL-00030435, http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00687.pdf

(accessed March 26, 2016).

164 For an example, BSEE Civil Penalties and Appeals, available at http://www.bsee.gov/Inspection-andEnforcement/Civil-Penalties-and-Appeals/Civil-Penalties-and-Appeals/ (accessed March 26, 2016).

165 BSEE. BSEE Issues Violations Following Investigation Into Deepwater Horizon: Notices Sent to BP, 

Transocean, and Halliburton. October 12, 2011, http://www.bsee.gov/BSEE-Newsroom/PressReleases/2011/BSEE-Issues-Violations-Following-Investigation-Into-Deepwater-Horizon/ (accessed March 26, 

2016). 

166 Partial Consent Decree Between the Plaintiff United States of America and Defendants Triton Asset Leasing 

GMBH, Transocean Holdings LLC, Transocean Offshore Deepwater Drilling Inc., and Transocean Deepwater 

Inc., Doc. 8608, case 2:10-md-02179 (E.D. La.) (Feb. 19, 2013).

167 “In January 2012, the IBLA, in response to our and the BSEE's joint request, suspended the appeal and ordered 

us and the BSEE to file notice within 15 days after the conclusion of the MDL and, within 60 days after the MDL 

court issues a final decision, to file a proposal for further action in the appeal. The BSEE has announced that the 

INCs will be reviewed for possible imposition of civil penalties once the appeal has ended.” Halliburton Form 10-

K, report to the Securities and Exchange Commission for Fiscal Year 2012 (p 18), 

http://www.sec.gov/Archives/edgar/data/45012/000004501213000086/hal12312012x10k.htm#sBEA207F94C6DF488FB8EE5FD8404B586 (accessed January 26, 2016). 

000982
Macondo Investigation Report Volume 4 4/17/2016

47 

Presumably, BSEE can regulate contractors because they are encompassed within the broad definition of 

“person” in the aforementioned provision.168 Additionally, in 43 U.S.C. § 1334(a), the introductory 

section covering “Administration of Leasing” on the Outer Continental Shelf,169 explains the subject and 

scope of regulations that the Secretary of the Interior can promulgate for OCS activities. The scope of this 

clause is broad:

170 

the Secretary shall administer the provisions of this subsection relating to the leasing of the outer 

Continental Shelf, and shall prescribe such rules and regulations as may be necessary to carry out 

such provisions. The Secretary may at any time prescribe and amend such rules and regulations as 

he determines to be necessary and proper in order to provide for the prevention of waste and 

conservation of the natural resources of the Outer Continental Shelf . . . such rules and regulations 

shall, as of their effective date, apply to all operations conducted under a lease issued or 

maintained under the provisions of this subsection.171

Immediately, the drilling industry and its stakeholders publicly opposed BSEE’s position and the issuance 

of INCs to Transocean and Halliburton, claiming the Bureau had “no express statutory authority to extend 

its jurisdiction”172 to contractors and “there are no definitions of exactly who is covered, nor are there 

standards for performance.”173 Even some members of Congress are not persuaded by BSEE’s asserted 

authority to hold contractors liable. In the Committee Report for the Department of Interior, Environment 

and Related Agencies Appropriations Bill for Fiscal Year 2013, congressional appropriators noted: 

The Committee continues to be concerned with the Bureau’s stated intentions for the expansion 

of regulatory authority over nonlease holders under the Outer Continental Shelf Lands Act 

(OCSLA). The authority and need for this action has not been explained or justified to the 

Committee, nor how this diversion of limited resources would impact the Bureau’s current 

mission and objectives identified in the fiscal year 2013 budget request. ... the Committee directs 

 

168 In the statute, “person” means, in addition to a natural person, “an association, a State, a political subdivision of a 

State, or a private, public, or municipal corporation.” 43 U.S.C. § 1331(d). In the accompanying regulations, 

“person” is similarly defined to include “a natural person, an association (including partnerships, joint ventures, 

and trusts), a State, a political subdivision of a State, or a private, public, or municipal corporation.” 30 C.F.R. § 

250.105. The Part 250 regulations define the word “you” as “a lessee, the owner or holder of operating rights, a 

designated operator or agent of the lessee(s), a pipeline right-of-way holder, or a State lessee granted a right-ofuse and easement.” 30 C.F.R. § 250.105 (emphasis added). A plain language reading of the statute and these 

defining regulations could support BSEE’s position that a contractor, as an agent of the lessee, may be legally 

responsible for compliance. 

169 In an Interim Policy Document issued on August 15, 2012, BSEE cites this section of the OCSLA to support its 

regulatory jurisdiction over all entities that perform activities under OCSLA leasing provisions; BSEE. Issuance 

of an Incident of Non Compliance (INC) to Contractors; IPD No. 12-07; August 15, 2012; 

http://www.bsee.gov/uploadedFiles/Issuance%20of%20an%20Incident%20of%20Non%20Compliance%20to%20

Contractors.pdf (accessed March 26, 2016). 

170 A look at the legislative history for this section of the Act reaffirms its breadth. Congress contemplated that oil 

companies would be the primary actors in OCS leasing and related activities and did not differentiate among 

leaseholders, operators, or contractors. H. CONF. REP. 95-1474 at 1679 (1978).

171 43 U.S.C. § 1334(a).

172 http://www.perkinscoie.com/bsee-asserts-jurisdiction-over-offshore-oil-and-gas-service-companies-12-08-2011/

(accessed August 28, 2012).

173 http://rigzone.com/news/article.asp?a_id=116394 (accessed August 28, 2012).

000983
Macondo Investigation Report Volume 4 4/17/2016

48 

that no funds be expended for other purposes until the agency has fully explained its authority, 

intentions, and objectives to the Committee and the public.174

Furthermore, regulations in Title 30 Part 250, which include safety requirements, define the Secretary’s 

authority to regulate oil, gas, and sulphur exploration, development, and production operations on the 

Outer Continental Shelf under the OCSLA.175 The definitions section states that when the word “you” is 

used in the Part 250 regulations, it “means a lessee, the owner or holder of operating rights, a designated 

operator or agent of the lessee(s), a pipeline right-of-way holder, or a State lessee granted a right-of-use 

and easement.”176 Still, other regulations confuse the definition. For instance, one regulation ensures that 

only co-lessees are jointly and severally liable for regulatory compliance, but then adds in a subsequent 

part that the “person” actually performing the activity to which the lessee requirement applies is also 

jointly and severally responsible for complying with the regulation.177 

3.3.1.1 Post-Macondo BSEE Efforts to Hold Contractors Responsible for Safety

BSEE’s decision to issue the INCs to Transocean and Halliburton post-Macondo reflected “the severity of 

the incident, the findings of the joint investigation, as well as Secretary Ken Salazar’s and Director 

Bromwich’s commitment to holding all parties accountable.”178 In his keynote address to the IADC 

annual conference in November 2011, former BSEE Director Bromwich reaffirmed the departure from 

the agency’s previous practice of issuing INCs only to operators.Bromwich noted that law did not require 

the MMS historical practice of limiting its citations to operators. He explained, “the fact that we had 

unilaterally decided to grant immunity to all non-operators was a misguided act of administrative grace 

rather than a result dictated by law or good policy. The fact that we had followed a bad practice was not a 

sufficient reason to continue it.”179

 

174 Comittee on Appropriations. Department of the Interior, Environment, and Related Agencies Appropriation Bill, 

2013; Report No. 112-586; July 10, 2012; https://www.gpo.gov/fdsys/pkg/CRPT-112hrpt589/html/CRPT112hrpt589.htm (accessed March 26, 2016). 

175 30 C.F.R. § 250.101.

176 30 C.F.R. § 250.105.

177 “When you are not the sole lessee, you and your co-lessee(s) are jointly and severally responsible for fulfilling 

your obligations . . . unless otherwise provided in these regulations.” 30 C.F.R. § 250.146(a). “Whenever the 

regulations in 30 C.F.R. parts 250 through 282 and 30 C.F.R. parts 550 through 582 require the lessee to meet a 

requirement or perform an action, the lessee, operator (if one has been designated), and the person actually 

performing the activity to which the requirement applies are jointly and severally responsible for complying with 

the regulation.” 30 C.F.R. § 250.146(c).

178 BSEE. BSEE Issues Violations Following Investigation Into Deepwater Horizon: Notices Sent to BP, 

Transocean, and Halliburton. October 12, 2011, http://www.bsee.gov/BSEE-Newsroom/PressReleases/2011/BSEE-Issues-Violations-Following-Investigation-Into-Deepwater-Horizon/ (accessed March 26, 

2016).

179 BSEE. BSEE Director Delivers Keynote Address at International Association of Drilling Contractors 

Conference, November 11, 2011, http://www.bsee.gov/BSEE-Newsroom/Press-Releases/2011/BSEE-DirectorDelivers-Keynote-Address-at-International-Association-of-Drilling-Contractors-Conference/ (accessed March 26, 

2016).

000984
Macondo Investigation Report Volume 4 4/17/2016

49 

On August 15, 2012, BSEE issued Interim Policy Document No. 12-07, entitled Issuance of an Incident 

of Non Compliance (INC) to Contractors,

180 which states that BSEE will issue enforcement actions 

against contractors who, after considering four factors,181 it determines to have engaged in “egregious” 

conduct.182 The document also notes that issuing INCs to contractors does not relieve lessees from 

liability, and in fact, INCs that are issued to contractors will also be issued to the lessee or operator.183

Since the Macondo incident and the issuance of Interim Policy Document No. 12-07, BSEE has continued 

to issue INCs to non-operators. BSEE investigated a November 16, 2012, incident at a platform in the 

Gulf of Mexico operated by Black Elk Energy Offshore Operations.184 An explosion and fire on Black 

Elk’s platform killed three workers and caused several other serious injuries during welding operations.185

This was the second incident investigation for which BSEE issued INCs to contractors for failure to 

perform safe operations.186 

On March 5, 2013, BSEE issued a single INC to Island Operating, a contractor working with Apache 

Corporation to work on an unmanned Apache platform. The INC, issued pursuant to 30 C.F.R. § 

250.107(a) for failure to perform all operations on the Platform in a safe and workmanlike manner, 

followed an incident at the platform where two Island Operating employees improperly transferred 

chemicals into a chemical tank, causing a fire and damage to the platform.187 Island Operating appealed, 

challenging BSEE’s jurisdiction. In a recent decision that will likely have far-reaching impact on offshore 

contractors, the Department of Interior Board of Land Appeals upheld BSEE’s issuance of the INC 

 

180 BSEE. Issuance of an Incident of Non Compliance (INC) to Contractors; IPD No. 12-07; August 15, 2012; 

http://www.bsee.gov/uploadedFiles/Issuance%20of%20an%20Incident%20of%20Non%20Compliance%20to%20

Contractors.pdf (accessed March 26, 2016). 

181 The four factors are: 1) the type of violation; 2) the harm resulting from the violation; 3) foreseeability of harm; 

and 4) the extent of the contractor’s involvement in the violation(s). Ibid at pp 1 and 2. 

182 Ibid., p 2. 

183 Ibid. 

184 BSEE. Investigation of November 16, 2012, Explosion, Fire and Fatalities at West Delta Block 32 Platform E; 

BSEE Panel Report 2013-002; November 4, 2013; Gulf of Mexico Region, New Orleans Distric Lease No. OCS 

00367; 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Accidents_and_Incidents/Panel_Investigation_Reports/Fi

nal%20BSEE%20Black%20Elk%20report.pdf (accessed March 26, 2016).

185 Ibid. p 1. 

186 A total of 41 INCs were issued to Black Elk Energy Offshore Operations, Wood Group Production Service 

Network, Grand Isle Shipyard and Compass Engineering Consultants. See BSEE’s Notifications of Incidents(s) of 

Noncompliance at, 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Enforcement_Programs/Compass%20INC's%20Signed%

2011-13-13.pdf; 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Enforcement_Programs/GIS%20INC's%20Signed%2011

-13-13.pdf; and 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Enforcement_Programs/Wood%20Group%20INC's%20S

igned%2011-13-13.pdf (accessed March 26, 2016).

187 See BSEE’s Notification of Incident(s) of Noncompliance at 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Enforcement_Programs/Island%20INC.pdf (accessed 

December 22, 2015). 

000985
Macondo Investigation Report Volume 4 4/17/2016

50 

despite the fact that Apache Corporation was the lessee.188 The Board noted that the Secretary is 

authorized under the Outer Continental Shelf Land Act (OCSLA) to prescribe regulations “necessary” to 

ensure that “operations” on the OCS are “conducted in a safe manner ... sufficient to prevent or minimize 

... [any] occurrences which may cause damage to the environment or to property, or endanger life or 

health.”189 The Board held that BSEE has general authority under OCSLA to issue a regulatory violation 

or civil penalty to “any person” who has violated the statute or related regulations.190 The Board also 

relied on 30 C.F.R. § 250.146(c), which provides that “[w]henever the regulations in 30 C.F.R. [P]art 250

... require the lessee to meet a requirement or perform an action, the lessee, operator[,] ... and the person 

actually performing the activity to which the requirement applies are jointly and severally responsible for 

complying with the regulation.”191 Island Operating then had 90 days from the date of the opinion to file 

an action with the federal district court seeking judicial review of the opinion.192 

BSEE has cited additional contractors under 30 C.F.R. § 250.107(a) as well: On March 9, 2013, BSEE 

issued one INC to Alliance Oilfield for allegedly failing to enact proper fall protection safeguards and 

creating hazardous conditions following a fatality in April 2011. On March 5, 2013, BSEE issued one 

INC to Nabors Offshore Corporation for failing to determine whether an electricity source was on or off, 

resulting in a serious injury. Finally, on March 5, 2013, BSEE issued four INCs to Ensco Drilling, 

including three related to drilling operations, for an inadvertent disconnect of the blowout preventer, 

failure to properly lock out/tag out, and failure to prevent a discharge into the Gulf of Mexico. This 

pattern suggests that BSEE believes it has the authority to issue INCs to contractors and will continue to 

use INCs as an enforcement strategy for both operators and contractors as long as the agency has 

authority to do so. 

The drilling industry disputes BSEE’s position that contractors are as accountable as operators. For 

example, the IADC opposed BSEE’s use of a policy document to announce contractor liability, 

proclaiming that “BSEE’s guidance is inconsistent with the industry model and creates a whole new area 

of ambiguity.”193 

3.3.1.2 Stakeholders Attempt to Fill Responsibility Gap with Voluntary Guidance

Despite industry pushback to BSEE oversight of contractors, the American Petroleum Institute attempted 

to fill safety management gaps with API Bulletin 97, Well Construction Interface Document Guidelines. 

API Bulletin 97 is voluntary industry guidance intended to help operators align their SEMS program with 

drilling contractors’ safe work practices.194 It envisions operators and drilling contractors creating 

bridging documents that delineate the operator’s and contractor’s responsibilities during well construction 

 

188 Island Operating Co., Inc., IBLA 2013-137 (September 25, 2015). 

https://www.oha.doi.gov/IBLA/Ibladecisions/186IBLA/186IBLA199%20.pdf (accessed December 22, 2015). 

189 186 IBLA 207. Citing U.S.C. §§ 1332 and 1348(a) (2012). 

190 Ibid. 

191 186 IBLA 213. 

192 The standard of review under the Administrative Procedures Act allows for reversal of the Board’s decision only 

if it is found to be “arbitrary, capricious, an abuse of discretion...[or] in excess of statutory jurisdiction [or] 

authority....” 5 U.S.C. § 706(2). 

193 IADC. IADC criticizes BSEE policy for citing drilling contractors. August 17, 2012, 

http://www.iadc.org/news/iadc-criticizes-bsee-policy-for-citing-drilling-contractors/ (accessed March 26, 2016). 

194 API Bulletin 97, 1st ed., Well Construction Interface Document Guidelines, November 2013. 

000986
Macondo Investigation Report Volume 4 4/17/2016

51 

activities in light of the API RP-75/SEMS rule.195 If followed, this bulletin could help operators and 

contractors better follow the spirit of the SEMS rule; however, it is still voluntary guidance that cannot 

impose any legal requirement. Furthermore, because the regulator was not involved in its development 

and will not review the bridging documents or assess their use, there is no reliable way to know how 

Bulletin 97 is being adopted or how many companies are actually using it. Finally, it does not solve the 

primary issue—that the owner of the offshore installation and (typically) the employer of a workforce 

majority can strongly influence how the major accident risks are controlled, but the regulator does not 

hold them directly accountable to demonstrate that those risks are effectively managed.

3.3.2 Other Regimes’ Focus on Safety Responsibilities of Operator/Lessee 

and Drilling Contractor

Outside the US, the UK and Australia avoid the ambiguity of responsibility through statutory directives 

over an offshore duty holder (or controller of risk). Norway takes a different approach by acknowledging 

different parties can bear either individual responsibility or co-responsibility, but makes it is the 

operator’s responsibility to ensure regulations are being adhered to by everyone on an offshore 

installation. 

While placing safety and environmental duties on all entities that create or contribute to the control of the 

risks for a particular activity, 196 UK regulations place primary compliance responsibility on the duty 

holder. On production installations, this is the “operator,” which may be either the entity appointed by the 

lessee to manage the installation functions, or the lessee itself. On non-production installations such as 

MODUs like the Deepwater Horizon, the duty holder is the rig “owner, which is the entity that controls 

the operation of that installation”197 In either case, the duty holder is “in overall control of the installation 

and must co-ordinate the health and safety activities of all the companies and personnel present.”198 

The responsibilities of the principal duty holder go beyond the basic requirement to develop and 

implement a basic safety and environmental management program. They must also:199

• Submit safety case documentation to the regulator that demonstrates how the major hazards will 

be controlled and mitigated and risks are reduced to as low as reasonably practicable;

 

195 Ibid., p 1. 

196 “The ultimate purpose of the enforcing authorities, [including the Offshore Division], is to ensure that duty 

holders manage and control risks effectively, thus preventing harm.” This enforcement method is based in part on 

proportionality, or relating enforcement action to the risks. “Those whom the law protects and those on whom it 

places duties (duty holders) expect that action taken by enforcing authorities to achieve compliance or bring duty 

holders to account for non-compliance should be proportionate to any risks to health and safety, or to the 

seriousness of any breach, which includes any actual or potential harm arising from a breach of the law.” UK 

HSE Enforcement Policy Statement, Pub. No. 41 (revised December 2009), 

http://www.hse.gov.uk/pubns/hse41.pdf (accessed March 26, 2016).

197 Offshore Installations (Safety Case) Regulations 2005; Offshore Installations (Offshore Safety Directive)(Safety 

Case etc.), 2015, Interpretation, Regulation 2(1) “duty holder.” 

http://www.legislation.gov.uk/uksi/2015/398/regulation/2/made (accessed March 26, 2016). 

198 UK HSE. A guide to the Offshore Installations (Safety Case) Regulations 2005, 3rd ed.; SCR 2005; 2006; 

http://www.hse.gov.uk/pubns/books/l30.htm (accessed March 26, 2016).

199 Adapted from Offshore Safety Case Regulations: Duty Holder Relationships, presented to CSB by Ian Whewell, 

retired head of UK HSE OSD; July 2011.

000987
Macondo Investigation Report Volume 4 4/17/2016

52 

• Submit appropriate revisions to the safety case documentation when the stipulated hazards 

management plan changes; 

• Review the safety case documentation for accuracy and completeness every 5 years; 

• Conform to the contents of the safety case documentation; 

• Comply with the auditing requirements meant to verify conformance. 

Thus, if the Macondo well were drilled in the North Sea, Transocean, as drilling contractor and owner of 

the rig, would be the designated duty holder, with primary legal responsibilities to ensure all operations 

on the rig were executed safely and that it conformed to all safety management practices and aspects of 

risk control as described within its safety case document.200 

To be clear, in the UK arrangement, the leaseholder is not exempt from safety responsibility. BP, as the 

operator, would have primary responsibility to plan and design the well safely to ensure that “the well is 

so designed and constructed, and is maintained in such repair and condition, that (a) so far as reasonably 

practicable, there can be no unplanned escape of fluids from the well; and (b) risks to the health and 

safety of persons from it or anything in it, or in strata to which it is connected, are as low as reasonably 

practicable.”201 The leaseholder is legally required to communicate and cooperate fully with the rig owner 

to ensure safe execution of those plans,202 and the leaseholder would be held liable for any of its actions 

found to be contributory to an incident. These shared legal requirements ensure that key participants are 

fully aware that they may be held liable in the event of an incident and that they cannot rely on legal 

responsibility falling on another party. As such, both the operator and owner have specific and explicit 

risk-reduction responsibilities, which are auditable by the regulator, to ensure that they safely conduct 

drilling and completion operations. 

In Australia, NOPSEMA asserts the principle that “those who create the risk must manage it” and states 

that this is the “operator’s job” because the operator of the facility “has the greatest in-depth knowledge 

of their installation.”203 NOPSEMA defines the operator as a person nominated by a facility owner or 

titleholder who has or will have the day-to-day management and control of the facility (or proposed 

facility) and the operations at that facility.204 For a drilling and completion operation like Macondo, this 

would be the facility/installation owner, similar to the UK. The applicable offshore regulations stipulate 

that the operator with direct control of the facility identify the hazards and risks, describe how it controls 

those risks, and explain its safety management system to apply the controls effectively and 

 

200 UK HSE. A guide to the Offshore Installations (Safety Case) Regulations 2005, 3rd ed.; SCR 2005; 2006; p 5, 

http://www.hse.gov.uk/pubns/books/l30.htm (accessed March 26, 2016).

201 Offshore Installations (Offshore Safety Directive)(Safety Case etc.), 2015, Establishment of well examination 

scheme, Regulation 11, http://www.legislation.gov.uk/uksi/2015/398/regulation/11/made (accessed March 26, 

2016).

202 Oil & Gas UK. Well Integrity Guidelines, Issue 1; July, 2012; Section 2.

203 NOPSEMA, What is a safety case, http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/

(accessed March 26, 2016). 

204 Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009, Select Legislative Instrument No. 

382, 2009 as amended, Chapter 2.3, https://www.legislation.gov.au/Details/F2013C00945 (accessed March 26, 

2016).

000988
Macondo Investigation Report Volume 4 4/17/2016

53 

consistently.

205 The titleholder (or leaseholder) also has specific safety responsibilities for the well. It

must prepare a Well Operations Management Plan (WOMP) identifying all risks that can cause a loss of 

well integrity to adequately assess the control measures and performance standards.206 Guidance provided 

by the regulator on the WOMP states, “The description and explanation should summarize the well 

management system goals, the well lifecycle integrity philosophy and process and provide a detailed risk 

assessment showing how these risks are reduced to as low as reasonably practicable. The content and 

level of detail must be sufficient for NOPSEMA to assess the well management system to be applied by 

the titleholder.”207 

Norwegian regulations state, “in reducing the risk, the responsible party shall choose the technical, 

operational or organisational solutions that, according to an individual and overall evaluation of the 

potential harm and present and future use, offer the best results, provided the costs are not significantly 

disproportionate to the risk reduction achieved.”208 They require the responsible party to “establish, 

follow up and further develop a management system designed to ensure compliance with requirements in 

the health, safety and environment legislation.”209 

Norwegian PSA regulations use the neutral phrases “responsible party” or “obligated party” to encompass 

the leaseholder, drilling contractor, and any other third-party contractors.210 PSA guidance explains the 

use of a neutral term because several parties can be responsible for compliance at the same time, and an 

individual’s responsibility will be limited to those tasks where the individual has control and instruction 

authority. The operator, however, has the duty to ensure that anyone working for it complies with the 

health, safety environmental regulations.211 Therefore, if Macondo had happened in Norwegian waters, 

Transocean would have had to establish a safety management system and technical, organizational, and 

operational barriers for its activities at the well, but BP would have been ultimately held responsible for 

any failures to do so. 

 

205 NOPSEMA, What is a safety case, http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/

(accessed March 26, 2016).

206 NOPSEMA. Guidance Note: Well operations management plan content and level of detail; N-04600-GN1602, 

Rev. 0; December, 2015; http://www.nopsema.gov.au/assets/Guidance-notes/GN1602-Well-operationsmanagement-plan-content-and-level-of-detail-Rev-0-December-2015.pdf (accessed March 26, 2016).

207 Ibid., p 8.

208 Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), Section 11, Risk 

reduction principles, http://www.psa.no/framework-hse/category403.html#_Toc357595238 (accessed March 26, 

2016). 

209 Ibid., Section 17, Duty to establish, follow up and further develop a management system, 

http://www.psa.no/framework-hse/category403.html#_Toc357595245 (accessed March 26, 2016). 

210 Petroleum Safety Authority Norway, Guidelines Regarding the Framework Regulations, Re Section 7, 

Responsibilities pursuant to these regulations, http://www.ptil.no/framework-hse/category408.html#p7 (accessed 

March 26, 2016).

211 Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), Section 7, 

Responsibilities pursuant to these regulations, http://www.psa.no/frameworkhse/category403.html#_Toc357595233 (accessed March 26, 2016). 

000989
Macondo Investigation Report Volume 4 4/17/2016

54 

In these other regimes, the regulator would also have the authority to proactively assess the drilling 

contractor’s performance, such as Transocean’s management of hazards throughout the applicable phases 

of the lifecycle where it is recognized as the primary duty holder. For example, when the UK HSE 

became concerned about human and organizational factors aboard Transocean facilities, the regulator 

decided to audit five Transocean rigs in the North Sea to determine the extent of the problems.212

Operators in this regulatory environment come to understand that safety is more than a checklist of 

completed required documents and tasks—that they must obey the rules and bear the burden of operating 

safely, acting “with confidence, knowing that they have a robust safety culture which can stand up to 

scrutiny, both externally and internally.”213

3.3.3 Conclusion

Work conducted by contractors offshore directly impacts the risk of offshore operations. Sometimes 

personal safety risk is affected, but other times it plays a role in process safety risk that could increase the 

probability of multiple fatalities and large scale environmental damage, both consequences of the 

Macondo blowout. Risk management approaches for the latter are different from those intended to 

mitigate personal safety.214 Just as the CSB argues that industry should approach personal and process 

safety differently, the CSB also sees value in the regulator having different approaches. To that end, the 

CSB sees the greatest potential to improve major accident prevention in US waters by explicitly focusing 

on the design and operation risks governed by the leaseholder/operators and drilling contractors for 

reasons. Ultimately, while this section describes the different approaches of several international regimes, 

the US needs to develop a more effective system for the oversight of key contractors’ work such as the 

drilling contractor during offshore operations who create or control major accident risk. 

3.4 Insufficient SEMS Worker Participation Provisions

Workers participate in virtually every safety activity, whether onshore or offshore.215 At a minimum, 

management should encourage workers to participate in the following activities:

• Collaborating in hazard and management of change (MOC) reviews and job safety analyses;

• Investigating incidents and near-misses;

• Serving on health and safety committees;

• Conducting health and safety inspection/audits; 

• Defining safe operating procedures and work practices for a task or job; 

 

212 Specialist Inspection Report, Transocean Offshore (North Sea) Ltd., by Martin Anderson, Specialist Inspector 

(Human and Organizational Factors), Offshore Division (inspections conducted over four months from July to 

October 2008).

213 Shaw, S. What’s the Case for a US Version of the Safety Case?; April 2, 2014; http://www.erm.com/en/newsevents/platform/whats-the-case-for-a-us-version-of-the-safety-case/ (accessed March 26, 2016). 

214 See Volume 3, Section 3.1

215 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; p 125. 

000990
Macondo Investigation Report Volume 4 4/17/2016

55 

• Reporting unsafe conditions, tools, equipment, and practices to management; and 

• Providing safety feedback through defined mechanisms to other workers.216

Actively engaging the workforce, employees, and contracted personnel ensures all those involved with 

the hazardous work are participating in efforts to identify and manage safety risks. Enhanced workforce 

participation helps to create a strong safety culture and can lead to a safer workplace. The experience of 

companies in implementing enhanced efforts to engage and empower the workforce shows that efforts to 

increase workforce involvement greatly outweighs the costs of such programs.217

Inadequate worker involvement in policies, programs, and regulations limits a drilling crew’s ability to 

help manage the hazards for major accident prevention. BP and Transocean used limited means to 

encourage and empower workers to be involved in managing major hazards. Efforts to include them in 

safety management primarily resided in company safety observation programs focused on occupational 

health and safety. As Volume 3 discussed in depth, occupational safety measures do not improve the 

process safety status of the organization. The CSB identified in previous investigation reports that 

effective process safety management and major accident prevention cannot be achieved without involving 

workers and their representatives. In its Chevron Regulatory Report, the CSB noted that the CCPS lists 

workforce involvement as one of 20 essential management components necessary to reduce process 

safety risks and prevent chemical accidents:218 

...workers are potentially the most knowledgeable people with respect to 

the day-to-day details of operating the process and maintaining the 

equipment and facilities and may be the sole source for some types of 

knowledge gained through their unique experiences. Workforce 

involvement provides management a mechanism for tapping into this 

valuable expertise.219

Worker participation in the offshore oil and gas industry is of critical importance. Workers aboard a rig 

can contribute keen insights into the daily workings of an operation that upper management might miss. 

As such, workers should be engaged in a wide range of safety management activities, including project 

planning, risk analysis, and incident investigations, and thus can play an integral role in preventing 

accidents. As Volumes 2 and 3 demonstrate, decisions that people on a rig make can impact the potential 

for a well kick, or strengthen or weaken a barrier. For example, “any problems that did occur during the 

TA [temporary abandonment] plan would be dealt with by employing the knowledge, experience and 

skills of the drilling team”220 Therefore, if workers are not effectively engaged in the management of 

major hazards in these ways, a duty holder bypasses a key layer of insight and enhanced protection. 

Inclusion of workers also contributes significantly to creation of a positive safety culture, while omitting 

 

216 American National Standards Institute/American Industrial Hygiene Association (ANSI/AIHA) Z10-2012, 

Occupational Health and Safety Managment Systems, 2012, p 34. 

217 Eves, D.; Gummer, J. Questioning Performance: Essential Guide to Health, Safety and the Environment ; IOSH 

Services Ltd: Wigston, United Kingdom, 2011, p 91.

218 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; p liv. 

219 Ibid., p 124. 

220 Volume 3, Section 1.8.2. 

000991
Macondo Investigation Report Volume 4 4/17/2016

56 

workers minimizes their contribution and weakens safety culture onboard a rig. A strong safety culture 

empowers individual workers and encourages them to be fully focused on safe working conditions. Thus, 

workforce engagement is vital to major accident prevention, and should be encouraged.

At the time of the Macondo incident, there were no effective US offshore regulations that provided for 

worker participation in the management of process safety. While BSEE asserts that post-Macondo worker 

participation provisions within SEMS221 provide “several key ways for personnel to help ensure safe 

performance of oil and gas activities on the OCS,”222 these regulations could be substantially improved to 

enhance worker engagement in offshore safety management and major accident prevention efforts. 

Comparisons of the SEMS worker participation regulations with those of international offshore regimes 

and other high-hazard industries in the US illustrate opportunities for further improvement. 

3.4.1 Post-Macondo/SEMS Worker Participation Provisions 

In April 2013, several provisions were added to the SEMS regulations for worker participation,223 but 

regulations do not guarantee that workers are effectively participating in managing offshore process 

safety. Effective worker participation requires active engaging workers in the designing, implementing, 

and improving an operation’s safety management systems.224 BSEE intends to meet this goal with the 

SEMS provisions:

1. Operators must have an Employee Participation Plan (EPP) for their employees. Under the rule, 

operators must consult with employees regarding the SEMS. Furthermore, operators must create a

“written plan of action” showing how “appropriate employees” will contribute to the 

“development and implementation” of an operator’s SEMS. Employees are also required to have 

access to any part of the SEMS that relates to their duties.

225 

2. Operators must include Stop-Work Authority (SWA) procedures in their SEMS program. Such 

procedures would authorize and require all employees and other personnel who witness an 

activity presenting an imminent risk or danger to the health or safety of an individual, the public, 

 

221 30 C.F.R.250.1930-1932.

222 Final Rule, Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety and 

Environmental Management Systems, 78 Fed. Reg. 20,423 (Apr. 5, 2013).

223 Ibid. 

224 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; p 124.

225 30 C.F.R. § 250.1932.

The purpose of employee participation is to utilize the employees' collective 

knowledge and experience to ensure that matters are sufficiently explored before 

decisions are made that concern health, safety, and the environment, and to provide 

the employees with the opportunity to exert influence on their own work situation. 

 — Norwegian PSA Framework Legislation, Section 13, Facilitating Employee Participation, 

http://www.ptil.no/framework/category408.html#p13.

000992
Macondo Investigation Report Volume 4 4/17/2016

57 

or to the environment to stop the work creating the risk or danger. “Imminent risk or danger is 

defined as any condition, activity, or practice in the workplace that could reasonably be expected 

to cause:

• Death or serious physical harm; or

• Significant environmental harm ....”226

3. Operators must define a process to designate an individual with Ultimate Work Authority (UWA) 

on each facility for operational and safety decision-making. After a Stop Work is initiated, work 

can resume upon determination by the UWA “that the imminent risk or danger .... no longer 

exists.”227

4. Operators must provide all personnel with a system for reporting unsafe work conditions.228 

These provisions are a marked improvement over the offshore safety regulations that existed at the time 

of the Macondo incident; however, the provisions are not adequate to ensure the workforce is engaged in 

creating and implementing a company’s SEMS program. 

3.4.2 Insufficient and Limited SEMS Worker Participation Provisions 

In promulgating the Employee Participation Plans, BSEE sought to encourage an “environment that 

promotes participation by employees and management in order to eliminate or mitigate hazards on the 

OCS.”229 BSEE held that the rule would require “an operator who performs regulated activities on the 

OCS ... to consult with its employees [workers] regarding the development, implementation, and 

modification of its SEMS program.”230 “Consult,” however, is a vague term that does not ensure workers 

have a voice in process safety management matters. Consultation can be a one-way process, with 

operators simply telling their workers how the hazards will be managed without consideration of worker 

viewpoints or concerns. The purpose is to engage and empower the workforce throughout the entire 

SEMS lifecycle (development, implementation, and modification), incorporating the workforce’s views, 

accepting those that are valid, and explaining why they are rejected when appropriate. But the SEMS 

regulations do not provide a framework for how that should occur. Furthermore, management selects the 

workers it deems “appropriate” and defines their level of involvement231 in a way that makes the most 

sense for each company or operation, but the possibility exists for continued worker exclusion. 

SEMS provisions that require worker participation are limited in scope. Additionally, other SEMS 

provisions that discuss aspects of worker involvement fail to require the level of active engagement that 

 

226 30 C.F.R. § 250.1930.

227 Ibid. The person with the ultimate work authority would be the person on the fixed, floating facilities or MODU 

with the final responsibility for making decisions. The operator’s SEMS program must identify all persons that 

could have UWA, and the operator must designate those persons as such.

228 30 C.F.R. § 250.1933. Furthermore, on August 28, 2013 BSEE reports it has launched a confidential near-miss 

reporting system with the Department of Transportation and Statistics. The system will “provide important trend 

analysis and statistical data to BSEE.” See BTS and BSEE to Develop Confidential Near-Miss Reporting System, 

http://www.rita.dot.gov/bts/bts_bsee (accessed March 26, 2016).

229 Final Rule, Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety and 

Environmental Management Systems, 78 Fed. Reg. 20,423 (Apr. 5, 2013).

230 Ibid. 

231 30 C.F.R. § 250.1932(b).

000993
Macondo Investigation Report Volume 4 4/17/2016

58 

would help to drive safety improvement. For instance, the SEMS Job Safety Analysis (JSA) provision 

requires “the immediate supervisor of the crew performing the job onsite [to] conduct the JSA, sign the 

JSA, and ensure that all personnel participating in the job understand and sign the JSA.”232 Essentially, 

the supervisor must inform workers of risks associated with their respective jobs and have them sign off 

on the analysis, but the workers need not be involved in identifying, assessing, or mitigating such risks. 

By contrast, other offshore regimes provide specific requirements for including the workforce in safety 

management activities through worker-elected safety representatives.233 Moreover, the SEMS Rule states, 

“Your SEMS program must establish and implement a training program so that all personnel are trained 

in accordance with their duties and responsibilities to work safely and are aware of potential 

environmental impacts.”234 Thus, incorporating process safety concepts and effective practice should be 

part of the required training provided to the workers or their representatives. 

The only other mechanism in SEMS directly addressing worker involvement besides EPP are the StopWork Authority (SWA) provisions;235 however, SWA provisions are a weak substitute for worker 

involvement in major accident prevention offshore. A regulatory SWA provision will not be successful if

the workforce is not aware of the specific safety risks of the work. For example, on the Deepwater 

Horizon, the majority of the frontline workers reported that they were “comfortable with identifying and 

understanding the hazards they were exposed to,”236 but supervisors and rig leadership had concerns with 

hazard awareness amongst the crew. They noted that the crew did not always identify major hazards and 

appropriate controls in their THINK237 plans.238 As one person stated, “they don’t know what they don’t 

know.” The stop-work programs of BP and Transocean allowed for any employee to call for a stop work 

to intervene in hazardous operating conditions, but without clear understanding of the risks, the workforce 

is hindered from effectively identifying situations when major hazard risk barriers have been 

compromised and, thus, will be less likely to initiate a stop work. 

 

232 30 C.F.R. § 250.1911(b)(2).

233 See CSB Chevron Regulatory Report Section 4.4 for a detailed discussion of Active Workforce Participation in 

other jurisdictions; USCSB, 2013. Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire, 

Richmond, CA, August 6, 2012, Report No. 2012-03-I-CA, April 2013, 

http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf (accessed January 

25, 2016). 

234 30 C.F.R. § 250.1915 

235 30 C.F.R. §§ 250.1930, 250.1931. 

236 Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North America 

Division Summary Report, July 2, 2010, TRN-HCEC-00090521, see Exhibit 0929 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015).

237 THINK is a planning and risk management tool that begins with task development and the identification of 

associated task hazards. After hazards are identified, the THINK process requires management to communicate 

hazards to people and to put in place controls to mitigate them. The complexity of a task determines the depth of 

assessment and formality of the THINK plan; See Volume 3, Section 1.8.3 for more detail. 

238 Internal Company Document, Transocean. Safety Management and Safety Culture/Climate: North America 

Division Summary Report, July 2, 2010, TRN-HCEC-00090521, see Exhibit 0929 

http://www.mdl2179trialdocs.com/releases/release201304041200022/Bertone_Stephen-Depo_Bundle.zip

(accessed October 7, 2015).

000994
Macondo Investigation Report Volume 4 4/17/2016

59 

3.4.3 No SEMS Provisions for Worker-Elected Safety Representatives

Safety representatives are spokespeople elected by the workforce onboard offshore drilling or production 

vehicles or other facilities to advocate for workers on “both day-to-day and strategic health and safety 

issues.”239 Exact rules for using safety representative vary among jurisdictions. The UK initiated safety 

representatives post-Piper Alpha, resulting in stronger workforce commitment to implement safety 

management programs. Now frontline personnel encourage employees to share valuable input in 

identifying and controlling hazards.240 

In many international regimes, the safety representative requirement is considered crucial to effectively 

implement worker participation measures.241The regulator-mandated safety representative motivates 

companies to include workers in safety management activities and promotes an essential dialogue among 

labor, the regulator, and the operator.242 The explicit nature of the UK, Norwegian, and Australian 

regulations pertaining to worker-elected safety representatives demonstrate the recognized integral role 

workers play in robust safety management. Such regulation fosters an environment where workers can 

participate with industry and the regulator in managing safety. In addition, empowering workers to elect 

safety representatives through regulation is an important step in overcoming fears of management 

retaliation for reporting concerns.243

UK regulations grant worker safety representatives a variety of defined functions and powers, including: 

• Investigating potential hazards and examining the causes of accidents; 

• Investigating workforce complaints relating to health and safety;

• Inspecting installation equipment; 

• Reporting findings from investigations to installation managers; 

• Reporting unsafe activities to the regulator when, for instance, the installation management does 

not take immediate remedial actions after safety representatives bring the circumstances to their 

attention; 

• Participating as a member of the installation’s safety committee; and

 

239 UK HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 

1989; 2012; http://www.hse.gov.uk/pubns/priced/l110.pdf. (accessed March 26, 2016).

240 Ibid., p 4. 

241 See The Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989, 1989 No. 971, 

18 Sept. 1989; Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at 

Certain Onshore Facilities (The Framework Regulations); Offshore Petroleum and Greenhouse Gas Storage Act 

2006, Volume 3, Schedule 3, Part 3, 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403628; Working Environment Act, 

December 14, 2012; available at: http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156; 

http://www.ptil.no/framework-hse/category403.html#_Toc357595234 (accessed March 26, 2016).

242 UK HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 

1989; 2012; p 7. http://www.hse.gov.uk/pubns/priced/l110.pdf. (accessed March 26, 2016).

243 Efforts to enhance worker participation should not conflict with provisions established under the National Labor 

Relations Act. 

000995
Macondo Investigation Report Volume 4 4/17/2016

60 

• Consulting in the development of a safety case document.244

Worker-elected safety representatives formally accomplish the worker participation in safety 

management.245 The UK captures the requirement that all workers participate in all phases of operation 

through the definition of the word “workforce” which “includes every person who is for the time being 

working on or from an offshore installation.”246 Worker-elected safety representatives in the UK are also 

permitted by regulation to participate in a wide range of safety matters aboard an offshore installation, 

ranging from investigations of accidents to general matters affecting the occupational health and safety of 

members of the workforce, and all without the loss of pay.

247

Norway provides workers with an opportunity to follow up on safety matters.248 For example, the 

working environment committee, which represents workers, “shall participate in planning safety and 

environmental work and shall follow up developments closely in [relation to] the safety, health and 

welfare of the employees [workers].”249 This helps workers to know that management takes their 

concerns seriously. Similarly, Norway provides workers with the opportunity to participate in safety 

matters throughout the lifecycle of the operation.250 Workers in Norway elect safety representatives called 

“safety delegates” to “see that work is carried out in such a manner that the safety, health and welfare of 

the employees [workers] are taken care of.”251 Through their elected representatives, workers are involved 

early in the safety management process.252 Relevant regulations provide that worker participation “shall 

be ensured in all various phases of the [petroleum] activities,” including the “establishment, follow-up 

 

244 The Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989, 

http://www.legislation.gov.uk/uksi/1989/971/contents/made (accessed March 26, 2016).

245 UK HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 

1989; 2012; http://www.hse.gov.uk/pubns/priced/l110.pdf. (accessed March 26, 2016). 

246 The Offshore Installations (Safety Representative and Safety Committees) Regulations 1989, Interpretation, 

SI971 (1989), (emphasis added), available at: http://www.legislation.gov.uk/uksi/1989/971/regulation/2/made

(accessed March 26, 2016).

247 UK HSE. Safety representatives and safety committees on offshore installations: A brief guide for the workforce, 

INDG199(rev1), 1999, http://www.hse.gov.uk/pubns/indg119.htm (accessed April 12, 2016).

248 Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), Section 17, Duty to 

establish, follow up and further develop a management system, and Section 13, Facilitating employee 

participation, http://www.psa.no/framework-hse/category403.html (accessed March 26, 2016).

249 Working Environment Act, December 14, 2012; Section 7-2,

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016). 

250 Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), Section 13, 

Facilitating employee participation, http://www.ptil.no/framework-hse/category403.html#_Toc357595240

(accessed March 26, 2016).

251 Ognedal, M. PSA, Workforce Contribution, June 11, 2011; 

http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/wig/110609/psa.pdf, Slides 6-7. PSA. Guidelines Regarding 

the Framework Regulations, Re Section 13, Facilitating employee participation,

http://www.ptil.no/framework/category408.html#_Toc407544828 (accessed March 26, 2016).

252 Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), Section 13, 

Facilitating employee participation, http://www.ptil.no/framework-hse/category403.html#_Toc357595240

(accessed March 26, 2016). 

000996
Macondo Investigation Report Volume 4 4/17/2016

61 

and further development of management systems.”253 Norway believes “the employees’ experience and 

active participation is a significant precondition for a sound management system.”254 The Norwegian 

safety delegates also have duties and protections similar to those established in the UK.255 PSA believes 

that this mandate provides workers with the opportunity to actually participate in and influence safety in 

day-to-day operations.256

Australia’s NOPSEMA requires that health and safety representatives be members of the workforce, 

which includes employees and contractors.257 The representative is also selected by the workforce. By 

objective, this regulation intends to “ensure that expert advice is available on occupational health and 

 

253 Ibid.

254 PSA. Guidelines Regarding the Framework Regulations, Re Section 17, Duty to establish, follow up and further 

develop a management system http://www.ptil.no/framework/category408.html#_Toc407544828 (accessed March 

26, 2016).

255 PSA. Guidelines Regarding the Framework Regulations, Section 13, Facilitating employee participation,

http://www.ptil.no/framework/category408.html#_Toc407544828; Working Environment Act, December 14, 

2012; Chapter 6, http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016).

256 Guidelines Regarding the Framework Regulations, Re Section 13, Facilitating employee participation,

http://www.ptil.no/framework/category408.html#_Toc407544828 (accessed March 26, 2016).

257 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Volume 3, Schedule 3, Part 3, and Volume 3, 

Schedule 3, Part 1.3 “member of the workforce,” 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403628 (accessed March 26, 2016). 

Worker Participation in Mine Safety Regulation 

In the US, the Mine Safety and Health Act of 1977 provides for two or more miners to 

designate a representative to advocate for their rights.a While the representative may 

be an employee, he or she does not necessarily have to be.b The miners’ 

representative can request inspections,c

 participate in Mine Safety and Health 

Administration (MSHA) inspections,d and learn of and participate in enforcement 

proceedings.e Congress provided miners with worker participation rights because it 

believed the miners’ knowledge of the operation could provide the MSHA with critical 

safety information.f

 a A Guide to Miners’ Rights and Responsibilities: Under the Federal Mine Safety and Health Act of 

1977; pp 11-15. 

 http://arlweb.msha.gov/s&hinfo/minersrights/minersrights.pdf (accessed March 26, 2016); 30 C.F.R 

40.1.

 b Ibid., pp 10-11. c Federal Mine Safety and Health Act of 1977 § 103(g). d Federal Mine Safety and Health Act of 1977 § 103(f). e Federal Mine Safety and Health Act of 1977 § 107(b). f A Guide to Miners’ Rights and Responsibilities: Under the Federal Mine Safety and Health Act of 

1977; p 10.

 http://arlweb.msha.gov/s&hinfo/minersrights/minersrights.pdf (accessed March 26, 2016).

000997
Macondo Investigation Report Volume 4 4/17/2016

62 

safety matters.”258 Such representation encourages a “consultative relationship between all relevant 

persons concerning the health, safety and welfare of members of the workforce at those facilities.”259

3.4.4 No SEMS Requirement for Contractor Participation 

SEMS does not directly apply to contractors. The EPP in SEMS, which requires the operator to “consult 

with its employees regarding the development, implementation, and modification of its SEMS 

program,”260 does not encompass contractor employees, including the drilling contractor and other well 

service providers.261 Yet, most crew members aboard these offshore facilities are contracted.262 On the 

Deepwater Horizon, 118 of the 126 crew members were contractors,263 including most of the individuals 

involved in the well operations activities leading up to the incident. Further, contractors performed 54% 

of BP’s 373 million total work hours in 2013.264

Many production facilities also have high numbers of contractors conducting hazardous operations. In the 

November 16, 2012, multi-fatality hot work incident on a Black Elk Energy production platform, all 24 

crew members present were employed by one of three contractor companies. A number of safety 

management system failures were identified as causal, including poor hot work procedures, inadequate 

assessment of the hazards, insufficient supervision, and lack of monitoring for flammable gas.265 No 

Black Elk employees were working aboard the production platform at the time of the incident, and as a 

result, the contracting companies did not have to have a SEMS program, nor did the workers have a 

regulatory right to have an EPP and participate in the SEMS development process. Thus, no one aboard 

the Black Elk facility had a regulatory right to be involved in the safety management aspects of their 

work. 

 

258 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Volume 3, Schedule 3, Part 1.1, 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403590 (accessed March 26, 2016).

259 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Volume 3, Schedule 3, Part 1.1, 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403590 (accessed March 26, 2016).

260 30 C.F.R. § 250.1932; Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety 

and Environmental Management Systems, 78 Fed. Reg. 20423 (Final Rule, April 5, 2013). 

261 Ibid. 

262 MMS made this observation in 2003, and then it was reiterated after Macondo by the National Commission on 

the BP Deepwater Horizon Oil Sill and Offshore Drilling: Oil and Gas and Sulphur Operations in the Outer 

Continental Shelf—Incident Reporting Rule, 68 Fed. Reg. 40585 (Proposed Rule, July 8, 2003) and National 

Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, A Competent and Nimble Regulator: 

A New Approach to Risk Assessment and Management, Staff Working Paper No. 21, p 7. 

263 Internal Company Document, Transocean. Personnel On-Board as of 20 Apr 2010 17:09:15, April 20, 2010, 

TRN-MDL-00030435, http://www.mdl2179trialdocs.com/releases/release201303071500008/TREX-00687.pdf

(accessed March 26, 2016).

264 BP. Sustainability Review 2013; Working with our contractors, suppliers and partners; p 27, 

http://www.bp.com/content/dam/bp/pdf/sustainability/group-reports/BP_Sustainability_Review_2013.pdf

(accessed March 26, 2016). 

265 BSEE. Investigation of November 16, 2012, Explosion, Fire and Fatalities at West Delta Block 32 Platform E; 

BSEE Panel Report 2013-002; November 4, 2013; Gulf of Mexico Region, New Orleans Distric Lease No. OCS 

00367; 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Accidents_and_Incidents/Panel_Investigation_Reports/Fi

nal%20BSEE%20Black%20Elk%20report.pdf (accessed March 26, 2016).

000998
Macondo Investigation Report Volume 4 4/17/2016

63 

The failure of the SEMS rule to include contract workers who comprise the majority of the frontline 

workforce presents significant risks for offshore oil and gas operations. The UK, Norway, and Australia 

offshore regulations grant participation rights to both employed and contracted labor. In the UK, the 

Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989 stipulate that 

“every person who is for the time being working on or from an offshore installation under a contract of 

service or a contract for services”266 has the authority to nominate and elect safety representatives “to 

ensure that the whole workforce is formally involved in promoting health and safety.”267

Similarly, Norwegian regulation provides that all workers elect a safety delegate, requiring each 

“individual employer” who carries out “simultaneous activities at the same workplace,” meaning all 

employees, including contractors, to comply with this mandate.268 In fact, PSA requires that the employer 

coordinate its selection of a safety delegate with a contractor’s selection,269 with the total number of 

representatives dependent on the operation size and the working conditions.270 

Australia’s NOPSEMA also requires that health and safety representatives be members of the workforce, 

including employees and contractors, and be selected by the workforce.271 Such representation encourages 

a “consultative relationship between all relevant persons concerning the health, safety and welfare of 

members of the workforce at those facilities”272 in order to “ensure that expert advice is available on 

occupational health and safety matters.”273 

3.4.5 SEMS Stop-Work Authority Impact on Worker Liability 

The SEMS SWA provision does not sufficiently prohibit reprisal for stopping dangerous activities. It 

grants “all personnel the responsibility and authority, without fear of reprisal, to stop work or decline to 

perform an assigned task when an imminent risk or danger exists.”274 Since the SWA provision obligates 

workers to report unsafe operations, workers could be blamed for failing to stop the work if an incident 

occurs. 

 

266 UK HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 

1989; 2012; p 2. http://www.hse.gov.uk/pubns/priced/l110.pdf. (accessed March 26, 2016). 

267 Ibid., p 7. 

268 Petroleum Safety Authority Norway, Regulations Relating to Health, Safety and the Environment in the 

Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations) (2013), Section 8, 

Employer's duties toward employees other than its own, http://www.ptil.no/frameworkhse/category403.html#_Toc357595234 (accessed March 26, 2016). 

269 Ibid; Working Environment Act, December 14, 2012; Section 2-2, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016).

270 Ibid; Working Environment Act, December 14, 2012; Section 6-1, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016).

271 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Volume 3, Schedule 3, Part 3, and Volume 3, 

Schedule 3, Part 1.3 “member of the workforce,” 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403628 (accessed March 26, 2016).

272 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Volume 3, Schedule 3, Part 1.1, 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403590 (accessed March 26, 2016).

273 Ibid. 

274 30 C.F.R. § 250.1930. 

000999
Macondo Investigation Report Volume 4 4/17/2016

64 

Placing “the responsibility and authority” to halt dangerous activities on workers can create a culture of 

assigning blame to workers. The provision discusses that workers should not fear reprisal for initiating an 

SWA; however, the regulation does not speak to the protections granted to those who arguably failed to 

initiate an SWA when circumstances might have seemed to require it. If workers do not have a sufficient 

awareness of the hazards of an activity, they may be blamed or criticized after an incident for failing to 

initiate a stop work. Essentially, a worker is confronted with the dilemma of choosing between facing 

criticism (or worse) for stopping work or being blamed for failure to act. 

The concept of imminent risk should not be a sole determinant for stop-work authority. Control of major 

hazards depends on defense-in-depth, or reliance on multiple barriers to prevent imminent danger because 

of barrier redundancy. Yet loss of a critical barrier should warrant a stop-work order even if risk is not 

imminent. 

A poorly designed or supported SWA program may encourage workers to try to ignore certain activities 

in the hopes of avoiding fault in a potential stop-work situation – the antithesis of an engaged workforce. 

Thus, involving workers in these situations can have the unintended effect of reducing safety reporting, 

increasing defensive posturing by workers, and minimizing the benefits of a reporting system.275

In contrast, both the UK and Norway remove from the workforce any duty to stop work.276 UK Safety 

Representative regulations state that “no function conferred on a [either the safety representative or the 

safety committee] by this regulation shall be construed as imposing a duty on [them].”277 Legislation in 

Norway provides the safety representative with the opportunity to stop work, but the “representative is not 

liable for any loss suffered by the undertaking as a result of work being halted.”278 In both instances, 

removing potential sources of blame on the worker for stopping work is crucial to improving offshore 

safety.

3.4.6 Inadequate SEMS Requirements to Protect Workers from Retaliation 

The SWA provision in SEMS is designed for use when work stoppage is most challenging. When the 

work is being performed, time and economic pressures are likely high, and the crew well understands the 

consequences of stopping work.279 The CSB Tosco Avon Refinery investigation uncovered workers who 

stated they felt pressure to avoid using stop work because of economic implications and production 

pressures.280 As such, they were greatly concerned about retaliation for initiating a stop work. Similarly, 

 

275 Dekker, S. Just Culture: Balancing Safety and Accountability; Ashgate Publishing Company: Hampshire, 

England, 2007; pp 20-27. 

276 Working Environment Act, December 14, 2012; Section 6-3, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156; The Offshore Installations (Safety 

Representatives and Safety Committees) Regulations 1989, No. 16 

http://www.legislation.gov.uk/uksi/1989/971/contents/made (accessed March 26, 2016). 

277 The Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989, No. 16 

http://www.legislation.gov.uk/uksi/1989/971/contents/made (accessed March 26, 2016).

278 Working Environment Act, December 14, 2012; Section 6-3, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016).

279 USCSB, 2001, Refinery Fire Incident, Martinez, CA, February 23, 1999, Report No. 99-014-I-CA, March 2001, 

http://www.csb.gov/assets/1/19/Tosco_Final_Report.pdf (accessed March 25, 2016). 

280 Ibid. 

001000
Macondo Investigation Report Volume 4 4/17/2016

65 

in the GoM, the fear of retaliation for stopping work is described in BSEE’s investigation of the 2012 

Black Elk production platform explosion, where BSEE noted that contractors did not initiate a stop work 

because they feared losing their jobs for doing so.

281 

In many instances, simply requiring that companies have a stop-work program does not guarantee the 

workforce will actually use it. The workers must believe that using SWA will not result in disciplinary 

action. Indeed, the SEMS SWA provision creates the type of stop work programs already implemented by 

BP and Transocean at the time of the blowout, found to be lacking adequate worker protections. 282 

SEMS also requires that operators establish a program for reporting unsafe working conditions that 

protect “a person’s identity to the extent authorized by law.”283 Initially, BSEE reported that it was 

developing a confidential near-miss reporting system with the Bureau of Transportation and Statistics.”284

This program has now been implemented.285 According to the BSEE website, the program is both 

voluntary and anonymous.286 At this time, the toll-free hotline line is operational but the BSEE website 

has not yet been modified to accept online reporting.287 However, there are insufficient provisions within 

SEMS to protect workers from retaliatory action.

A bill that originated in 2010 in the House Committee on Education and the Workforce stated there was 

that no federal law that protects oil and gas workers if they are retaliated against after they blow the 

whistle on workplace health and safety violations on the Outer Continental Shelf.288 The bill eventually 

 

281 BSEE. Investigation of November 16, 2012, Explosion, Fire and Fatalities at West Delta Block 32 Platform E; 

BSEE Panel Report 2013-002; November 4, 2013; Gulf of Mexico Region, New Orleans Distric Lease No. OCS 

00367; pp 3-4. 

http://www.bsee.gov/uploadedFiles/BSEE/Enforcement/Accidents_and_Incidents/Panel_Investigation_Reports/Fi

nal%20BSEE%20Black%20Elk%20report.pdf (accessed March 26, 2016).

282 Bureau of Ocean Energy Management, Regulation, and Enforcement. Report Regarding the Causes of the April 

20, 2010, Macondo Well Blowout; 2011; pp 189-190; OCEANA statement to BSEE, RE: Revisions to Safety and 

Environmental Management Systems (SEMS), 1010-AD73, November 14, 2011; p 3.

http://www.bsee.gov/uploadedFiles/Oceana%2011-9-11.pdf (accessed March 26, 2016).

283 30 C.F.R. § 250.1933; 30 C.F.R. § 250.193.

284 Notice of Voluntary Confidential NearMiss Reporting System Public Workshop, 79 Fed. Reg. 17563; See also 

BTS and BSEE to Develop Confidential Near-Miss Reporting System, http://www.rita.dot.gov/bts/bts_bsee

(accessed March 26, 2016). 

285 This program was implemented on May 5, 2015 in SafeOCS. See Section 4.3.2.

286 “SafeOCS is a voluntary and completely confidential system, in which the Bureau of Transportation Statistics 

(BTS) will collect and analyze near-miss reports submitted by individual OCS workers, companies, and others. 

The aggregated data will be shared with the general public through the BTS website, and used to identify safety 

trends and increase understanding of offshore risk;” http://www.bsee.gov/BSEE-Newsroom/PressReleases/2015/BSEE-Director-Brian-Salerno-Announces-Key-Efforts-to-Reduce-Risk-Offshore/ (accessed March 

26, 2016). 

287 The CSB has not identified an anonymous online reporting tool on the BSEE website. The Bureau of 

Transportation Statistics does have a functioning SafeOCS near-miss reporting system link which can be found 

here: https://near-miss.bts.gov/#contactUs (accessed March 31, 2016). 

288 111 H.R. 5851. Offshore Oil and Gas Worker Whistleblower Protection Act of 2010.

https://www.congress.gov/bill/111th-congress/house-bill/5851 (accessed January 7, 2016). The House also

brought forward subsequent versions of this bill in 2011, and then again in 2015. See 112 H.R. 503, Offshore Oil 

and Gas Worker Whistleblower Protection Act of 2011; 114 H.R. 2824, Offshore Oil and Gas Worker 

Whistleblower Protection Act of 2015.

001001
Macondo Investigation Report Volume 4 4/17/2016

66 

expired due to inaction during a previous Congress. Nevertheless, such legislation highlighted the 

regulatory gap in whistleblower protection that the SEMS program has not addressed. 

BSEE itself, in its Safety Culture Policy Statement of May 9, 2013, identified an “Environment for 

Raising Concerns” as one of nine characteristics of a robust safety culture and that this meant that “A 

work environment is maintained where personnel feel free to raise safety and environmental concerns 

without fear of retaliation, intimidation, harassment, or discrimination.”289 

Some existing statutes have jurisdictional language that may apply offshore and the possibility exists that 

offshore workers may have some, albeit limited, measure of whistleblower protection. OSHA currently 

oversees enforcement of many different whistleblower protection laws arising in areas such as 

occupational, environmental, nuclear, transportation, consumer, and other categories.290 Some of the most 

potentially applicable statutes that might help protect offshore workers tend towards environmental 

protection, are the Clean Air Act,291 the Comprehensive Environmental Response, Compensation and 

Liability Act,292 and the Federal Water Pollution Control Act (the Clean Water Act).293 

In the UK, the workforce brings forward its safety concerns to its designated safety representatives who

present these matters to the installation manager.294 In effect, the workforce has a protective mechanism 

from retaliation. Norway and Australia take similar approaches.295 

The Mining Safety and Health Administration, or MSHA, also provides protections for workers voicing 

safety concerns with mining operations. Neither a miner nor a miner’s representative can be discharged or 

retaliated against for filing a complaint concerning safety related matters. Moreover, a miner or a miner’s 

representative can seek legal relief if they believe they have been the subject of dismissal or harassment 

for filing such complaint.296 

Effectively managed reporting programs provide the regulator a view of issues that may not otherwise be 

detected through inspections. To manage a reporting program effectively, the operator must remove 

 

289 BSEE, Safety Culture Policy, http://www.bsee.gov/Safety/Safety-Culture-Policy/ (accessed October 7, 2015). 

290 US Department of Labor. The Whistleblower Protection Programs, 

http://www.whistleblowers.gov/wb_filing_time_limits.html (accessed March 31, 2016). 

291 42 U.S.C. § 7422.

292 42 U.S.C. § 9610.

293 33 U.S.C. § 1367.

294 Malloy, J. Former Director, Regional Organizer, RMT Union Offshore Energy Branch, Personal communication, 

October 3, 2013; UK HSE. Safety representatives and safety committees on offshore installations: A brief guide 

for the workforce, INDG199(rev1), 1999, http://www.hse.gov.uk/pubns/indg119.htm.; The Offshore Installations 

(Safety Representatives and Safety Committees) Regulations 1989, 

http://www.legislation.gov.uk/uksi/1989/971/contents/made (accessed March 26, 2016).

295 Working Environment Act, December 14, 2012; Section 6-2, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156.; Offshore Petroleum and Greenhouse Gas 

Storage Act 2006, Volume 3, Schedule 3, Part 3, Subdivision B, 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403653.

296 30 U.S.C. § 815(c).

001002
Macondo Investigation Report Volume 4 4/17/2016

67 

penalties for reporting safety issues.297 As long as SEMS and other potential sources of federal oversight 

fail to provide protection for whistleblowers or workers seeking to stop work in the offshore environment, 

offshore process safety suffers. 

3.4.7 No SWA Worker-Requested Regulatory Provision in Regulation

The SEMS regulations do not contain a provision allowing the workforce to seek intervention by the 

regulator should they feel that management is not responding adequately to their call for a stop work. 

Rather, SEMS states, “Work may be resumed when the individual on the facility with Ultimate Work 

Authority (UWA) determines that the imminent risk or danger does not exist or no longer exists.”298 But 

management designates the individual with the UWA.299 This creates the potential for resolving when to 

resume operations without adequate or impartial review. Workers may reasonably believe that operations 

still pose a significant risk if restarted. Therefore, SEMS should provide for regulatory intervention 

whenever management and workers disagree on whether work can be safely resumed. 

UK law provides that if two or more safety representatives believe an “imminent risk” exists in any 

activity, they must inform the installation manager.300 The installation manager then must inform an HSE 

inspector of the issue through a report as soon as is reasonably practicable.301 The HSE may issue an 

enforcement notice either to prohibit the activity until matters have been corrected or to require some 

longer-term improvements, or in the worst case, to prosecute the responsible party.302 The decision on 

when work can begin again is left to the regulator and is specified in the prohibition notice.303

In Norway, the safety representatives have the right to halt dangerous work. The danger must be 

immediate and cannot be averted by other means. If the safety representative determines these conditions 

to be the case, work may be halted until the labor inspection authority decides whether work may 

continue.304

 

297 Committee on Education and the Workforce. H.R. 503: Offshore Oil and Gas Worker Whistleblower Protection 

Act, http://democrats.edworkforce.house.gov/bill/hr-503-offshore-oil-and-gas-worker-whistleblower-protectionact (accessed March 26, 2016).

298 30 C.F.R. § 250.1930(c).

299 30 C.F.R. § 250.1931(a). 

300 The Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989, 

http://www.legislation.gov.uk/uksi/1989/971/contents/made (accessed March 26, 2016).

301 UK HSE, Safety Representatives and Safety Committees on Offshore Installations, 

http://www.hse.gov.uk/pubns/indg119.pdf (accessed March 26, 2016). 

302 UK HSE, HSE Public Register of Enforcement Notices, http://www.hse.gov.uk/notices/ (accessed March 26, 

2016). 

303 Joomla!. UK Health and Safety Legal System: Appendix A – UK Health and Safety Legal System, Prohibition 

Notice, 

http://www.simplesensiblesafety.co.uk/index.php?option=com_content&view=article&id=22&catid=1&Itemid=8

2 (accessed March 26, 2016).

304 Working Environment Act, December 14, 2012; Section 6-3, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016). 

001003
Macondo Investigation Report Volume 4 4/17/2016

68 

Australia requires safety representatives to report an imminent danger to the supervisor or, if no 

supervisors can be located, to stop work.305 If supervisors can be located, then the supervisor is required 

to take actions that he or she believes will remove the danger. If the safety representatives believe 

imminent danger still exists, they may make a request to NOPSEMA to conduct an inspection of the 

activity. This option also exists for the supervisors if they disagree with the safety representatives. Only 

after the NOPSEMA inspection determines that the activity is safe can work resume.

306

The SEMS failure to require regulatory intervention in a stop-work dispute between the workforce and 

management increases potential safety risk. Lack of regulatory participation in a stop-work situation can 

result in management’s always making the ultimate decision. Management may order work to resume 

after a stop work before eliminating or sufficiently mitigating the hazard in the interest of averting costs, 

lost time, and other economic impacts caused by the stop work. Management may decide even with 

limited understanding of the risks due to distance from the worksite or unfamiliarity with the work, the 

requirements of its special tasks, or other unique circumstances. Regulatory intervention of the type 

discussed in the UK, Norway, and Australia thus provide an avenue for improving the SEMS regulation. 

The reality is, however, that the formality of involving the regulator in a stop work situation is only a 

backstop. Sound safety culture, with informed safety representatives and enhanced protection for workers 

who exercise stop work authority should resolve worker concerns about safety without frequent need for 

regulator involvement. Nevertheless, the right to involve the regulator is always available in those 

jurisdictions, and it remains a powerful driver to resolve issues. The US should emulate this important 

protection. 

3.4.8 No SEMS Safety Committees or Tripartite Safety Forums Provision 

A fundamental element in effective safety management for major accident prevention is active and equal 

participation from the regulator, industry, and labor. Each stakeholder provides unique and essential 

insights; removing the participation of any of them can result in losing a critical voice in safety 

management. While the regulator and industry management typically have the means to ensure that their 

voices are heard—they have the enforcement power on one hand and ownership or managerial authority 

on the other—the workers often lack similar means. Labor participation is vital as it gives workers the 

opportunity to provide management and the regulator with invaluable insights, and in many instances the 

workers are the only source of this information.307 In other offshore regimes, workers are guaranteed 

rights to form safety committees, made up of both management and workforce members, to encourage 

dialogue on safety issues or concerns at each offshore facility. In contrast, SEMS lacks requirements for 

workforce-management safety committees that would promote dialogue on safety concerns between both 

entities.

The UK requires each offshore installation with more than one safety representative to establish a safety 

committee comprised of the installation manager, another person appointed by the installation manager, 

 

305 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Volume 3, Schedule 3, Part 3, Division 5, 44, 

http://www.comlaw.gov.au/Details/C2013C00071/Html/Volume_3#_Toc347403653. 

306 Ibid., Division 5, 44 & 45. 

307 Center For Chemical Process Safety. Guidelines for Risk Based Process Safety; John Wiley & Sons: Hoboken, 

NJ, 2007; p 124. 

001004
Macondo Investigation Report Volume 4 4/17/2016

69 

and all of the safety representatives.308 Through the committee, management and the workforce discuss 

health and safety matters with the goal of developing mutual cooperation and ensuring the safety of the 

workforce.309 

In addition to these safety committees, many regimes have developed larger forums where regulator, 

industry, and workforce all have equal opportunities to directly interact and discuss safety matters. The 

regulator often hosts and supports these forums. Yet no such regulator-supported forum has been 

developed for US offshore worker representatives can openly discuss safety issues with industry 

management and the regulator. 

The UK has a tripartite forum which is enabled through Step Change in Safety,310 an organization 

established in 1997 when industry decided to require significant improvements in health and safety, and 

when collaboration among the parties became a priority.311 Through the years, Step Change influenced

greater cooperation among labor, industry, and the regulator.312 The organization is led by a team of 

senior managers from industry, trade unions, trade associations, and the regulator. The workforce is 

specifically engaged through networks, including elected safety representatives, safety professionals, and 

site leaders. Regular meetings are held throughout the year to share safety information and to discuss 

safety issues. Through this framework, issues such as competence, leadership, workforce engagement, 

continual improvement, asset integrity, and communication are addressed to improve health and safety 

offshore.313 Step Change supports a number of steering groups, including the Workforce Engagement 

Support Team (WEST), which aims to maximize the value of both safety representatives and workforce 

engagement survey tools that strengthen workers’ role in safety management.314 The UK HSE also chairs 

a more formal, higher level tripartite body, the Offshore Industry Advisory Committee (OIAC), which 

brings employer and worker representatives together with the regulator in another important forum to 

discuss offshore health and safety matters.315 

Similarly, Norway’s regulator established a number of tripartite bodies. A working environment 

committee is involved in planning safety issues such as construction work, work processes, and 

 

308 The Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989, 

http://www.legislation.gov.uk/uksi/1989/971/contents/made (accessed March 26, 2016).

309 UK HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 

1989; 2012; p 2. http://www.hse.gov.uk/pubns/priced/l110.pdf. (accessed March 26, 2016); note, in the United 

States, safety committees are required by some state laws and often, in unionized workplaces, through the 

collective bargaining process. 

310 http://www.stepchangeinsafety.net/; UK HSE. Offshore Oil & Gas Sector Strategy,

http://www.hse.gov.uk/offshore/priorities.htm (accessed March 26, 2016). 

311 Step Change in Safety, Strategic Plan 2010-2015: Making the UK the safest place to work in the worldwide oil 

and gas industry, 2010. 

312 Ibid. 

313 Ibid. 

314 Step Change in Safety, Workforce Engagement, https://www.stepchangeinsafety.net/about-step-changesafety/steering-groups/workforce-engagement (accessed March 26, 2016).

315 UK HSE, Offshore Industry Advisory Committee (OIAC), http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/

(accessed March 26, 2016).

001005
Macondo Investigation Report Volume 4 4/17/2016

70 

preventive safety measures. The committee receives paid time off to attend training sessions.316 A 

Regulatory Forum and the Safety Forum317 also facilitates discussion of safety issues such as trends in 

risk management, practical implementation of regulatory requirements, and safety standards for use 

offshore.318 PSA asserts that these forums are beneficial venues to raise awareness of safety issues and 

discuss potential solutions, especially for industry members who are less sophisticated.

319

Australia’s NOPSEMA uses its Offshore Petroleum Safety Tripartite Forum to actively engage all the 

stakeholders involved in the offshore petroleum industry.320 NOPSEMA maintains that such engagement 

will improve safety by promoting “information sharing, learning and innovation across the offshore 

petroleum industry.”321

The US lacks similar initiatives to encourage participation among the regulator, industry, and labor. This 

remains a missed opportunity. 

3.4.9 Conclusion

The importance of worker participation in safety management cannot be overstated. Existing US offshore 

safety regulations addressing workforce participation are improved since Macondo; however, the 

regulations still suffer from significant gaps. The regulations fail to engage all members of the workforce; 

lack workforce-elected safety representatives and safety committees; rely heavily on SWA which is a 

weak form of worker involvement if not properly implemented or supported; and create potential 

opportunities for blaming the workforce without recourse to regulator intervention. These gaps diminish 

safety by discouraging workforce participation in managing offshore safety. The regulator should take 

additional steps to improve these regulatory provisions, provide for protection against retaliation for 

workforce participation in safety management activities, as well as play a lead role in establishing a 

tripartite forum to aid workers in having a larger voice in process safety management and major accident 

prevention. 

 

 

316 Working Environment Act, December 14, 2012; Section 7, 

http://www.arbeidstilsynet.no/binfil/download2.php?tid=92156 (accessed March 26, 2016). 

317 Hauge , H., Okstad , E., Tinmannsvik , R., Lootz, E., Ovesen , M., Carlsen, I., Risk of Major Accidents: Causal 

Factors and Improvement Measures Related to Well Control in the Petroleum Industry, SPE Americas E&P 

Health, Safety, Security and Environmental Conference, Galveston, TX, March 18-20, 20132; SPE-163775-MS: 

318 Ibid.; PSA, Regulatory Forum, 2014, http://www.ptil.no/regulations/regulatory-forum-article9524-216.html#

(accessed March 26, 2016). 

319 Sophistication refers to industry members who do not have the breadth and depth of offshore business experience 

as some of the oil majors, who have well-developed operational programs from decades of experience; CSB 

Norway trip notes, April 26 – May 1, 2012. 

320 NOPSEMA. Offshore Petroleum Safety Tripartite Forum, http://www.nopsema.gov.au/safety/offshorepetroleum-safety-tripartite-forum/. 

321 Offshore Petroleum Safety Tripartite Forum, Terms of Reference, Feb. 26, 2013, 

http://www.nopsema.gov.au/assets/document/Terms-of-Reference-Offshore-Petroleum-Safety-Tripartite-ForumRev-0-Feb-2013.pdf. 

001006
Macondo Investigation Report Volume 4 4/17/2016

71 

4.0 US Offshore Regulator Challenge in Effective Oversight

BSEE’s goal of a SEMS program is “to promote safety and environmental protection.”322 To accomplish 

that goal, operators must “ensure [their] SEMS program identifies, addresses, and manages safety, 

environmental hazards ...”323 This language is weaker than the corporate policies BP and Transocean had 

at the time of Macondo to prevent incidents that harmed people and the environment and to apply 

ALARP principles in their operations.324 Furthermore, BP and Transocean already had mandated internal 

safety management systems that would have satisfied post-Macondo SEMS requirements, including 

hazard analysis, management of change, operating procedures, and incident investigation.325 The analysis 

presented in Volume 3 demonstrates that BP and Transocean’s failures to effectively implement these 

systems were causal factors in the blowout. Thus, merely having a documented safety management 

program that complies with SEMS regulations is not sufficient. A fundamental question arises: Have 

enough changes occurred in the US to make safety management programs, like those which BP and 

Transocean already had in place, effective? This chapter answers the question by describing the value of 

major hazard documentation that identifies the major hazards and the barriers intended to prevent or 

mitigate them, as well as the influential role of the regulator in proactive review and verification of that 

documentation. The chapter also describes potential opportunities for BSEE to drive further industry 

safety improvements through the use of effective process safety indicators and transparency. 

 

322 30 C.F.R. § 250.1901.

323 Ibid. 

324 BP’s OMS Exploration and Production Drilling and Well Operations Practice (DWOP) states, “all risks shall be 

managed to a level which is as low as reasonably practical” or ALARP, Internal Company Document, BP. GP 10-

00 Drilling and Well Operations Practice, Issue 1, October 2008, "This document contains the practices that have 

been agreed by BP management as current and relevant for drilling and well operations.", p A-8, BP-HZNBLY00034518, http://www.mdl2179trialdocs.com/releases/release201304110900026/TREX-06121.pdf (accessed 

May 26, 2015). Transocean policies requires employees to manage risks to ALARP, which Transocean defines as 

“... requiring personnel to consider the various additional risk reduction measures (additional controls) and 

determine if the effort and cost of those measures justify the additional amount of risk reduction obtained” 

Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, Revision 

07, HQS-HSE-PP-01, December 15, 2009, Section 4 (Safety Policies, Procedures and Documentation), p BPHZN-2179MDL00132218, see Exhibit 4942, BP-HZN-2179MDL00132055, 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).

Internal Company Document, BP. The BP Operating Management System Framework, Part 1, An Overview of 

OMS, Issue 2, November 3, 2008, p 24, BP-HZN-2179MDL0033320, see Exhibit 2352 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Lynch_Richard-Depo_Bundle.zip 

(accessed October 7, 2015). 

Internal Company Document, Transocean. Health and Safety Policies and Procedures Manual, Issue 03, Revision 

07, HQS-HSE-PP-01, December 15, 2009, General, BP-HZN-2179MDL00132067, see Exhibit 4942 

http://www.mdl2179trialdocs.com/releases/release201302281700004/Farr_Daniel-Depo_Bundle.zip (accessed 

October 7, 2015).

325 30 C.F.R. § 250.1902 and Volume 3.

001007
Macondo Investigation Report Volume 4 4/17/2016

72 

In 2015 BSEE laid out two strategic goals:326

• Regulate, enforce, and respond to OCS development using the full range of authorities, policies, 

and tools to compel safety, emergency preparedness and environmental responsibility and 

appropriate development and conservation of the offshore oil and natural gas resources. 

• Build and sustain the organizational, technical, and intellectual capacity within and across 

BSEE’s key functions – capacity that keeps pace with OCS industry technological 

improvements, innovates in regulation and enforcement, and reduces risk through systemic 

assessment and regulatory and enforcement actions.” 

Yet despite these aims and the post-Macondo regulatory changes, BSEE still struggles with several 

limitations and untapped opportunities to more effectively regulate the offshore oil and gas industry:

• Limited proactive oversight mechanisms to drive industry to improve safety systems as evidenced 

by these shortfalls:

o BSEE does not require documentation demonstrating control of major hazards before 

commencing the hazardous offshore operations; 

o Lack of sufficient direct involvement in SEMS audits, and the accompanying dialogue 

with the company that occurs as part of the auditing process, which minimizes BSEE’s 

influence; 

• Inadequate collection and use of safety performance indicator data to identify and analyze 

developing safety issues before they turn into more severe problems; 

o BSEE has not initiated industrywide or companywide audits to proactively assess safety 

trends;

• Historically inadequate levels of transparency in disseminating industry safety information and in 

the performance of oversight activities. 

This chapter explores proactive mechanisms BSEE can use to counter this issues and more effectively 

oversee industry’s efforts to manage major accident risk, while driving further safety improvements and 

promoting trust among members of industry, workforce, and the public. 

4.1 No Required Review of Major Accident Hazard Documentation 

Before Hazardous Work Begins

Oil and gas companies operating in the US OCS are not required to provide major hazard documentation 

that: (1) identifies all major accident hazards, (2) implements the necessary barriers and controls to reduce 

risk to ALARP, and (3) describes an effective and operational safety management program to ensure that 

those barriers and controls will remain reliable and available as needed. 327 While point 3 could 

 

326 The US Department of the Interior. Budget Justifications and Performance Information Fiscal Year 2015: 

Bureau of Safety and Environmental Enforcement; 

http://www.bsee.gov/uploadedFiles/BSEE/About_BSEE/Budget/BSEE%20FY%202015%20Final%20Greenbook

%20File.pdf (accessed March 25, 2015).

327 See Chapter 4, Volume 2.

001008
Macondo Investigation Report Volume 4 4/17/2016

73 

potentially be addressed by a SEMS program, points 1 and 2 go beyond current SEMS requirements.328

BSEE could review major hazard documentation, and if necessary, challenge a company’s assertions 

before and/or during hazardous activities. Furthermore, the assertions in major hazard documentation 

could become the foundation for BSEE to conduct more effective preventative audits and inspections and 

have meaningful dialogue with the duty holder about its specific risk management policies and 

practices.

329 

As described in Chapters 2.0 and 3.0, the development of a written case for safety is critical to the UK 

and Australian offshore regulatory regimes, and a similar “internal control” plan requirement exists for 

companies operating in Norwegian waters.330 Originally only UK and Australian offshore regulators had 

to accept331 a facility’s written case for safety before it could commence operation, and as of June 28, 

2013 that requirement now applies to all European Union members, 332 including over 1,000 facilities in 

the North Sea, Mediterranean Sea, and Black Sea with offshore drilling and production activities.333 The 

regulator’s acceptance of a written case for safety in any jurisdiction (called a Major Hazard Report under 

the EU directive) still does not license the facility or installation as “fit,” nor does it shift the duty of risk 

control and reduction away from the facility owner or operator and onto the regulator. Rather, the duty of 

major accident prevention and risk-reduction to ALARP remains with the duty holder throughout the life 

of the facility. In fact, even in adopting the new directive, the EU noted that offshore safety remains 

primarily the obligation of the offshore operators and the individual countries in which they operate.334

Following the regulator’s acceptance of the safety case document, the duty holder must ensure that the 

installation is operated in accordance with the safety management system and other risk-reduction 

provisions described in the safety case.

The term “safety case” came about because in such a regime, the duty holder is expected to make a 

written case for safety to the regulator.335 In their documentation, duty holders must explain the processes 

 

328 As described in Section 6.1.1 of Volume 2, the hazard analysis requirement in SEMS (30 C.F.R. 250.1911) is not 

focused on targeted risk reduction of major accident events and the barriers intended to prevent or mitigate them. 

329 Section 4.2 for further discussion.

330 See, Hopkins, A. Explaining the Safety Case; Working Paper 87; National Research Centre for OHS Regulation, 

Australian National University: April, 2012.

331 This concept is discussed in the CSB’s report on the Chevron Richmond Refinery. “Acceptance requires 

satisfaction with the duty holder’s approach to identifying and meeting health and safety needs ... HSE ‘accepts’ 

the validity of the described approach as being capable, if implemented as described, of achieving the necessary 

degree of risk control, but HSE does not confirm the outcomes of that approach.” Therefore, “HSE will accept a 

safety case or a revision ... when duty holders demonstrate and describe specified matters to HSE’s satisfaction. 

Acceptance will be based on HSE’s judgment that the arrangements and measures described in the safety case 

taken as a whole are likely to achieve compliance if implemented as described. To give acceptance HSE does not 

need to be satisfied that compliance will be achieved....” UK HSE. A guide to the Offshore Installations (Safety 

Case) Regulations 2005, 3rd ed.; SCR 2005; 2006; p 6, http://www.hse.gov.uk/pubns/books/l30.htm (accessed 

March 26, 2016).

332 Http://ec.europa.eu/energy/en/topics/oil-gas-and-coal/offshore-oil-and-gas-safety. 

333 Safety of Offshore Oil and Gas Operations Directive, http://eur-lex.europa.eu/legalcontent/EN/ALL/?uri=CELEX:32013L0030. 

334 European Commission, Offshore oil and gas safety, Http://ec.europa.eu/energy/en/topics/oil-gas-andcoal/offshore-oil-and-gas-safety (accessed January 26, 2016). 

335 Ibid., p 4. 

001009
Macondo Investigation Report Volume 4 4/17/2016

74 

they used to identify hazards and assess risks336 and their rationale for choosing a particular method of 

controlling them.337 The regulator reviews the case and accepts or rejects the document, which is a 

prerequisite to obtain a license to drill.338 Once a rig has an accepted safety case, it can operate anywhere

in that jurisdiction without resubmitting the case, assuming it addressed the full range of hazard options. 

This presentation and acceptance feature of the Australian and UK safety case process forms the basis of 

the legal agreement between the company and the regulator. 

According to UK HSE guidance on the offshore Safety Case Regulations, safety case reports are 

“intended to be living documents, kept up to date and revised as necessary during the operational life of 

the installation.”339 Similarly, Australian regulators explain that if carried out properly, the process of 

developing the safety case will “improve safety of offshore activities by ensuring a systematic review of 

the hazards, their associated risks and the control measures that are applied at the facility to either 

eliminate the hazards or otherwise reduce the risks. Progress, in terms of risk-reduction, is achieved by 

applying the process both during initial development of the safety case and subsequently in the course of 

continual improvement.”340 

 

336 Ibid., p 5. 

337 Ibid., p 5. 

338 Whewell, I. Former Director, UK HSE Offshore Division, Personal communication, July 6, 2011. 

339 UK HSE. A guide to the Offshore Installations (Safety Case) Regulations 2005, 3rd ed.; SCR 2005; 2006; p 7. 

http://www.hse.gov.uk/pubns/books/l30.htm (accessed March 26, 2016).

340 NOPSEMA. ALARP Guidance Note; N-04300-GN0166, Rev 6; June, 2015; p 18. 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0166-ALARP.pdf (accessed March 26, 2016).

EU-wide safety standards

Under the Safety of Offshore Oil and Gas Operations Directive, the EU put in place a 

set of rules to help prevent accidents, as well as to respond promptly and efficiently 

should one occur before exploration or production begins. For their offshore 

installation, companies must prepare a Major Hazard Report, containing a risk 

assessment and an emergency response plan. They must keep resources at hand to put 

them into operation when necessary when granting licenses. EU countries must 

ensure that companies are well financed and have the necessary technical expertise 

and solutions critical for the safety of operators' installations. These must be 

independently verified by the regulator before the installation commences operation. 

National authorities must verify safety provisions, environmental protection 

measures, and the emergency preparedness of rigs and platforms. If companies do not 

respect the minimum standards, EU countries can impose sanctions, including halting 

production. Information on how companies and EU countries keep installations safe 

must be made available for citizens. Companies will be fully liable for environmental 

damages caused to protected marine species and natural habitats. For damage to 

marine habitats, the geographical zone will cover all EU marine waters including 

exclusive economic zones and continental shelves.

001010
Macondo Investigation Report Volume 4 4/17/2016

75 

Internationally, both the UK HSE and NOPSEMA require acceptance of an operator’s safety case before 

beginning activities.341 This framework requires operators to demonstrate that all risks were reduced to 

ALARP.342 Nevertheless, the safety case is “accepted” and not “approved,” as the safety of the facility is 

not guaranteed by the regulator, nor does it mean the operation as a whole is fit.343 Acceptance of the 

safety case indicates that the facility’s approach is valid in terms of good practice; however, confirmation 

of compliance is based on post-acceptance programs, such as inspections and audits.344 The requirement 

that the regulator accept an operator’s safety case before beginning activities is beneficial because it 

allows for meaningful dialogue to begin at the early stages of development.345

In Norway, the PSA does not formally review and “accept” the management system documentation 

before permitting companies to drill, but it does require that management system documentation be 

prepared and be made available for the regulator’s review at any time, such as during a facility audit. PSA 

then routinely reviews the documentation and discusses its contents with the operator to assess how the 

operator’s SMS is working.346 PSA does not require the facility to submit its safety management system 

for acceptance, and asserts that the benefits of this approach are: (1) it does not create the impression that 

the duty of ensuring safety has shifted to the regulator and (2) regulatory resources can focus on industry 

activities instead of the paperwork review.347

In the UK, Australia, and Norway, duty for assuring risks are reduced to ALARP remains with the entity 

responsible for creating or controlling the risk. The regulator checks that an operation is effectively 

reducing risk to ALARP through audits and inspections that verify the duty holder’s adherence to its own 

 

341 See The Offshore Installations (Safety Case) Regulations 2005, No. 3117, Regulation 7 & 8, 

http://www.legislation.gov.uk/uksi/2005/3117/contents/made (accessed March 26, 20160; Offshore Petroleum and 

Greenhouse Gas Storage (Safety) Regulations 2009, Division 2- Submission and acceptance of safety cases, 

https://www.legislation.gov.au/Details/F2013C00945 (accessed March 26, 2016).

342 UK HSE. A guide to the Offshore Installations (Safety Case) Regulations 2005, 3rd ed.; SCR 2005; 2006; 

Demonstration of ‘as low as reasonably practicalbe, p 13. http://www.hse.gov.uk/pubns/books/l30.htm (accessed 

March 26, 2016); Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009, 1.4 Objects, 

https://www.legislation.gov.au/Details/F2013C00945 (accessed March 26, 2016). 

343 Pitblado, R.; Bjerager, P.; Andreassen, E. An Effective US Offshore Safety Regime; Det Norske Veritas: 22 2010, 

July; p 3. http://www.dnvusa.com/Binaries/1008-001%20Offshore%20Update_Key%20aspects_tcm153-

430982.pdf (accessed March 16, 20106); Powell, T. US Voluntary Semp Initiative: Holy Grail or Poisoned 

Chalice?, Offshore Technology Conference, Housont, TX, May 8-9, 1996; OTC 8111.

344 CSB Public Hearing: Regulatory Approaches to Offshore Oil and Gas Safety, Washington, DC, December 15, 

2010; see, for example, pp 32-35.

http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed March 7, 2015). 

345 Ibid.

346 Transportation Research Board of the National Academies. Evaluating the Effectiveness of Offshore Safety and 

Environmental Management Systems; Transportation Research Board Special Report 309; National Academy of 

Sciences: Washington, DC, 2012; pp 62-63. http://onlinepubs.trb.org/onlinepubs/sr/SR309.pdf (accessed March 

31, 2016).

347 Center for Stratetic & International Studies. The International Regulatory Structures for Offshore Exploration; 

November 8, 2010; p 2. http://csis.org/files/attachments/101108_Summary_International%20Practices.pdf

(accessed March 26, 2016). 

001011
Macondo Investigation Report Volume 4 4/17/2016

76 

safety assertions.348 The true strength of the regimes lie then in the regulators’ abilities to test the validity 

of duty holder claims.349 

Without such a review of the documentation detailing the planned risk reduction measures, a scenario 

could arise in which the operator assembles and executes a deficient safety management system and 

BSEE misses an opportunity to identify safety gaps. The permit-to-operate process that currently exists in 

the US OCS provides opportunities to evaluate aspects of a facility’s management systems before certain 

design and operational phases of the well site. None, however, sufficiently address process safety 

concerns. For instance, in bidding on an OCS lease, BOEM can disqualify a potential lessee for various 

reasons, including unresolved or multiple incidents of noncompliance, civil penalties, or failure to adhere 

to lease obligations.350 While civil penalties may touch upon aspects of process safety, disqualification 

largely depends on administrative or occupational safety matters. 

Once a lease has been obtained, an operator must obtain approval from BSEE to drill by submitting 

information such as design criteria for the proposed well, drilling plans, and diverter and BOP system 

descriptions.351 The information required by BSEE is a prescriptive-based series of technical 

specifications that does not contain a comprehensive list of best technical practices nor a comprehensive 

barrier-risk analysis that addresses both design and operational site specific risks.352 Further, there is no 

performance based requirement to ensure the design risks of the well are and will remain reduced to a 

level such as ALARP throughout the lifecycle of the well. 

For the US to effectively implement a more robust regulatory regime for its offshore oil and gas 

operations, BSEE must play a proactive role in risk-reduction. In the CSB’s view, this includes not only 

active review and response to third-party audit results, but independent BSEE audits and initiatives on 

identified safety issues or at-risk facilities/companies, and the authority and to accept, reject, or require 

 

348 CSB Public Hearing: Regulatory Approaces to Offshore Oil and Gas Safety, Washington, DC, December 15, 

2010; see, for example, p 95. http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf

(accessed March 7, 2015). UK HSE. A guide to the Offshore Installations (Safety Case) Regulations 2005, 3rd 

ed.; SCR 2005; 2006; Demonstration of ‘as low as reasonably practicalbe, p 6. 

http://www.hse.gov.uk/pubns/books/l30.htm (accessed March 26, 2016).

349 “The fact is that the safety case is simply a series of ‘claims’ as to how an installation is being safely operated. 

The real strength in the regime is testing the validity of those claims through strategic intervention by competent 

regulators,” Whewell, I. Former Director, UK HSE Offshore Division, Personal communication, August 23, 2013. 

350 30 C.F.R. § 556.35; & 30 C.F.R. § 550.136; see also BSEE. Regional Leasing, http://www.boem.gov/Oil-andGas-Energy-Program/Leasing/Regional-Leasing/Index.aspx (accessed March 26, 2016). 

351 §250.410; §250.400 indicates that those subject to Subpart D—Oil and Gas Drilling Operations under which the 

permitting requirements are described include lessees, operating rights owners, operators, and their contractors 

and subcontractors. 

352 For example, the regulations for cementing require that the operator provide “A written description of how you 

evaluated the best practices included in API Standard 65—Part 2, Isolating Potential Flow Zones During Well 

Construction, Second Edition...Your written description must identify the mechanical barriers and cementing 

practices you will use for each casing string (reference API Standard 65—Part 2, Sections 4 and 5).” Sections 4 

and 5 in API Standard 65 state, “This section [4] is not exhaustive, nor does it provide the reader with a 

comprehensive set of detailed recommendations for well construction. The intent is to highlight the salient aspects 

that should be considered and summarize the interrelationship between drilling operations and cementing success. 

All topics discussed are covered in detail in various API, ISO, and other industry publications. [...] This 

[technical references] list is not all-inclusive. Other technical references are available in industry literature.”

001012
Macondo Investigation Report Volume 4 4/17/2016

77 

modifications to a company’s major hazard risk management approach before or throughout the entirety 

of the offshore operation. 

4.2 Regulatory Safety Oversight Audits and Initiatives

After BSEE’s first audit of the SEMS program in 2013, it noted there was a significant variation in SEMS 

programs amongst operators.353 As might be expected, for companies like BP and Transocean, BSEE 

observed that complying with the SEMS regulations entailed mapping their corporate policies to the 

SEMS elements listed in 30 C.F.R. 250 Subpart S.354 BSEE noted that for other organizations, the SEMS 

rule “triggered a first effort to develop and implement a formal SEMS,” and that for many organizations 

the focus was on compliance rather than “developing a tool to manage their respective operating health, 

safety, and environmental (HSE) risks.”355 

In a 2012 interview, former BSEE Director James Watson contended that BSEE did not “review and 

approve the safety and environmental management system programs and that’s by design.”356 BSEE did 

not want to create a system in which industry relied on the government to management it.357 ‘Reviewing’ 

a company’s SEMS program and major hazard documentation, however, is an opportunity for the 

regulator to challenge 1) if hazards and risks have been assessed and 2) if controls and proposed safety 

management systems meant to ensure their effectiveness have been established. In this framework, 

“approving’ a SEMS program or major hazard documentation can simply be acknowledgement by the 

regulator that all the elements it has deemed necessary to manage safety have been addressed. The 

effectiveness of a SEMS program though can only be assessed or audited after being tested under the 

demands of actual operations. 

In 2012, BSEE (then BOEMRE) engaged the Transportation Research Board (TRB) to provide guidance 

on how to evaluate the effectiveness of the SEMS regulations. TRB observed:358 

• If BSEE’s goal is, as it should be, to encourage a culture of safety so that individuals know the 

safety aspects of their actions and are motivated to think about safety, then the agency will need 

to evolve an evaluation system for Safety and Environmental Management Systems (SEMS) that 

emphasizes the evaluation of attitudes and actions rather than documentation and paperwork.

 

353 BSEE. SEMS Program Summary—First Audit Cycle (2011-2013); July 23, 2014, 

http://www.bsee.gov/uploadedFiles/BSEE/Regulations_and_Guidance/Safety_and_Environmental_Management_

Systems_-_SEMS/SEMS%20Program%20Summary%208132014.pdf (accessed March 29, 2016).

354 Ibid. 

355 Ibid. 

356 Dlouhy, J. Offshore enforcement chief outlines approach to safety. Fuel Fix from the Houston Chronicle, 

December 18, 2012, http://fuelfix.com/blog/2012/12/18/offshore-enforcement-chief-outlines-approach-to-safety/

(accessed March 26, 2016). 

357 Ibid. 

358 Transportation Research Board of the National Academies. Evlauating the Effectiveness of Offshore Safety and 

Environmental Managment Systems; Transportation Research Board Special Report 309; National Academy of 

Sciences: Washington, DC, 2012; pp 31 and 91. http://onlinepubs.trb.org/onlinepubs/sr/SR309.pdf (accessed 

March 31, 2016).

001013
Macondo Investigation Report Volume 4 4/17/2016

78 

• BSEE can encourage or hurt the development of a culture of safety by the way it measures and 

enforces SEMS. Forcing an operation to satisfy checklists that require specific forms of 

documentation and penalizing those operations that do not is likely to encourage a culture of 

compliance and discourage the development of a culture of safety.

BSEE’s findings two years later in 2014 on the SEMS programs validated TRB’s observations. BSEE 

noted that audit questions “were focused on assessing compliance rather than focusing on successfully 

reducing or managing risk” and that some reports were submitted “as nothing more than a completed 

checklist with little incorporated information or analysis.” BSEE stated that compliance checklists “limit 

[its] ability to assess degrees of implementation or effectiveness [of SEMS programs].” TRB reviewed 

existing approaches for assessing safety management systems and BSEE’s potential role in the process. 

TRB’s report summarizes several auditor characteristics it observed in US and international regulatory 

agencies from a variety of industries (not all inclusive):359

• Specialized training for auditors to ensure a working knowledge of SMS elements, worker duties, 

and the industry 

• A variety of tools for auditors to assess the implementation of SMSs including observing 

operations, verifying procedures, seeking evidence of corrective actions, and in the case of 

offshore, speaking to workers and managers, both at the offshore facilities and shore-based 

offices.

• Scheduled audits, in response to an incident or risk-based. 

• Regulatory tools to stop work if companies cannot demonstrate adequate risk management of 

operations. 

Specific to Norway, TRB noted that PSA replaced the term “inspection” with “supervision,” and 

“approvals” with “consents.” PSA believes that the terminology change was significant because it helped 

move audits beyond monitoring exercises and created a climate “in which PSA worked with the industry 

to improve safety instead of acting in the role of a compliance inspector and guarantor of the acceptability 

of company.”360 This sentiment was paralleled both in the US and the UK. In 1990, a Marine Board 

charged with exploring alternative inspection measures for the OCS told MMS that regulatory presence 

on offshore installations conveys a sense of oversight and provides impetus for safety improvement by 

marginal and inexperienced operators. 361 In the UK, following the 2005 Buncefield incident,362 the HSE 

onshore regulator began emphasizing regulatory inspections and audits to ensure companies implement 

safety management systems to reduce risks to ALARP, as described in their safety case reports. 

 

359 Ibid., Chapter 4.

360 Ibid., pp 60-61.

361 Committee on Alternatives of Inspection of Outer Continenetal Shelf Operations, Marine Board, Commission on 

Engineering and Technical Systems National Reserach Council. Alternatives for Inspecting Outer Continental 

Shelf Operations [Online]; National Academy Press: Washington, 1990; p 81, 

http://www.nap.edu/download.php?record_id=1517 (accessed March 26, 2016).

362 On December 11, 2005, a number of explosions occurred at Buncefield Oil Storage Depot in Hemel Hempstead, 

Hertfordshire, England, following the overfilling of a gasoline tank. There were no fatalities, 43 people were 

injured, and nearby commercial and residential property totaled $1.5 billion; Buncefield Major Incident 

Investigation Board. The Buncefield Incident, 11 December 2005; Volume 1; UK HSE: 2008; 

http://www.hse.gov.uk/comah/buncefield/miib-final-volume1.pdf (accessed March 26, 2016). 

001014
Macondo Investigation Report Volume 4 4/17/2016

79 

According to HSE, roughly 70 percent of an HSE onshore inspector’s time is now spent inspecting.363 In 

conversations with CSB investigators, HSE management and inspectors emphasized the importance of 

inspections and the “creative tension” created during dialogue between the inspector and the duty 

holder.364 

4.2.1 Challenges of Relying on Third-Party Audits in the GoM 

Third-party SEMS program audits are required by BSEE, 365 after which BSEE receives an audit report 

that then becomes its main source of information on the effectiveness of a SEMS program.366 Third-party 

audit service providers (ASP) can play an important role in achieving safety, but solely relying on them 

creates a gap between BSEE and the companies it regulates. For instance, BSEE does not accredit the 

ASPs itself, instead relying on BSEE-approved Accreditation Bodies (AB).367 Currently, the only AB 

BSEE has approved is the Center for Offshore Safety (COS), an industry sponsored organization.368

Therefore if BSEE does not independently determine the quality and effectiveness of the third-party 

audits, the process could potentially devolve into ineffective industry self-regulation.

As part of the auditing process, the ASP must provide BSEE with an Audit Plan 30 days prior to 

conducting the audit, whereby BSEE reserves the right to modify the list of facilities identified for 

audit.369 The auditor must provide BSEE a report of the audit findings and conclusions, including 

identified deficiencies, within 30 days of completion, and the company audited must provide a plan for 

addressing the deficiencies, the corrective actions that will be taken, and the person responsible for 

each.370 BSEE has the legal authority to verify that the corrective actions have been taken.371 

Yet, this approach has limitations and raises conflict-of-interest concerns. If BSEE does not conduct any 

of its own SEMS audits, it risks losing opportunities to: directly interact with the companies it regulates, 

gain familiarity with those offshore facilities and well operations/technologies/equipment, and dialogue 

directly with the workforce. These lost opportunities inhibit the development of that “creative tension” 

between the regulator and those regulated. Additionally, the manner in which third parties conduct BSEE 

audits is potentially problematic for several reasons:

 

363 Learned during CSB staff visit to the UK in March 2014. 

364 The UK HSE uses third-party audits to augment its own work, not supplant it. See Chapter 5.5, Volume 2.

365 30 C.F.R. § 250.1920(a) (2016). Prior to April 2013, BSEE also permitted “designated and qualified” personnel 

to complete the audits; 30 C.F.R. § 250.1920(a) (2012). With the introduction of SEMS II, BSEE removed this 

definition. Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety and 

Environmental Management Systems, 78 Fed. Reg. 20423 (Final Rule, April 5, 2013) (to be codified at 30 C.F.R. 

Part 250).

366 BSEE communication to the CSB in 2016.

367 30 C.F.R. § 250.1921 and 1922.

368 BSEE can recognize other accreditation bodies, but currently has only named COS an AB; BSEE. Information to 

Lessees (ITL) and Operators of Federal Oil and Gas Leases on the Outer Continental Shelf (OCS); June 18, 

2015; http://www.bsee.gov/uploadedFiles/Information%20To%20Lessees-%20Accreditation%20Body.pdf

(accessed March 26, 2016). 

369 30 C.F.R. § 250.1920(b)(4)

370 30 C.F.R. § 250.1920(c) and (d)

371 30 C.F.R. § 250.1920(e)

001015
Macondo Investigation Report Volume 4 4/17/2016

80 

• No law requires third-party auditors to behave independently and consistently, especially without 

regulator review of, and routine calibration with, all accredited auditors. 

• SEMS does not require BSEE to send staff to attend audits, even though it does; thus, if these 

audit practices do not evolve, BSEE’s own staff will not develop its own expertise. 

• Problems with consistency are surfacing among accredited service providers. At a June 2015 

Ocean Energy Safety Institute forum a presenter from DNV GL, an ASP, indicated inconsistent 

practices existed amongst ASPs.372 For instance, DNV GL will not conduct an audit of a nonoperating asset, but it has been informed that other ASPs are.373 

On December 7, 2015, BSEE announced the launch of a pilot Risk-Based Inspection Program.374 Industry 

data and BSEE reportable incident data indicates that four out of five incidents occur at just 20% of 

offshore facilities.375 Consequently, BSEE wanted to efficiently and effectively manage the limited 

inspection and auditing resources of the agency by focusing on facilities that present a higher safety 

risk.376 Such a program may prove to bridge the gap created by solely relying on third party audits, but as 

the pilot program is in its infancy, no conclusions concerning its effectiveness can be made at this time. 

Furthermore, lack of an accident does not guarantee no accidents in the future. Thus, BSEE must examine 

and follow-up on third-party audit results to proactively identify emerging safety issues at specific 

facilities/companies as well as industry-wide trends. 

4.3 Regulatory Use of Safety Performance Indicator Data

One essential mechanism by which a regulator can check the pulse of industry and target major accident 

event risk is through comprehensive review of safety performance indicators. As the CSB learned in its 

July 2012 public hearing on Safety Performance Indicators377 and then emphasized in its Chevron Interim 

and Regulatory Reports,378 leading process safety indicators help drive continual safety improvements in 

 

372 Ilango, C. Where has SEMS Been, an Auditors Perspective, Taking SEMS to the Next Level Ensuring 

Continuous Improvement of Safety and Environmental Management Systems, Houston, TX, July 2015, 2015; 

http://oesi.tamu.edu/events/forum/ (accessed March 16, 2016).

373 DNV also noted that initially, audit consistency was poor. While COS criteria has better defined audit 

expectations, new issues are emerging, for example “the minimum duration of audits allowing for wide variability 

in the depth of the audits – compliance vs. system audit;” Ibid.

374 Bureau of Safety and Environmental Enforcement to Launch Pilot Risk-Based Inspection Program for Offshore 

Facilities. December 7, 2015. http://www.bsee.gov/BSEE-Newsroom/Press-Releases/2015/Bureau-of-Safety-andEnvironmental-Enforcement-to-Launch-Pilot-Risk-Based-Inspection-Program-for-Offshore-Facilities/ (accessed 

December 21, 2015).

375 BSEE. BSEE Blog: Risk-Based Inspection Pilot Program: What’s in your facility?, 

http://www.bsee.gov/safety/bsee-blog/ (accessed March 16, 2016). 

376 Ibid. 

377 Described more fully in Section 3.4.1 of Volume 3; CSB Public Hearing: Safety Performance Indicators, 

Houston, TX, July 23-24, 2012; http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/

(accessed October 7, 2015). This information, including the agenda, the verbatim transcript of the proceedings, 

working papers submitted, slide presentations, and other materials from the proceedings, is available as part of the 

CSB’s record pertaining to the Macondo investigation.

378 USCSB, 2012 and 2014. Regulatory and Intermim Reports: Chevron Richmond Refinery Pipe Rupture and Fire, 

Richmond, CA, August 6, 2012, Report No. 2012-03-I-CA, 

http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf and 

001016
Macondo Investigation Report Volume 4 4/17/2016

81 

preventing major accidents, as long as regulators effectively use these indicators to focus inspections, 

audits, and investigations, and to share lessons learned throughout industry. Similarly, industry must 

simultaneously focus attention on indicators. Yet the indicators and other data BSEE collects do not 

adequately focus on process safety matters, especially relating to leading indicators. As such, BSEE’s 

efforts are still insufficient in guiding industry concerning safety trends and deficiencies. 

In contrast with the company-specific indicators tracked by individual companies, regulators can track 

more broad-based indicators, which they can then use to:

• Diagnose systemic problems in the safety management systems across industry;

• Develop and maintain industry benchmarks;

• Assess the effectiveness of their own regulations and policies to prevent major accidents;

• Measure the regulator’s own performance with respect to core duties such as audits, inspection 

activities, and related regulatory initiatives; and

• Analyze macro trends to focus on big-picture issues and initiatives to improve industry safety 

performance. 

4.3.1 Roadblocks to Regulatory Improvements in Data Collection and 

Analysis 

Following the Piper Alpha incident in the UK in 1988, the US regulator received technical advice for 

improvement to its regulatory standards and practices. For example, a National Research Council 

Committee recommended that “MMS improve its collection, analysis, and use of safety-related data 

regarding offshore operations,” since “improvements in safety performance derive in large part from past 

lessons.”379 The Committee explained:

The committee recommends that MMS place its primary emphasis on detection of potential 

accident-producing situations—particularly those involving human factors, operational 

procedures, and modifications of equipment and facilities—rather than scattered instances of noncompliance with hardware specifications. ... An important step is to extend the definition of a 

“mishap” to include near misses, i.e., drilling or production disruptions, and events that prompt 

the operator or an MMS inspector to shut down operations and require investigation of these less 

serious occurrences as well as events (accidents). 380

Thirteen years after the Committee’s study, in 2003, MMS proposed federal rulemaking to enhance 

reporting regulations.381 At the time, MMS only required death or serious injury, fires, explosions, and 

blowouts be reported orally,382 but the rule proposed expanding requirements to include written reports of 

 

http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf, April 2013 and October 2015 

(accessed October 7, 2015).

379 Committee on Alternatives of Inspection of Outer Continenetal Shelf Operations, Marine Board, Commission on 

Engineering and technical Systms National Reserach Council. Alternatives for Inspecting Outer Continental Shelf 

Operations [Online]; National Academy Press: Washington, 1990; p 31, 

http://www.nap.edu/download.php?record_id=1517 (accessed March 26, 2016).

380 Ibid., p 831.

381 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Rule, 68 Fed. Reg. 

40585 (Proposed Rule, July 8, 2003). 

382 30 C.F.R. § 250.191 (2003)

001017
Macondo Investigation Report Volume 4 4/17/2016

82 

the incidents listed in Table 4-1. MMS’s intent was to capture those “near misses” that did not result in 

the accidents already being reported by industry. In proposing the rule, MMS noted that results from the 

voluntary SEMP program indicated there could be a marked increase in the number of incidents 

reported.383 Tracking this data, MMS hoped to develop regulatory initiatives, conduct risk-based 

inspections, and work with industry to develop new standards, among other approaches, to address safety 

issues on the OCS. Additionally, MMS requested industry comments on whether it should collect the total 

number of hours worked by employees and the kind of information it should collect about contractors.384

Without such data, MMS observed it could not normalize raw injury data and calculate injury rates or 

account for injury and illness cases that involved contractors, which MMS indicated made up 80% of the 

offshore workforce.385 

Table 4-1. Abridged list of reportable incidents to BSEE from § 250.188.

1. All fatalities.

2. All injuries that require the evacuation of the injured person(s) from the facility to shore or to 

another offshore facility.

3. All losses of well control.

4. All fires and explosions.

5. All reportable releases of hydrogen sulfide (H2S) gas.

6. All collisions that result in property or equipment damage greater than $25,000. 

7. All incidents involving structural damage to an OCS facility.

8. All incidents involving crane or personnel/material handling operations. 

9. All incidents that damage or disable safety systems or equipment (including firefighting 

systems).

10. Any injuries that result in one or more days away from work or one or more days on restricted 

work or job transfer;

11. All gas releases that initiate equipment or process shutdown; 

12. All incidents that require operations personnel on the facility to muster for evacuation for 

reasons not related to weather or drills;

13. All other incidents, not listed in paragraph (a) of this section, resulting in property or 

equipment damage greater than $25,000. 

 

383 MMS reported “injuries that required evacuation from the facility, and injuries that resulted in days away from 

work, restricted work, or job transfer) could require up to 291 additional injury reports.” Incidents due to 

hydrogen sulfide and gas releases, collisions, damage, and cranes could result in an increase of 60 incidents 

reported per year; Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Rule, 

68 Fed. Reg. 40585 (Proposed Rule, July 8, 2003). 

384 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Rule, 68 Fed. Reg. 

40585 (Proposed Rule, July 8, 2003). 

385 Ibid. 

001018
Macondo Investigation Report Volume 4 4/17/2016

83 

Numerous objections to the proposed rule were raised by industry groups, including the Offshore 

Operator’s Committee (OOC) 386 the IADC, and the National Ocean Industries Association. 387 They 

objected because the proposed rule was overly prescriptive and burdensome and too complex.388 One 

example the OOC gave was the proposed requirement to report “any unintentional release of gas at an 

OCS facility that could, without corrective action, raise hydrocarbon or other gas concentrations to the 

lower flammable (explosive) limit.”389 OOC explained that it would be difficult to determine when an 

unintentional release could have raised gas concentrations to explosive limits. OOC noted that gas 

detectors in some areas could result in system shut-ins, but reporting such incidents would be burdensome 

to MMS and the industry and “serve no purpose in improving safety on platforms.” MMS disagreed: 

platforms have numerous sources of ignition, and there are many small fires reported on these 

facilities. Small fires have the potential to become major incidents that could cause serious 

injuries or deaths. By collecting the information on gas releases that result in equipment or 

process shut-in, we can track the trends, and possibly decrease the number of gas releases.390 

With gas releases, MMS began to address the National Research Council’s recommendation to extend the 

definition of “mishap” to include near-misses, but the CSB notes that due to the qualifiers on the 

definition of a gas release,

391 the data has limitations as to its usefulness. A review of previous years’ data 

demonstrates that most of the companies operating in the OSC will likely not experience a qualifying gas 

release in a given year. In fact, there were never more than 17 gas releases that met the reporting criteria 

per year during any of the last six years. If BSEE had previously mandated that operators were to report 

all hydrocarbon releases, they would have reported more incidents, which could assist the regulator in at 

least three different functions: 

• To alert the regulator about incidents or near-miss events that could warrant an immediate 

regulator response such as an urgent offshore visit to investigate; 

• To help the regulator gather industrywide data at a macro scale for assessing overall industry 

performance and trends, and to help direct the regulator’s priorities; and 

• To benchmark and compare individual operators and companies. 

At its most basic level, such data could alert the regulator to potentially dangerous trends that require 

initiating regulatory action or other industry improvements. This oversight role accords with the same 

industry methodology accepted and currently in use by other offshore regimes. 

 

386 The Offshore Operator’s Committee’s comments to the proposed regulation were particularly strong citing 

“serious flaws” in “several areas” of the proposed regulation. Offshore Operator’s Committee, letter referencing 

RIN 1010-AC57; NPRM Incident Reporting FR 68-40585, November 24, 2003, p 2.

387 According to the group’s website, “The National Ocean Industries Association (NOIA), founded in 1972 with 33 

members, represents all facets of the domestic offshore energy and related industries. Today, over 300 member 

companies are dedicated to the safe development of offshore energy for the continued growth and security of the 

United States.” http://www.noia.org/about/ (accessed March 26, 2016). 

388 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Requirements, 71 Fed. 

Reg. 19640 (Final Rule, April 17, 2006). 

389 Ibid. 

390 Ibid. 

391 A ‘gas release’ must result in either equipment or process shutdown; 30 C.F.R § 250.188(b)(2).

001019
Macondo Investigation Report Volume 4 4/17/2016

84 

BSEE could also track other types of near misses. An examination of loss of well control events 

illustrates this point. The 2006 reporting rule essentially defined loss of well control as the point when 

formation (or other fluids) leaves the well.392 Analysis of the data collected from MMS’s incident 

reporting rules since 2006 reveals that reported loss of well control events are infrequent. In fact they 

amounted to no more than eight events per year in the Gulf of Mexico over the last several years. 393 This 

is not a surprise as MMS predicted “a very minor increase in the number of loss of well control incidents 

(blowouts) reported due to this rule.”394 

A loss of well control is different from a well kick, which is the unintended flow of formation fluids into 

the wellbore. While not all well kicks evolve into serious events, Macondo demonstrates that unmanaged 

ones can lead to dangerous ‘gas-in-riser’ events and blowouts.395 Therefore, variables related to kicks can 

produce trends to evaluate industry performance and create strategies to promote safety on the OCS. 

Ultimately, while the US offshore regulator recorded fewer than eight loss of well control events since 

2006, internal Transocean kick data demonstrates that from 2006 to 2009 Transocean observed an 

increase in kicks in North America from 7 to 19, 396 and this is only from a single driller. By focusing on 

the more severe, but less frequent, loss of well control events, the utility of the metric is limited and does 

not lend itself to trending. Researchers funded by BSEE recently proposed key performance indicators 

related to kicks that “require special consideration and consistent tracking.” 397 These include kick 

response time, kick volume, and the frequency of kicks during various drilling activities. In fact, the 

suggested key performance indicators echo kick indicators suggested by Transocean itself.398

MMS adopted the final reporting rule in 2006,399 and required incident data (Table 4-1) for both operators 

and contractors.400 The 2006 rule did not ultimately require that the total number of employee hours 

 

392 The rule defined loss of well control as an (i) Uncontrolled flow of formation or other fluids. The flow may be to 

an exposed formation (an underground blowout) or at the surface (a surface blowout); (ii) Flow through a diverter; 

or (iii) Uncontrolled flow resulting from a failure of surface equipment or procedures; Oil and Gas and Sulphur 

Operations in the Outer Continental Shelf—Incident Reporting Requirements, 71 Fed. Reg. 19640 (Final Rule, 

April 17, 2006).

393 BSEE, OCS Incidents/Spills by Category: 1996-2007, http://www.bsee.gov/Inspection-andEnforcement/Accidents-and-Incidents/Spills-Archive-less-than/ and OCS Incidents/Spills by Category: CY 2008 - 

2015 ytd, http://www.bsee.gov/Inspection-and-Enforcement/Accidents-and-Incidents/Listing-and-Status-ofAccident-Investigations/ (accessed March 26, 2016).

394 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Requirements, 71 Fed. 

Reg. 19640 (Final Rule, April 17, 2006).

395 See Volume 3, Section 1.3.

396 Volume 3, Section 3.5.1.1.; Internal Company Document, Transocean. Well Control Events & Statistics 2005 to 

2009, TRN-INV-00760094, http://www.mdl2179trialdocs.com/releases/release201303211200016/TREX05649.pdf (accessed June 24, 2015).

397 Fraser, D.; Lindley, R.; Moore, D.; Staak, V. Early Kick Detection Methods and Technologies, SPE Annual 

Technical Conference and Exhibition, Amsterdam, The Netherlands, October 27-29, 2014; SPE-170756-MS.

398 See Volume 3, Section 3.5.1.1.

399 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Requirements, 71 Fed. 

Reg. 19640 (Final Rule, April 17, 2006). 

400 30 C.F.R. § 250.189-190 (2016).

001020
Macondo Investigation Report Volume 4 4/17/2016

85 

worked to be reported, despite MMS’s initial indication that it would like them.401 This did not change 

until 2011 when BSEE made a voluntary MMS Form-131 mandatory (renamed “BSEE-0131”402).403 This 

form collects personal safety statistics and infrequent lagging metrics listed in, such as recordable illness 

injuries, Days Away, Restrictions and Transfers (DART), injury/illness rate, notices of EPA 

noncompliance, and the total number of oil spills suffered over a specified period of time in a 

standardized written format not previously required.404 The report format and reportable incidents mirrors 

that found in Appendix E of API 75. BSEE-0131 remains substantively similar to its predecessor. 

At best, the regulator and the company reporting the information can use data from BSEE-0131 and Table 

4-1 only to react to the circumstances giving rise to the incidents reported after the fact. It is good that a 

regulator would be responsive to data of any type, including personal safety matters and lagging 

indicators, but BSEE cannot effectively use the data on this form to shape audits or inspections because of 

its inherent limitations. It also is less useful in identifying precursor events that present warning signs, 

which could allow for the company’s immediate responsive action, or even the regulator’s own urgent 

attention. The result of this narrow data-gathering process is a small data set that does not lend itself to 

trending or other potentially helpful analysis because only serious incidents are reported. 

BSEE continues to miss a critical opportunity to use performance safety indicators more proactively 

because it collects mostly infrequent lagging indicator data and does not use the data to inform its own 

performance in terms of special areas of focus, audit and inspection activities, and other targeted 

activities.

4.3.2 Inadequate Use of Safety Performance Indicators 

One essential mechanism by which a regulator can check the pulse of industry and target major accident 

event risk is through comprehensive review of safety performance indicators. Neither MMS before 

Macondo, nor BSEE currently, had (has) direct indicator data that provides information on the 

effectiveness of the barriers and safety management systems meant to keep offshore operations safe (e.g., 

maintenance issues, audit results, failures of equipment during routine testing).405 These are the Tier 3 and 

Tier 4 indicators described in Volume 3.406 Instead, the original desire of MSS to use indicator data to 

influence safety strategies on the OCS remain limited by the type of data collected. 

 

401 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Incident Reporting Rule, 68 Fed. Reg. 

40585 (Proposed Rule, July 8, 2003). 

402 BSEE. BSEE-0131, Performance Measures Data; 

http://www.bsee.gov/uploadedFiles/BSEE/About_BSEE/Doing_Business_with_BSEE/OCS_Forms_New/Form%

200131%20for%20exp%202018.pdf (accessed March 29, 2016).

403 Reorganization of Title 30: Bureaus of Safety and Environmental Encorcement and Ocean Energy Management, 

76 Fed. Reg. 64432 (Final Rule, October 18, 2011). 

404 See BSEE Form 131, http://www.bsee.gov/About-BSEE/Procurement-Business-Opportunities/BSEE-OCSOperation-Forms/BSEE-OCS-Operation-Forms.aspx (accessed January 21, 2016). 

405 See Volume 3, Chapter 3, particularly Sections 3.4.1-3.4.2.

406 Section 3.4.2, as defined by API 754, Tier 3 indicators include challenges to a safety systems, which results when 

exceeding defined process limits and a safety system is initiated to bring the system back to an accepted safe state 

(e.g., the activation of a shutdown system or a pressure relief device); Tier 4 indicators include performance of 

001021
Macondo Investigation Report Volume 4 4/17/2016

86 

As the CSB has emphasized,407 leading process safety indicators help drive continual safety 

improvements in the area of major accident prevention, as long as regulators effectively utilize these 

indicators to focus inspections, audits, and investigations, and to share lessons learned throughout 

industry. 

 

To date, BSEE does not have SEMS performance indicators, though it has reported sponsoring efforts to 

quantify such indicators.408 As such, BSEE’s efforts are insufficient in guiding industry with respect to 

safety trends and deficiencies. In the meantime, indirect, lagging measures of a SEMS program could be 

gleaned from the reporting of the incidents listed in Table 4-1; presumably, an effective SEMS program 

would reduce the occurrence of fatalities, injuries, loss of well control, etc. On May 5, 2015, BSEE 

 

barriers and management system components, such as management of change (MOC) compliance, inspections, or 

timely training schedules.

407 Volume 3, Chapter 3.

CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; 

http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed October 7, 2015). 

(including the agenda, the verbatim transcript of the proceedings, working papers submitted, and PowerPoint 

presentations and other materials from the proceedings are all available and included as part of the CSB’s record 

pertaining to the Macondo investigation).;

407 USCSB, 2012 and 2014. Regulatory and Intermim Reports: Chevron Richmond Refinery Pipe Rupture and Fire, 

Richmond, CA, August 6, 2012, Report No. 2012-03-I-CA, 

http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf and 

http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf, April 2013 and October 2015 

(accessed October 7, 2015).

408 For example, there is an April 2016 SPE/BSEE Summit: Assessing the Processes, Tools, and Value of Sharing & 

Learning from Offshore E&P Safety Related Data, http://www.spe.org/events/smsr/2016/ (accesses April 1, 

2015). 

Global Indicator Data Sharing

The International Regulators’ Forum (IRF) on Global Offshore Safety Performance 

Measurement Project was created to establish a framework based on a common set of 

indicators definitions and criteria. The IRF annually complies indicators, such as 

numbers of fatalities and injuries, losses of well control, mass hydrocarbon releases, 

collisions, and fires, for each IRF member country and makes them publicly available 

on the IRF website.† The focus is on higher consequence lagging and personal safety 

data, and the IRF is still working on reporting consistency among members. But, as 

this global sharing network continues to improve, it should allow for even greater 

improved opportunities to uncover emerging safety risks.

 † IRF, IRF Performance Measurement Project, 

http://www.irfoffshoresafety.com/country/performance/scope.aspx 

 (accessed December 21, 2015).

001022
Macondo Investigation Report Volume 4 4/17/2016

87 

announced its intention to initiate a new program called SafeOCS.409 In addition to providing a voluntary 

and anonymous reporting channel for offshore workers, BSEE designed this program as a way to collect 

leading and lagging safety indicator data that could made publicly available and inform prevention and 

mitigation efforts.

410 Although a positive step, BSEE currently has limited SafeOCS reports.411 Several 

companies have verbally indicated they will participate in the near future,412 but BSEE will need more 

time to determine the success of the voluntary program. Anonymous reporting and key performance 

indicators though are two different systems, and while they complement one another, they do not replace 

one another. 

BSEE publishes incident statistics and summaries of the data received on incidents listed in Table 4-1 on 

its website,413 and could use this data to drive industry initiatives as observed in other oil-producing 

jurisdictions around the world. In the UK, the offshore regulator HSE uses focused Key Programme 

Initiatives (Key Programmes or KPs), which are multi-year efforts to collect data and assess trends to 

drive improvement in offshore areas of significant concern, such as hydrocarbon releases, deck and 

drilling operations, asset integrity, and aging facilities.414 The Key Programmes are not limited to data 

collection and trend assessments, but are detailed and coordinated programs covering other regulatory 

activities including inspecting sites, raising awareness, and facilitating the development of standards, all 

requiring some level of data gathering activity.

HSE launched these Key Programmes to formulate and share good practices with industry.415 During the 

first Key Programme (KP1), between 2000 and 2004, among other notable regulatory activities, the 

regulator worked with industry and unions to collect relevant data to reduce reportable hydrocarbon 

releases by 50 percent in four years. For KP1, gas releases were categorized as minor, significant, or 

major using release size, rate, and duration criteria developed with industry.416 While the number of major 

releases was reduced by 33%, the regulator noted a 50% increase in the number or reported minor 

releases.417 This was attributed to an increased awareness of the need to report minor releases, and 

demonstrates that regulator participation can lead to more robust data collection. 

 

409 BSEE. BSEE Director Brian Salerno Announces Key Efforts to Reduce Risk Offshore, 

http://www.bsee.gov/BSEE-Newsroom/Press-Releases/2015/BSEE-Director-Brian-Salerno-Announces-KeyEfforts-to-Reduce-Risk-Offshore/ (accessed March 26, 2016). 

410 BSEE, 2014 Annual Report; p 9, 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Publications_Library/Annual_Report/BSEE%20201

4%20Annual%20Report.pdf (accessed December 21, 2015).

411 BSEE communication to the CSB.

412 Ibid.

413 BSEE. Incident Statistics and Summaries, http://www.bsee.gov/Inspection-and-Enforcement/Accidents-andIncidents/Other-Incidents/ (accessed March 29, 2016). 

414 UK HSE, Key Programme final reports, http://www.hse.gov.uk/offshore/programmereports.htm (accessed March 

26, 2016).

415 UK HSE. OSD hydrocarbon release reduction campaign, Report on the hydrocarbon release incident 

investigation project -1/4/2000 to 31/3/2001; 2001; p 1. 

http://www.hse.gov.uk/research/otopdf/2001/oto01055.pdf (accessed March 26, 2016). 

416 Ibid., p 2.

417 Ibid., p iii.

001023
Macondo Investigation Report Volume 4 4/17/2016

88 

In 2010, the UK HSE initiated KP4 to address the issue of aging equipment offshore and the operation of 

installations beyond their design life.418 That same year, the HSE published Managing Aging Plant: A 

Summary Guide,419 to aid industry in preventing major accidents. The report provides an overview of 

plant and equipment failure due to age related mechanisms, their management, and suggested leading and 

lagging indicators to monitor them. It also presents analysis on how aging plant equipment may be a 

factor in loss of containment incidents. According to Jake Malloy, Regional Organizer of the National 

Union of Rail, Maritime and Transport Workers Union (UK), “it is our firm belief that the most 

influential and effective schemes using indicators to measure improvements and major accident 

prevention are those initiatives generated by our regulator, the Health and Safety Executive.”420

The Norwegian offshore regulator, PSA, runs a multi-year program to track indicators data. The program, 

Trends in Risk Level in the Petroleum Activity (RNNP), focuses on identifying trends in leading and 

lagging indicators such as near-miss incidents, barrier performance, chemical exposure, well control 

incidents, and maintenance management.421 PSA chose these indicators for its trends program because it 

noticed industry was relying on indicators such as lost-time incidents, which alone are unable to present a 

full picture of safety.422 PSA states, “RNNP has become an important management tool for all 

participants in the petroleum sector. Its findings are valuable for our planning of supervision activities and 

development of the regulations.”423 Furthermore, PSA indicates, “with solid facts on the table, employers 

and unions can drop time consuming discussions [on whether the industry is “safe”] and concentrate 

instead on achieving improvement.”424

If BSEE were to take the lead in establishing a robust system of safety performance indicators that 

includes information on barriers and safety management systems and use that information to target audits, 

inspections, enhanced rule-making, and other regulatory activity aimed at major offshore accident 

prevention, the risk of incidents like Macondo can be reduced. Ultimately, six years after the catastrophe, 

regulatory requirements are still needed for developing and implementing safety performance indicators 

to prevent major accidents.

 

418 UK HSE. Key Programme 4 (KP4): Ageing and life extension, http://www.hse.gov.uk/offshore/ageing/kp4-

report.pdf (accessed December 8, 2014).

419 UK HSE. Managing Ageing Plant, A Summary Guide, http://www.hse.gov.uk/research/rrpdf/rr823-summaryguide.pdf (accessed November, 1, 2013).

420 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Jake Malloy, 

Safety Performance Indicators—The Workforce Perspective, p 139,

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

421 Numerous reports available, PSA. Trends in risk level, http://www.psa.no/risk-level/category876.html (accessed 

March 26, 2016).

422 PSA. Summary Report 2012—Norwegian Continental Shelf, Trends in Risk Level in the Petroleum Activity, p 1, 

http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed March 26, 

2016).

423 PSA, Trends in risk level in the petroleum activity (RNNP), http://www.psa.no/about-rnnp/category911.html

(accessed March 26, 2016).

424 See video at http://www.psa.no/about-rnnp/category911.html (accessed March 26, 2016).

001024
Macondo Investigation Report Volume 4 4/17/2016

89 

4.4 Transparency of Offshore Safety

Public disclosure of offshore safety information encourages accountability, risk-reduction, effective 

enforcement, and sharing of lessons learned. Public disclosure of this type of information could also 

promote trust among workers, operators, and the regulator, and even help to provide a mechanism for 

members of the public to satisfy themselves about the safety of offshore operations and the adequacy of 

regulatory action. Historically, the US offshore safety regulator did not promote safety improvements 

through transparency.425 That may now be starting to change, however, as BSEE initiated an annual 

report, which is publicly available and published on the agency’s website. The report contains industry 

safety performance indicator data, acknowledges operational and organizational BSEE deficiencies, and 

provides strategic goals and objectives for the agency. The report notes that BSEE is working to create a 

Data Stewardship team, with the primary responsibility of improving the overall quality, management, 

and use of offshore data.426 In addition, BSEE issues safety alerts and publishes them on its website to 

help share lessons learned from investigations of incidents.427 BSEE also makes available on its website a 

listing of “Incident Statistics and Summaries” which includes data covering a variety of topics back to 

2008, with additional incident archive data back to 1996. 428 BSEE notes in its 2014 annual report that 

lessons learned from investigations in the Pacific Region triggered two safety alerts in 2014.429 Currently, 

 

425 Steffy, L. Dearth of data leaves Gulf safety record in the dark. Fuel Fix from the Houston Chronicle, December 

7, 2012, http://fuelfix.com/blog/2012/12/07/steffy-dearth-of-data-leaves-gulf-safety-record-in-the-dark/ (accessed 

March 26, 2016). 

426 BSEE. 2014 Annual Report. May 5, 2015; p 12. 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Publications_Library/Annual_Report/BSEE%20201

4%20Annual%20Report.pdf (accessed December 21, 2015). 

427 BSEE. Current Safety Alerts, http://www.bsee.gov/Regulations-and-Guidance/Safety-Alerts/Safety-Alerts/

(accessed March 26, 2016). 

428 BSEE. Incident Statistics and Summaries, http://www.bsee.gov/Inspection-and-Enforcement/Accidents-andIncidents/Listing-and-Status-of-Accident-Investigations/ (accessed March 26, 2016). 

429 BSEE. 2014 Annual Report. May 5, 2015; p 17. 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Publications_Library/Annual_Report/BSEE%20201

4%20Annual%20Report.pdf (accessed December 21, 2015). 

Safety performance indicators (SPIs) should be used as an aid to communication. 

They are not the entire message. . . . All stakeholders need to remember SPIs do not 

measure the level of safety. SPIs indicate how the measures to achieve safe operation 

are performing. SPIs offer a chance to improve transparency and communication 

between operators and inspectors. It is up to senior management to decide whether 

they wish to implement these tools. Government policy makers need to realize the 

potential and provide suitable training and resources to allow inspectors to be 

competent partners in the use of SPIs and thus enable the necessary dialogue to take 

place. †

 † Jennings, K.; Hailwood, M. OECD Guidance on Safety Performance Indicators - An International 

Approach to Assessing the Success of Industry, Public Authorities and Communities in Managing Major 

Accident Hazards; IChem E Loss Prevention Bulletin 2010, 212, p 10.

001025
Macondo Investigation Report Volume 4 4/17/2016

90 

operators and drilling contractors are not required to provide public access to safety-related 

documentation or statistics. Some enforcement data and statistics on lagging indicators are available 

publicly,430 but insufficient dialogue about these issues remains among industry, the regulator, and the 

public. 

4.4.1 Regulatory Approaches to Transparency

Transparency can be achieved through publishing enforcement actions, safety case documentation, and 

annual reports of safety statistics. In Norway, the PSA disseminates offshore process safety data through 

its website, forums, and archives.431 The PSA website provides statistics, an annual Risk Assessment 

Report, and information on recent major accidents in Norwegian waters.432 PSA also uses numerous 

indicators to uncover trends and determine the overall process safety health offshore, which are published 

in an annual Risk Assessment Report. The agency then bases it priorities for the year on PSA data 

analysis and establishes forums in which it participates with industry and workers to engage in open 

discussion on how to improve safety.433 The PSA asserts this approach is necessary to reduce risks.434 

Although the UK does not make public an operator’s safety case documentation,435 it does publish 

guidance for compliance with ALARP, enforcement decision processes for the safety case, and 

aggregation of process safety indicators.436 The Seveso III Directive, enacted in UK law in June 2015 

through Control of Major Accident Hazards (COMAH) regulations, requires active public disclosure of 

major accident risks at any operation.437 The UK HSE provides public access to its enforcement decisions 

regarding safety case violations.438 The UK HSE also publishes its safety case assessment process online 

 

430 30 C.F.R. § 250.1929; and BSEE. Incidents of Noncompliance, http://www.bsee.gov/Inspection-andEnforcement/Enforcement-Programs/Incidents-of-Non-Compliance/. 

431 PSA. Transparency: Open and honest, http://www.ptil.no/news/transparency-open-and-honest-article7627-

878.html (accessed March 26, 2016); CSB Public Hearing: Regulatory Approaces to Offshore Oil and Gas Safety, 

Washington, DC, December 15, 2010; see, for example, pp 70-71.

http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed March 7, 2015).

432 See PSA. Safety Stats and signals, http://www.ptil.no/?lang=en_US; Report following the audit of Exxon 

Mobil’s use of quantitative risk analyses, http://www.ptil.no/news/report-following-the-audit-of-exxon-mobil-suse-of-quantitative-risk-analyses-article6019-878.html; and Notification of orders to BP after investigation of 

Valhall PC fire, http://www.ptil.no/risk-management/notification-of-orders-to-bp-after-investigation-of-valhallpcp-fire-article8233-1029.html; and Risk Level, http://www.ptil.no/rnnp/category876.html (accessed March 7, 

2015)..

433 CSB Public Hearing: Regulatory Approaces to Offshore Oil and Gas Safety, Washington, DC, December 15, 

2010; see, for example, pp 70-71.

http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed March 7, 2015).

434 PSA. Transparency: Open and honest, http://www.ptil.no/news/transparency-open-and-honest-article7627-

878.html (accessed March 26, 2016);

435 The CSB Investigations staff learned in its March 2014 trip to the UK that before 9/11, the UK HSE made safety 

case report summary documents publicly available; however, for security reasons, the UK ceased to make these 

documents available under a Secretary of State order. 

436 Learned during CSB staff visit to the UK in March 2014. 

437 UK HSE, Public Information, http://www.hse.gov.uk/seveso/public.htm (accessed March 26, 2016). 

438 UK HSE, HSE Public Register of Enforcement Notices, http://www.hse.gov.uk/notices/ (accessed March 26, 

2016). 

001026
Macondo Investigation Report Volume 4 4/17/2016

91 

along with annual offshore safety statistics, safety alerts, and reports of key intervention programmes.439 

According to Ian Travers, the UK HSE Head of Chemical Industries Strategy Unit, Hazardous 

Installations Directorate, transparency revolutionized the offshore industry. For example, Travers 

explained that although UK HSE operates a hotline for confidential whistle-blowing, it is “rarely used” 

and tends to be used only in situations where companies operating offshore lack a good safety culture, 

which Travers attributed to an atmosphere of “transparency” in the North Sea.440 Travers also explained 

that the role of the regulator in terms of its relationship with industry, along with the unique place 

indicators play in that relationship: 

The essential role of the regulator for major hazards is to provide public assurance that those 

whose activities give rise to risks to people and the environment are adequately controlling those 

risks. Industry in turn should ensure that there is transparency and openness in how well those 

risks are being controlled. KPIs are an essential ingredient in that dialogue between the regulator 

and the regulated in, for example, setting and agreeing on programmes for operators’ major 

hazard improvement and the regulator’s intervention strategies and plans.441

Travers’s testimony was corroborated by Bob Lauder, former Health and Safety Policy Manager of Oil & 

Gas UK, the industry trade association that serves as “the voice of the offshore industry” in the North Sea. 

Lauder testified this openness did not always exist: 

There was significant reluctance on the part of lots of companies ... in the UK to go as public as 

we’ve now gone with our statistics. ... So, what we do now is ... we get this information directly 

back from the Health and Safety Executive from their managed database. And, on a quarterly 

basis, we put it on our website so it’s publicly available. ... And, on a quarterly basis, we—I 

hate to use the phraseology, but it has been called naming and shaming .... You can see that we 

named the duty-holder, we named the installation, and then we give some indication of the 

nature and scale of the release. So, that's out there. It’s [visible to] anybody who wants to see it. 

A point I might want to make here is you’ll see some very familiar names on there. ... So, I 

think that really was a big deal for us to [become] as transparent as we now are with that and it 

didn’t happen overnight and it didn't happen without some resistance.442

Mr. Lauder left unstated, however, that industry players in the UK are now working in a more mature 

regulatory environment that values disclosure of this type of safety information. Rather than viewing it as 

harmful to their respective competitive positions or to their standing within the industry, the operators 

came together through their trade association and formalized an arrangement to provide for openness 

about hydrocarbon releases. This intentional strategy is an important source of potential learning for the 

 

439 UK HSE, Key Programme final reports, http://www.hse.gov.uk/offshore/programmereports.htm (accessed March 

26, 2016); 

440 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Ian Travers, 

Overview of Leading Indicator and Usage, p 157, http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf 

(accessed October 7, 2015). 

441 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; written testimony of Ian 

Travers, The Implementation of Effective Key Performance Indicators for Major Hazard Enterprises, p 3, 

http://www.csb.gov/UserFiles/file/Travers%20%28HSE%29%20-%20Testimony%20-%20printed.pdf (accessed 

October 7, 2015). 

442 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Bob Lauder, 

Major Hazard (Asset Integrity) Key Performance Indicators in Use in the UK Offshore Oil and Gas Industry, pp 

175-176, http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015). 

001027
Macondo Investigation Report Volume 4 4/17/2016

92 

entire industry, and it can actually help to promote public and political trust and confidence in offshore 

operators. 

In his testimony to the CSB at the agency’s performance safety indicators event on July 24, 2012, Jake 

Malloy, Regional Organizer of the National Union of Rail, Maritime and Transport Workers Union (UK), 

further corroborated the transparency of the UK’s offshore regulator, explaining the benefits of open, 

public and transparent safety information that he has observed over the course of his career in the UK 

offshore industry since the HSE initiated “Key Programmes.” Malloy explained that Key Programme 1 

(KP1), “Reducing Hydrocarbon Releases,” was accompanied by publicly available results and other 

information relative to actions by North Sea operators and the regulator. Malloy noted that “since KP1 

was launched the industry has been pro-active in setting its own targets for leak reduction.” In addition, 

industry publishes details of the leaks, including volumes, locations, and operators as part of their own 

initiative to reduce leaks still further through sharing and learnings.”443 Malloy attributed this improved 

performance to the general availability of the information explaining, “KP1 was launched publicly, 

meaning workers and moreover the press had the ability to report and monitor performance. In short, it is 

transparent and subject to public and governmental scrutiny.”444

Some of Australia’s safety regulators provide the public with summaries of safety case documentation 

produced by the duty holders.445 NOPSEMA, Australia’s federal safety regulator, offers public access to a 

host of safety-related information, including monthly newsletters containing data on inspections and 

incidents, aggregated safety statistics, drilling guidance, and brochures on process safety.446 For instance, 

NOPSEMA publishes guidance on elements of a safety case report, including hazard identification with 

assistance on selecting a hazard identification technique.447

The Nuclear Regulatory Commission provides a positive example of using transparency to drive safety 

improvement. Testifying before the CSB, John Lubinski, Director of the Division of Inspection and 

Regional Support, Office of Nuclear Reactor Regulation, explained: 

Yes, we believe [public reporting] does [influence safety] as far as impacting the performance. 

Under the old system ... [w]hen we had findings or we had people that were outside of a key 

performance indicator, we could take enforcement action issuing citations, issuing monetary civil 

 

443 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Jake Malloy, 

Safety Performance Indicators, The Workforce Perspective; 2012; 

http://www.csb.gov/UserFiles/file/Molloy%20%28RMT%29%20Testimony.pdf (accessed March 26, 2016).

444 Ibid. 

445 See WorkSafe Victoria, Guidance Note: Overview of the Safety Case regime for a Major Hazard Facility; p 14. 

“The local community must be provided with certain information, including a summary of the Safety Case,” 

http://www.worksafe.vic.gov.au/__data/assets/pdf_file/0015/12381/50712_WS_3_Safety_Case_OV_5HR.pdf,

(accessed March 26, 2016). Examples Safety Case Summaries can be found at: 

http://www.exxonmobil.com/Australia-English/PA/Files/publication_safetycase_altonaref.pdf; and 

http://www.exxonmobil.com/Australia-English/PA/Files/publication_Longford_Safety_Case_2013.pdf (accessed 

March 26, 2016). 

446 IRF. Member Country Profile—Australia, http://www.irfoffshoresafety.com/country/Australia.aspx (accessed 

March 26, 2016).

447 NOPSEMA. Guidance Note: Hazard Identification; N- 04300-GN0107, Rev. 5; December, 2012; 

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0107-Hazard-Identification.pdf (accessed March 

26, 2016).

001028
Macondo Investigation Report Volume 4 4/17/2016

93 

penalties. What we found is this is actually a more risk informed and also a benefit from the 

standpoint of moving forward to increasing performance. Number one is it focuses the licensee's 

effort and the NRC inspection efforts in the correct area. But, number two is because all of the 

information is made public, not just when a bad event occurs at a plant, all the information. It 

requires all the licensees to look at it and say “how are we being publicized on the NRC 

website?” The performance indicators are not a report card; however, they are information. And 

we think that information being available, not only does it have the licensees more accountable 

for safety but it also has us as the regulator more accountable. When the public is looking at this 

website and saying how can you have a plant that has white performance indicators, yellow 

findings and you're still letting them operate, what is your technical basis for doing that? So it 

holds us accountable in being able to describe what the safety performance is of that plant. So, 

that's where we see the benefits to making all this information available to the public. The final 

[reason] is just the fact that from our standpoint we believe in open and transparent regulation and 

we want the people in the community to understand what the hazards are associated with the plant 

and what the safety implications are of any activities that are occurring. 448

In addition to boosting public goodwill for a high-hazard industry, transparency provides a tangible safety 

benefit: deterrence. Public scrutiny can be a significant deterrent against bad practices in offshore 

operations through publications, discussions, and political pressure.449 The Environmental Protection 

Agency (EPA) enforces anti-pollution laws and makes them public. Former EPA Administrator William 

Reilly recently noted, “I see no reason not to publicize these violations,” Reilly explained during his 

investigation of the Macondo incident for a Presidential Commission.450

Further elaborating on the desirability of publicly available safety information, Lois Epstein, Engineer 

and Arctic Program Director for The Wilderness Society, explained, “the public interest community 

strongly supports making operator-specific data publicly available with shielding of company names kept 

to a minimum and only with a very strong justification. Sunshine451 improves the quality and increases 

the learning opportunities associated with accident prevention data. Potential litigation should not be a 

reason to withhold data, as litigation will occur regardless.”452 

Complete transparency is not necessary. For instance, the UK does not require that an operation’s safety 

case be made publicly available.453 In contrast, certain states and territories of Australia make safety case 

 

448 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of John W. 

Lubinski, Questions & Answers by CSB Board, Staff and Public, p 94, 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

449 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Jake Malloy, 

Safety Performance Indicators, The Workforce Perspective, pp 139-40, 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed October 7, 2015).

450 Dlouhy, J. After spill, offshore enforcement remains murky. Fuel Fix from the Houston Chronicle, December 12, 

2012, http://fuelfix.com/blog/2012/12/12/after-spill-offshore-enforcement-remains-murky / (accessed March 26, 

2016).

451 “Sunshine” refers to openness or transparency in matters of public importance, relating back to a famous quote 

from former US Supreme Court Justice Brandeis. "Publicity is justly commended as a remedy for social and 

industrial diseases. Sunlight is said to be the best of disinfectants; electric light the most efficient policeman."

452 CSB Public Hearing: Safety Performance Indicators, Houston, TX, July 23-24, 2012; testimony of Lois N. 

Epstein, Safety Performance Indicators, p 152, http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf 

(accessed October 7, 2015).

453 CSB UK trip notes, March 6 & 7, 2014. 

001029
Macondo Investigation Report Volume 4 4/17/2016

94 

summaries publicly available. There are also limits on disclosing some information due to commercial 

sensitivity (e.g., trade secrets, confidential business information) that provides a competitive advantage in 

a challenging sector of the economy, as well as physical security issues, among other concerns. 

Companies must strike a balance between disclosing all relevant information and protecting information 

not appropriate for disclosure. Yet global experience suggests that an effective offshore regulatory regime 

will seek opportunities to use transparency to drive continual safety improvements.

001030
Macondo Investigation Report Volume 4 4/17/2016

95 

5.0 Insufficient and Inadequate Staff for Appropriate 

Oversight

BSEE’s ability to regulate safety is contingent upon adequate numbers of staff with multifaceted 

competencies in not only technical disciplines, but human and organizational factors, communication and 

interpersonal skills such as negotiation, persuasion and advocacy, and process safety, among others. 

These skill sets provide inspectors with the tools to conduct effective preventive audits and inspections, 

and to regularly engage with duty holders. To date, the staffing changes in BSEE have not fully met these 

requirements. Congress has not appropriated sufficient funding on an ongoing and consistent basis for 

BSEE to meet such staffing needs, and along with these constraints, continuing conflicts between political 

and legislative priorities are structural impediments to BSEE’s ability to fulfill its difficult mission. The 

Department of Interior has confronted this issue recently, noting that continuing resolutions and a 

sequester of 5 percent in fiscal years 2013 and 2014 significantly impacted the Department’s agencies, 

requiring a hiring freeze and reducing funding for staffing and oil and gas activities.454 

To ensure that companies are managing major hazard risks and employing the best available standards 

and technology effectively, the regulator must hire and retain knowledgeable and skilled staff who can 

critically assess company safety practices. The CSB discusses in the Chevron Regulatory Report the 

importance of having a well-funded, technically competent regulator that has the ability to conduct 

proactive, preventive inspections. To operate a robust performance-based regulatory regime in which the 

regulator directly oversees and evaluates total safety performance of the industry, BSEE’s enhanced 

recruiting, hiring, and retention efforts must continue and must include senior specialists with experience 

in areas such as petroleum engineering, process safety, human factors, and organizational performance.

5.1 Models for Building a Competent Regulator

The UK and other US safety regulators, particularly in the nuclear sector, use effective methods for 

recruiting, training, and retaining highly proficient staff that could help inform BSEE efforts. 

5.1.1 UK Offshore Safety Directive Regulator 

The UK Offshore Safety Directive Regulator (OSDR) is part of the UK Health and Safety Executive 

(HSE). It provides detailed guidance for companies, inspectors, and the public on how the regulator 

assesses companies’ plans to reduce major accident hazards.455 It published pamphlets and handbooks, 

geared toward duty holders, on offshore topics ranging from corrosion to human factors to process 

integrity. The “Assessment Principles for Offshore Safety Cases” is an agreed framework for inspector 

conduct during the offshore assessment process.456 Those principles emerge from the definitive, 300+ 

 

454 US Covernment Accountability Office. Report to Congressional Requesters. Oil and Gas: Interior Has Begun to 

Address Hiring and Retention Challenges but Needs to Do More; US Government Accountability Office: January, 

2014; p 77; http://www.gao.gov/assets/670/661025.pdf (accessed March 26, 2016). 

455 UK HSE, Guidance, http://www.hse.gov.uk/offshore/safetycases.htm (accessed March 26, 2016). 

456 UK HSE. Assessment Principles for Offshore Safety Cases (APOSC); March, 2006; 

http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed March 26, 2016). 

001031
Macondo Investigation Report Volume 4 4/17/2016

96 

page inspector’s manual, Guidance for the Topic Assessment of the Major Accident Hazard Aspects of 

Safety Cases (GASCET).457

The OSDR can hire competent personnel to develop guidance and perform safety case reviews because it 

is authorized to pay offshore staff higher specialist salaries. Offshore assessor work involves time away 

from family in uncomfortable conditions. To incentivize it, most mid-level OSDR technical staff were 

paid between £67,213 and £77,499 in 2012, the equivalent of $109,241 to $125,959.458 Specialist staff in 

Aberdeen receive a location enhancement on top of these “standard” pay scales that enables HSE to 

recruit to that location and compete with the oil industry. The enhancement is currently £10,000 

(approximately $15,600). These salaries are significantly higher than their onshore inspector counterparts, 

whose mid-level salaries ranged from £37,303 to £46,937 in 2012, the equivalent of $60,628 to $76,286.

Former UK Offshore regulatory staff reported that the OSDR looks for new recruits with good 

communication skills in addition to relevant education, licensure, and experience because their job 

requires getting companies to aspire to make safety improvements that the companies may not want to 

do.459 Once on board, new recruits directly from industry undertake a rigorous regulator training program 

during their first two years, including significant on-the-job training.460 They are required to take a series 

of courses and related assessments, and they may be fired if they do not pass the assessments.461 At the 

same time, new inspectors receive training by working alongside more experienced inspectors on safety 

case procedures, technical assessment procedures (such as electrical and mechanical safety), audit and 

regulatory intervention activities.462 For inspectors who have a primary interface role with offshore 

companies, OSDR aims to rotate them to different companies every two to three years to avoid the 

inspectors becoming too comfortable with their surroundings.463 One message that UK offshore industry 

and regulatory staff repeated to CSB investigators is that the industry believes having proficient 

regulatory staff adds significant value to their business.464 Professional proficiency, as well as technical 

and risk management acumen, allow regulatory staff the wherewithal to pushback against industry claims, 

should that be necessary.

465 This competence is also essential for companies’ confidence in the accuracy 

of the regulatory staff’s advice, inspections, and citations. 

 

457 HSE. (http://webcommunities.hse.gov.uk/connect.ti/gascet/view?objectId=62036 (accessed March 2, 2016). 

458 In contrast, BSEE pays mid-level petroleum engineers somewhere between $62,000 and $84,000 per year. 

https://www.usajobs.gov/GetJob/ViewDetails/341573400 (accessed March 26, 2016). 

459 Whewell, I. Former Director, UK HSE Offshore Division, and Wilkinson, P. principal “architect” for the 

development of Australia’s National Offshore Petroleum Safety Authority, (NOPSA), Personal communication, 

July 11, 2011.

460 Ibid. 

461 Ibid.

462 Ibid.

463 Ibid.

464 Ibid.

465 Wilkinson, P. Australia Department of Industry, Tourism and Resources, Presentation to the National Research 

Centre for Occupational Health and Safety; May 15, 2002.

001032
Macondo Investigation Report Volume 4 4/17/2016

97 

5.1.2 US Government Incentives to Build Competent Staff 

The federal government has used extensive resources to retain the best available talent to focus on health 

and safety oversight of US commercial and defense nuclear facilities.466 Many nonsupervisory technical 

staff at the US Nuclear Regulatory Commission (NRC)467 and the Defense Nuclear Facilities Safety 

Board (DNFSB) are paid at the top of the General Schedule.468 Virtually all technical staff at the DNFSB 

hold technical master’s degrees, and approximately 25 percent hold doctorates.469 

The US government has a unique category of non-executive positions, Scientific or Professional,470 which 

involve high-level research and development in the physical, biological, medical, or engineering sciences, 

or a closely related field.471 These positions are classified above the highest general schedule pay level. 

These special salary authorizations contribute to the ability of technical agencies to compete with private 

industry in recruiting and retaining highly proficient staff. 

The NRC’s extensive training programs also help attract and retain competent technical staff. For new 

inspection staff, the NRC requires a series of courses, assessments, and simulations, all of which take 

approximately two years to complete.472 Inspectors must have a bachelor’s degree in engineering or a 

degree in a relevant scientific field and Professional Engineer certification.473 The agency operates a 

technical training center in Chattanooga, Tennessee, with various control room simulators that mirror 

licensees’ facilities. NRC staff are expected to understand how this equipment operates so that they can

conduct audits and investigations.474 Before they are deemed qualified to inspect, inspector candidates 

must be recommended by the NRC inspector qualification board and certified by the regional 

administrator or division director.475

 

466 FY 2013 Budget Request to the Congress; Defense Nuclear Factilities Safety Board: 2012; pp 1-3; 

http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FI

NAL.PDF (accessed March 26, 2016). 

467 Presentation by NRC Executive Director Bill Borchardt to CSB, January 2011.

468 $123,758 to $155,500 per year in 2012 in Washington, DC.; OPM. Pay & Leave, Salaries & Wages, 

https://www.opm.gov/oca/12tables/html/dcb.asp (accessed March 26, 2016). 

469 FY 2013 Budget Request to the Congress; Defense Nuclear Factilities Safety Board: 2012; p 7; 

http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FI

NAL.PDF (accessed March 26, 2016).

470 See, e.g., 5 C.F.R. § 319.103. This category covers non-executive positions classified above the GS-15 level. See 

https://www.opm.gov/policy-data-oversight/senior-executive-service/scientific-senior-level-positions/ (accessed 

January 7, 2016). 

471 OPM. Senior Executive Service, http://www.opm.gov/ses/recruitment/stpositions.asp (accessed March 26, 2016). 

472 NRC. NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245); 2011; p 4; 

http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed March 26, 2016). 

473 NRC Reactor Inspector Job Posting No. R-I/DRS-2013-0001.

474 See, e.g., IAEA. NS Tutorial, http://www.iaea.org/ns/tutorials/regcontrol/regbody/reg2124.htm (accessed March 

26, 2016). 

475 NRC. NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245); 2011; ; 

http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed March 26, 2016).

001033
Macondo Investigation Report Volume 4 4/17/2016

98 

5.2 Disproportionate Regulator Resources for Gulf of Mexico 

Offshore Activity

Historically, the number of MMS employees working on permitting, permit modifications, and 

inspections did not increase proportionally to the increase in production—in fact, those staff numbers 

decreased by 36 percent between 1983 and 2010.476 Meanwhile, MMS found that OCS leasing 

experienced a 200 percent increase, and oil production increased by 185 percent between 1982 and 

2007.477 In addition, an internal MMS report issued a few months after the Macondo incident put it more 

bluntly: the Gulf of Mexico district offices did not have enough engineers to conduct permit reviews, and 

they had only about 55 inspectors for 3,000 facilities.478

Following these reports and associated recommendations to increase hiring,479 BSEE stated that it 

intended to triple the number of inspectors in the Gulf of Mexico,480 but hiring efforts initially focused on 

recent graduates, who lacked relevant professional experience. Former-Director [of BOEMRE] Bromwich 

began the hiring effort by visiting several universities with petroleum engineering departments to entice 

new graduates to work for the offshore regulator.481 The agency also sought recently retired petroleum 

engineers to work temporarily until permanent hires could join, but several potential applicants lost 

interest when they saw that the starting salaries were significantly lower than what industry offered for 

similar work.482 In March 2012, former BSEE Director Watson stated to Congress that the agency 

increased inspector hiring by 50 percent since April 2010, but engineers hiring had only increased by ten 

percent.483 Watson later explained that BSEE intended to hire another 200 people to conduct permit and 

spill response plan reviews, inspect offshore facilities, and ensure environmental compliance.484 He added 

 

476 Lewis, W.; Kendall, M.; Suh, R. U.S. Department of the Interior Outer Continental Shelf Safety Oversight Board 

Report to the Secretary of the Interior Ken Salazar ; US Department of the Interior: September 1, 2010; p 6 and 

13; http://www.noia.org/wp-content/uploads/2015/12/DOI-OCS-Safety-Oversight-Board-Report.pdf (accessed 

March 26, 2016).

477 Ibid., p 13. 

478 The report highlighted a 71% increase in permit modification applications in the New Orleans District in 2009; 

Ibid., p 6.

479 See, e.g., National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deepwater: The 

Gulf Oil Disaster and the Future of Offshore Drilling - Report to the President; Janurary, 2011; p 256, 

Recommendation A5. 

480 Budget Justifications and Performance Information Fiscal Year 2013; US Department of the Interior: 2012; p 30; 

http://www.bsee.gov/About-BSEE/Budget/FY2013BudgetJustification/ (accessed March 26, 2016).

481 Snow, N. BOEMRE seeks recently retired petroleum engineers, Bromwich says. Oil & Gas Journal, April 22, 

2011, http://www.ogj.com/articles/2011/04/boemre-seeks-recently.html (accessed March 26, 2016). 

482 Ibid. 

483 Watson, J. Statement of James Watson, Director Bureau of Safety and Environmental Enforcement United States 

Department of the Interior Committee on Appropriations Subcommittee on Interior, Environment and Related 

Agencies House of Representatives; March 7, 2012; 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Congressional_Testimony/Congressional%20Testimony%2

020120307.pdf (accessed March 26, 2013). 

484 Dittrick, P. OTC: BSEE director calls for industry to promote safety culture. Oil & Gas Journal, May 1, 2012, 

http://www.ogj.com/articles/2012/05/otc-bsee-director-calls-for-industry-to-promote-safety-culture.html

(accessed March 26, 2016). 

001034
Macondo Investigation Report Volume 4 4/17/2016

99 

there was “still a considerable amount of positions yet to be filled, including additional inspectors, 

engineers, regulatory specialists, environmental specialists, and other critical disciplines.”485 

BSEE stated in its 2014 annual report that the Bureau hired 88 personnel in 2014, a net gain of 9 fulltime-equivalent employees, and 56 of the 88 newly hired personnel were from critical scientific, 

inspection, and engineering fields. 486 BSEE noted in the report that it will maintain its long-term focus on 

growing its workforce by attracting the top talent available to fill the agency’s ranks.487 In April 2015, 

BSEE reported that the number of inspectors in the Gulf of Mexico OCS region increased from 55 in 

April 2010 to 92 (as of April 20, 2015).488 Additionally, the number of engineers in the BSEE workforce 

increased from 106 in October 2011 to 129 in April 2015.489 Despite the challenges, BSEE made 

progress. 

In 2015, BSEE received authorization to offer new recruits a salary incentive of 25% above base pay.490

The purpose of this authorization was to help BSEE better compete with the private sector, which is not 

bound by the federal government’s salary and retention rules;491 however, the authorization brought entrylevel starting salaries up to only approximately $40,000, nowhere near equivalent to private industry 

offerings for equivalent jobs, which average $80,849.492 Also, this authorization focused exclusively on 

geophysicists, geologists and petroleum engineering positions, but did not incentivize hiring specialists 

with other critical professional backgrounds such as environmental science, human factors, psychology, 

toxicology, or other complementary engineering disciplines relevant to offshore exploration, drilling and 

production. More remains to be done to help BSEE attract and retain the staff needed to execute its 

important mission. 

 

485 Watson, J. Statement of James Watson, Director Bureau of Safety and Environmental Enforcement United States 

Department of the Interior Committee on Appropriations Subcommittee on Interior, Environment and Related 

Agencies House of Representatives; March 7, 2012; 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Congressional_Testimony/Congressional%20Testimony%2

020120307.pdf (accessed March 26, 2013). 

486 BSEE. 2014 Annual Report. May 5, 2015; p 13. 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Publications_Library/Annual_Report/BSEE%20201

4%20Annual%20Report.pdf (accessed December 21, 2015). 

487 Ibid., p 3. 

488 BSEE and BOEM. Reforms since the Deepwater Horizon Tragedy; 

http://www.eenews.net/assets/2015/04/16/document_gw_03.pdf (accessed March 26, 2016). 

489 Ibid. 

490 BSEE. Understanding the Special Salary Rate for Certain Geologist, Geophysicist, and Petroleum Engineer 

Positions in the BSEE and BOEM Gulf of Mexico Region; p 1. 

http://www.boem.gov/uploadedFiles/BOEM/About_BOEM/Jobs/FAQs_BOEM-PayTables.pdf (accessed 

December 21, 2015). 

491 BSEE. Director’s Corner, August 27, 2014, http://www.bsee.gov/safety/directorscorner/ (accessed March 26, 

2015).

492 BSEE starting salaries for entry level petroleum engineers range from $35,657.00 to $56,859.00. See BSEE 

position announcement for Petroleum Engineer, GS-0881-05/07, 

https://www.usajobs.gov/GetJob/ViewDetails/331348800. Meanwhile, the median salary for a highly recruited 

petroleum engineer in the private sector is $127,970, with average starting salaries around $80,000. See, e.g., 

http://www.reuters.com/article/2012/01/18/us-energy-jobs-idUSTRE80H1GQ20120118; 

http://www.forbes.com/pictures/efkk45eghj/1-petroleum-engineering/ (accessed March 26, 2015). 

001035
Macondo Investigation Report Volume 4 4/17/2016

100 

Unfortunately, a 2014 report published by the US Government Accountability Office (GAO) found that 

the actual pay increase provided to support BSEE’s hiring initiative was lower than the 25 percent target 

envisioned because the increase did not include locality pay.493 The report also found that US Department 

of Interior oil and gas departments, such as BSEE and BOEM, continue to struggle hiring and retaining 

 

493 US Covernment Accountability Office. Report to Congressional Requesters. Oil and Gas: Interior Has Begun to 

Address Hiring and Retention Challenges but Needs to Do More; US Government Accountability Office: January, 

2014; pp 22-23; http://www.gao.gov/assets/670/661025.pdf (accessed March 26, 2016). 

The BSEE salary incentive allows for only 25% more than a new hire’s base pay, not 

above the locality pay. Locality pay is a supplemental pay amount added to account 

for regional differences in cost of living, among other factors.a The specific duty 

locations that can offer this special pay rate in the Gulf of Mexico Region are 

Jefferson, Lafayette, Lake Charles, and Houma, Louisiana.b Although the Lake 

Jackson, Texas, District Office is part of the Gulf of Mexico Region, its basic pay plus 

locality pay is higher than the 25 percent allotted by Congress, so employees of that 

office cannot receive this supplemental pay.c

 

For instance, a new graduate hired for a petroleum engineer position at general 

schedule Grade 7, step 5 in Jefferson County, Louisiana would receive a base salary 

of $38,511 per year in 2012.d Even without the special authority, he or she would 

automatically receive the locality pay increase for that area, which means the salary 

would actually be $43,964 per year.e BSEE’s incentive authority would permit an 

increase of up to 25 percent of base salary, or $9,628, for a total salary of $48,138 

per year. If the engineer were hired for the Lake Jackson, Texas, District Office, he or 

she would not get the bonus pay, because the locality-adjusted salary of $49,568 per 

yearf

 is already more than the 25 percent bonus. In effect, this special pay authority is 

able to bring only the other Gulf of Mexico district office salaries for geophysicists, 

geologists, and petroleum engineers closer to their peers’ salaries in Lake Jackson. 

 a OPM. Pay & Leave, Salaries & Wages, http://www.opm.gov/oca/payrates/LPA.asp (accessed March 

 26, 2015). b BSEE. Understanding the Special Salary Rate for Certain Geologist, Geophysicist, and Petroleum 

 Engineer Positions in the BSEE and BOEM Gulf of Mexico Region; p 1. 

 http://www.boem.gov/uploadedFiles/BOEM/About_BOEM/Jobs/FAQs_BOEM-PayTables.pdf 

 (accessed December 21, 2015). c Ibid. d For an example, see BSEE position announcement for Petroleum Engineer, GS-0881-05/07, 

 https://www.usajobs.gov/GetJob/ViewDetails/331348800 http://www.opm.gov/oca/payrates/LPA.asp; 

 OPM. Pay & Leave, Salaries & Wages, http://www.opm.gov/oca/payrates/LPA.asp (accessed March 

 26, 2015). e OPM. Pay & Leave, Salaries & Wages, http://www.opm.gov/oca/payrates/LPA.asp (accessed March 

 26, 2015). f Ibid.

001036
Macondo Investigation Report Volume 4 4/17/2016

101 

key oil and gas oversight positions, including inspectors and petroleum engineers.494 The report attributes 

this difficulty to competitive oil and gas industry salaries and signing bonuses for new hires,495 although 

low oil and natural gas prices in recent quarters started to impact this dynamic. The report also stated that 

these challenges have resulted in less time available for oil and gas oversight activities, including 

inspections. Surveys conducted by GAO showed that the number and thoroughness of inspections were 

“somewhat or greatly reduced because of ... vacancies.”496 To compound the problem, the report noted 

that a “high proportion of staff in key oil and gas positions ... will be eligible to retire within a few 

years.”497 GAO analysis found that roughly 35 percent of BSEE’s petroleum engineers would be eligible 

to retire by 2017 compared with a government-side average of 27.5 percent for all federal employees 

during the same period.498

BSEE staff has to cover three geographical regions (Alaska, GoM, and the Pacific), and the GoM alone 

has 2,481 active platforms, with 329 new wells drilled during 2014, and 133 designated operators.499

Thus, total staffing resources leveraged against the current GoM assets and accompanying drilling and 

production activity, supports the agency’s human capital aspirations “to meet the consistent challenge of 

recruiting and retaining top talent.”500 With its efforts in place, BSEE may be able to take advantage of 

macroeconomic conditions and the current low prices of oil and natural gas which are driving down GoM 

activity and job cuts in the industry.

501 It is only a matter of time, however, before the trend reverses, 

therefore BSEE needs to remain ready for these cycles.

5.3 The Deficit in Regulator Technical Competency and Credibility 

Earlier reports on the Macondo incident, such as the Presidential Oil Spill Commission Report502 and 

MMS’s own report,503 explained MMS permit reviewers and inspectors historically lack technical 

competency, noting that it struggled to retain competent staff. In the version of the proposed SEMS rule 

 

494 Ibid., p 14. 

495 Ibid., p 19. 

496 Ibid., pp 31-32. 

497 Ibid. p 17. 

498 Ibid., p 17 

499 BSEE. 2014 Annual Report. May 5, 2015; p 8. 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Publications_Library/Annual_Report/BSEE%20201

4%20Annual%20Report.pdf (accessed December 21, 2015). 

500 Ibid., p 13.

501 As of April 1, 2016, the total number of active rigs in the US dropped by 545; Baker Hughes. Rig Count 

Overview & Summary Count, http://phx.corporate-ir.net/phoenix.zhtml?c=79687&p=irol-rigcountsoverview; and 

Reed, S. Stung by Low Oil Prices, BP Will Cut 4,000 Jobs. January 12, 2016, 

http://www.nytimes.com/2016/01/13/business/energy-environment/bp-jobs-oil-prices.html (accessed March 26, 

2016).

502 See e.g., National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deepwater: The 

Gulf Oil Disaster and the Future of Offshore Drilling - Report to the President; Janurary, 2011; p 74.

503 Lewis, W.; Kendall, M.; Suh, R. U.S. Department of the Interior Outer Continental Shelf Safety Oversight Board 

Report to the Secretary of the Interior Ken Salazar ; US Department of the Interior: September 1, 2010; pp 13-16; 

http://www.noia.org/wp-content/uploads/2015/12/DOI-OCS-Safety-Oversight-Board-Report.pdf (accessed March 

26, 2016).

001037
Macondo Investigation Report Volume 4 4/17/2016

102 

issued the year before the Macondo incident, MMS noted that most comments received in response to the 

2006 advanced notice of proposed rulemaking expressed that API RP 75 provided excellent guidance, but 

that MMS should not approve SEMS plans, “rather, a third party should determine or certify whether a 

SEMS plan is viable, because MMS may not have the resources and expertise to approve a minimum of 

one plan for each OCS operator.”504 MMS’s inadequate budget and conflicting missions resulted in 

serious management deficiencies and a pervasive culture of deference to the offshore industry for 

guidance on reviews and inspections at the time of the Macondo incident.505 

5.4 Post-Macondo Efforts to Improve Competency

BSEE has been working to correct many of the deficiencies in MMS’s recruitment and training programs 

for offshore inspectors and investigators. In March 2010, it issued an internal handbook to improve the 

conduct of internal investigations, but it did not significantly change the basic protocol or management 

responsibilities outlined in an earlier manual.506 More importantly, it did not provide special procedures 

for conducting catastrophic or serious accident investigations, nor did it contain a protocol for evidence 

gathering.507 

To improve training at the agency, BSEE opened its virtual National Offshore Training Center in 2011.508 

According to BSEE, agency staff logged more than 10,000 hours of technical and safety training in FY 

2012,509 and 38 staff attended a two-week boot camp in petroleum geology, drilling engineering, 

production engineering and permitting, with lectures by college professors complemented by hands-on 

exposure to equipment in August 2012.510 Additionally, BSEE Director Salerno recently stated that the 

National Offshore Training Program grew in FY 2014, offering 79 technical courses, an increase of 29 

courses over FY 2013.511 The BSEE 2014 Annual Report noted the agency remains committed to 

employee development and that in calendar year 2014, BSEE offered 105 training courses with 145 

 

504 Safety and Environmental Management Systems for Outer Continental Shelf Oil and Gas Operations, 74 Fed. 

Reg. 28639 (Proposed, June 17, 2009).

505 Forty-two percent of inspectors interviewed for the Safety Oversight Board’s Report to Secretary Salazar stated 

that “headquarters management does not provide sufficient direction and support;” Lewis, W.; Kendall, M.; Suh, 

R. U.S. Department of the Interior Outer Continental Shelf Safety Oversight Board Report to the Secretary of the 

Interior Ken Salazar ; US Department of the Interior: September 1, 2010; p 15; http://www.noia.org/wpcontent/uploads/2015/12/DOI-OCS-Safety-Oversight-Board-Report.pdf (accessed March 26, 2016). 

506 Ibid., p 22.

507 Ibid., p 22.

508 BSEE. BSEE Director Delivers Remarks at the International Regulators Forum 2011 Global Offshore Safety 

Summit Conference. October 4, 2011, http://www.bsee.gov/BSEE-Newsroom/Press-Releases/2011/BSEEDirector-Delivers-Remarks-at-the-International-Regulators-Forum-2011-Global-Offshore-Safety-SummitConference/ (accessed March 26, 2016). 

509 Dlouhy, J. Tougher offshore scrutiny? Not yet. Fuel Fix from the Houston Chronicle, December 13, 2012, 

http://fuelfix.com/blog/2012/12/13/tougher-offshore-scrutiny-not-yet/ (accessed March 26, 2016).

510 Ibid. 

511 BSEE. The National Offshore Training Program Shows Continued Growth in 2014: Remains a Priority for 

BSEE Moving Forward. October 28, 2014, http://www.bsee.gov/BSEE-Newsroom/BSEE-News-Briefs/2014/TheNational-Offshore-Training-Program-Shows-Continued-Growth-in-2014/ (accessed December 9, 2014). 

001038
Macondo Investigation Report Volume 4 4/17/2016

103 

engineers attending an average of three classes each, and 124 inspectors attending an average of 

approximately four classes each, for a total of 24,486 training hours conducted.512 

Additional insights into BSEE’s intentions to equip its staff with needed skills appear in the 2014 US

Department of the Interior Office of Inspector General (IG) Report on Offshore Oil and Gas 

Permitting.

513 According to the report, BSEE issued an internal policy document in spring 2013, Training 

Requirements for Engineers, which requires all engineers to complete at least 32 hours of approved 

technical training annually and newly hired engineers with fewer than 3 years of oil and gas engineering 

experience to complete BSEE’s engineering boot camp or a similar program.514 The report found that 

BSEE did not “effectively or efficiently” implement that policy, and “did not ensure that all employees 

were aware of the new requirement.”515 As a result, the IG recommended that BSEE “document that all 

permitting employees are aware of IPD [Interim Policy Document] requirements; and monitor and track 

all training to ensure that training requirements, including training hours, are met and that all training is 

recorded.”516 BSEE stated in its response that in April 2014, it finalized a mandatory online training 

awareness module, that by August 29, 2014, “more than 94 percent of BSEE engineers had completed 

their fiscal year 2014 training requirements ... [and that] by January 1, 2015, BSEE will ensure that all 

technical courses offered in FY15 will have the training hours listed on the engineer’s transcript, as well 

as the class completion certificate.”517 

In addition to needing technical competency, inspectors must have excellent communication, advocacy, 

and negotiation skills. Hiring and developing regulatory personnel with a full range of skill sets is 

essential to help build a knowledgeable, credible regulator who can recognize deficiencies and engage 

with operators to develop appropriate risk-reduction strategies and persuade them to make changes when 

necessary.

518 

5.5 Insufficient Regulatory Funding Mechanism for Securing Staff 

At the time of the Macondo incident, the US offshore safety regulator did not have sufficient, sustainable 

funding to manage major accident prevention activities. To drive continual improvement in the offshore 

industry and hire and retain sufficient competent staff, the offshore regulator needs adequate and 

sustainable funding. Insufficient funding is often cited as the main reason that MMS was unable to hire 

 

512 BSEE. 2014 Annual Report. May 5, 2015; p 13. 

http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Publications_Library/Annual_Report/BSEE%20201

4%20Annual%20Report.pdf (accessed December 21, 2015). 

513 IG. Offshore Oil and Gas Permitting US Department of the Interior; Report No. CR-EV-BSEE-0006-2013; 

September, 2014; https://www.doioig.gov/sites/doioig.gov/files/CR-EV-BSEE-0006-2013Public.pdf (accessed 

March 26, 2016). 

514 Ibid., p 12. 

515 Ibid., p 1. 

516 Ibid., p 13. 

517 Ibid., p 18. 

518 Wilkinson, P. Creating a New Offshore Petroleum Safety Regulator, Presentation to IADC, Australian Petroleum 

Production & Exploration Association Conference, March 25, 2003; p 6 

http://www.nopsema.gov.au/assets/document/IADC-Annual-General-Meeting.pdf (accessed March 26, 2016). 

001039
Macondo Investigation Report Volume 4 4/17/2016

104 

and retain sufficient staff or to adequately oversee deepwater drilling.519 Beginning in 2011, BSEE 

received a sizeable budget increase; however, this funding is by congressional appropriations that may 

(and likely will) vary from year to year. Other offshore regimes ensure the regulator is funded at variable 

but appropriate levels through an industry self-funding or “cost recovery” mechanism. As offshore 

activities increase or decrease, so too does the regulator funding to ensure adequate resources for 

regulatory oversight.

5.5.1 Ineffectual Funding Appropriations for Offshore Activity 

As offshore drilling activities increase and expand into deeper and riskier waters, the need for a stronger, 

more effective offshore regulator becomes greater.

520 Adequate and sustainable funding is a necessary 

attribute of a competent regulator.521 One way to ensure consistent funding in the appropriation process is 

to provide agencies with an independent funding mechanism.522 An independent funding mechanism 

based on the number and type of active offshore sites renders a straightforward means of ensuring 

sufficient funding. When offshore operations decline, the overall level of risk that the industry assumes 

declines, and so too would the funding. 

As a component of the Department of the Interior, MMS was, and BSEE is, appropriated funding by 

Congress through the General Fund.523 Each year, the agency sends a budget justification and request to 

its appropriators in Congress, whose jurisdiction extends to the rest of the Department of the Interior, the 

Environmental Protection Agency, and several smaller independent agencies.524 The appropriators then 

determine the size of each agency’s annual budget. In March 2012, former BSEE Director Watson 

attributed recent regulatory action and increased hiring of inspectors partly to the budget increase that 

Congress provided.525 By spring 2012, however, Interior officials expressed concern to the Government 

Accountability Office that current and future budgetary constraints may prevent BSEE from fully 

implementing reforms as planned, and that this would handicap BSEE’s ability to manage oil and gas 

 

519 MMS’s inability to keep up with technological advances was made more problematic because its level of funding 

and technical staffing remained static or decreased as industry’s offshore drilling activity increased; National 

Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deepwater: The Gulf Oil Disaster and 

the Future of Offshore Drilling - Report to the President; Janurary, 2011; p 72. 

520 “Interior’s capacity to identify and evaluate risk remains limited, raising questions about the effectiveness with 

which it allocates its oversight resources;” US Government Accountability Office. Oil and Gas Management: 

Interior’s Reorganization Complete, but Challenges Remain in Implementing New Requirements; GAO-12-423; 

July 30, 2012; p 106. http://www.gao.gov/assets/600/593110.pdf (accessed March 26, 2016).

521 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, A Competent and Nimble 

Regulator: A New Approach to Risk Assessment and Management, Staff Working Paper No. 21.

522 Barkow, R. Insulating agencies: avoiding capture through institutional design, Texas Law Review, 89, 2010, p 15,

44. 146-47. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1717037. 

523 The General Fund is the US Treasury account that appropriates funds to most federal agencies.

524 US House of Representative Committee on Appropriations. Interior Subcommittee Jurisdiction, 

http://appropriations.house.gov/about/jurisdiction/interiorenvironment.htm (accessed March 26, 2016).

525 Watson, J. Statement of James Watson, Director Bureau of Safety and Environmental Enforcement United States 

Department of the Interior Committee on Appropriations Subcommittee on Interior, Environment and Related 

Agencies House of Representatives; March 7, 2012; 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Congressional_Testimony/Congressional%20Testimony%2

020120307.pdf (accessed March 26, 2013). 

001040
Macondo Investigation Report Volume 4 4/17/2016

105 

activities in the Gulf of Mexico.526 BSEE officials from the Gulf of Mexico regional office said that they 

could not reliably anticipate budget increases for new hiring and helicopter operating costs.527 This budget 

uncertainty, the officials explained, hindered BSEE’s ability to review permits and conduct inspections.528 

The fiscal year 2012 appropriations bill, passed in March 2012, included a line item for inspection fees of 

$62 million,529 which BSEE officials agreed would cover most of the resources needed to increase 

BSEE’s inspection and permitting capacity for that year.530 In a given year, fees for inspections and 

additional offsetting collections can comprise a portion of BSEE’s operating costs, and they are 

subtracted from the appropriated budget.531 Despite the increase for fiscal year 2012, BSEE officials 

expressed concern that public and congressional attention to oversight of offshore oil and gas drilling may 

diminish over time and that future appropriations may decrease, which would endanger their ability to 

provide effective safety oversight offshore.532 Despite these concerns, BSEE total appropriations have not 

drastically changed since 2012. BSEE total appropriations were $182.4 million in FY 2012,533 $200.8 

million in FY 2013,534 $202.6 million in FY 2014,535 and $204.6 million in FY 2015.536 

The Mine Safety and Health Administration (MSHA) provides a particularly compelling example of how 

appropriations funding can decrease over time. MSHA was formed in 1977, following a slew of mining 

 

526 US Government Accountability Office. Oil and Gas Management: Interior’s Reorganization Complete, but 

Challenges Remain in Implementing New Requirements; GAO-12-423; July 30, 2012; p 101. 

http://www.gao.gov/assets/600/593110.pdf (accessed March 26, 2016).

527 Ibid., p 101. 

528 Ibid., p 101. 

529 For FY 2015, the BSEE budget requested $204.6 million, which includes $50.4 million from offsetting rental 

collections, $8.2 million from cost recovery fees, and $65.0 million inspection fees; The US Department of the 

Interior. Budget Justifications and Performance Information Fiscal Year 2015: Bureau of Safety and 

Environmental Enforcement; 

http://www.bsee.gov/uploadedFiles/BSEE/About_BSEE/Budget/BSEE%20FY%202015%20Final%20Greenbook

%20File.pdf (accessed March 25, 2015). 

530 US Government Accountability Office. Oil and Gas Management: Interior’s Reorganization Complete, but 

Challenges Remain in Implementing New Requirements; GAO-12-423; July 30, 2012; p 101. 

http://www.gao.gov/assets/600/593110.pdf (accessed March 26, 2016).

531 For example, in FY2013, BSEE anticipated receiving half of its appropriation from fees and offsetting 

collections. The portion has varied significantly, but it has typically been 25% or less of the total appropriation; 

Budget Justifications and Performance Information Fiscal Year 2013; US Department of the Interior: 2012; p 6, 

Table 1; http://www.bsee.gov/About-BSEE/Budget/FY2013BudgetJustification/ (accessed March 26, 2016). 

532 US Government Accountability Office. Oil and Gas Management: Interior’s Reorganization Complete, but 

Challenges Remain in Implementing New Requirements; GAO-12-423; July 30, 2012; p 101. 

http://www.gao.gov/assets/600/593110.pdf (accessed March 26, 2016).

533 Budget Justifications and Performance Information Fiscal Year 2013; US Department of the Interior: 2012; p 3; 

http://www.bsee.gov/About-BSEE/Budget/FY2013BudgetJustification/ (accessed March 26, 2016).

534 Budget Justifications and Performance Information Fiscal Year 2014; US Department of the Interior: 2013; p 3; 

http://www.doi.gov/budget/appropriations/2014/upload/FY2014_BSEE_Greenbook.pdf (accessed March 26, 

2016).

535 Budget Justifications and Performance Information Fiscal Year 2016; US Department of the Interior: 2015; p 3; 

http://www.doi.gov/budget/appropriations/2016/upload/FY2016_BSEE_Greenbook.pdf (accessed March 26, 

2016).

536 Ibid., p 3.

001041
Macondo Investigation Report Volume 4 4/17/2016

106 

disasters when Congress and the public realized that the predecessor agency, the Mining Enforcement and 

Safety Administration, had prioritized revenue generation over safety.537 Congress recognized that the 

increased enforcement, legal, and administrative responsibilities for MSHA would require additional 

funds for hiring and support services. Yet it did not create a special mechanism to ensure increased 

funding was available year after year. Instead, Congress expected that MSHA’s funds “can be provided 

through the normal appropriation process as necessary.”538 So in 1979, the year it became a fully 

operational agency, MSHA’s budget peaked at an inflation-adjusted $355 million. By 2007, despite some 

increases in spending, the budget dropped 15 percent.539 The President recommended to Congress that 

MSHA receive a budget of $395 million in 2016.540 The MSHA experience is a powerful reminder that 

the source of an agency’s funding is critical to achieving its mission. 

If it is to avoid repeating MSHA’s good intentions and budget woes, a renewable, sustainable funding 

structure is the best way to ensure that BSEE will have adequate funding to regulate environmental and 

safety activity on the OCS in future years. One argument against an industry-funded regulator is that it 

can become “captured” by the industry that funds it. 541 Conversely, interest groups can exert pressure on 

Congress to control an agency’s activities through its budget, which is just another type of agency 

capture. 542 Yet other federal safety regulators transitioned to industry-funded appropriations precisely to 

avoid the inadequacies and lack of a consistent budget. The Nuclear Regulatory Commission (NRC) was 

reorganized in response to the Three Mile Island incident in 1979. As part of the regulatory overhaul in 

the 1980s and 1990s, the NRC transitioned to a fee-for-service model of regulating. Now, Congress sets 

the agency’s budget, but the NRC is required by law to recover at least 90% of its funding through 

licensing and inspection fees.543 For instance, each year the agency determines and publishes fee amounts 

for new reactor license applications ($17,800), amendments to licenses ($9,600), and inspections ($273 

 

537 Senate Report 95-181 at 3405 (95th Congress), May 16, 1977

http://arlweb.msha.gov/SOLICITOR/COALACT/leghist2.htm (accessed March 26, 2016).

538 Ibid. 

539 OMB Watch. Coal Mine Safety Shortchanged by Years of Budget Cuts; OMB Watch: Washington, D.C., 2008; 

http://miningquiz.com/pdf/NEC/US_Coal_Mine_Safety_Shortchanged_by_Years_of_Budget_Cuts.pdf (accessed 

March 26, 2016); meanwhile, mining production had increased significantly since the 1970s. In 1973, the U.S. 

Department of Energy, Energy Information Administration reported 591 million short tons of coal produced in the 

U.S. By 2007, production increased to 1.147 billion short tons; The American Resource, Trends in U.S. Coal 

Mining 1923-2001, http://www.nma.org/pdf/c_trends_mining.pdf. (accessed March 26, 2016). 

540 US Department of Labor. Budget request for FY 2016 outlines priorities for future, 

http://www.msha.gov/fromthedesk/2015/0203.asp (accessed March 26, 2016).

541 Rachel E. Barkow, Insulating Agencies: Avoiding Capture Through Institutional Design, 89 TEX. L. REV. 15, 42 

n. 146-47 (2010); see also Steven A. Ramirez, Depoliticizing Financial Regulation, 41 WM. & MARY L. REV. 503, 

517 (2000) (noting with surprise that most proposals for offshore regulatory reform have not focused on agency 

financing).

542 Capture of a federal agency can be defined as strong responsiveness to the desires of the industry or groups being 

regulated. See Rachel E. Barkow, Insulating Agencies: Avoiding Capture Through Institutional Design, 89 TEX.

L. REV. 15, p 21 (2010); Roger G. Noll, REFORMING REGULATION 99-100 (1971). This document explains that 

capture happens most often when an agency assigns undue weight to the interests of the regulated industries as 

opposed to public interests.

543 Section 6101 “NRC User Fees and Annual Charges,” Omnibus Budget Reconciliation Act, Pub. L. 103-66. 107 

Stat. 312 (Aug. 10, 1993).

001042
Macondo Investigation Report Volume 4 4/17/2016

107 

per hour).544 This funding mechanism ensures that the agency’s budget adequately covers the regulatory 

activities it performs, but no more. It also simplifies the agency’s budget planning. Because fees directly 

correspond to the actions the NRC performs, the agency does not worry about potential budget shortfalls 

from year to year. BSEE could use this same approach to fund additional hires. Offshore revenue from 

existing drilling and production activities could cover necessary inspection staff. Salaries could then be 

calculated at a rate comparable to a private third-party auditor in the GoM, making the structure more cost 

effective.

The Pipeline and Hazardous Materials Safety Administration (PHMSA) within the Department of 

Transportation provides another example of an industry-supported federal safety regulator. PHMSA is 

authorized to assess and collect pipeline user fees to fund its pipeline safety activities.545 The pipeline 

safety statute that authorized PHMSA recognized a need for consistent funding for the pipeline 

regulator’s safety oversight. It reflected Congress’s intention that the total costs of administering certain 

federal pipeline safety programs be recovered through charges to the industry.546 PHMSA assesses 

operators of interstate and intrastate natural gas and hazardous liquid transmission pipelines so that the 

operators each pay a share of the total federal pipeline safety program costs in proportion to the number of 

miles of pipeline they have in service at the end of a calendar year.547

At least one county safety regulator is industry funded. In Contra Costa County, California, the California 

Accidental Release Prevention Program (CalARP) works to prevent catastrophic accidental releases of 

highly toxic or flammable chemicals through its Risk Management Program.548 CalARP engineers review 

industry risk-management program plans, conduct regular audits of sites, and follow up with action items 

to verify compliance.549 The county uses a Certified Unified Program Agency (CUPA) single-fee system, 

which assesses fees to users of all CUPA programs, including CalARP.550 Under this system, a single 

invoice is issued annually to each of the regulated business sites for review and audit services that 

CalARP performs. The collected fees cover salaries and benefits, services and supplies, and overhead 

costs of the CUPA programs.

551

5.5.2 Industry Funding of International Offshore Regulators 

In contrast to the US offshore regulator’s hybrid fee and congressional appropriation scheme, the North 

Sea and Australian offshore regimes use a cost-recovery model. Since 1999, the UK offshore regulator 

 

544 10 C.F.R. § 170.21.

545 49 U.S.C. § 60301.

546 Skinner v. Mid-America Pipeline Co., 490 U.S. 212 (1989).

547 The 2010 fee assessed on liquid pipelines was offset by $18.8 million, roughly half of the total program allocated, 

from the Oil Spill Liability Trust Fund. Letter from Cynthia Quarterman, Administrator, Pipeline and Hazardous 

Materials Safety Administration, to Senator Daniel K. Inouye, Chairman, Committee on Appropriations (April 5, 

2010).

548 Contra Costa Health Services, California Accidental Release Prevention (CalARP) Program, 

http://cchealth.org/groups/hazmat/california_accidental_release_prevention.php (accessed March 26, 2016). 

549 Ibid. 

550 http://cchealth.org/groups/hazmat/pdf/cupa/fee-exhibits.pdf. 

551 Contra Costa Health Hazardous Materials. List of Exhibits: To Staff Report on the Determination and 

Apportionment of CUPA Fees; http://cchealth.org/hazmat/pdf/cupa/fee-exhibits.pdf (accessed March 26, 2016).

001043
Macondo Investigation Report Volume 4 4/17/2016

108 

aimed to recover its costs entirely through fees or “charges” to duty holders.552 The UK government 

wanted to ensure appropriate funding for the offshore safety and health program, so it decided the 

industry benefiting from the regulator’s services should support that program. It instituted a per-hour cost 

recovery rate for offshore regulatory activities, such as safety case document review and inspections.553 

Not long after the fee schedule was established, an independent consulting firm authored a report for UK 

HSE examining the potential effects on UK HSE charging industry in this manner. Relying on extensive 

interviews with duty holders, unions, UK HSE staff, document review, and statistical analysis,554 the 

report explained that the majority of the industry respondents interviewed indicated their relationship with 

the regulator had not been “negatively affected”, and they observed no change in regulatory performance 

or in efficiency on the part of the regulator.555 

Although there were some faults in the program in terms of implementation, including some negative 

feedback concerning administrative issues (primarily proper invoicing and difficulties for duty holders 

with anticipated budgeting based on anticipated inspector activity at particular locations),556 cost did not 

turn out to be an issue. Only half of the companies surveyed claimed to have incurred additional costs 

after the UK transitioned to this system, most of which were less than £3,000 (approximately $4,516).557 

The single most important focus in terms of statistical analysis covered by the report was to determine if 

any change in outcomes on health and safety resulted across the population of duty holders.558 The study 

concluded that it was impossible to prove statistically whether the new system affected health and safety 

issues due to the low probability of events, resulting in a relative paucity of data from which to try to 

draw such conclusions.559 The study documented, however, a significant statistical increase in 

documented activity across all regulatory areas by inspectors, including increased issuance of 

improvement notices, prohibition notices, enforcement notices, and prosecutions.560 The total number of 

safety cases presented, and accepted, also increased significantly from 1996-2001, but the percentage of 

safety cases accepted remained relatively constant.561 

 

552 Offshore Oil and Gas in the UK—An Independent Review of the Regulatory Regime; 

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875-offshore-oil-gas-ukind-rev.pdf (accessed March 26, 2016). “The Panel comprised three independent appointees, including myself, 

all with an element of experience and knowledge relevant to the industry, alongside a senior representative of 

each of the three national regulatory bodies with responsibilities for the offshore oil & gas sector, namely: the 

Department of Energy and Climate Change (DECC), the Health and Safety Executive (HSE) and the Maritime 

and Coastguard Agency (MCA);” Ibid., p 1.

553 Since April 2016, the charge is £266 per inspector hour. http://www.hse.gov.uk/charging/offshore/chgoffsh.htm

for information on the UK HSE’s charging process (accessed March 26, 2016).

554 Ibid., § 1.2. 

555 Ibid., e.g., §§ 1.6-1.7, 1.10, 1.16-1.17.

556 Ibid., § 1.12. 

557 Ibid., § 1.2. 

558 Ibid., § 3.2. 

559 Ibid., § 4.1.

560 Ibid., § 4.1-4.4.

561 Ibid., § 4.5-4.6.

001044
Macondo Investigation Report Volume 4 4/17/2016

109 

Australia’s offshore safety regulator, NOPSEMA, is also industry-funded, but in a slightly different way 

than the UK OSDR.

562 Much like the UK, NOPSEMA collects funds through safety case levies on the 

offshore industry, which it determines by individual activity levels.563 Rather than hourly rates, levies 

paid by the duty holders are flat fees based on the facility in use.564 This arrangement ensures that each 

operator is well aware of the cost it will incur for regulatory services. Also, the regulator is aware of its 

budget for the year, and it does not cause industry any misgivings over the need for additional inspections 

or audits. In addition, this funding scheme helps regulatory staff build healthy and appropriate 

relationships with industry. 

While BSEE’s most recent budget suggests that it is well-funded, an industry funding mechanism 

guarantees that future funding is always commensurate with industry activity offshore, regardless of 

cyclical movements of oil and gas prices, which can impact the industry, along with changing political 

will in terms of the desirability of an enhanced regulatory presence versus production pressures during 

times of peak energy demand.

5.6 The Importance of an Independent Regulator 

To ensure that safety is a priority offshore, the regulator must maintain its independence from the 

economic aspects of offshore drilling activities. Independence is an essential feature of an effective safety 

regulator for major hazard facilities because offshore leasing and revenue generation goals are often in 

conflict with safety and environmental protection. In mining and nuclear safety, Congress recognized that 

an independent safety regulator requires full isolation of the safety mission from the government agency 

tasked with production and revenue management. A regulator must be regarded as independent from 

stakeholder community it regulates while still maintaining appropriate levels of engagement. UK HSE 

communications with the CSB corroborate this, noting that even the perception of a conflict of interest 

with industry in the UK would undermine that regulator’s effectiveness. 

BSEE has taken steps to establish and maintain independence, but evidence suggests it has yet to achieve 

full independence, and the appearance of a conflict of interest may remain. Reorganization of offshore 

safety regulator in the Department of Interior fails to reflect the lessons from previous congressional 

safety reforms and the experiences of other international offshore regulatory regimes. 

5.6.1 The Minerals Management: The Safety Versus Revenue Conflict

The Minerals Management Service (MMS) regulated offshore safety from 1982 until its reorganization 

following Macondo in 2010. Through the Secretary of the Interior, MMS used the Outer Continental 

 

562 Australian Petroleum (Submerged Lands) Act Section 138 specifies industry payment of fees to the regulator.

563 NOPSEMA, Cost Recovery and Levies, http://www.nopsema.gov.au/about/cost-recovery-and-levies/ (accessed 

March 26, 2016). 

564 NOPSEMA. Guideline: Safety Case Levies; December 19, 2013; 

http://www.nopsema.gov.au/assets/Guidelines/N-11000-GL0238-Safety-Case-Levies.pdf (accessed March 26, 

2016); Ibid. 

001045
Macondo Investigation Report Volume 4 4/17/2016

110 

Shelf Lands Act to promulgate regulations outlining leasing, revenue collection, environmental 

compliance, and safety requirements for activities on the outer continental shelf (OCS).565 

MMS was created in 1982, during a period of rising inflation and market uncertainty about oil prices.566 

Then-Secretary of the Interior James Watt, expressing concern about offshore revenue, attempted to 

expand offshore federal leasing to promote drilling and oil production. Soon after, an administration blue 

ribbon commission issued a report that exposed ineffective revenue management for energy production 

on federal lands, describing it as “a failure for more than 20 years.”567 

To expand leasing and revenue-promotion goals, Secretary Watt used his discretion under the Outer 

Continental Shelf Lands Act to transition the authority for revenue collection from the Bureau of Land 

Management and for regulatory oversight of offshore activity from the US Geological Survey. These 

functions, previously separated, were now vested in one agency, the new Minerals Management 

Service.568 This created an inherent conflict of interest within one agency because through the fall of 

2010, the MMS would oversee both regulatory and revenue functions for offshore drilling operations on 

the OCS. In many ways, Secretary Watt’s actions were reinforcing the purpose of the Outer Continental 

Shelf Lands Act of “expeditious and orderly development [of OCS resources], subject to environmental 

safeguards, in a manner which is consistent with the maintenance of competition and other national 

needs.”569 Nevertheless, the inherent conflict remained, with the desire for enhanced revenue generation 

potentially pitted against the drive for offshore safety.

One of Watt’s first actions were to streamline the OCS leasing process and to encourage drilling with an 

ambitious five-year leasing plan for up to five billion acres of the US Outer Continental Shelf.570 Though 

it succeeded in invigorating lease sales, the 1982-1987 five-year plan was dampened by a longstanding 

congressional leasing moratorium,

571 which was followed by a series of executive offshore leasing 

moratoria, the first issued by President George H. W. Bush in 1990.572 The western Gulf of Mexico, 

 

565 See 30 C.F.R. Part. 250.

566 Bernanke, B.; Gertler, M.; Watson, M.; Sims, F.; Friedman, B. Systematic Monetary Policy and the Effects of Oil 

Price Shocks; Brookings Papers on Economic Activity 1997 (1), 1997, pp 91-157; see also International Monetary 

Fund. Global Economy Learns to Absorb Oil Price Hikes, 

http://www.imf.org/external/pubs/ft/survey/so/2012/num052512a.htm (accessed March 26, 2016); Ibid. 

567 Commission on Fiscal Accountability of the Nation's Energy Resources. Fiscal Accountability of the Nation's 

Energy Resources; January, 1982; http://www.onrr.gov/laws_R_D/FRNotices/PDFDocs/linowesrpt1-5.pdf

(accessed March 26, 2016). 

568 Secretarial Order No. 3071 (Jan. 19, 1982).

569 43 U.S.C. § 1332(3).

570 Department of the Interior Notice, Tentative Proposed Final 5-Year OCS Oil and Gas Leasing Program, 47 Fed. 

Reg. 11980 (March 19, 1982).

571 Over Secretary Watt’s objections, Congress reined in his proposal to offer almost all of the US coastline for 

offshore oil and gas development by 1987. The 1984 Interior appropriations bill banned drilling along most of 

California and Cape Cod. See e.g., Russakoff, D. Watt's Adversaries Would Almost Hate To See Him Resign. The 

Washington Post, October 7, 1983, https://www.washingtonpost.com/archive/politics/1983/10/07/wattsadversaries-would-almost-hate-to-see-him-resign/f324ed56-31d7-4b59-ae52-2b756cf53e91/ ; and Vann, A. 

Offshore Oil and Gas Development: Legal Framework; RL33404 2-3; Congressional Research Service: 2011.

572 President George Bush: Statement on Outer Continental Shelf Oil and Gas Development; June 26, 1990; 

http://www.presidency.ucsb.edu/ws/?pid=18638 (accessed March 26, 2016).

001046
Macondo Investigation Report Volume 4 4/17/2016

111 

however, was not part of the leasing and drilling moratoria, and the lease sales and resulting revenue 

became the second largest revenue source for the federal treasury.573 An assessment of the scope of MMS 

activities from that time through the date of the Macondo incident shows the agency’s emphasis on 

maximizing revenue generation as compared to safety and environmental regulation.574 

5.6.2 BSEE Organizational Structure 

Changes in the Department of the Interior post-Macondo are in line with the September 2010 US 

Department of Interior Outer Continental Shelf Safety Oversight Board’s Report to Secretary of the 

Interior Ken Salazar, which recommends “In future institutional structures implemented through the 

ongoing BOEMRE reorganization, separate the management of environmental functions from the leasing 

and development to ensure that environmental concerns are given appropriate weight and 

consideration.”575 They are also consistent with the Presidential Commission’s recommendation to create 

“an independent agency within the Department of the Interior with enforcement authority to oversee all 

aspects of offshore drilling safety.”576 The recommendation did not resolve the inherent problems with the 

Secretary of Interior’s continued responsibility for simultaneous missions that often conflict. The 

Department of the Interior retains offshore production and revenue collection authority. 

The various bureaus and services composing the Interior Department are not independent agencies; each 

is one part of a strict, hierarchical structure with the Secretary at the top of the pyramid.577 These line 

bureaus operate only on delegated authority because the statutes they implement do not even mention the 

bureau. Instead, final powers of decision remain with the Secretary of the Interior.578 The following 

organizational charts for the Department of the Interior illustrate the similarities between MMS and

BSEE’s positions within the Department. Both agencies report to the Assistant Secretary for Land and 

Minerals Management, who reports to the Deputy Secretary of the Interior, who reports to the Secretary. 

The Director of BSEE is three levels of authority below the Secretary of the Interior, as was the MMS 

Director. The agency branch responsible for safety follows the same hierarchical structure as before the 

Macondo blowout. 

 

573 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deepwater: The Gulf Oil 

Disaster and the Future of Offshore Drilling - Report to the President; Janurary, 2011; p 63.

574 House Committee on Energy and Commerce, JIT hearing, July 20, 2010, statement of Rep. Sutton, 

http://www.gpo.gov/fdsys/pkg/CHRG-111hhrg77922/html/CHRG-111hhrg77922.htm.

575 Lewis, W.; Kendall, M.; Suh, R. U.S. Department of the Interior Outer Continental Shelf Safety Oversight Board 

Report to the Secretary of the Interior Ken Salazar ; US Department of the Interior: September 1, 2010; p 33; 

http://www.noia.org/wp-content/uploads/2015/12/DOI-OCS-Safety-Oversight-Board-Report.pdf (accessed March 

26, 2016).

576 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deepwater: The Gulf Oil 

Disaster and the Future of Offshore Drilling - Report to the President; Janurary, 2011; p 26, Recommendation 

A4.

577 George Cameron Coggins and Doris K. Nagel, Nothing Beside Remains: The Legal Legacy of James G. Watt’s 

Tenure as Secretary of the Interior on Federal Land Law and Policy, 17 B.C. ENVTL. AFF. L. REV. 473, 482 

(1990). 

578 Ibid. 

001047
Macondo Investigation Report Volume 4 4/17/2016

112 

Other agencies with competing missions exist in the federal government.579 The federal administrative 

agencies and bureaus that manage public lands, like the former MMS, the Bureau of Land Management, 

and the US Forest Service, probably have the most diverse and sweeping range of goals, including 

production, environmental protection, public use, and worker and public safety, all of which are difficult 

to address equally.580 Each of these agencies has either admitted to or been accused of emphasizing one or 

more of their missions, typically the economic or production-related ones, over others such as safety.581

There are signs that BSEE may continue to emphasize the economic or production-related aspects of 

DOI’s mission, particularly for permitting offshore operations. 

 

579 In addition to the Department of the Interior, they include the Federal Bureau of Investigation, the US Forest 

Service, and the Department of Homeland Security, among others. See, e.g., Eric Biber, Too Many Things To Do: 

How to Deal With the Dysfunctions of Multiple-Goal Agencies, 33 HARV. ENVT’L. L. REV. 1 (2009).

580 For an example, see Eric Biber, Too Many Things to Do: How to Deal With the Dysfunctions of Multiple-Goal 

Agencies, 33 HARV. ENVT’L. L. REV. 1, 2 (2009).

581 Ibid. 

001048
Macondo Investigation Report Volume 4 4/17/2016

113 

Figure 4-1. Department of Interior organization chart: at the time of the April 20, 2010, Macondo incident and 

currently.

001049
Macondo Investigation Report Volume 4 4/17/2016

114 

 

5.6.3 Critical BSEE Drilling Permit Concerns 

Post-Macondo, there has been a resurgence of pressure for BSEE to approve drilling permits. In more 

than one committee hearing that purported to explore other topics, the focus of questioning shifted to 

Gulf-area congressional representatives’ concerns about oil production and the pace of drilling permit 

review. In an October 2011 House Natural Resources committee hearing about the results of the Joint 

Investigation Team,

582 committee members chided then-Director Bromwich for not focusing enough on 

speeding up drilling permit reviews and production.583 A few months later, after testimony before the 

House and Senate appropriations subcommittees in 2012, members repeatedly questioned former Director 

Watson about BSEE’s slow pace of drilling permit approvals.584 In episodes reminiscent of early MMS 

OCS subcommittee discussions, congressional representatives expressed concern about a decrease in 

drilling permits and about rigs “leaving our shores and going to Brazil” because the country needs to “get 

[offshore] production going up and prices at the pump going down.”585 Less than two years following the 

incident, congressional attention to safety reform was nearly eclipsed by a seeming preoccupation with 

the potential effects of a drilling moratorium that had been in place while the Macondo well was still 

leaking oil into the Gulf. Thus, the inherent conflict between production and safety remains on the 

shoulders of the DOI Assistant Secretary, Deputy Secretary, and Secretary, all whom also face economic 

development and production pressures. By remaining under the DOI umbrella, the offshore safety 

regulator is not truly independent from these pressures, potentially compromising major accident 

prevention initiatives. 

 

582 As offshore safety regulators in the US, BOEMRE and USCG formed a Joint Investigation Team to investigate 

the Deepwater Horizon disaster. BOEMRE and the USCG published separate reports addressing their respective 

areas of safety responsibility; USCG, Report of the Investigation into the Circumstances Surrounding the 

Explosion, Fire, Sinking and Loss of Eleven Crew Members Aboard the Mobile Offshore Drilling Unit Deepwater 

Horizon in the Gulf of Mexico, April 20-22, 2010, Volume 1, MISLE Activity Number 3721503; p 127.

http://www.uscg.mil/hq/cg5/cg545/dw/exhib/DWH%20ROI%20-%20USCG%20-%20April%2022,%202011.pdf

(Accessed March 26, 2016).

583 Full Committee Oversight Hearing on the BOEMRE/U.S. Coast Guard Joint Investigation Team Report, U.S. 

House of Representatives Committee on Natural Resources, October 13, 2011, see e.g., p 3 

https://www.gpo.gov/fdsys/pkg/CHRG-112hhrg70720/pdf/CHRG-112hhrg70720.pdf (accessed March 26, 2016).

584 House Natural Resources Subcommittee on Energy and Mineral Resources Hearing on President Obama’s Fiscal 

2013 Budget Proposal for the Bureau of Ocean Energy Management and Bureau of Safety and Environmental 

Enforcement, March 8, 2012 http://naturalresources.house.gov/calendar/eventsingle.aspx?EventID=282268 and 

Senate Appropriations Subcommittee on Interior, Environment and Related Agencies Hearing on the Proposed 

2013 Appropriations for the Interior Department’s Onshore and Offshore Energy Development Programs, March

14, 2012 

http://www.appropriations.senate.gov/imo/media/doc/hearings/03_14_12%20Interior%20&%20Environment%20

On&Off%20Shore%20energy%20GPO%20Record.pdf (accessed March 26, 2016).

585 House Natural Resources Subcommittee on Energy and Mineral Resources Hearing on President Obama’s Fiscal 

2013 Budget Proposal for the Bureau of Ocean Energy Management and Bureau of Safety and Environmental 

Enforcement, March 8, 2012 http://naturalresources.house.gov/calendar/eventsingle.aspx?EventID=282268

(accessed March 26, 2016).

001050
Macondo Investigation Report Volume 4 4/17/2016

115 

5.6.4 Historical Recognition for Separating Safety Oversight from Resource 

Development

Congress can rely on several precedents for separating safety and environmental oversight from a 

predecessor agency to an independent regulator. Some of the most analogous situations that resulted in 

legislative actions to separate safety oversight were prompted by a catastrophic incident much like 

Macondo. As it has done with mining and nuclear safety, Congress would need to take action to move 

offshore safety regulation into an independent agency separate from the Department of Interior. 

5.6.4.1 Creation of the Mine Safety and Health Administration

The current Mine Safety and Health Administration (MSHA) was once the Mining Enforcement and

Safety Administration (MESA), a subcomponent of the Department of the Interior. After a string of 

serious mining disasters in the 1970s (including Sunshine Silver, Buffalo Creek, Blacksville, and Scotia), 

Congress reviewed MESA’s enforcement record, finding the fatality and injury numbers unacceptably 

high.

586 Congress determined that a conflict existed between MESA, which was responsible for enforcing 

and administering the mine safety and health laws, and the Department of Interior, which “pursued the 

goal of maximizing production.”587 Congress reasoned that separating the mine safety and health 

regulator from revenue-related activities would solve the problem of conflicting missions.588 MSHA was 

moved to the Department of Labor because its primary mission is to keep workers safe.

589 Congress 

enacted the Federal Mine Safety and Health Amendments Act of 1977 to formalize MSHA’s authority.590

5.6.4.2 Creation of the Nuclear Regulatory Commission 

Just as the reorganization of MESA was prompted by a catastrophic accident, nuclear safety regulatory 

structures were reformed again after the Three Mile Island nuclear incident in 1979. The original Atomic 

Energy Commission (AEC) had three conflicting goals: managing the atomic weapons program, 

promoting the peaceful use of atomic power, and protecting public health and safety.591 The AEC came 

under attack for its focus on developing nuclear technology and a cozy relationship with industry. Critics 

complained that it was “like letting the fox guard the henhouse.”592 In response, Congress split the AEC, 

assigning safety regulation to the new Nuclear Regulatory Commission (NRC) and placing the 

development and research in what is now the Department of Energy.593 But the NRC’s Reorganization 

 

586 Senate Report 95-181 at 3405 (95th Congress), May 16, 1977

http://arlweb.msha.gov/SOLICITOR/COALACT/leghist2.htm (accessed March 26, 2016).

587 Ibid. 

588 Ibid. 

589 Ibid. 

590 Ibid. 

591 Mazuzan, G.; Walker, S. Controlling the Atom: The Beginnings of Nuclear Regulation, 1946-1962, 1st ed.; 

University of California Press: 1984. 

592 Ibid. 

593 Energy Reorganization Act of 1974, Pub. L. No. 93-438, 88 Stat. 1233; see also Alice L. Buck, U.S. Dep’t of 

Energy, A History of the Atomic Energy Commission 8 (1983) (describing history of conflict); see also Eric 

Biber, Too Many Things To Do: How to Deal With the Dysfunctions of Multiple-Goal Agencies, 33 HARV.

ENV’TL. L. REV. 1, 33 (2009).

001051
Macondo Investigation Report Volume 4 4/17/2016

116 

Plan No. 1 of 1980, a major overhaul of the agency, was the direct result of Three Mile Island accident.

The 1980 plan established a program to integrate NRC findings about licensee performance into a public 

report, expanded performance-oriented and safety-oriented inspections and risk assessment, and 

strengthened and reorganized a separate, independent NRC enforcement office.594

5.6.4.3 Creation of the UK HSE Offshore Division

In the UK, the offshore regulator was initially organized within the Department of Energy—Petroleum 

Engineering Division. This division held responsibility for developing and enforcing health and safety 

regulations in addition to licensing and resource development.595 Although the conflict between these 

missions was apparent before then, a 1972 inquiry identified fundamental flaws in this arrangement.596 In 

1988, the Piper Alpha disaster confirmed that a complete reorganization of offshore safety regulation was 

necessary.597 

A major recommendation of the Lord Cullen report was to transfer the responsibility for offshore safety 

regulation from the Department of Energy to the UK’s HSE. In response, the UK HSE Offshore Division 

was created in 1991, with sole responsibility for offshore safety oversight.598 This separation of 

responsibility for regulating offshore safety from licensing and revenue collection continued in the UK 

ever since, despite various subsequent organizational changes. Following the recent implementation of the 

EU Offshore Safety Directive by the UK, the offshore regulator is now the Offshore Safety Directive 

Regulator (OSDR). In the US, a similar structure without inherent conflicts would strengthen BSEE in its 

regulatory function. 

 

594 See, e.g., NRC. Backgrounder on the Three Mile Island Accident, http://www.nrc.gov/reading-rm/doccollections/fact-sheets/3mile-isle.html#impact; Nuclear Regulatory Legislation: 113th Congress; 2nd Session 

(Volume 1, Number 11), http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0980/v1/sr0980v1.pdf,

(accessed March 26, 2016).

595 T. Hunter and J. Paterson, Offshore Petroleum Facility Integrity in Australia and the United Kingdom: A 

Comparative Study of Two Countries Utilising the Safety Case Regime, Oil, Gas & Energy Law Intelligence 

(October 2011), p 7.

596 Ibid. 

597 Ibid. 

598 UK HSE, Who we are, http://www.hse.gov.uk/offshore/who.htm (accessed March 26, 2016). 

001052
Macondo Investigation Report Volume 4 4/17/2016

117 

6.0 Conclusion

This final volume on the Macondo blowout focuses on several key attributes of more robust process 

safety management regulatory regimes that the CSB believes would enhance existing US offshore 

regulations. Many of the attributes of an effective goal-setting, risk-reduction regime focused on major 

accident prevention were not present pre-Macondo, and recent changes to the US offshore regulator’s 

organization and regulations, particularly the establishment of SEMS, do not go far enough to ensure 

effective industry management and control of major hazards or prevent possible future Macondo-type 

incidents. Specifically, the US offshore regulatory regime does not adequately put the onus on industry to 

minimize risk and empower the regulator proactively to ensure effective industry management and 

control of major hazards. 

The CSB finds that more robust US and international regimes focus on major accident prevention and 

continual improvement and they identify gaps and weaknesses that were causal to the Macondo incident. 

When taken together:

• Foster continual improvement by requiring companies to reduce their risks through goal-setting 

risk reduction techniques such as ALARP; 

• Cultivate more adaptability;

• Clarify safety responsibility to focus accountability on key parties such as leaseholder/operator 

and drilling contractor that create or control major accident risks; 

• Create opportunities for active workforce participation;

• Require written safety documentation by duty holders; 

• Require proactive regulatory assessment and verification;

• Establish and use helpful process safety indicators to drive performance;

• Employ appropriately trained and experienced regulatory staff; and 

• Feature a transparent, independent, and well-resourced regulator.

Collectively, these attributes provide the foundation for a more robust goal-setting risk-reduction 

regulatory model for US offshore drilling and production operations. Based upon its analysis of other 

high-hazard industries that use similar performance-based regulations, as well as other offshore regimes, 

the CSB concludes that augmenting the current US offshore regulatory model will better ensure major 

accident risk reduction. 

001053
Macondo Investigation Report Volume 4 04/17/2016

118 

7.0 Recommendations

The CSB issues four recommendations to the US Department of Interior for additional improvements in 

offshore safety.

CSB2010-10-I-OS-R11 Recommends Revision to the Offshore Safety Regulations to Establish a 

Regulatory Framework with a Specific Goal Of Preventing Major 

Accidents Based on the Attributes Described in CSB Macondo 

Investigation Report Volume 4. 

United States Department of Interior 

Revise and augment the offshore safety regulations, including the SEMS Rule (C.F.R. 250 subpart S), and 

issue guidance as it relates to those revisions/augmentations, to: 

a. Establish clear and consistent safety and environmental management responsibilities to prevent 

major accidents for the companies having primary control over the hazardous activities being 

undertaken (e.g., the owner/drilling contractor for a non-production installation and the 

leaseholder/operator for the production installation);

b. Require all responsible parties as defined in R11(a) to develop documentation for each hazardous 

operation/facility it maintains primary control over, where the documentation demonstrates the 

party’s systematic analysis that risks posed by all identifiable major accident hazards are reduced 

to As Low As Reasonably Practicable (ALARP) or similar risk-reduction target. The 

documentation shall include: 

1. Identification of major hazards and the barriers and safety management systems controls 

(including augmented SEMS elements) that will be used to reduce risk to ALARP or 

similar risk reduction target;

2. Use of the hierarchy of controls to the greatest extent feasible in establishing safety 

barriers and controls; 

3. Identification of safety critical elements and tasks to establish and maintain safety 

barriers and controls, in fulfillment of R1 (See Volume 2); 

4. Demonstrate use of established qualitative, quantitative and semi-quantitative methods in 

determining (1) the barriers and safety management systems necessary to achieve 

ALARP risk reduction levels and (2) the performance requirements of those barriers and 

controls (e.g., reliability, functionality, and availability) to ensure their effectiveness;

5. Identification of all US and international standards that have been applied, or will be 

applied, in relation to the facility, hazardous operation, or equipment used on/in 

connection with the operation for which required documentation is submitted. Should the 

responsible party wish to use standards other than well-recognized US or international 

consensus safety standards developed by a representative committee of diverse 

stakeholders, a detailed technical justification that those standards achieve risk-reduction 

to ALARP must accompany submitted documentation. The regulator may challenge or 

reject the technical justification. Remove from the US offshore safety regulatory scheme

001054
Macondo Investigation Report Volume 4 04/17/2016

119 

the provisions that allow companies to substitute requirements to use the best available 

and safest technology with a showing of compliance with BSEE regulations. 

c. Require responsible parties as defined by R11(a) to fully implement all aspects of the 

documentation stipulated in R11(b) and establish a documented process to verify that all methods 

to manage, reduce, and control those hazards are effectively maintained throughout the lifecycle 

of the operation/facility.

CSB2010-10-I-OS-R12 Recommends Strengthening Preventative Oversight by the Offshore 

Safety Regulator

United States Department of Interior

Augment the capabilities and functioning of BSEE to incorporate the following proactive oversight 

mechanisms:

a. Review of the documentation required to be submitted under CSB 2010-I-OS-R11(b) by 

technically qualified regulatory personnel who have the capability and authority to require 

modifications and improvements to the major hazards report as necessary, either before an 

acceptance process and commencement of the major hazards operation(s) or during periodic 

proactive review by the regulator; 

b. Establish a program for preventive, comprehensive inspections and audits with technically 

qualified staff as described in R13(a) to ensure that the responsible party as defined in R11(a) can 

demonstrate the risk reduction commitments stipulated in its major hazards report. 

CSB2010-10-I-OS-R13 Recommends Continued Efforts to Develop a Sufficiently Resourced, 

Technically Qualified, and Diverse Staff

United States Department of Interior

Further enhance the qualifications, professional competency, and diversity of BSEE staff to implement 

major accident prevention programs by: 

a. Continuing efforts to enhance recruiting and retention of sufficient staff with a diversity of 

expertise, professional backgrounds and skill sets, such that BSEE has staff competencies in a 

variety of safety-critical and technical areas, including petroleum, chemical, and mechanical 

engineering; human and organizational factors; well design and control; and process safety, as 

well as those with industry experience to perform an even more expanded mission as envisioned 

in this report; 

b. Retaining the services of a human resources consulting firm to complement BSEE’s efforts to 

date on human capital management and workforce planning issues, in light of documented 

difficulties in recruiting and retaining necessary staff, including the development of a plan with 

respect to large numbers of retirements facing the agency in the coming decade, as well as a 

compensation analysis (and a plan for subsequent periodic market analyses and benchmarking) to 

ensure BSEE remains competitive with other employers in the offshore industry. Augment the 

agency’s compensation system as necessary to enable BSEE to attract and retain the level of 

staffing needed to perform BSEE’s mission. 

001055
Macondo Investigation Report Volume 4 04/17/2016

120 

c. Continuing to assess, expand, and improve ongoing BSEE training programs for new hires to 

provide all employees with robust skill sets, including appropriate technical training as well as 

interpersonal skills such as communications, negotiation and advocacy. 

If funding, legislative authority, or other approvals are required to implement the recommended 

regulatory provisions in Recommendation R11 – R13, the Secretary of the Interior shall seek such 

authority from Congress or expedited hiring authority from the Office of Personnel Management. 

CSB2010-10-I-OS-R14 Recommends Improving the Regulatory Reporting Program to Drive 

Continual Safety Improvement of Industry 

United States Department of Interior

Expand the offshore safety regulatory program that collects, tracks, and analyzes safety performance 

indicators from industry to further influence industry efforts in reducing major accident risks to ALARP. 

At a minimum, this program shall: 

a. Require the reporting of safety indicator data by all responsible parties, as defined in R11(a);

b. Emphasize the greater preventive value of using leading indicators to actively monitor the health 

and performance of major accident safety barriers and the management systems meant to ensure 

their effectiveness, and work with industry to develop leading indicators that are measurable, 

actionable, normalized across industry, and that occur with sufficient frequency to allow for 

meaningful trending and analysis at the facility and corporate levels; 

c. Augment current reporting requirements to include leading safety performance indicators; 

d. Use the safety performance indicator data to: 

1. identify industrywide, companywide, and facility-specific safety trends and deficiencies; 

2. set annual process safety goals or targets for the industry, company and/or facility, as 

appropriate, based upon those identified safety trends and deficiencies; 

3. issue, at a minimum, annual reports that publicly communicate those trends, deficiencies, 

targets, and goals; and 

4. determine future appropriate allocations of BSEE resources and the prioritization of 

BSEE inspections; 

e. Include use of significant lagging indicators data (including those already mandated by 30 C.F.R.

250.188(a) and (b), such as major events like explosions, fires, gas releases, fatalities, INCs) as 

qualification criteria in the lease-approval and permit-to-drill decision-making processes by the 

regulator.

CSB2010-10-I-OS-R15 Recommends Strengthening Regulatory Requirements for Worker 

Engagement in the Management of Safety

United States Department of Interior

Issue participation regulations and training requirements for workers and their representatives that include 

the following: 

a. Worker-elected safety representatives and safety committees for each staffed offshore facility 

chosen under procedures overseen by the regulator; these safety representatives will have the 

001056
Macondo Investigation Report Volume 4 04/17/2016

121 

authority to interact with employers (such as operators and drillers) and regulators on issues of

worker health and safety risks and the development and implementation of the major hazard 

report documentation; 

b. The elected worker representative has the right to issue an enforceable stop-work order if an 

operation or task is perceived as unsafe; all efforts should be made to resolve the issue at the 

workplace level, but if the issue remains unresolved, BSEE shall establish mechanisms such that 

the worker representative has the right and ability to seek regulator intervention to resolve the 

issue, and the regulator must respond in a timely fashion;

c. The regulator will host an annual tripartite forum for workforce representatives, industry 

management, and the regulator to promote opportunities for interaction by all three entities on 

safety matters and to advance initiatives for major accident prevention.

d. Protections for workers participating in safety activities with a specific and effective process that 

workers can use to seek redress from retaliatory action with the goal to provide a workplace free 

from fear that encourages discussion and resolution of safety issues and concerns. Protected 

activities include, but are not limited to reporting unsafe working conditions, near misses, and 

situations where stop work authority is used. 

CSB2010-10-I-OS-R16 Recommends Incorporating API 75 by Reference upon Revision in 

Response to CSB Recommendation R11

United States Department of Interior

Incorporate by reference into the offshore safety regulations the revised version of Recommended 

Practice 75, Development of a Safety and Environmental Management Program for Offshore Operations 

and Facilities, 3rd Ed., May 2004 (reaffirmed May 2008) upon the inclusion of the CSB 

recommendations in R11 by API.

001057
Macondo Investigation Report Volume 4 04/17/2016

122 

Appendix A: International Offshore Incidents and the US 

Response 

Alexander Kielland and Regulatory Change in Norway

On March 27, 1980, the Alexander L. Kielland installation capsized in the North Sea, killing 123 of the 

212 people on board.599 The incident had a dramatic impact on the offshore industry and the Norwegian 

regulator, which was called the Norwegian Petroleum Directorate.600 The day after the incident, a 

Commission was appointed to determine the causes of the accident and recommend actions to prevent 

similar incidents.601 The Commission’s final report identified weaknesses in Norwegian inspection 

routines, safety training, and technical expertise in rescue equipment.602 It also recommended centralizing 

regulatory authority and finalizing the Petroleum Activities Act, which licensed internal controls for 

offshore operations and implemented risk-analysis requirements.603

By the mid- to late-1980s, dramatic changes took place for the regulator and the overall management of 

major accident risk. New regulations and requirements were established for companies operating offshore 

to develop and implement internal control plans for safety management, which required regulatory 

approval.604 The aim of these regulatory changes was to shift from adherence to prescriptive requirements 

to a more comprehensive understanding of risk.605 In addition to centralizing regulatory authority, new 

concepts were introduced, including a “compliance responsibility” whereby companies were required to 

verify acceptable risk management.606 

The Norwegian government began to consider its role as supervisor instead of inspector of the offshore 

industry.607 The regulator began interacting with industry professional associations and studies, adding to 

 

599 Norwegian Public Reports, Presented to Ministry of Justice and Police (March 1981), NOU 1981: 11 “The 

Alexander L. Kielland accident” p 9.

600 Melberg , E. Determined to learn from history. August 13, 2010, http://www.npd.no/en/publications/norwegiancontinental-shelf/no1-2010/determined-to-learn-from-history/ (accessed 31 2013, October).

601 Norwegian Public Reports, Presented to Ministry of Justice and Police (March 1981), NOU 1981: 11 “The 

Alexander L. Kielland accident” pp 1-2.

602 PSA. From prescription to performance in petroleum supervision. March 12, 2010, 

http://www.ptil.no/news/from-prescription-to-performance-in-petroleum-supervision-article6696-878.html 

(accessed October 31, 2013).

603 Ibid.

604 Committee on Alternatives of Inspection of Outer Continenetal Shelf Operations, Marine Board, Commission on 

Engineering and technical Systms National Reserach Council. Alternatives for Inspecting Outer Continental Shelf 

Operations [Online]; National Academy Press: Washington, 1990; p 111, 

http://www.nap.edu/download.php?record_id=1517 (accessed March 26, 2016).

605 Melberg , E. Determined to learn from history. August 13, 2010, http://www.npd.no/en/publications/norwegiancontinental-shelf/no1-2010/determined-to-learn-from-history/ (accessed 31 2013, October).

606 PSA. From prescription to performance in petroleum supervision. March 12, 2010, 

http://www.ptil.no/news/from-prescription-to-performance-in-petroleum-supervision-article6696-878.html 

(accessed October 31, 2013).

607 Ibid. 

001058
Macondo Investigation Report Volume 4 04/17/2016

123 

its audit, verification, investigation and consideration responsibilities.608 Additionally, it began issuing 

“consents” to operate in lieu of “approvals.”609 These shifts helped the Norwegian offshore regulator 

transform from a compliance-based regime that shifted some of the responsibility for safety from the 

regulator into a goal-based regime that allowed industry to determine how best to meet those goals.610 

Ocean Ranger and Regulatory Change in Canada

The Ocean Ranger drilling rig capsized off the Canadian coastal region of Newfoundland during a severe 

storm with hurricane-force winds, ending 84 lives.611 A Royal Commission on the Ocean Ranger Marine 

Disaster formed to investigate the incident found the prescriptive offshore regulatory regime overly 

complex and inadequately enforced. Recommendations from the Commission’s resulting two reports 

involved consolidation of regulatory powers under a single body.612 At the time of the incident, the 

Canada Oil and Gas Lands Administration, Newfoundland Labrador Petroleum Directorate, and the US 

Coast Guard all held some regulatory authority over the Ocean Ranger’s drilling operation.613 In 1985, the 

Canada-Newfoundland Offshore Petroleum Board was formed to centralize regulatory authority.614 As 

offshore development continued to grow into more complex and challenging geographical locations, the 

offshore safety regulators for Canada’s eastern provinces, the Nova Scotia and Newfoundland Labrador 

Offshore Petroleum Boards, worked with the Norwegians to implement changes they considered 

necessary to safely develop their resources.615 They have replaced many of their prescriptive offshore 

regulations for goal-based rules, moving much of their prescription to guidance documents. The boards 

recognized that this fundamental change allowed for the regulator not only to keep step with industry 

advances, but also to demand continual safety improvement from industry without rule-making.616 

 

608 Ibid. 

609 Ibid. 

610 Melberg , E. Determined to learn from history. August 13, 2010, http://www.npd.no/en/publications/norwegiancontinental-shelf/no1-2010/determined-to-learn-from-history/ (accessed 31 2013, October).

611 Higgins, J. Response to the Ocean Ranger Disaster. Newfoundland and Labrador Heritage, 2012, 

http://www.heritage.nf.ca/articles/politics/ocean-ranger-disaster-response.php (accessed December 17, 2014). 

612 Ibid. This regulatory body is now known as the Canada-Newfoundland and Labrador Offshore Petroleum Board. 

There is also a Canada-Nova Scotia Offshore Petroleum Board which regulates offshore oil and gas industry 

safety for the Nova Scotia and frontier lands and a National Energy Board, which regulates offshore areas not 

otherwise covered by provincial or federal management systems. http://www.neb-one.gc.ca/clfnsi/rthnb/whwrndrgvrnnc/nbfctsht-eng.html (accessed January 26, 2016). 

613 The Ocean Ranger was owned by Ocean Drilling and Exploration Company, an American corporation that had 

been contracted by Mobil Oil to drill; Higgins, J. Response to the Ocean Ranger Disaster. Newfoundland and 

Labrador Heritage, 2012, http://www.heritage.nf.ca/articles/politics/ocean-ranger-disaster-response.php (accessed 

December 17, 2014).

614 Ibid. 

615 Trip notes from CSB meeting with the Canada Newfoundland and Labrador Offshore Petroleum Board 

(CNLOOPB), St. John’s, Newfoundland, Canada (March 7, 2011).

616 Ibid. 

001059
Macondo Investigation Report Volume 4 04/17/2016

124 

Piper Alpha and Regulatory Change in the United Kingdom 

On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the 

coast of Scotland in the North Sea.617 A series of explosions and fire killed 167 workers and almost 

completely destroyed the platform. This accident is the deadliest in the history of the offshore 

operations.618 Multiple systemic, organizational, and regulatory deficiencies caused the incident.619 

The UK government conducted an inquiry that called into question the adequacy of the detailed 

prescriptive regulatory regime that existed at the time of the incident.620 Lord Cullen, the judge leading 

the inquiry, listed 106 recommendations to revamp offshore safety regulation in the UK, which included a 

recommendation for the responsible party providing a written case for safety identifying the hazards and 

demonstrating the adequacy of the safety management systems in place to control for each hazard at every 

offshore site.621 

The intent of the safety case was to shift the responsibility for identifying and mitigating hazards and risks 

from the regulator to the duty holder.622,623 Lord Cullen reasoned that “a regulator cannot be expected to 

assume direct responsibility for the on-going management of safety. ... this is and remains in the hands of 

the operator.”624 The UK government accepted all of the 106 recommendations,625 ushering in new goalsetting regulations to replace the existing prescriptive ones.626 The Offshore Installations (Safety Case) 

Regulations came into force in 1992. By November 1993, a safety case for every installation had been 

submitted to the HSE, and by November 1995, all had had their safety case accepted by the HSE. 

 

617 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty. November, 1990. 

618 John M.T. Balmer, The BP Deepwater Debacle and Corporate Brand Exuberance, 18 J. Brand Mgmt. 97, 100 

(2010).

619 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty. November, 1990; pp 121-22.; John Paterson, The 

Significance of Regulatory Orientation in Occupational Health and Safety Offshore, 38 B.C. Envtl. Aff. L. Rev. 

369 (2011), http://lawdigitalcommons.bc.edu/ealr/vol38/iss2/8 (accessed March 26, 2016). 

620 T. Hunter; J. Paterson; "Offshore Petroleum Facility Integrity in Australia and the United Kingdom: A 

Comparative Study of Two Countries Utilising the Safety Case Regime" OGEL 6 (2011); p 9.

621 Ibid. 

622 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a 

particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. 

Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; 

October 2011; p 2. These entities may include operators, contractors, and subcontractors. 

http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 

623 T. Hunter; J. Paterson; "Offshore Petroleum Facility Integrity in Australia and the United Kingdom: A 

Comparative Study of Two Countries Utilising the Safety Case Regime" OGEL 6 (2011); p 9-10. 

624 Ibid. 

625 180 Parl. Deb., H.C. (6th ser.) (1990) 329-45; John Paterson, The Significance of Regulatory Orientation in 

Occupational Health and Safety Offshore, 38 B.C. Envtl. Aff. L. Rev. 369 (2011), 

http://lawdigitalcommons.bc.edu/ealr/vol38/iss2/8 (accessed March 26, 2016).

626 John Paterson, The Significance of Regulatory Orientation in Occupational Health and Safety Offshore, 38 B.C. 

Envtl. Aff. L. Rev. 369 (2011), http://lawdigitalcommons.bc.edu/ealr/vol38/iss2/8 (accessed March 26, 2016).

001060
Macondo Investigation Report Volume 4 04/17/2016

125 

The Safety Case Regulations require the duty holder of every installation operating in UK waters to 

submit a safety case to HSE for acceptance. The safety case must fully explain the duty holder’s plans for 

managing health and safety and controlling major accident hazards on the installation.627 It must 

demonstrate that the company has established safety management systems, identified risks and reduced 

them to as low as reasonably practicable, introduced management controls, provided a temporary safe 

refuge on the installation, and provided for safe evacuation and rescue.628 Duty holders are required to 

revise and update their safety cases as needed throughout the life cycle of their installation.

Outside the UK, other regulators also heeded the Cullen Report recommendations. A few months after the 

incident, Australia formed the Consultative Committee on Safety in the Offshore Petroleum Industry to 

advise the Minister for Resources on safety issues related to Australia.629 The Committee recommended 

that the key outcomes of the UK Piper Alpha inquiry be implemented in Australia, and regulatory reform 

ensued that made the safety case a requirement for offshore.630 The UK Safety Case Regulations were 

revised in 2005 to improve their effectiveness and reduce the burden of three yearly resubmissions.

Montara and Regulatory Change in Australia

On August 21, 2009, approximately six months prior to the Macondo incident, the Montara Wellhead 

Platform suffered a blowout in the Timor Sea off the coast of Australia.631 The Montara rig caught fire 

and a well leaked tens of thousands of barrels of oil over two-and-a-half months before it was shut 

down.632 Although it was similar to the Macondo event in many ways, including well capping and 

misunderstandings about cement,633 this blowout did not result in any fatalities. At the time of the 

Montara incident, Australia was already using a goal-setting regulation that required operating companies 

to set their own standards based on the hazards and risks posed by their activities, and then follow through 

on their commitment.634 The duty holder on the Montara platform failed to comply with its own well 

construction standards (WCS) in numerous ways, including (1) failure to test the cemented casing shoe 

and subsequent reliance on this untested barrier, (2) reliance on pressure containing corrosion caps 

(PCCCs) as a well barrier when these are not approved in the WCS, (3) failure to install sufficient barriers 

to meet the requirements for long-term suspension of the well, and (4) failure to monitor completion fluid 

 

627 Oil & Gas UK. Piper Alpha Lessons Learnt; 2008; p 5. http://oilandgasuk.co.uk/wpcontent/uploads/2015/05/HS048.pdf (accessed 26 2016, March).

628 Ibid. 

629 Patrick Brazil and Peter Wilkinson, The Establishment of a National Offshore Petroleum Safety Authority (2005) 

24 Australian Resources and Energy Law Journal 87, pp 88-89.

630 T. Hunter; J. Paterson; "Offshore Petroleum Facility Integrity in Australia and the United Kingdom: A 

Comparative Study of Two Countries Utilising the Safety Case Regime" OGEL 6 (2011); pp 15-16.

631 Montara Commission of Inquiry. Report of the Montara Commission of Inquiry; Commonwealth of Australia 

2010: June, 2010; http://www.iadc.org/wp-content/uploads/2016/02/201011-Montara-Report.pdf (accessed March 

26, 2016).

632 Ibid., p 38. 

633 Hayes, J. Operator competence and capacity – Lessons from the Montara blowout; Safety Science 2012, 50, pp 

563-574.

634 Ibid.

001061
Macondo Investigation Report Volume 4 04/17/2016

126 

parameters to ensure overbalance and subsequent reliance on this unmonitored barrier during temporary 

suspension.635

As a result of the accident, the Australian government organized an inquiry to identify the likely causes of 

the release, including regulatory failures.636 The Australian government report confirmed that the blowout 

was immediately caused by the failure of the primary well control barrier—the cement casing shoe.637 In 

addition, the report also criticized the operator’s reliance on improper secondary well control barriers, 

inadequate well management plans, improper pressure testing, and inexperienced personnel.638 The 

Montara blowout was the worst of its kind in Australia’s offshore industry history.639 The inquiry helped 

the Australian government realize that the provincial regulation of offshore safety was inadequate for 

preventing major accident. In other words, no problem was uncovered concerning the quality of the wellintegrity regulations, but a failure of the provincial regulator (the Northern Territory) to adequately 

enforce the existing regulations, primarily based on the authority being too trusting of industry. It has 

since implemented changes to bring offshore operations under the purview of NOPSEMA, a national 

agency with the necessary resources to enforce existing regulations more effectively.

History of Regulatory Change in the US 

The lessons learned from major industrial accidents helped shape the major hazard regulatory regimes 

around the world, both on and offshore. In most cases, post-accident regulatory changes involved 

replacing compliance-based regulations with performance-based, goal-setting risk-reduction models that 

support adaptability and continued risk-reduction to as low as reasonably practicable (ALARP) or some 

roughly equivalent standard, while providing the regulator with the needed resources and tools to drive 

continual improvement among major hazard facilities. 

For example, the international offshore energy industry experienced several catastrophic accidents in the 

1980s, including the Alexander Kielland in Norway in 1980, the Ocean Ranger in Canada in 1982 and 

Piper Alpha in the UK in 1988. These accidents prompted significant shifts in the offshore regulatory 

structures of Norway, Canada, the UK, and Australia from prescriptive compliance-based regulation to 

performance-based goal-setting models. The CSB’s Chevron Regulatory Report also provides a helpful 

discussion of the accidents that spurred global development of the safety case regulatory regime for 

onshore and offshore major hazards.640 

 

635 Ibid.

636 Peter Wilkinson presentation on Montara to CSB, July 2011 (slide 14).

637 Montara Commission of Inquiry. Report of the Montara Commission of Inquiry; Commonwealth of Australia 

2010: June, 2010; p 7. http://www.iadc.org/wp-content/uploads/2016/02/201011-Montara-Report.pdf (accessed 

March 26, 2016). 

638 Ibid., pp 7-11.

639 Ibid., p 5.

640 USCSB, 2013. Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire, Richmond, CA, August 6, 

2012, Report No. 2012-03-I-CA, April 2013, 

http://www.csb.gov/assets/1/19/Chevron_Regulatory_Report_11102014_FINAL_-_post.pdf (accessed January 

25, 2016). See Chapter 3 for a helpful discussion of the accidents that spurred global development of the safety 

case regulatory regime for onshore and offshore major hazards.

001062
Macondo Investigation Report Volume 4 04/17/2016

127 

At the time of the Alexander Keilland accident in 1980, the US GoM OCS region still consisted of 

shallow-water (defined here as less than 1,000 feet) exploration, drilling, and production operations, 

though some offshore drilling operations reached depths of approximately 1,500 feet in the California 

OCS as early as 1975, which were considered “deepwater” drilling operations at the time.641 The GoM 

also enjoys more hospitable weather, as well as calmer seas, minus the occasional hurricane, and warmer 

temperatures than the North Sea. Thus, it is perhaps not surprising that lessons learned overseas in foreign 

offshore oil-producing jurisdictions did not result in full-scale changes to the US offshore regulatory 

regime, especially with an accident such as the Alexander Keilland which was not a drilling platform or 

vessel but an accommodations vessel. Drilling and production regulations in the US thus remained 

prescriptive and focused heavily on equipment rather than on hazard assessments and safety management 

systems. 

Yet a decade later, regulatory changes did not keep pace with changes in the field, as the US GoM OCS 

industry began exploring deeper waters, encountering ever more complex subsea geology and higher 

pressures during more dangerous drilling operations.642 Approximately one year after the Piper Alpha 

incident, when the US experienced its own major offshore event—a 1989 explosion at the ARCO 

platform in the Gulf of Mexico resulting in 7 fatalities643—MMS commissioned a task force to review its 

regulatory program. It also requested that the Marine Board of the National Research Council recommend 

improvements in MMS’s operational safety and environmental protection inspection practices.644 

The National Research Council Marine Board, referencing Piper Alpha, recommended adopting a more 

systems-based risk analysis focused on human factors, operational procedures, and modifications of 

equipment and facilities rather than adding equipment-specific prescriptive regulations.645 The Marine 

Board report identified that MMS’s prescriptive approach to regulating offshore operations actually 

forced industry into a compliance mentality that did not promote effective risk identification or 

comprehensive accident mitigation.646 The Board highlighted its long-held belief that the offshore 

regulatory regime should itself evolve by exploring different inspection, enforcement, and compliance 

 

641 National Commission on the BP Deepwater Horizon Oil Spill. A Brief History of Offshore Oil Drilling; Staff 

Working Paper No. 1; August, 2010; 

http://cybercemetery.unt.edu/archive/oilspill/20121211011815/http:/www.oilspillcommission.gov/sites/default/fil

es/documents/A%20Brief%20History%20of%20Offshore%20Drilling%20Working%20Paper%208%2023%2010

.pdf (accessed March 26, 2016). 

642 Hopkins, A. Disastrous Decisions; CCH Australia: Australia, 2012; p 138. 

643 E.P. Danenberger et al., Investigation of March 19, 1989 Fire, South Pass Block 60 Platform B, Lease OCS-G 

1608, OCS Report MMS 90-0016 (New Orleans: U.S. Dept of the Interior, MMS, April 1990), p 15, as cited in

National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water: The Gulf Oil 

Disaster and the Future of Offshore Drilling; 2011; p 70. It is important to note that the ARCO incident involved 

shallow-water drilling at approximately 200 feet below sea level. See http://incidentnews.noaa.gov/incident/6687

(accessed March 26, 2016). 

644 Committee on Alternatives of Inspection of Outer Continenetal Shelf Operations, Marine Board, Commission on 

Engineering and technical Systms National Reserach Council. Alternatives for Inspecting Outer Continental Shelf 

Operations [Online]; National Academy Press: Washington, 1990; p v, 

http://www.nap.edu/download.php?record_id=1517 (accessed March 26, 2016). 

645 Ibid., p 83. 

646 Ibid. 

001063
Macondo Investigation Report Volume 4 04/17/2016

128 

approaches.647 For example, the Board found that MMS’s program at the time “incorporates no 

mechanism or analytical basis for systematically upgrading safety requirements for OCS operations.”648

Specifically, the Board found that MMS failed to:

• analyze data to identify safety trends; 

• collect data consistently across operators and facilities that would permit such analyses;

• document operator safety histories; or

• cross-reference PINCs (potential incidents of non-compliance) and incidents of noncompliance 

(INCs) to events (accidents).649

The Board recommended that MMS enhance its collection and analysis of safety-related data to “permit 

systematic targeting of spot inspections, and ... to support a variety of continuing safety analysis to be 

used to improve safety and environmental protection on the OCS.”650 The Board noted these activities 

were “essential to an ongoing ‘risk assessment and management’ program.”651 It recommended that MMS 

emphasize “detection of potential accident-producing situations—particularly those involving human 

factors, operational procedures and modifications of equipment and facilities—rather than scattered 

instances of non-compliance and hardware specifications.”652MMS was not slow to act on the Board’s 

recommendations, perhaps because, along with the US Coast Guard, it was preoccupied with the effects 

of the Exxon Valdez oil spill, in March 1989.653

Two years later, in 1991, MMS introduced a regulatory model for offshore safety management, the Safety 

and Environmental Management Program (SEMP).654 Industry pushback led to SEMP stagnating and it 

became a voluntary program whereby MMS asked offshore operators655 to adopt active safety and 

environmental management approaches in their operations.656 

Before the Macondo incident, MMS maintained an insular view of learning from international accidents. 

In particular, eight months prior to the Macondo incident, MMS largely disregarded the causes of a 

blowout in Australian waters from the Montara Wellhead Platform.657 Especially concerning about this 

 

647 Ibid., p v.

648 Ibid., p 81. 

649 Ibid., p 81. 

650 Ibid., p 75. 

651 Ibid., p 75. 

652 Ibid, p 83. 

653 On March 24, 1989, the tanker Exxon Valdez grounded on Bligh Reef in Alaska's Prince William Sound, 

rupturing spilling nearly 11 million gallons of Prudhoe Bay crude oil into the Sound. Before the 2010 Deepwater 

Horizon oil spill, it was the largest single oil spill in US coastal waters.

654 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 56 Fed. Reg. 30400 (Notice, July 2, 1991). 

655 “Operators” as referenced in US offshore regulations refer explicitly to the leaseholders of the well; this term 

does not include drilling contractors or other well service providers.

656 Oil and Gas and Sulphur in the Outer Continental Shelf (OCS)—Safety and Environmental Management 

Systems, 71 Fed. Reg. 29278 (Advanced Notice of Proposed Rulemaking, May 22, 2006).

657 U.S. Chemical Safety and Hazard Investigation Board interview of former MMS Director, April 5, 2011; 

Montara Commission of Inquiry. Report of the Montara Commission of Inquiry; Commonwealth of Australia 

2010: June, 2010; p 7. http://www.iadc.org/wp-content/uploads/2016/02/201011-Montara-Report.pdf (accessed 

March 26, 2016).

001064
Macondo Investigation Report Volume 4 04/17/2016

129 

situation were the similarities between that incident and Macondo,658 and despite differences in the 

regulatory framework between the two countries, and some differences in the operations, sufficient 

similarities between Montara and Macondo blowouts made Montara a missed learning opportunity for 

MMS. For example, the failure of the cement to seal in the well, improper pressure testing, and reliance 

on limited and compromised (or missing) barriers all presented MMS with opportunities to study a major 

offshore accident. This could have aided MMS in identifying potential deficiencies in the US regulatory 

system, or in sharing some lessons learned with industry to enhance major accident prevention in US 

waters. 

MMS might have learned lessons from Montara if it had mechanisms for assessing major incidents and 

implementing needed changes from the lessons learned. But MMS lacked those mechanisms. Despite the 

enormous concern in Australia about the Montara incident, the Director of MMS at the time said, “what 

had happened in Australia was not going to happen here.”659 She also reported the US had little to learn 

 

658 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water: The Gulf Oil 

Disaster and the Future of Offshore Drilling; 2011; p 125 and 327. 

659 U.S. Chemical Safety and Hazard Investigation Board interview of former MMS director, April 5, 2011.

Offshore Operators Historically Opposed SEMP Due to Its Prescriptive Nature 

Industry opposition to SEMP’s incorporation as regulation, as documented in public 

comment (excerpted below) submitted during consideration of the issue, revealed 

industry’s concerns about the limiting and compliance-based nature of a prescriptive 

regime. These concerns could be ameliorated by supplementing the existing 

regulatory structure with the attributes identified in this volume...

“As MMS has noted, most industrial accidents and spill result from human error or 

organizational errors, not device or equipment failures and we agree. So, the question 

is, How do we overcome human error? It is difficult for us to see how a mandatory, 

highly prescriptive program proposed in the rulemaking will overcome human error.” 

— Offshore Operators Committee, OOC/API Comments on Proposed Subpart SSEMS, RIN 1010-AD 15; FR Vol. 74, No. 115, (June 17, 2009). 

“While BP is supportive of companies having a system in place to reduce injuries, 

risks, accidents and spills, we are not supportive of the extensive, prescriptive 

regulations proposed in this rule.” — BP Americaa

 

“The proposed rule takes the approach of incorporating API RP 75 into the 

regulation and then rewords the requirements. Complicating these proven processes 

with additional prescriptive requirements may be detrimental to the overall 

implementation and will take away from the key elements of an integrity management 

system.” — Exxon Mobilb 

 a Comment on Proposed Rule (74 Fed. Reg. 1010-AD15), from Richard Morrison, BP, to MMS, 

(September 19, 2009).

 b Comment on Proposed Rule (74 Fed. Reg. 1010-AD15) from Jonathan Armstrong, Exxon, to MMS 

(September 14, 2009).

001065
Macondo Investigation Report Volume 4 04/17/2016

130 

from the event because Australia’s offshore regulatory standards were not as strong as those in the US.660

The CSB observed that such statements from MMS offshore regulatory personnel made during interviews 

reflected an agency that was not attuned to learning best-practice lessons from other jurisdictions and 

lacked a broader continual learning philosophy aimed at major accident prevention and continued 

improvement. Rather, at the time of the Montara incident, MMS appeared to focus more on issues such as 

offshore production and oil and gas royalty revenue collection than on major accident prevention.661 Thus, 

notwithstanding Montara, it took the Macondo disaster to spur increased dialogue regarding safety 

management offshore in the US. 

History demonstrates that the broad lessons of Macondo were not new. While other regimes made drastic 

changes to their regulatory frameworks after major offshore accidents, it was not until the US had an 

accident in its own waters that change was spurred. In a break from the past, and in an effort to prevent 

similar incidents, the US offshore regulatory regime reorganized and introduced new safety regulations 

beginning in 2010 in the aftermath of Macondo. 

Two months after the Macondo incident, MMS was renamed the Bureau of Ocean Energy Management, 

Regulation and Enforcement (BOEMRE). On October 1, 2010, the revenue collection arm of the former 

MMS moved to its own office, the Office of Natural Resources Revenue.662 In October 2011, thenDepartment of Interior Secretary Salazar created the Bureau of Ocean Energy Management (BOEM) and 

BSEE from the former BOEMRE.663 BOEM, with leasing responsibilities, and BSEE, with environmental 

and safety responsibilities,

664 both report to the same Assistant Secretary for Land and Minerals 

Management, and the heads of these two bureaus still report to Secretary of the Interior.665 According to 

communications from former Secretary Salazar and the Department of the Interior, however, this 

restructuring had been intended to eliminate conflicts associated with the differing missions of promoting 

resource development, enforcing safety regulations, and maximizing revenue from offshore oil and gas 

development.666

The reorganization was in line with the Presidential Oil Spill Commission’s recommendation to create 

“an independent agency within the Department of the Interior with enforcement authority to oversee all 

aspects of offshore drilling safety.”667 The Presidential Commission’s recommendation did not resolve the 

 

660 Ibid. 

661 U.S. Chemical Safety and Hazard Investigation Board interview of former MMS director, April 5, 2011. Issues 

included (1) an offshore renewable energy program, (2) five-year plans for offshore oil and gas production under 

the OCSLA, (3) environmental sensitivity analysis for the current five-year plan, and (4) ongoing issues about oil 

and gas royalty revenue collection.

662 Fact Sheet, BSEE and BOEM Separation: An Independent Safety, Enforcement and Oversight Mission (January 

19, 2011). http://www.bsee.gov/uploadedFiles/BOEMRE%20Reorganization%20Fact%20Sheet(1).pdf (accessed 

March 26, 2016).

663 Ibid. 

664 The US Coast Guard shares responsibility with BSEE for regulating safety and the environment offshore.

665 Secretarial Order No. 3299 (May 19, 2010). 

666 BSEE. The Reorganization of the Former MMS. http://www.bsee.gov/About-BSEE/BSEEHistory/Reorganization/Reorganization/ (accessed March 26, 2016).

667 National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water: The Gulf Oil 

Disaster and the Future of Offshore Drilling; 2011; Recommendation A4; p 256. Both the US Coast Guard 

(regulates safety of navigation and environmental protection on OCS units and vessels) and BSEE have shared 

001066
Macondo Investigation Report Volume 4 04/17/2016

131 

inherent problems associated with the Secretary of Interior’s continued responsibility for missions that 

often conflict with one another. The Department of the Interior retains offshore production and revenue 

collection authority. In addition, the various bureaus and services that compose the Interior Department 

are not independent agencies; each is part of a strict, hierarchical structure with the Secretary at the top of 

the pyramid.668 These line bureaus also operate only on delegated authority because the statutes they 

implement do not even mention the bureaus.669 Instead, final decision authority remains with the 

Secretary.670 

Once BSEE was created, the agency made an effort to increase its staffing and hire additional inspectors. 

According to former BSEE Director James Watson, between April 2010 and March 2012, BSEE 

increased its number of inspectors by 50 percent and its number of engineers by nearly 10 percent.671 In 

conjunction with changes to the regulatory body, new safety regulations were also established. The Safety 

and Environmental Management Systems (SEMS) rule is the new regulation through which BSEE 

oversees oil and gas offshore safety. Its stated purpose is to ensure safe operations on the OCS. In 

promulgating this regulation, BSEE stated that “requiring operators to implement SEMS will reduce the 

risk and number of accidents, injuries, and spills during OCS activities.”672 The final rule, issued in 

October 2010, incorporated by reference and made mandatory API RP 75(3rd edition). As a result, SEMS 

established requirements pertaining to 13 specific safety management elements, including hazard 

analysis, management of change, operating procedures, and training, among others.673 Any permissive 

language found in API RP 75 was also amended in the final version of the rule and made mandatory. 

 

responsibilities for safety regulation on the OCS. The two entities have a Memorandum of Agreement to establish 

a process for the identifying offshore safety and environmental management requirements within the jurisdiction 

of both agencies and to spur joint development of policies and guidance. See 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Publications_Library/BSEEUSCG%20MOA_FINAL%20SIGNED%2004-30-13.pdf (accessed January 6, 2016). 

668 George Cameron Coggins and Doris K. Nagel, Nothing Beside Remains: The Legal Legacy of James G. Watt’s 

Tenure as Secretary of the Interior on Federal Land Law and Policy, 17 B.C. ENV’TL. AFF. L. REV. 473, 482 

(1990). 

669 Since the Secretary of the Interior created each bureau without presidential or congressional direction, the 

bureaus are operating through authority delegated to the Secretary, not to the head of the bureaus. Thus, the 

bureaus are purely creations of the Secretary of the Interior.

670 George Cameron Coggins and Doris K. Nagel, Nothing Beside Remains: The Legal Legacy of James G. Watt’s 

Tenure as Secretary of the Interior on Federal Land Law and Policy, 17 B.C. ENV’TL. AFF. L. REV. 473, 482 

(1990). 

671 Watson, J. Statement of James Watson, Director Bureau of Safety and Environmental Enforcement United States 

Department of the Interior Committee on Appropriations Subcommittee on Interior, Environment and Related 

Agencies House of Representatives; March 7, 2012; 

http://www.bsee.gov/uploadedFiles/BSEE/Newsroom/Congressional_Testimony/Congressional%20Testimony%2

020120307.pdf (accessed March 26, 2013). Director Watson noted that there was still a considerable number of 

positions to be filled, including additional inspectors, engineers, regulatory specialists, and other disciplines. 

672 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 75 Fed. Reg. 63609 (Final Rule, October 15, 

2010) (to be codified at 30 C.F.R. Part 250).

673 30 C.F.R. § 250, Subpart S (2011).

001067
Macondo Investigation Report Volume 4 04/17/2016

132 

In April 2013, BSEE published additional safety provisions as amendments to SEMS. Informally called 

“SEMS II,”674 it provided additional requirements for stop-work authority and ultimate work authority, 

employee participation in developing and implementing SEMS programs, reporting unsafe working 

conditions, conducting independent third-party audits of operators’ SEMS programs, and performing job 

safety analyses (JSAs) for activities identified in an operator’s SEMS program. 

 

674 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety and Environmental 

Management Systems, 78 Fed. Reg. 20423 (Final Rule, April 5, 2013) (to be codified at 30 C.F.R. Part 250).

001068
Macondo Investigation Report Volume 4 04/17/2016

133 

By the

U.S. Chemical Safety and Hazard Investigation Board

 Vanessa A. Sutherland

 Chairperson

Manuel Ehrlich

 Member

 Rick Engler

 Member

 Kristen Kulinowski

 Member

 

Date of Board Approval: April 17, 2016 

001069
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATIVE STUDY 

REPORT NO. 2011-H-1 

SEPTEMBER 2011

Final Report

PUBLIC SAFETY AT OIL AND GAS STORAGE 

FACILITIES

MULTIPLE SITES

(44 FATALITIES, 25 INJURED) 

26 INCIDENTS FROM 

1983-2010 

KEY ISSUES: 

 OIL AND GAS EXPLORATION AND PRODUCTION FACILITIES PRESENT HAZARDS TO MEMBERS OF 

THE PUBLIC INCLUDING CHILDREN

 SECURITY MEASURES ARE INSUFFICIENT AT EXPLORATION AND PRODUCTION FACILITIES 

 REGULATIONS AND INDUSTRY STANDARDS DO NOT PROVIDE UNIFORM, EFFECTIVE GUIDANCE

001070
Final Report September 2011 

2 

Table of Contents

1.0 EXECUTIVE SUMMARY ............................................................................................................. 6

1.1 Oil and Gas Storage Sites Present a Hazard in Rural Areas ............................................................ 6

1.2 CSB Study ........................................................................................................................................ 7

1.3 Findings from Oil and Gas Site Incidents ........................................................................................ 7

1.4 Recommendations ............................................................................................................................ 9

2.0 HAZARD AT OIL AND GAS PRODUCTION FACILITIES ..................................................... 10

2.1 CSB Outreach ................................................................................................................................ 10

2.2 Study Methodology ........................................................................................................................ 10

3.0 CHARACTERISTICS OF OIL AND GAS STORAGE FACILITIES ......................................... 11

3.1 Process Overview........................................................................................................................... 11

3.1.1 Measuring Flammability Properties at Oil and Gas Facilities .......................................... 12

3.2 Close Proximity of Oil and Gas Facilities to Residents ................................................................. 13

4.0 INCREASE IN OIL AND GAS STORAGE SITES POSES INCREASED RISK ....................... 15

5.0 OIL AND GAS TANK EXPLOSIONS IN THE U.S. FROM 1983 TO 2010 .............................. 16

6.0 CSB INVESTIGATIONS, 2009-2010 ........................................................................................... 17

6.1 Delphi Oil, Carnes, Mississippi ..................................................................................................... 18

6.1.1 Incident Details ................................................................................................................. 18

6.1.2 Incident Site ...................................................................................................................... 20

6.1.3 Flammability ..................................................................................................................... 20

6.1.4 Access, Fencing, Warning Signs, and Security ................................................................ 21

6.1.5 Recognition of Oil and Gas Site Hazards ......................................................................... 21

6.2 Three MG Family, Weleetka, Oklahoma ....................................................................................... 22

6.2.1 Incident Details ................................................................................................................. 22

6.2.2 Incident Site ...................................................................................................................... 23

6.2.3 Flammability ..................................................................................................................... 24

6.2.4 Access, Fencing, Warning Signs, and Security ................................................................ 24

6.3 MC Production, New London, Texas ............................................................................................ 25

6.3.1 Incident Details ................................................................................................................. 25

6.3.2 Incident Site and Flammability ......................................................................................... 25

001071
Final Report September 2011 

3 

6.3.3 Access, Fencing, Warning Signs, and Security ................................................................ 26

6.4 Recreational Use of Oil and Gas Sites ........................................................................................... 27

6.4.1 Survey Methods ................................................................................................................ 27

6.4.2 Survey Results .................................................................................................................. 28

7.0 INHERENTLY SAFER TANK DESIGN ..................................................................................... 28

8.0 OVERSIGHT OF SECURITY AT OIL AND GAS STORAGE FACILITIES ............................ 29

8.1 Mississippi Oil and Gas Rules ....................................................................................................... 30

8.1.1 County Rules: Oil and Gas Well Sites in Forrest County, Mississippi ............................ 30

8.1.2 State of Mississippi Regulations ....................................................................................... 31

8.1.3 Communication with the Mississippi Oil and Gas Board ................................................. 32

8.1.4 Tanks with Hydrogen Sulfide ........................................................................................... 32

8.1.5 Role of Local Municipalities ............................................................................................ 33

8.1.6 Forrest County Local Ordinance ....................................................................................... 33

8.1.7 New Tank Storage Site Security Measures: Mississippi Oil and Gas Board .................... 33

8.2 State of Oklahoma Oil and Gas Rules ........................................................................................... 34

8.2.1 Oklahoma Lacks Oil and Gas Sites Security Requirements ............................................. 34

8.2.2 Tanks with Hydrogen Sulfide ........................................................................................... 34

8.2.3 Tank Hatch Security ......................................................................................................... 35

8.3 Texas Oil and Gas Rules ................................................................................................................ 36

8.3.1 Texas lacks oil and gas security requirements .................................................................. 36

8.3.2 Hydrogen Sulfide Storage Tanks ...................................................................................... 36

8.3.3 State/Municipal Storage Tank Site Security Policies ....................................................... 37

8.4 Other State Oil and Gas Rules ....................................................................................................... 39

8.4.1 Ohio Oil and Gas Rules .................................................................................................... 39

8.4.2 California Oil and Gas Rules ............................................................................................ 39

8.5 Federal Regulations ....................................................................................................................... 40

8.5.1 Federal OSHA Regulations............................................................................................... 40

8.5.2 The Hazard Communication Standard (29 CFR 1910.1200) ............................................ 41

8.5.3 Flammable and Combustible Liquids Standard (29 CFR 1910.106) ................................ 41

8.6 Environmental Protection Agency (EPA) ...................................................................................... 42

8.6.1 Clean Water Act (CWA) ................................................................................................... 42

8.6.2 Clean Air Act Amendments .............................................................................................. 43

001072
Final Report September 2011 

4 

8.7 Industry Standards and Guidance .................................................................................................. 46

8.7.1 American Petroleum Institute (API) ................................................................................. 46

8.7.2 API Standard 2610 ............................................................................................................ 46

8.7.3 API Recommended Practice 74 ........................................................................................ 47

8.7.4 API Oil and Natural Gas Industry Security Assessment and Guidance ............................ 48

8.7.5 National Fire Protection Association (NFPA) .................................................................. 48

8.7.6 NFPA 30 ........................................................................................................................... 49

8.7.7 NFPA 30A ........................................................................................................................ 49

8.7.8 NFPA 730 ......................................................................................................................... 50

9.0 CSB FINDINGS ............................................................................................................................ 50

10.0 RECOMMENDATIONS ............................................................................................................... 52

11.0 APPENDIX A: PREVIOUS INCIDENTS ................................................................................... 56

 

001073
Final Report September 2011 

5 

Abbreviations

API American Petroleum Institute 

bbl Barrel (42 U.S. gallons) 

CSB U.S. Chemical Safety Board 

E&P Exploration and Production 

EIA U.S. Energy Information Administration 

EPA U.S. Environmental Protection Agency 

GOR Gas Oil Ratio 

MSO&GB Mississippi Oil and Gas Board 

NFPA National Fire Protection Association 

OCC Oklahoma Corporation Commission 

OSHA U.S. Occupational Safety and Health Administration 

psig Pounds per square inch gauge 

RRC Railroad Commission of Texas 

001074
Final Report September 2011 

6 

1.0 Executive Summary 

1.1 Oil and Gas Storage Sites Present a Hazard in Rural Areas 

On October 31, 2009, two teenagers, aged 16 and 18, were killed when a petroleum storage tank exploded 

in a rural oil field in Carnes, Mississippi. Six months later a group of youths were exploring a similar tank 

site in Weleetka, Oklahoma, when an explosion and fire fatally injured one individual. Two weeks later, a 

25-year-old man and a 24-year-old woman were on top of an oil tank in rural New London, Texas, when 

the tank exploded, killing the woman and seriously injuring the man. In April 2010, the U.S. Chemical 

Safety Board (CSB) initiated an investigation into the root causes of these tragic incidents. All three 

incidents involved rural unmanned oil and gas storage sites that lacked fencing and signs warning of the 

hazards, which might have otherwise deterred members of the public from using them as places to gather. 

Oil and gas storage sites are part of the landscape in many rural American communities and an important 

component of the country’s vast system of oil and gas exploration and production. Over 800,000 crude oil 

and natural gas producing facilities are distributed across the U.S., often located in wooded clearings or 

other isolated locations. 

However, in many states, these sites can be placed as close as 150 to 300 feet from existing residences, 

schools, churches and other structures. Only in a few large cities where these sites exist – Houston, 

Oklahoma City, and Los Angeles – are constraints placed on the location of the facilities within the city 

limits.1

 

In most cases, however, these sites are away from public view, often unfenced, unsupervised, and lacking 

warning signs. They have proven to be a tempting venue for young people looking for a place to gather, 

 

1

 New Jersey Petroleum Council and The American Petroleum Institute. Oil and Natural Gas Industry Security 

Assessment and Guidance. 2002. 

<http://www.nj.gov/dep/rpp/brp/security/downloads/NJ%20Best%20Practices%20Petroleum%20Sector.pdf> 

001075
Final Report September 2011 

7 

and socialize. Activities where an ignition source is introduced into the tank, or even the presence of 

static electricity or lightning, can cause hydrocarbon vapors in the tanks to ignite and explode. 

1.2 CSB Study 

To prevent future deaths and injuries, the CSB investigated the root causes of the three incidents and 

conducted an analysis of the regulatory framework that contributed to the prevalence of this type of event. 

The CSB examined federal, state, and local regulations; inherently safer designs of tanks; and industry 

standards and practices recommended by the American Petroleum Institute (API) and the National Fire 

Protection Association (NFPA). The CSB also administered a survey to gauge the public’s view of these 

sites and the issues arising from their presence in the community. Among 190 survey recipients in a rural 

Mississippi community, 11 percent of respondents stated they had “hung out at oil sites.” When asked 

about the type of activity engaged in at oil sites, 14 percent stated they socialized; 19 percent said that 

they rode four-wheelers at oil sites; and 11.5 percent stated that they hunted. 

This CSB study provides recommendations to strengthen security at exploration and production (E&P) 

sites to include fencing, warning signage, locking of all hatches and using inherently safer tank features to 

prevent future incidents. 

1.3 Findings from Oil and Gas Site Incidents 

The CSB found the three explosions in Mississippi, Oklahoma, and Texas could have been prevented or 

made less likely by restricting access to the facilities, by providing warning signage, by securing the 

hatches on the tanks or utilizing inherently safer tank design at these facilities. The growing number of oil 

and gas facilities nationally, their accessibility to members of the public, and the lack of awareness among 

the public about the hazards posed by the tanks suggest a potential for similar incidents. The CSB makes 

the following key findings: 

001076
Final Report September 2011 

8 

1. Members of the public, most often children and young adults, commonly visit oil and gas 

production sites without authorization for recreational purposes. 

2. Members of the public gain access to production tanks via attached unsecured ladders and 

catwalks, and may come into contact with flammable vapors from tank vents or unsecured 

tank hatches. 

3. Members of the public, unaware of the explosion and fire hazards associated with the tanks, 

unintentionally introduce ignition sources for the flammable vapor, leading to explosions. 

4. The CSB identified 26 similar incidents between 1983 and 2010, which resulted in a total of 

44 fatalities and 25 injuries. All the victims were 25 years of age or less. 

5. The three incidents investigated by the CSB in 2009-2010 occurred in isolated, rural wooded 

areas at production sites that were unfenced, did not have clear or legible warning signs, as 

required under OSHA’s Hazard Communication Standard, and did not have hatch locks to 

prevent access to the flammable hydrocarbons inside the tanks. 

6. The storage tanks did not include inherently safer design features to prevent tank explosions. 

Safer design features used in the downstream, refining sector would likely prevent tank 

explosions at E&P sites. These include the use of vents fitted with pressure-vacuum devices, 

flame arrestors, vapor recovery systems, floating roofs or an equivalent alternative.

7. E&P storage tanks are exempt from the security requirements of the Clean Water Act and 

from the risk management requirements of the Clean Air Act.

8. Industry guidance from the American Petroleum Institute recommends specific security 

measures for storage tanks of refined petroleum products but not for storage tanks at upstream 

E&P sites, and the National Fire Protection Association standards do not adequately define 

security expectations where these deadly incidents occurred.

9. Some states, including California and Ohio, and some localities have mandated security 

(including fencing, locked or sealed tank hatches, and warning signs) for E&P sites, 

particularly in urban areas. As a result, despite its large role as an oil producing state with 

many of these types of facilities, none of the 26 incidents occurred in California. However, 

many other large oil and gas producing states have no such requirements (except for certain 

E&P sites where toxic hydrogen sulfide gas is present).

001077
Final Report September 2011 

9 

1.4 Recommendations 

As a result of the findings from this study, the CSB makes recommendations to the following 

recipients: 

 U.S. Environmental Protection Agency (EPA) 

 Mississippi Oil and Gas Board 

 Oklahoma Compact Commission 

 Texas Railroad Commission 

 American Petroleum Institute (API) 

 National Fire Protection Association (NFPA) 

001078
Final Report September 2011 

10 

2.0 Hazard at Oil and Gas Production Facilities 

Between October 2009 and April 2010, four teenagers and young adults lost their lives from explosions at 

three different oil and gas production sites in rural Mississippi, Oklahoma, and Texas. The CSB first 

became aware of this hazard in 2003 when a similar explosion in Palestine, Texas, fatally injured four 

teenagers. In 2010, the CSB initiated an investigation to further examine the issue. The CSB found 26 

similar incidents involving explosions and fires at oil and gas production sites. 

2.1 CSB Outreach 

After the CSB’s initial deployment to a tank explosion in Carnes, Mississippi, the agency created a safety 

video targeting individuals under the age of 25 to increase awareness of the hazards posed by oil and gas 

sites. The safety video, “No Place to Hang Out: The Danger of Oil Sites,” incorporates the experiences of 

the victims’ friends, families, and community leaders in Carnes, and is intended to be integrated into high 

school and middle school curricula. The CSB distributed this video to school superintendents across 

Mississippi and continues to work with safety advocates in an effort to reach young people who live in oil 

and gas producing communities. 

2.2 Study Methodology 

To further understand why these incidents were occurring across the country, the CSB deployed to and 

investigated the three oil and gas tank explosions discussed above and collected information on 23 similar 

explosions across the country. Investigators interviewed key witnesses and first responders at each of the 

three incident sites and gathered exploration and production (E&P) site records from each state oil and 

gas regulator. Incident reports for the 23 additional incidents were requested from local responders. A 

survey of high school students and community members in Carnes, Mississippi, was administered to 

understand the use of and hazard awareness at oil and gas facilities. The CSB then analyzed safety and 

001079
Final Report September 2011 

11 

security regulations at the local, state, and federal level as well as relevant industry standards in order to 

identify systemic gaps and formulate recommendations aimed at preventing future incidents. 

3.0 Characteristics of Oil and Gas Storage Facilities 

3.1 Process Overview 

At typical E&P sites, crude oil and natural gas are pumped from underground hydrocarbon reservoirs to 

the surface. The well stream is connected to a piping system that transports hydrocarbons to an oil-gas 

separator where gas and water are removed from crude oil. The oil is then transferred to storage tanks in 

a tank battery2

 until it is pumped into a transport truck for eventual sale (Figure 3-1). 

In states where vapor recovery systems3

 are not mandated,4 oil tanks are usually equipped with a tank 

hatch5

 and an atmospheric vent on the surface (Figure 3-1). Oil field workers regularly check liquid levels 

through the hatch, which is accessible by a walkway or catwalk.6

 The oil-gas separator also contains an 

atmospheric vent that releases hydrocarbon vapors. 210-barrel capacity atmospheric storage tanks –

which were involved in two of the three explosions investigated by the CSB – are commonly used to store 

crude oil and condensate at E&P facilities throughout the U.S. These tanks are rated for petroleum 

liquids with a vapor pressure of less than 0.5 psig7

 and are selected “based on vapor pressure, flash point, 

potential for explosion, temperature and specific gravity.”8

 If circumstances change inside the tank and 

 

2

 A tank battery is an installation of several tanks at E&P facilities. 

3

 A vapor recovery system consists of a sealed vapor gathering system capable of collecting the hydrocarbon vapors and gases 

discharged and a vapor disposal system capable of processing such hydrocarbon vapors and gases so as to prevent their 

emission into the atmosphere. 

4

 California state law requires oil and gas sites located in non-attainment (non-compliant) air pollution areas to capture all 

hydrocarbon vapors produced in a stock tank and cycle them through a vapor recovery system. 

5

 A tank hatch is a covered opening on the surface of a tank. 

6

 A catwalk is the stair or ladder leading to and providing access to the top of a tank or vessel. 

7

 Myers, P.E. Aboveground Storage Tanks. 1997. NY: McGraw-Hill, p. 25. 

8 Ibid.

001080
Final Report September 2011 

12 

the internal pressure increases significantly above its pressure rating, the tank loses its structural integrity 

and fails. 

3.1.1 Measuring Flammability Properties at Oil and Gas Facilities 

The flammability of the product at E&P facilities varies depending on the geology of the formation and 

can change over time. The flammability of crude oil and condensate may be characterized by specific 

gravity (weight per volume), American Petroleum Institute (API) gravity, and the gas oil ratio (GOR). 

The higher the API gravity, the lighter and more flammable the compound; materials below an API 

gravity value of 35 are characterized as crude oil, while those above 45 are considered condensate. Light 

crudes generally exceed 38 degrees API and heavy crudes have an API gravity of 22 degrees or below. 

Figure 3-1: Basic schematic of oil and gas production facility. 

001081
Final Report September 2011 

13 

Intermediate crudes fall in the range of 22 degrees to 38 degrees API gravity. API gravity is measured 

using stock oil taken from the storage tanks and is often reported to state oil and gas boards upon initial 

production from a well. The Gas Oil Ratio (GOR) measures the dissolved natural gas remaining in a well 

stream at a specific pressure and temperature and is a ratio of the gas produced for each barrel of stock oil 

in standard cubic feet per barrel (scf/bbl). 

In addition to being flammable, crude oil and associated produced water (also referred to as brine) may 

contain varying levels of hydrogen sulfide9

 depending on the geology of the hydrocarbon reservoir. 

Crude oil storage sites containing hydrogen sulfide are typically subjected to stronger regulatory 

requirements. 

3.2 Close Proximity of Oil and Gas Facilities to Residents 

In most states oil and gas leases are divided into a mineral10 and surface estate11. In the past, both the 

surface and mineral estates were transferred when a property was sold. It is now common for mineral 

estates and surface estates to be severed and sold separately. However, federal and state laws allow 

dominance of mineral estate rights over the rights of the surface estate. This supremacy allows mineral 

estate owners to lease their rights to oil and gas operators, who utilize the surface estate to access the 

minerals beneath the surface.12 Although requirements vary across states, surface estate owners can 

refuse access to the minerals estate owners or charge a fee for access. While some states may institute 

“accommodation” statutes that enable a surface estate owner to reduce the impact of the exploration 

activities to the surface, such an agreement is not required by an operator who has leased the mineral 

 

9

 Hydrogen sulfide is hazardous and deadly at low concentrations with an Immediately Dangerous to Life and Health 

concentration of 100 parts per million-(ppm) in air. 

10 Mineral estate refers to the ownership of mineral rights or “mineral interest”-- all unusual organic and inorganic substances in 

the soil giving it value on a property. 

11 Surface estate refers to the ownership of the surface of a property above the mineral estate. 

12 Texas Rail Road Commission. Oil & Gas Exploration and Surface Ownership. 

< http://www.rrc.state.tx.us/about/faqs/SurfaceOwnerInfo.pdf> 

001082
Final Report September 2011 

14 

estate from its owner.13 Additionally, once an oil or gas operator obtains a mineral lease, drilling 

operations can occur in close proximity to existing residences, without notifying the surface owner. 

In both urban and rural areas, drilling may occur within a few hundred feet of residences. For example, in 

many states, minimum requirements for the placement of oil sites and tank storage facilities range from 

150 to 300 feet from existing residences, schools, churches, and other structures.14 CSB investigators 

observed that a number of oil and gas production facilities in Mississippi, Oklahoma, and Texas are 

unsecured and located within rural communities and in close proximity to residences. The CSB also 

learned that although the mineral estate can be leased to an oil or gas operator, unless stipulated otherwise 

in the leasing agreement, the surface estate owner can concurrently lease the surface rights of the same 

property as part of hunting leases or for other uses. 

 

13 Court of Appeals of Mississippi. No. 2003-CA-01572-COA. MS: Turner vs EOG Resources.

<http://caselaw.findlaw.com/ms-court-of-appeals/1243004.html> 

14 Colorado Law Institute. Comparison of State Oil and Gas Regulations and Local Ordinances Regarding Setbacks 

for the Intermountain West. 2009. 

<http://www.oilandgasbmps.org/laws/setback.standards.comparison.10.8.09.pdf> 

001083
Final Report September 2011 

15 

4.0 Increase in Oil and Gas Storage Sites Poses Increased Risk 

As the number of oil production sites and 

the population density increase, so does the 

likelihood that young people will access oil 

sites as places to “hang out.” In 2009, the 

Energy Information Administration (EIA) 

reported that there were at least 363,459 

active oil and 461,388 active gas well sites 

throughout the U.S.15 Approximately 85 

percent of oil and gas wells are small 

producers generating 15 barrels of oil 

equivalent per day (BOE/day)16 or less.17 

The EIA data demonstrate a general increase in drilling activity over the past decade (Figure 4-1). In 

addition, drilling in shale for natural gas exploration and development has nearly doubled from 2009 to 

2010 and active wells increased from 11,657 to 20,388.18 The increase in oil and gas drilling activity for 

crude oil and natural gas exploration creates an increase in the number of oil and gas production sites, 

likely increasing the risk to members of the public. 

 

15 The Energy Information Administration. United States Total 2009, Distribution of Wells by Production Rate 

Bracket. < http://www.eia.gov/pub/oil_gas/petrosystem/us_table.html> 

16 Barrels of Oil Equivalent per day is used in the production or distribution of oil. One barrel of oil has the same 

amount of energy content as 6,000 cubic feet of natural gas. 

17 The Energy Information Administration. United States Total 2009, Distribution of Wells by Production Rate 

Bracket. <http://www.eia.gov/pub/oil_gas/petrosystem/us_table.html> 

18 The Energy Information Administration. Annual Energy Outlook 2011. 

<http://www.eia.gov/forecasts/aeo/pdf/0383(2011).pdf> 

4-1: EIA U.S. Onshore Crude Oil and Natural Gas Rotary 

Rigs in Operation

001084
Final Report September 2011 

16 

5.0 Oil and Gas Tank Explosions in the U.S. from 1983 to 2010 

Through media searches, the CSB identified 26 similar incidents that occurred from 1983 to 2010 at oil 

and gas production sites in 10 different states (Figure 5-1). These incidents resulted in 44 fatalities and 25 

injuries to members of the public under 25 years of age (Appendix A). The majority of these incidents 

occurred in rural areas, where the sites lacked security and safety measures such as fencing, warning 

signs, or locks on tank hatches. The CSB collected investigation reports from oil and gas boards, local 

fire departments, and/or state environmental agencies detailing the circumstances and consequences of 

these incidents (Appendix A). The reports illustrate the explosion hazard to members of the public who 

wander into these sites for recreational purposes. The data are limited to accidents covered in the media, 

since a central database for tracking incidents involving members of the public does not exist. For this 

reason, a background rate of the frequency of these incidents could not be obtained. However, the CSB 

found these incidents are occurring consistently, 

although the data were not sufficient to 

demonstrate a meaningful trend. 

Of the incidents reviewed, the CSB concluded 

that 82 percent of the fatally injured victims were 

teenagers and 18 percent were young adults 

between the ages of 20-25. Sixty-nine percent of 

the incidents involved multiple injuries or 

fatalities. 

The majority of the 26 incidents occurred in Texas (27 percent) and Oklahoma (27 percent); however the 

remaining 46 percent of incidents occurred in oil and gas production states throughout the country (Figure 

5-2). The CSB discovered approximately 84 percent of the 26 incidents occurred in areas that did not 

have any state or local zoning ordinances that required security fencing, signs, or hatch locks to 

Figure 5-1: Oil and Gas Storage Tank Explosions 

across 10 states, 1983-2011

001085
Final Report September 2011 

17 

discourage site access. Only 16 percent of the incidents occurred in areas where zoning ordinances 

appeared to require fencing for sites in urban locations. (See Appendix A for more details on incidents). 

Figure 5-2: Map of oil and gas production facility explosions from 1983-2010 that killed or injured 

members of the public. 

6.0 CSB Investigations, 2009-2010 

The CSB investigated the three recent incidents described in this section to develop a more thorough 

understanding of why tank explosions continue to occur at E&P sites. 

001086
Final Report September 2011 

18 

6.1 Delphi Oil, Carnes, Mississippi 

6.1.1 Incident Details 

On October 31, 2009, two teens from Carnes, Mississippi, were fatally injured when a tank of gas 

distillate exploded at a rural oil and gas storage site located near several residences. The two teenagers, 18 

and 16, arrived at the home of one of the victims at approximately 11:00 p.m. on October 30, 2009. 

Between midnight and 4 a.m., the victims drove to the adjoining gas well site located approximately 150 

yards from the home in a nearby clearing in the woods. At approximately 4:00 a.m. a violent explosion 

occurred inside one of the site’s two storage tanks. 

Figure 6-1: Delphi Oil gas production site, Carnes, Mississippi 

001087
Final Report September 2011 

19 

The force of the explosion propelled the upper part of the tank approximately 225 feet while the bottom of 

the tank was thrown about 60 feet in the opposite direction. The tank’s vent pipe and hatch detached from 

the tank top and landed over 300 feet away (Figure 6-2B). The 

exploding tank lost all its contents, triggering a large fire up to 200 

feet high that persisted for about four hours. The fire prevented first 

responders from accessing the sign containing Delphi Oil’s emergency 

contact information, which was located at the well head within the fire 

zone (Figure 6-3). Both teenagers were killed instantly; their bodies 

were found approximately 120 feet from the original location of the 

tank. Forrest County Sheriff photographs taken immediately 

following the incident demonstrate the two victims were thrown from 

the catwalk. Although a cigarette lighter was found at the site there 

was no evidence that it was the ignition source.19 CSB staff traveled to 

 

19 Ignition sources may include matches, lighters, cigarettes, lightning, static electricity, and in some cases pyrophoric iron 

sulfide. 

Figure 6-2: A) Remnants of exploding tank 

B) Tank hatch located approximately 300ft from berm 

C) Bottom of tank found 60 feet from berm in adjacent wooded area

Figure 6-3: Delphi Oil gas 

production site identification sign

001088
Final Report September 2011 

20 

the incident site in November 2009 and January 2010 and interviewed emergency responders, neighbors, 

family members, and friends of the victims. 

6.1.2 Incident Site 

The explosion and fire occurred at an active natural gas well site 

leased by Delphi Oil, an oil and gas producer based in Baton Rouge, 

Louisiana. Delphi Oil began exploring and developing the site in 

November 2006, when it obtained the mineral leases to a number of 

lots in Forrest County. Delphi Oil leased approximately 400 acres 

of mineral rights for the Delphi Oil 5-18 No. 1 gas production well. 

The site produced natural gas and gas condensate,20 a mixture of 

light hydrocarbons, which was stored in a 210-barrel21 capacity 

tank interconnected to an adjacent 210-barrel tank that stored brine. 

Each tank had a six-inch diameter hatch and a vent pipe located on 

the roof that was open to the atmosphere. 

6.1.3 Flammability 

At the time of the incident, the exploding tank contained 

approximately 14 barrels of condensate. According to records from 

the Mississippi Oil and Gas Board (MSO&GB), the distillate from the well had an API gravity of 50 

degrees, indicating the presence of a highly volatile hydrocarbon mixture. 

 

20 Condensate: A flammable natural gas liquid recovered from gas wells using separation equipment.

21 A barrel is a unit of volume equal to 42 U.S. gallons. 

Figure 6-4: Delphi Oil gas production 

site surrounded by woods

Figure 6-5: Oil and gas production site 

in Carnes, Mississippi with elevated 

catwalk

001089
Final Report September 2011 

21 

6.1.4 Access, Fencing, Warning Signs, and Security 

This particular gas well site is located in a rural clearing surrounded by woods (Figures 6-1 and 6-4) 

approximately 500 feet from an adjacent residential property. It is readily accessible from a number of 

foot trails in the woods and an unsecured dirt access road. At the time of the explosion, the site did not 

have signage to warn of the hazardous contents of the tanks, hatch locks, perimeter or equipment fencing 

to deter public access, nor were the tanks designed to avoid an internal vapor explosion. 

6.1.5 Recognition of Oil and Gas Site Hazards 

Rural oil and gas tank production sites are often in remote locations that are cleared for the installation of 

extraction and storage equipment. Residents and friends of the victims told CSB investigators that prior 

to the incident, they did not view oil and gas production sites as dangerous, as they were part of the 

landscape. Many had grown up in close proximity to oil rigs and tank storage sites and used them as 

common gathering locations for recreational purposes such as socializing, hunting, and driving all-terrain 

vehicles. The CSB learned that a number of hunting leases in the area incorporate oil and gas sites and 

their storage facilities, and some residents described using the sites’ elevated catwalks (Figure 6-5) and 

the tanks as platforms for hunting. 

001090
Final Report September 2011 

22 

6.2 Three MG Family, Weleetka, Oklahoma 

6.2.1 Incident Details 

On April 14, 2010, a 210-barrel capacity tank exploded at an oil and gas production site in rural 

Weleetka, Oklahoma, fatally injuring a 21-year-old male and causing second-degree burns to a 26-yearold male. At the time of the explosion, a group of six young adults and teenagers, ages 18 to 32, were 

socializing at the oil and gas site. They were on their way to an isolated location along the North 

Canadian River in Oklahoma, when they turned off onto a rural dirt road, which also provided access to 

the oil and gas site. According to witness testimony, rather than continue directly to the riverbank, the 

group stopped at the oil and gas site about a half mile from their intended destination at approximately 

8:30 p.m. Shortly thereafter, witnesses said the victim ascended stairs to the catwalk that accessed the 

three oil storage tanks belonging to Three MG Family, Inc. Witnesses said that the victim looked into the 

hatch of tank 4-22, possibly while smoking; at the same time another friend was walking behind him in 

the dark and struck his lighter to see. Vapors from the tank ignited and an explosion ensued. 

A fireball engulfed the victim, causing third degree burns covering up to 95 percent of his body. The 

Weleetka Fire Department received a 9-1-1 call at 9:06 p.m. and, upon arrival at the scene, observed a 

Figure 6-6: Weleetka, OK, oil and gas well site indicating Tank 4-22, which exploded

001091
Final Report September 2011 

23 

raging fire. The victim was airlifted to a Tulsa burn center but succumbed to his injuries the next day. 

The exploding tank (Tank 4-22) contained approximately 155 barrels of crude oil; the adjacent tank had 

approximately 10 barrels of crude oil and the tank closest to the oil separator was half-full of brine 

(Figure 6-6). Three Enterprise Oil tanks on the opposite side of the oil-gas separators were unaffected by 

the explosion and ensuing fire. As a result of the explosion and fire, oil spilled around the tanks and fire 

spread about 15 feet onto the surrounding brush area behind the affected tanks. The site did not have a 

berm or dike to contain the oil released from the exploding tank when it lost its contents. 

6.2.2 Incident Site 

The oil and gas site was leased by Three MG Family, ScissorTail Energy, LLC, and Enterprise Energy. 

The site contained six 210-barrel capacity storage tanks, two oil separators, and two gas separators. One 

set of oil and gas separators was connected to three adjacent interconnected storage tanks belonging to 

Three MG Family, Inc.; the other set provided oil and gas to three interconnected storage tanks belonging 

to Enterprise Oil (Figure 6-6). 

Figure 6-7: A) Gate at entrance to dirt road leading to Weleetka oil and gas well site B) Cattle gate on dirt road 

leading to oil and gas well. C) Sign identifying gas pipeline at Weleetka oil and gas site

001092
Final Report September 2011 

24 

6.2.3 Flammability 

Three MG Family, Inc. sales records show that the three interconnected tanks were emptied on April 10, 

2010, four days before the explosion and fire, leaving a significant vapor space above the remaining 

contents in the tank. According to company transport documents, the crude oil in the exploding tanks had 

an API gravity rating of approximately 39.0, falling between the range of crude oil and condensate. A 

transport receipt dated March 4, 2010, identified the contents of the affected tanks as Petroleum Crude 

Oil, 3 UN 1267. A material safety data sheet (MSDS) for this type of oil describes the material as “easily 

ignited by heat, sparks or flames.” Section 4 of the MSDS, “Fire and Explosion Hazards,” states that 

“vapor/gas will spread along the ground [and] collect in low or confined areas (sewers, basements, tanks). 

[Vapors] may also travel to a source of ignition and flash back. Containers may explode when heated.”22

6.2.4 Access, Fencing, Warning Signs, and Security 

 

The oil tank site involved in this incident is located in a wooded clearing less than a mile from the main 

road and half a mile from the banks of the Northern Canadian River. The dirt road leading to the site is 

unlit and secured by a typically unlocked iron cattle gate located where the dirt road intersects the main 

road (Figure 6-7A, B). The gate is approximately 4 feet high and 12 feet long and is the only means of 

discouraging access to the site (Figure 6-7B). The site lacks a perimeter fence, warning signs identifying 

hazards of the flammable materials inside the tanks, or hatch locks. The design of the failed tank did not 

prevent an internal explosion. There was one warning sign identifying the location of a gas pipeline on 

site (Figure 6-7C). The site is unmanned except for a well tender who checks the oil levels in the tanks 

 

22 Irving Oil. MSDS Crude Oil. 

<http://www.irvingoil.com/dloads/refinery/03050%20CRUDE%20OIL%20MSDS.pdf.> 

001093
Final Report September 2011 

25 

each morning. The CSB determined from witness testimony that the gate to the dirt road leading to the oil 

tank storage site was often left unlocked and on the day of the incident was likely unlocked.

6.3 MC Production, New London, Texas 

6.3.1 Incident Details 

At approximately 1:00 a.m. on April 26, 2010, an oil tank exploded in New London, Texas, fatally 

injuring a 24-year-old woman and seriously injuring a 25-year-old man. The exploding tank was 

propelled 48 feet away from its original location; the top of the tank was found 35 feet from its original 

location. The CSB learned that two individuals were climbing the stairway of the catwalk when one 

victim asked the other to light a cigarette. Witness testimony revealed that when the second victim lit the 

cigarette, an explosion ensued. 

6.3.2 Incident Site and Flammability 

The oil and gas site was leased by MC Production. At the time of the explosion, there were three 

interconnected 1000-barrel capacity tanks at the facility. The exploding tank contained a small amount of 

hydrocarbons and another adjacent tank had a hole. The oil site has been in operation for at least 80 

years. According to well records obtained from the Texas Railroad Commission (RRC), the oil lease was 

active at the time of the explosion producing 185 barrels of oil and selling 369 barrels during the month of 

the incident. However, testimony from the well tender indicates the oil tank involved in the explosion 

Figure 6-8: MC Production Oil tank site, New London, Texas 

001094
Final Report September 2011 

26 

had not stored product for at least one-and–a-half years prior to the explosion. The CSB also learned that 

MC Production reported the oil from the site had an API gravity of 37.4, characteristic of an intermediate 

crude oil that can produce flammable hydrocarbons. 

6.3.3 Access, Fencing, Warning Signs, and Security 

The MC Production oil field is located at the end of an isolated 

road in the middle of a clearing surrounded by woods (Figure 6-

9C). According to Rusk County Fire Department officials and 

the Rusk County Sheriff’s office, at the time of the explosion 

the oil site had no fences or hatch locks nor were the tanks 

designed to reduce the potential of an internal explosion. A 

cattle gate marked the entrance to a dirt road that led to the tank 

battery site over 200 feet away (Figure 6-9A). The site did 

have one warning sign covered by graffiti; however, its exact 

location at the time of the incident is unclear. Witness 

testimony revealed the sign may have been moved three to four times the day after the explosion. 

Although the “No” on the sign was blurred from graffiti, it warned against smoking, matches or open 

lights (Figure 6-10). 

Figure 6-10: M-C Production tank site with 

warning sign 

Figure 6-9: A) Open cattle gate leading to storage site B) Access road leading to tank storage site 

C) Woods surrounding oil tank site

001095
Final Report September 2011 

27 

Incident photos also revealed the tank site 

contained graffiti tags from local gangs 

(Figure 6-10). In addition, on the night of the 

explosion, a pink children’s bicycle was found 

at the tank site (Figure 6-11). Both the 

presence of the graffiti and the children’s 

bicycle indicate the tank site was visited by 

various members of the public. Two days 

after the fatal accident, Rusk County 

investigators returned to the accident scene to 

find a new steel gate with locks and signs at 

the entry to the access road. 

6.4 Recreational Use of Oil and Gas Sites 

6.4.1 Survey Methods 

The three tank storage sites investigated by the CSB were located in rural areas in close proximity to 

residential communities. To further assess public understanding of oil and gas site hazards, the CSB 

conducted a survey of students at Forrest County Agricultural High School, where the victims of the 

October 2009 explosion were enrolled, and other members of the Carnes, Mississippi, community. The 

survey was conducted during the spring of 2010, several months after the explosion. The surveys were 

administered by Forrest County Agricultural High School personnel. Participants were asked to provide 

age and gender information but no other personal identifiers. A total of 190 surveys were completed; 

participants had a median age of 16. The survey results are summarized below. 

Figure 6-11: A) Exploding Tank at MC Production oil site B) 

Children’s bicycle found on M-C Production tank site on the 

day of the explosion. 

001096
Final Report September 2011 

28 

6.4.2 Survey Results 

Similar to CSB interviews of community members, the survey results reveal that many local residents 

(especially children and young adults) view oil and gas sites as convenient places to gather and participate 

in recreational activities, made easier by relatively unhindered access. Respondents to the survey stated 

overwhelmingly that they would avoid these sites if hazard signs were present or if access were made 

more difficult with perimeter fencing and locks. 

In the survey, 11 percent of respondents stated they previously “hung out at oil sites.” When asked about 

the activity engaged in at an oil or gas production site, 14 percent stated they spent time with friends; 19 

percent said that they rode four-wheelers; and 11.5 percent stated that they fished or hunted. Seven 

respondents said they had climbed onto the catwalk at an oil site, while six stated they consumed 

alcoholic beverages and four stated that they smoked cigarettes or cigars at oil sites. 

Of the 190 respondents, 11 indicated they visited oil sites once a year and 21 said they did so less than 

once a year. Five respondents stated that they had lifted the hatch of an oil storage tank; and seven stated 

they used a lighter or a match while at an oil well site. 

7.0 Inherently Safer Tank Design 

Inherently safer tank design could have prevented the formation of a flammable atmosphere inside the 

tanks and likely prevented the three incidents investigated by the CSB, as well as the 23 other similar tank 

explosions that were identified. The following are examples of tank design features that can be used at 

E&P facilities to isolate and contain the flammable vapors in order to prevent a vapor space explosion. 

An internal floating roof is a design feature where a roof floats on top of a flammable liquid, reducing the 

hydrocarbon vapor to low concentrations well below the flammable limit. In the past, smaller diameter 

tanks (e.g. less than 30 feet diameter) could not practically use floating roofs because of stability issues. 

Today, due to API 650 relaxed buoyancy requirements for small tanks and the development of new 

composite floating roof materials, floating roofs can be installed in new or existing tanks as small as 8-10 

001097
Final Report September 2011 

29 

feet in diameter. Currently, most E&P storage tanks have fixed roofs—a less costly alternative to an 

internal floating roof. 

A second inherently safer design feature is the use of pressure vacuum (PV) relief valves. Pressure 

vacuum relief valves are commonly used on fixed roof tanks to minimize evaporation losses. However, 

they effectively isolate ignition sources, essentially acting as flame arrestors, so that external ignition 

sources nearby will not flash back to the vapor space, causing a tank explosion. The valves are designed 

to prevent the accumulation of pressure or vacuum which could compromise the tank integrity. However, 

most existing E&P oil storage tanks use open vents when storing flammable liquids. Only those tanks 

located in areas with strict air pollution rules (e.g. in California) avoid the use of open atmospheric vents. 

The likelihood of a flash back can be significantly reduced by the use of PV relief valves. 

A third design option (one which is recommended for tanks located in urban areas of Ohio) is the use of 

an actual flame arrestor—a device that extinguishes a developing flame outside a tank, preventing it from 

entering the vapor space. The flame arrestor forces a flame front through narrow channels that inhibit the 

propagation of the flame. Both flame arrestors and pressure vacuum valves are similar in function in that 

they act as barriers to flame propagation from outside the tank into the vapor space. 

A final option is the use of a vapor recovery system—a closed system that keeps flammable vapors inside 

the tank. This system requires the entire tank (tank hatches, atmospheric vents and all tank orifices) to be 

sealed and isolated from the atmosphere, thus preventing external ignition sources from entering the 

vapor space. The internal vapors are either recovered for future use or routed to a flare system. Vapor 

recovery systems are required for tanks located in poor air quality zones in California. 

8.0 Oversight of Security at Oil and Gas Storage Facilities 

The CSB reviewed federal, state, and local regulations as well as industry standards and guidance to 

evaluate the existing safety and security requirements for preventing public access to oil and gas 

production sites. 

001098
Final Report September 2011 

30 

8.1 Mississippi Oil and Gas Rules 

8.1.1 County Rules: Oil and Gas Well Sites in Forrest County, 

Mississippi 

The Delphi Oil gas site involved in the 

October 31, 2009, explosion is located 

in the Pistol Ridge oil field. Delphi Oil 

leases 15 of the producing wells and 

their associated tank storage sites in the 

area. In 2010, following the incident, 

the Forrest County Emergency 

Management District (FCEMD) 

conducted an analysis and reported 119 

oil and gas production and storage sites 

in Forrest County, which includes the rural community of Carnes. Of the 119 oil and gas sites, only 15 

were fenced at the time of the FCEMD report.23 At the time of the incident, Forrest County had no local 

zoning ordinances requiring oil and gas facilities to be fenced or marked by warning signs. Following the 

FCEMD report, county supervisors required new measures to improve security at these facilities (see 

Section 8.1.7). 

 

23 Forrest County Oil and Gas Well Report. July 2010. The Emergency Management District. 

Figure 8-1: Oil and gas production wells in Mississippi

 (Source: Mississippi Oil and Gas Board) 

001099
Final Report September 2011 

31 

8.1.2 State of Mississippi Regulations 

Since 1999, there has been an increase in the number of oil and gas production wells in the state of 

Mississippi (Figure 8-1).24 In 2009 there were 5,417 producing oil and gas wells, which were all 

regulated by the Mississippi Oil and Gas Board (MSO&GB).25 This is the largest number of wells 

present since 1951. Multiple wells may feed into a single tank site. The MSO&GB does not collect 

information on the number of tank batteries in the state. Since 1932, the MSO&GB has regulated the 

drilling, completion, recompletion and/or operation of oil and gas wells and related facilities throughout 

Mississippi. The MSO&GB has “sole and exclusive” authority to regulate oil and gas conservation in the 

state and has “jurisdiction and authority over all persons and property necessary” to enforce all laws 

requiring the conservation of oil and gas.26 The MSO&GB has seven inspectors who are responsible for 

inspecting over 5,000 wells throughout the state. 

At the time of the incident, oil field rules promulgated by the MSO&GB did not require fencing, signage, 

or locks to prevent unauthorized entry to oil and gas sites, apart from those that contain hydrogen sulfide. 

The MSO&GB does not require inherently safer tank design features be utilized to prevent internal vapor 

explosions. Rule 6 of the MSO&GB Statewide Rules and Regulations required producers to post a site 

identification sign with company emergency contact information at tank sites, but did not state where the 

sign should be located. Additional rules require wells to be located 330 feet from every exterior boundary 

of the drilling unit;27 28 no requirements exist for spacing tanks from existing structures such as residences 

or public places. 

 

24 MSO&GB Annual Production Report. < http://www.ogb.state.ms.us/annprod.php> 

25 The Mississippi Oil and Gas Board. Annual Production Report. Retrieved from 

 <http://www.ogb.state.ms.us/annprod.php. > 

26 The Mississippi Oil and Gas Board. MSO&GB. 53-1-17. Powers of Board. (g) 

27 Drilling unit is the maximum area in a pool which may be assigned to one well to produce recoverable oil or gas. 

001100
Final Report September 2011 

32 

8.1.3 Communication with the Mississippi Oil and Gas Board 

The CSB found the MSO&GB had numerous interactions and communications with personnel from 

Delphi Oil during the permitting process and the commissioning of drilling operations at the gas well site. 

There were at least 14 separate communications with Delphi Oil and two site inspections. These 

inspections did not consider security measures since they were not required in state regulations at the 

time. 

8.1.4 Tanks with Hydrogen Sulfide 

The MSO&GB has a site security rule for oil tanks containing hydrogen sulfide in excess of 20 parts per 

million. Since July 1, 1971, MSO&GB Rule 62 on “Storage Tanks and Sour Crude Oil” has required that 

oil and gas wells be adequately marked to alert the public and well site workers if a well contains 

hydrogen sulfide.29 Additionally, Section A requires that “all access hatches to the tanks capable of being 

readily operable shall be kept closed securely at all times except when necessary for such hatches to be 

open for inspection and gauging.” The same rule also requires that “all fumes and vapor in such tank or 

tanks be suitably recovered in a vapor recovery unit or flared to the atmosphere [and] all storage tanks and 

the nearby surrounding areas be conspicuously marked and posted in a manner advising of the presence of 

potentially lethal fumes and vapors.” 

The Safety Practices section of the Mississippi Oil and Gas Statutes, “Operations Involving Hydrogen 

Sulfide,” requires that “safety precaution signs be displayed and unauthorized personnel kept out of the 

storage area.” The CSB determined that similar requirements, if extended to all aboveground production 

sites storing flammables (with or without hydrogen sulfide hazards), would significantly discourage 

public access to the sites, preventing possible fires and explosions. 

 

28 MSO&GB. Statutes, Rules of Procedure. Statewide Rules and Regulations. April 3, 2009. Rule 62: Storage 

Tanks, Sour Crude Oil Pg 88. 

29 ibid. 

001101
Final Report September 2011 

33 

8.1.5 Role of Local Municipalities 

At the time of the October 2009 explosion, Forrest County had no zoning ordinances that required 

fencing, locked hatches, or posting of hazard warning signs at oil and gas sites. However, the City of 

Laurel, in an adjacent county, had implemented stricter ordinances since 1988 that require fencing and 

signage at oil and gas sites within the city limits for public safety.30 In Laurel, fences must be at least six 

feet high with double stranded barbed wire enclosing all tanks and related equipment. 

8.1.6 Forrest County Local Ordinance 

As a result of the October 2009 incident, in 2010 the Forrest County Board of Supervisors adopted a local 

ordinance that requires fencing and warning signs at oil and gas sites that are outside corporate city limits. 

The measure requires continuous perimeter fencing at least five feet high with one or more strands of 

barbed wire, locks on gates, and warning and identification signs within five feet of any access point.31

The ordinance also requires that well operators employ a locking mechanism to “restrict unauthorized use 

of an exterior gate, door, hatch, ladder, stairway, stairwell or similar device controlling access.” 

8.1.7 New Tank Storage Site Security Measures: Mississippi Oil and Gas 

Board 

In the aftermath of October 2009 incident in Carnes, in January 2011 the MSO&GB amended Rule 6 of 

the Mississippi code to require the following at production sites: 

 A hazard sign posted at the entrance of well locations in “reasonably large and clear lettering” 

stating, “Danger,” “No Trespassing,” and “Authorized Personnel Only.” 

 

30 City of Laurel, Mississippi. Code of Ordinance, Ch. 16: Section 75. 

31 Forrest County Board of Supervisors. Ordinance of the Forrest County Board of Supervisors Requiring Certain 

Safety Measures at Oil and Gas Facilities. July 13, 2010. 

001102
Final Report September 2011 

34 

 A gate affixed to stairways leading to storage tanks accompanied by a sign reading “Danger 

(white lettering on red background),” “No Trespassing,” and “Authorized Personnel Only.” 

 The placement of identification signs at site entrances during drilling operations, at the wellbore 

after well completion, and on the tank battery if it is remote from the wellbore. 

 An around-the-clock telephone number posted for reporting incidents at unmanned facilities. 

 A sign identifying all wells providing oil or natural gas to a tank battery. 

8.2 State of Oklahoma Oil and Gas Rules 

8.2.1 Oklahoma Lacks Oil and Gas Sites Security Requirements 

The Oklahoma Corporation Commission (OCC) regulates oil and gas site safety for the state. OCC oil 

field rules do not require a perimeter berm or fencing of oil and gas sites, hazard signs, or hatch locks on 

oil storage tanks not containing hydrogen sulfide.32 The OCC does not have any requirements for using 

inherently safer tank design features. Of the 26 similar incidents identified by the CSB, seven occurred in 

Oklahoma. Oklahoma reported approximately 41,000 gas wells and 83,000 oil wells in 2009. 

8.2.2 Tanks with Hydrogen Sulfide 

Similar to Mississippi, the State of Oklahoma requires more public protection measures if oil tanks 

contain vapor concentrations of hydrogen sulfide. When these conditions are present, OCC rules require 

warning signs and wind indicators on atmospheric storage tanks. The rules specify language warning 

about the presence of poisonous hydrogen sulfide. Signage is required within 50 feet of the facility, to be 

readable from the entrance and of “sufficient size.” The OCC also requires fencing when storage tanks 

containing hydrogen sulfide above 500 ppm are located inside populated limits of a township or city 

“where conditions cause the storage tanks to be exposed to the public.” 

 

32 Oklahoma Corporation Commission. Chapter 10: Oil and Gas Conservation, July 11, 2009, p. 49. 

001103
Final Report September 2011 

35 

8.2.3 Tank Hatch Security 

The State of Oklahoma changed its security requirements after a fatal accident in 1993 where a 12-yearold boy was asphyxiated upon putting his head into a large hatch of an oil storage tank. On January 1, 

1995, Oklahoma state law was amended to require crude oil producers to adopt one of the following 

security measures: 

 Install and maintain a sealing device on the hatch of a tank, 

 Reduce the opening of the hatch to less than six inches in diameter or affix, or 

 Maintain a sign on or near the hatch no smaller than 40 square inches that warns against opening 

the hatch and the danger within the storage tank. 

The CSB determined that the tanks involved in the April 14, 2010, explosion were equipped with six-inch 

diameter hatches, but they were not locked. 

The OCC also has stronger requirements for certain aboveground flammable storage tanks;33 however, the 

rules do not cover the approximately 120,000 oil and gas wells and their associated tanks involved in 

upstream exploration and production (E&P) activities.34 Tanks covered under the aboveground storage 

tank provision are required to be enclosed within a 6-foot high chain link fence, be separated from the 

fence by at least 10 feet, and have a gate to secure against unauthorized entry.35 This provision also 

requires “conspicuously posted” signs with the words “Warning” and “No Smoking” and grounding 

instructions. CSB investigators determined that the incident in Weleetka would have been less likely to 

occur if the site were required to follow the fencing and/or warning provisions for either aboveground 

storage tanks or production sites with hydrogen sulfide hazards. 

 

33 Aboveground storage tanks under OCC Ch 26-1-21 include tanks used in wholesale or bulk distribution activities. 

34 Oklahoma Corporation Commission (2009). Energy, Transportation and Utilities. Annual Report Snapshot FY 

2009. 

35 Oklahoma Corporation Commission. Chapter 26: Aboveground Storage Tanks, July 1, 2009. p 27. 

001104
Final Report September 2011 

36 

8.3 Texas Oil and Gas Rules 

8.3.1 Texas lacks oil and gas security requirements 

In September 2011, there were over 261,400 producing oil and gas wells in Texas, which were regulated 

by the Railroad Commission of Texas (RRC). Title 16, Chapter 3, Rule § 3.3, Identification of Properties, 

Wells, and Tanks, requires all oil and gas production facilities to post identification signs displaying the 

name of the property (as shown on RRC records), the name of the operator, and related information, but 

does not require fencing, warning signs, or locked tank hatches for tanks without hydrogen sulfide.36 The 

RRC does not have requirements for using inherently safer tank design to prevent an internal vapor 

explosion. 

8.3.2 Hydrogen Sulfide Storage Tanks 

As in Mississippi and Oklahoma, the RRC has stronger requirements for oil and gas production and 

storage sites where hydrogen sulfide is present. Under Texas Administrative Code Title 16, Chapter 3, 

Rule § 3.36, oil and gas production wells with hydrogen sulfide are required to post a warning sign 50 

feet from the facility to warn of the dangers.37 Fencing is also required as a security measure if the oil and 

gas well site is located inside the limits of a township or city. If the concentration of hydrogen sulfide gas 

exceeds 100 ppm and the radius of exposure exceeds 50 feet, warning signs must be posted on access 

roads or public streets. If the concentration of hydrogen sulfide is less than 100 ppm, the lease is not 

subject to the RRC's hydrogen sulfide rule and lease access and warnings to the public are determined by 

the operator. 

 

36 Railroad Commission of Texas; Ch. 3, Oil and Gas Division; Rule 3.36, Gas or Geothermal 

 Resources Operations in Hydrogen Sulfide Areas. 

37 Texas Administrative Code Title 16, Economic Regulation; Part 1, Railroad Commission of Texas; Ch. 3, Oil and 

Gas Division; Rule 3.36, Gas or Geothermal Resources Operations in Hydrogen Sulfide Areas. 

001105
Final Report September 2011 

37 

8.3.3 State/Municipal Storage Tank Site Security Policies 

The CSB reviewed state and local regulations in states with active oil and gas extraction operations, 

focusing on areas with a high production volume and areas where oil tank explosions have occurred 

affecting members of the public. 

The CSB found a lack of consistent state or municipal regulations for perimeter fencing, hatch locks, and 

warning signage. The 26 incidents identified by the CSB occurred in ten states. The CSB reviewed the 

regulations in these states and determined that there is a wide disparity in requirements from state to state. 

Ohio and California appeared to have the most extensive regulations related to tank security, while some 

states had no requirements at all. Table 1 summarizes the findings of the analysis. 

 

001106
Final Report September 2011 

38 

Table 1: Summary of Oil and Gas Rules in Urban and Rural Areas 

Summary of Oil and Gas Rules in Urban (U) and Rural (R) Areas 

Jurisdiction 

Fences Hatch Locks Warning 

Signs Gates Flame Arrestors Comments 

U R U R U R U R U R 

California Y Y N* N* N N N N N N 

*Bolted hatches 

(air emission 

requirement) 

Colorado Y N N* N Y** Y** Y Y N N 

*Gauge hatches to be 

closed 

**Prohibit smoking near 

flammables 

Kentucky N N N N N N N N N N 

Louisiana N* N N N N N N N N N 

*Requires dike/ firewall 

around tanks in urban 

areas 

Mississippi N N N N N N N N N N 

H2S sites require 

fencing, signs and 

secured hatches 

New Mexico Y N* N N N N N N* N N 

*Fencing and gates 

required for low grade 

tanks/pits 

Ohio Y N Y N Y N Y N Y N 

Oklahoma N N N N N N N N N N 

Texas N N N N Y Y N N N N Warning signs specific 

to tank batteries 

Los Angeles Y Y N/A* N/A* N N Y Y Y Y 

*Req vapor recovery 

system and bolted 

hatches by state 

Forrest 

County, 

Mississippi 

N/A Y N N N/A Y* N/A Y* N N 

*Operators restrict use 

with locking 

mechanism 

City of Laurel, 

Mississippi Y N/A N N/A Y N/A Y N/A N N/A 

001107
Final Report September 2011 

39 

8.4 Other State Oil and Gas Rules 

8.4.1 Ohio Oil and Gas Rules 

The Ohio Department of Mineral Resources Management has stronger requirements for tank storage 

facilities within city limits than in rural areas. Prior to 2004, oil and gas drilling was not permitted in 

urban areas. However, State House Bill 278 (The Urban Drilling Law) allowed drilling in areas with a 

population of 5,000 or more people and developed rules to adequately protect the public from the hazards. 

In urban areas, the law requires oil and gas producers to erect eight-foot-high chain-link fences with three 

strands of barbed wire around storage tanks, separators, and associated production equipment.38 The rules 

require tanks to have spark or lightning arrestors and hatches that are secured at all times. Sites are 

required to have signs warning against entry and prohibiting smoking. In rural areas, lesser requirements 

apply. 

8.4.2 California Oil and 

Gas Rules 

There are over 53,800 producing oil and gas 

wells in California regulated by the 

California Department of Conservation, 

Division of Oil, Gas and Geothermal 

Resources.39 However, none of the 26 

incidents identified by the CSB occurred in California. The CSB found California was the only state to 

require some type of fencing in both urban and rural areas for E&P facilities. Title 14 of the California 

 

38 Ohio Department of Mineral Management. 1501:9-9-05 Producing operations. 

39 California Department of Conservation, Division of Oil, Gas and Geothermal Resources. 2009 Annual Report of 

the State Oil & Gas Supervisor. < ftp://ftp.consrv.ca.gov/pub/oil/annual_reports/2009/PR06_Annual_2009.pdf.> 

Figure 8-2: Tank battery in Los Angeles, California

001108
Final Report September 2011 

40 

Code of Regulations requires that all oil and gas equipment located in urban areas be fenced with chainlink perimeter fencing extending a minimum of five feet high with three strands of barbed wire. In rural 

areas, oil and gas producers can choose whether to install a five-foot chain-link fence as required in the 

urban areas or a fence constructed of barbed wire or commercial livestock wire netting extending at least 

four feet high.40 The rules require identification signs but not warning signs. As a result of more 

stringent air pollution rules in California, oil and gas storage tanks in air pollution non-attainment areas 

do not have an atmospheric vent pipe and the hatch is bolted to the top of the tank. Under California 

clean air requirements enforced by local air resource boards, tank vapors are routed to vapor recovery 

systems (Figure 8-2). These systems make it virtually impossible to ignite the flammable vapors inside 

the tank because the atmosphere is too rich to burn. 

8.5 Federal Regulations 

8.5.1 Federal OSHA Regulations 

The federal regulatory framework for E&P facilities includes measures to protect workers onsite and 

other measures to protect the health and safety of members of the public offsite. The Federal 

Occupational Safety and Health Administration (OSHA) has regulatory standards that are designed solely 

to protect workers while the Environmental Protection Agency (EPA) and the Department of Homeland 

Security (DHS)41 have regulations intended to protect members of the public outside of facilities. The 

CSB found no current federal regulatory standards to protect members of the public, including children 

and young adults, who enter unattended oil sites without authorization. 

 

40 California Code of Regulations, Title 14: Natural Resources, Article 3: 1778. Enclosure Specifications. 

California Environmental Protection Agency. Air Resources Board. Vapor Recovery Health and Safety Code 

Statutes. <http://www.arb.ca.gov/regact/2011/evr11/gdfhapp3.pdf> 

41 The Department of Homeland Security promulgated the Chemical Facility Anti-Terrorism Standards to protect 

U.S. chemical facilities from acts of terrorism. Covered facilities must submit a performance based security plan. 

DHS does not consider E&P facilities to be a significant risk for acts of terrorism; therefore they do not submit a 

security plan. 

001109
Final Report September 2011 

41 

The CSB noted that OSHA has promulgated several standards that include protections for employees 

working at oil production sites that may also provide a certain degree of protection for members of the 

public. The most relevant are the storage tank provisions in the Hazard Communication Standard (29 

CFR 1910.1200) and the Flammable and Combustible Liquids Standard (1926.152). 

8.5.2 The Hazard Communication Standard (29 CFR 1910.1200) 

The OSHA Hazard Communication Standard requires employers to ensure that each container of 

hazardous chemicals in the workplace is labeled, tagged, or marked with the identity of the hazardous 

chemicals and an appropriate hazard warning.42 Contrary to the Hazard Communication Standard, many 

of the oil and gas production sites examined by CSB investigators did not identify the hazardous 

chemicals contained in storage tanks or provide appropriate hazard warnings.43 Moreover, OSHA permits 

employers to use labeling systems with various codes, symbols, and/or numeric ratings that may not be 

understood by the public. The oil and gas storage sites visited by the CSB did not contain such symbols 

or numeric ratings. 

8.5.3 Flammable and Combustible Liquids Standard (29 CFR 1910.106) 

OSHA’s Flammable and Combustible Liquids Standard is another occupational regulation that may offer 

overlapping protections to members of the public. Although the standard is outdated, based on the 1969 

version of NFPA 30, it does address many safety issues for aboveground storage tanks including design, 

construction and installation, corrosion protection, instrumentation, normal vent and emergency relief 

devices, fire protection, and controlling sources of ignition. However, the OSHA standard has no 

 

42 Occupational Health and Safety Administration. 29 CFR 1910.1200(f)(5)(i)-(ii). 

43 For a detailed discussion and analysis of this issue, see Section 5.3 of the CSB Investigation Report on the Vapor Cloud 

Deflagration and Fire that occurred at the BLSR Operating Ltd in Rosharon, Texas on January 13, 2003. (Report No. 2003-06-ITX). 

001110
Final Report September 2011 

42 

requirements for security or fencing. The standard also exempts crude oil tanks at E&P facilities from 

requirements for venting valves and flame arrestors. 

8.6 Environmental Protection Agency (EPA) 

In contrast to OSHA, the EPA has jurisdiction to regulate oil and gas storage sites for the protection of 

human health and the environment. Accordingly, the agency administers a number of environmental 

statutes relevant to oil and gas production, including the Clean Air Act (CAA); the Clean Water Act 

(CWA); the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA or 

Superfund); the Resource Conservation and Recovery Act (RCRA); and the Toxic Substances Control 

Act (TSCA). However, many of these statutes contain various exemptions applicable to oil and gas well 

sites. 

8.6.1 Clean Water Act (CWA) 

The Federal Water Pollution Control Act of 1972, as amended, or CWA, is the principal federal statute 

for protecting navigable waters, adjoining shorelines, and the waters of the contiguous zone from 

pollution. Section 311 addresses the control of oil and hazardous substance discharges and provides the 

authority for a program to prevent, prepare for, and respond to such discharges. Specifically, 

§311(j)(1)(C) mandates regulations establishing procedures, methods, equipment, and other requirements 

to prevent and contain discharges of oil44 from facilities and vessels. 

8.6.1.1 Spill Prevention Control and Countermeasure (SPCC) Rule 

The SPCC regulation promulgated by EPA under the CWA, has been in effect since January 10, 1974 (38 

FR 34164). The 1974 SPCC Rule established oil discharge prevention procedures, methods, and 

 

44 Under CWA §311(a)(1), “oil” means “oil of any kind or in any form.” 

001111
Final Report September 2011 

43 

equipment requirements for non-transportation-related facilities with an aboveground oil storage capacity 

greater than 1,320 gallons (or greater than 660 gallons in a single aboveground tank) or a buried 

underground oil storage capacity greater than 42,000 gallons. Regulated facilities were also limited to 

those that, because of their location, could reasonably be expected to discharge oil into the navigable 

waters of the U.S. or adjoining shorelines. Subparagraph (e)(5)(iii) contains specific requirements for bulk 

storage tanks at onshore oil production facilities, which are defined in subparagraph (e)(5)(i) as including 

“all wells, flowlines, separation equipment, storage facilities, gathering lines, and auxiliary nontransportation-related equipment and facilities in a single geographical oil or gas field operated by a 

single operator.”45 

These requirements address the need for storage tank construction to be compatible with the oil being 

stored, secondary containment to catch spills, periodic inspection and maintenance, and installation of 

fail-safe devices to prevent overflow and collapse. Under the security provisions for unattended SPCC 

facilities, “All plants handling, processing, and storing oil should be fully fenced, and entrance gates 

should be locked and/or guarded when the plant is not in production or is unattended.” However, oil 

production facilities (see subparagraph (e)(9)(i)), were specifically excluded from compliance with these 

requirements.46 

8.6.2 Clean Air Act Amendments 

Following a series of chemical accidents in the U.S. and overseas, Congress enacted the Clean Air Act 

Amendments (CAAA) of 1990. Under 42 U.S.C. § 7412 (r), owners and operators of stationary sources47

 

45 The US Environmental Protection Agency. SPCC Guidance for Regional Inspectors, US EPA, Version 1.1, 3/14/2006 p. 1-2. 

46 38 FR 34168-70. 

47 Stationary source means any buildings, structures, equipment, installations, or substance-emitting stationary activities that 

belong to the same industrial group, which are located on one or more contiguous properties and under the control of the same 

person (or persons under common control), and from which an accidental release may occur (63 FR 645). 

001112
Final Report September 2011 

44 

must identify hazards, prevent, and minimize the effect of accidental releases whenever extremely 

hazardous substances are present at their facility.48

This section of the CAAA required the EPA to promulgate an initial list of at least 100 substances that, in 

the event of an accidental release, “are known to cause or may reasonably be anticipated to cause death, 

injury, or serious adverse effects to human health or the environment.” Stationary sources that have more 

than a threshold quantity of a regulated substance are subject to accident prevention regulations, including 

the requirement to develop a risk management plan (RMP).49

E&P facilities were originally considered for coverage under the RMP rule. However, in 1995, the 

American Petroleum Institute (API) submitted an analysis50 to the EPA docket that argued for removing 

the facilities from the scope of the rule asserting that the facilities did not pose a significant flammable or 

toxic hazard offsite. In January 1998, the EPA agreed to an exemption, stating the “EPA believes 

regulated flammable substances in naturally occurring hydrocarbon mixtures, 51 such as crude oil, that 

contain many non-volatile components, are unlikely to form large vapor clouds and therefore, generally 

have low potential for vapor cloud explosions. EPA considers vapor cloud explosions the consequence of 

greatest concern for flammable substances.” EPA further stated that “the general duty clause of section 

112(r)(1) would apply when site-specific factors make an unlisted chemical extremely hazardous.” 52

 

48 Guidance for the Implementation of the General Duty Clause of the Clean Air Act, Section 112(r)(1), US EPA, Publication No. 

EPA 550-B00-002, May 2000, page 2. 

49 63 FR 640, 640 (January 6, 1998). 

50 Hazard Assessment of Exploration and Production Facilities Potentially Subject to the Environmental Protection Agency’s 

Risk Management Program regulations (API, January 20, 1995). 

51 EPA defines naturally occurring hydrocarbon mixtures as any or all combination of the following: natural gas condensate, 

crude oil, field gas, and produced water. 

52 63 FR 642.

001113
Final Report September 2011 

45 

8.6.2.1 The General Duty Clause 

The Clean Air Act Amendments include a “general duty clause” which holds owners and operators 

responsible for preventing chemical accidents involving extremely hazardous substances. The clause 

states that: 

It shall be the objective of the regulations and programs authorized under this subsection to 

prevent the accidental release and to minimize the consequences of any such release of any 

substance listed pursuant to paragraph (3) or any other extremely hazardous substance. The 

owners and operators of stationary sources producing, processing, handling or storing such 

substances have a general duty, in the same manner and to the same extent as section 654, title 

29 of the United States Code, to identify hazards which may result from such releases using 

appropriate hazard assessment techniques, to design and maintain a safe facility taking such 

steps as are necessary to prevent releases, and to minimize the consequences of accidental 

releases which do occur. 

As part of their responsibility, industries have developed standards and generally accepted safe practices 

to address the risks posed by extremely hazardous substances.53 The EPA recommends that owners and 

operators handling extremely hazardous substances “adhere to a recognized industry standard and 

practices (as well as government regulations)” to comply with the general duty clause. The EPA advises 

that when site specific conditions create “unique circumstances” that render some standards 

“inapplicable,” the Agency “may exercise its authority to require an owner or operator to implement 

additional measures to address the hazard.”

To advise the regulated community of its general duty clause obligations, the EPA has published a 

number of Chemical Safety Alerts. Alerts have addressed a variety of subjects including pressure vessel 

hazards, lightning hazards to facilities handling flammables, and the catastrophic failure of storage tanks. 

Security guidance similar to the “Chemical Accident Prevention: Site Security” and “Anhydrous 

 

53 Although there is no definition for extremely hazardous substances, the legislative history of the 1990 Clean Air Act 

Amendments suggests criteria which EPA may use to determine if a substance is extremely hazardous. The Senate Report 

stated the intent that the term “extremely hazardous substance” would include any agent “which may or may not be listed or 

otherwise identified by any Government agency which may as the result of short-term exposures associated with releases to the 

air cause death, injury or property damage due to its toxicity, reactivity, flammability, volatility, or corrosivity” (Senate 

Committee on Environment and Public Works, Clean Air Act Amendments of 1989, Senate Report No. 228, 101st Congress, 

1st Session 211 (1989). 

001114
Final Report September 2011 

46 

Ammonia Theft” safety alerts published under the general duty clause would alert operators to the 

security precautions necessary to prohibit members of the public from entering oil and gas storage 

facilities. Based on flammability, hydrocarbons stored at E&P facilities would meet the definition of 

extremely hazardous substances and thus be subject to the CAAA general duty clause. 

8.7 Industry Standards and Guidance 

The CSB determined that there are currently no comprehensive, specific industry standards or guidance 

addressing the safety of members of the public at oil and gas sites. The CSB noted some provisions in 

existing API and NFPA guidance documents that provide limited protections. 

8.7.1 American Petroleum Institute (API) 

API is a national trade association that represents the oil and natural gas industry and also develops 

industry standards, recommended practices, and codes.54 Although they are voluntary, API standards are 

widely utilized by the energy industry. API standards that are relevant to E&P storage tanks include API 

2610 and API 74. 

8.7.2 API Standard 2610 

API Standard 2610, Design, Construction, Operation, Maintenance and Inspection of Terminal & Tank 

Facilities (2nd ed.), issued in May 2005, applies to downstream facilities that store refined petroleum 

products. Section 13.3.6 of API 2610 discusses security measures such as fencing, perimeter lighting, 

and preventing tank access.55 The standard recommends that covered facilities be fenced to “maintain 

facility security and prevent product loss and vandalism,” and that “barriers can be added to tank external 

ladders or stairways to restrict access.” The EPA lists API 2610 as a standard that can assist owners and 

 

54 The American Petroleum Institute. About API. <www.api.org/aboutapi>. 

55 The American Petroleum Institute. API 2610, Second Edition, May 2005. 

001115
Final Report September 2011 

47 

operators of SPCC-covered facilities with security plans. However, the scope of API 2610 specifically 

excludes “[t]anks that are part of oil and gas production, natural gas processing plants, or offshore 

operations.” Nonetheless, the incidents involving public fatalities and injuries at E&P sites demonstrate 

that these facilities are subject to similar fire and explosion hazards as storage sites in the downstream or 

refining sector. 

8.7.3 API Recommended Practice 74 

API Recommended Practice 74, Occupational Safety for Onshore Oil and Gas Production Operation, was 

developed in response to a CSB safety recommendation that resulted from a 1998 explosion that killed 

four workers at a Louisiana oil and gas production facility. It includes safety guidance for fire prevention 

and protection, such as designating areas where there are fire hazards, prohibiting smoking and ignition 

sources within those areas, posting conspicuous warning signs, and properly labeling tanks that contain 

flammable liquids. Appendix A of API 74 includes a checklist of questions for periodically assessing 

safety at oil production facilities.56 Some questions, for example, suggest that operators verify the posting 

of “No Smoking,” “No Trespassing,” and/or “Authorized Personnel Only” signs at oil site entrances. 

Other checklist questions ask whether “ladders are caged when over 20 feet,” if the “access opening to the 

ladders [is] provided with a swinging gate or chain closure,” and whether “tank thief hatches seal or are in 

good repair.” 

Beyond these appendix questions, however, the main sections of API 74 include no guidance on 

requirements for fencing, physical barriers, or security gates to prevent access to tank catwalks and tank 

hatches; hatch locking mechanisms; or specific tank explosion warning signs to prevent fatal incidents 

due to unauthorized entry. As currently written, API 74 primarily focuses on occupational safety 

requirements, containing only limited recommendations for public protection. 

 

56 The American Petroleum Institute. API RP 74, Appendix A, p. 17. 

001116
Final Report September 2011 

48 

8.7.4 API Oil and Natural Gas Industry Security Assessment and 

Guidance 

Following the 9/11 attacks, the API assessed the E&P sector for security vulnerabilities. The API 

assessment found most E&P facilities produce low quantities of product; over 75 percent of U.S. oil wells 

are “stripper” wells that produce fewer than 10 barrels of oil daily. Most are located in rural areas. To 

provide safety and security, the API suggested the use of the following standards: 

 Recommended Practice 49, Drilling and Well Servicing Operations Involving Hydrogen Sulfide 

 Recommended Practice 54, Occupational Safety for Oil and Gas Well Drilling and Servicing 

Operations 

 Recommended Practice 74, Occupational Safety for Onshore Oil and Gas Production Operations 

 Publication 761, Model Risk Management Plan for E&P Facilities 

Of these standards, only API 54 recommends labeling of tanks “to denote their flammable contents” (API 

54 Section 8.4.4). 

8.7.5 National Fire Protection Association (NFPA) 

The NFPA is a non-profit organization that develops and advocates consensus codes and standards for 

fire protection and prevention. The codes and standards are voluntary unless adopted by law or regulation. 

The codes are used as good-practice guidance by industry, insurance companies, engineers, and safety 

professionals. There are three NFPA codes that address security measures for various sectors, but these 

are not specific to E&P facilities. These codes include NFPA 30, Flammable and Combustible Liquids 

Code (2008); NFPA 30A, Code for Motor Fuel Dispensing Facilities and Repair Garages (2008); and 

NFPA 730, Guide for Premises Security (2008).57

 

57 The National Fire Protection Administration. Codes and Standards. Retrieved from 

<www.nfpa.org/assets/files/PDF/CodesStandards/Directory/NFPADirectory2010.pdf> 

001117
Final Report September 2011 

49 

8.7.6 NFPA 30 

NFPA 30, the Flammable and Combustible Liquids Code (2008), applies to the storage, handling, and use 

of flammable and combustible liquids, including waste liquids. Section 21 requires the use of flame 

arrestors when storing certain flammable liquids (Class 1B and IC) and Annex A suggests their use to 

stop the propagation of a flame inside a tank. Section 22 has requirements for storing liquids in 

aboveground tanks including location and installation, normal and emergency venting, fire protection, 

spill control, collision protection, and maintenance. In the 1990 edition, the NFPA added subsection 2-

9.3 which states that “unsupervised, isolated aboveground storage tanks shall be secured and marked in 

such a manner as to identify the fire hazards of the tank and its contents to the general public.” The 2008 

edition further states “where necessary, to protect the tank from tampering or trespassing, the area where 

the tank is located shall be secured.” The NFPA justified the provision based on “several recent tank 

explosions caused by youngsters who have trespassed in and on tanks.” However, the code has no 

specific requirements for security or fencing. The CSB learned that 44 states58 have adopted a version of 

NFPA 30 (ranging from the 1990 to 2008 editions). 

8.7.7 NFPA 30A 

NFPA 30A, the Code for Motor Fuel Dispensing Facilities and Repair Garages (2008), provides guidance 

to reduce hazards of motor fuels from marine/motor fuel-dispensing facilities located inside buildings, at 

fleet vehicle motor fuel facilities, farms, isolated construction sites, and motor vehicle repair garages. 

Section 4.3.7 contains requirements to physically protect aboveground tanks. If tanks are not enclosed in a 

vault, or if the property lacks a perimeter security fence, the code requires a secured gate and a chain link 

fence, at least 1.8 meters (6 feet) high and separated from the tanks by at least 3 meters (10 feet). Section 

13.3 includes requirements for marking tanks and containers: they must be “conspicuously marked” with 

the name of the product and “FLAMMABLE – KEEP FIRE AND FLAME AWAY.” The EPA lists this 

 

58 The National Fire Protection Association. Editions Currently Adopted. <NFPA.org>. 

001118
Final Report September 2011 

50 

standard as a guideline for security for SPCC-covered facilities. However, NFPA 30A does not apply to 

E&P facilities. 

8.7.8 NFPA 730 

NFPA 730, Guide for Premises Security (2008), describes construction, protection, occupancy features, 

and practices intended to reduce security vulnerabilities to life and property. As a guide, this NFPA 

document is advisory and informational and contains only non-mandatory provisions; the NFPA does not 

deem the document, as a whole, to be suitable for adoption into law. Chapter 6 discusses requirements for 

exterior security devices and systems for perimeter protection of facilities and lists detailed specifications 

for chain link fencing, including design, location of the fence line, signs, height, posts, bracing, top 

guards, entrances and locks, lighting, and maintenance. Although Chapters 11 through 22 contain specific 

requirements for different types of facilities (e.g., restaurants, shopping centers, industrial facilities, etc.), 

there are no specific requirements for oil production sites. However, assuming that such sites can be 

considered industrial facilities, the guide recommends that access to critical assets be restricted by 

establishing a secure perimeter accessible only to employees, authorized vendors and contractors, and 

escorted visitors. Moreover, the guide recommends the following: 

All industrial companies, big and small, should have site security programs in place to minimize 

security vulnerabilities and to protect company assets. This is especially true for facilities that 

handle extremely hazardous substances. 

9.0 CSB Findings 

The CSB found that the three incidents in Mississippi, Oklahoma, and Texas, could likely have been 

prevented by restricting access to the oil and gas production facilities and providing appropriate warning 

signage, hatch locks, or other appropriate security alternatives; or utilizing inherently safer tank design 

alternatives. The ease of accessibility and a lack of awareness of the hazards associated with the storage 

tanks, coupled with the number of oil and gas facilities nationally, demonstrate a potential for similar 

incidents to occur. The CSB makes the following key findings: 

001119
Final Report September 2011 

51 

1. Members of the public, most often children and young adults, commonly visit oil and gas 

production sites without authorization for recreational purposes. 

2. Members of the public gain access to production tanks via attached unsecured ladders and 

catwalks, and may come into contact with flammable vapors from tank vents or unsecured 

tank hatches. 

3. Members of the public, unaware of the explosion and fire hazards associated with the tanks, 

unintentionally introduce ignition sources for the flammable vapor, leading to explosions. 

4. The CSB identified 26 similar incidents between 1983 and 2010, which resulted in a total of 

44 fatalities and 25 injuries. All the victims were 25 years of age or less. 

5. The three incidents investigated by the CSB in 2009-2010 occurred in isolated, rural wooded 

areas at production sites that were unfenced, did not have clear or legible warning signs, as 

required under OSHA’s Hazard Communication Standard, and did not have hatch locks to 

prevent access to the flammable hydrocarbons inside the tanks. 

6. The storage tanks did not include inherently safer design features to prevent tank explosions. 

Safer design features used in the downstream, refining sector would likely prevent tank 

explosions at E&P sites. These include the use of vents fitted with pressure-vacuum devices, 

flame arrestors, vapor recovery systems, floating roofs or an equivalent alternative.

7. E&P storage tanks are exempt from the security requirements of the Clean Water Act and 

from the risk management requirements of the Clean Air Act.

8. Industry guidance from the American Petroleum Institute recommends specific security 

measures for storage tanks of refined petroleum products but not for storage tanks at upstream 

E&P sites, and the National Fire Protection Association standards do not adequately define 

security expectations where these deadly incidents occurred.

9. Some states, including California and Ohio, and some localities have mandated security 

(including fencing, locked or sealed tank hatches, and warning signs) for E&P sites, 

particularly in urban areas. As a result, despite its large role as an oil producing state with 

many of these types of facilities, none of the 26 incidents occurred in California. However, 

many other large oil and gas producing states have no such requirements (except for certain 

E&P sites where toxic hydrogen sulfide gas is present).

001120
Final Report September 2011 

52 

10.0 Recommendations 

The CSB makes the following recommendations: 

The Environmental Protection Agency

2011-H-1-R01 

Publish a safety alert directed to owners and operators of exploration and production facilities with 

flammable storage tanks, advising them of their general duty clause responsibilities for accident 

prevention under the Clean Air Act. At a minimum, the safety alert should: 

a) Warn that storage tanks at unmanned facilities may be subject to tampering or introduction of 

ignition sources by members of the public, which could result in a tank explosion or other 

accidental release to the environment 

b) Recommend the use of inherently safer storage tank design features to reduce the likelihood of 

explosions, including restrictions on the use of open vents for flammable hydrocarbons, flame 

arrestors, pressure vacuum vent valves, floating roofs, vapor recovery systems or an equivalent 

alternative. 

c) Describe sufficient security measures to prevent non-employee access to flammable storage 

tanks, including such measures as a full fence surrounding the tank with locked gate, hatch locks 

on tank manways, and barriers securely attached to tank external ladders or stairways 

d) Recommend that hazard signs or placards be displayed on or near tanks to identify the fire and 

explosion hazards using words and symbols recognizable by the general public 

The Mississippi Oil and Gas Board 

2011-H-1-R02 

Amend state oil and gas regulations to require the use of inherently safer tank design features such as 

flame arrestors, pressure vacuum vents, floating roofs, vapor recovery systems or an equivalent 

alternative, to prevent the ignition of a flammable atmosphere inside the tank.

Oklahoma Corporation Commission

2011-H-1-R03 

Amend state oil and gas regulations to: 

a) Protect storage tanks at exploration and production sites from public access by requiring 

sufficient security measures, such as full fencing with a locked gate, hatch locks on tank 

manways, and barriers securely attached to tank external ladders and stairways. 

001121
Final Report September 2011 

53 

b) Require hazards signs or placards on or near tanks that identify the fire and explosion hazards 

using words and symbols recognizable by the general public.

c) Require the use of inherently safer tank design features such as flame arrestors, pressure vacuum 

vents, floating roofs, vapor recovery systems or an equivalent alternative, to prevent the ignition 

of a flammable atmosphere inside the tank.

The Texas Railroad Commission (RRC)

2011-H-1-R04 

Amend state oil and gas regulations to: 

a) Protect storage tanks at exploration and production sites from public access by requiring 

sufficient security measures, such as full fencing with a locked gate, hatch locks on tank 

manways, and barriers securely attached to tank external ladders and stairways. 

b) Require hazards signs or placards on or near tanks that identify the fire and explosion hazards 

using words and symbols recognizable to the general public.

c) Require the use of inherently safer tank design features such as flame arrestors, pressure vacuum 

vents, floating roofs, vapor recovery systems or an equivalent alternative to prevent the ignition 

of a flammable atmosphere inside the tank.

American Petroleum Institute

2011-H-1-R05 

Create a new standard or amend existing standards covering exploration and production facilities to: 

a) Warn that storage tanks at unmanned facilities may be subject to tampering or introduction of 

ignition sources by members of the public, which could result in a tank explosion or other 

accidental release to the environment. 

b) Recommend the use inherently safer storage tank design features to reduce the likelihood of 

explosions, including restrictions on the use of open vents for flammable hydrocarbons, flame 

arrestors, pressure vacuum vent valves, floating roofs, vapor recovery systems or an equivalent 

alternative. 

c) Require security measures at least as protective as API 2610 to prevent non-employee access to 

flammable storage tanks at upstream E&P sites, including such measures as a full fence 

surrounding the tank(s) with a locked gate, hatch locks on tank manways, and barriers securely 

attached to tank external ladders or stairways. 

001122
Final Report September 2011 

54 

d) Require that hazard signs or placards be displayed on or near tanks to identify the fire and 

explosion hazards using words and symbols recognizable by the general public. 

e) Recommend that new or revised mineral leasing agreements include security and signage 

requirements as described above. 

The National Fire Protection Association 

2011-H-1-R06 

Amend NFPA 30, “Storage of Liquids in Tanks—Requirements for all Storage Tanks” as follows: 

a) Remove the term “isolated” from the current wording of the standard and replace it with a more 

descriptive term, such as “normally unoccupied” 

a) Remove the words “Where necessary” from Security for Unsupervised Storage Tanks, Chapter 

21.7.2.2. 

b) Add a reference to a relevant security standard that offers specifications on fencing, locks and 

other site security measures. 

c) Add a definition of security encompassing requirements such as fencing, locked gates, hatch locks, 

and barriers. 

 

001123
Final Report September 2011 

55 

By the 

U.S. Chemical Safety and Hazard Investigation Board 

The Honorable Rafael Moure Eraso 

 Chair 

 The Honorable John S. Bresland 

 Member 

 The Honorable Mark Griffon 

 Member 

 

Date of Board Approval 

001124
Final Report September 2011 

56 

11.0 Appendix A: Previous Incidents 

Rio Blanco County, Colorado, June 24, 2007: 2 Teen Fatalities59

On June 24, 2007, in Rio Blanco County, Colorado, a tank exploded when a group of 15 to 20 teens and 

young adults were socializing near an oil tank storage site. The site was located along an access road on 

public land leased from the National Forest Service. The production site had two 400-barrel capacity 

tanks with atmospheric vent pipes; one contained 60 barrels and the other contained 120 barrels of oil. 

The youths had built a campfire approximately 50 to 60 yards from a group of oil tanks and two or three 

individuals and a dog climbed onto the tanks. Witnesses indicated that these individuals were jumping on 

the tanks when the witnesses heard a hissing coming from the tanks. Approximately 10 minutes later, an 

explosion propelled the bottom of one tank 80 to 100 yards away from its original location. The force of 

the explosion killed the two teens jumping on the tanks. The oil site was located in an isolated area and 

the embankment surrounding the tanks had a steel construction type pipe fence around it, intended to 

restrict cattle. The Colorado Bureau of Investigations (CBI) determined a lighter to be the likely ignition 

source and recommended that fencing be placed around the pumping unit and pit area. 

Mercedes, Texas, May 17, 2007: 3 Teen Fatalities60 

A tank explosion on May 17, 2007, in Mercedes, Texas, killed three teens. Shoe prints were found on top 

of the tank, indicating that the teens were likely on top of the tank prior to the explosion; a cigarette 

lighter was also found. The tank was easily accessible and was a regular hangout for the teens. 

 

59 Colorado Bureau of Investigations 

60 Hidalgo County Fire Marshal's Office

001125
Final Report September 2011 

57 

Long Lake, Texas, April 11, 2003: 4 Teen Fatalities61

A tank explosion on April 11, 2003, in Anderson County, Texas, killed three teens instantly; another died 

later of his injuries. Five teens had gathered at a remote oil site to socialize. They climbed the catwalk 

that accessed several tanks. They climbed to the top of the tank when one teenager climbed back down to 

the catwalk, opened an access hatch to one of the tanks, and looked inside. He returned to his spot on top 

of one of the tanks while one of his friends climbed down to look inside the tank, using a lighter to see the 

contents more clearly. The tank exploded fatally injuring three, seriously injuring one teen and leaving 

one with minor injuries. The site had no fences or warning signs. 

Heflin, Louisiana, May 26, 2001: 1 Teen Fatality 62

An oil tank incident on May 26, 2001, in Heflin, Louisiana, killed one teen, severely burned another, and 

left a third with minor burns. Six teens gathered at an oil site at approximately 5:00 a.m., when three of 

the six climbed the catwalk of a tank, which allowed access to the tops of three oil tanks. One teen 

climbed the center tank; another joined him, but became frightened while on the tank and climbed back 

down to the catwalk. The teen on top of the tank was smoking a cigarette, which likely ignited flammable 

fumes venting from the tank, causing the explosion. The force from the explosion threw the teen 

approximately 96 feet from the tank, killing him. Another teen on the catwalk was doused in burning 

liquid and severely burned. The third received minor burns. 

 

 

61 Anderson County Sheriff Department 

62 Webster Parish Sheriff’s Office 

001126
Final Report September 2011 

58 

Oil and Gas Storage Site Explosions, 1983-2010 

 Date City State Fatality Injury Incident Summary Fencing 

Required

1 4/2/1983 Center TX 2 0 

Explosions blew apart two 

storage tanks of gas 

distillate killing two 

fourteen-year-old girls 

playing nearby; four other 

youths escaped uninjured. 

No 

2 6/24/1985 Centralia IL 1 4 

Firecrackers tossed into a 

10-ft oil tank triggered an 

explosion and killed one 

teenager and injured four, 

including the father of a 

victim. The blast sprayed 

crude oil on homes nearly 

100 yards away. 

No 

3 5/16/1990 Beggs OK 3 0 

An oil storage tank 

exploded, killing three men 

in their early 20s when one 

of the men attempted to 

light a cigarette. 

No 

4 8/19/1990 Logansport LA 4 0 

Four people, including two 

teenage sisters, were 

killed when a storage tank 

exploded. The victims 

appeared to be climbing a 

ladder to the top of the 

tank when the explosion 

happened. 

No 

5 6/19/1991 Oklahoma 

City OK 1 0 

A 13-year-old boy playing 

atop an oil field salt water 

tank was killed by an 

explosion triggered when 

he apparently struck a 

match. His body was 

thrown 60 yards by the 

blast. 

Yes 

(Urban) 

6 10/28/1991 Tyler County TX 0 2 

An adult and a teenager 

were injured when an oil 

storage tank exploded, 

igniting four other tanks 

when one of the victims lit 

a cigarette lighter near the 

storage tank’s open hatch. 

No 

7 9/22/1992 Sherman TX 1 4 

A tank explosion killed a 

teenager and injured four 

others at a tank farm 

where seven teenagers 

were partying after four 

teens climbed a tank and 

lit a match to see inside. 

Yes 

(Urban) 

001127
Final Report September 2011 

59 

 Date City State Fatality Injury Incident Summary Fencing 

Required

8 7/2/1993 Providence KY 4 5 

Four teenagers were killed 

and five others injured in a 

crude oil storage tank 

explosion triggered by a 

cigarette at a party. The 

victims were sitting on top 

the tank when it exploded. 

No 

9 4/23/1995 Duncan OK 3 0 

An oil field blast killed 

three 13-year-old boys 

while playing near two 

remote oil field storage 

tanks. 

No 

10 11/28/1995 Bradford PA 2 0 

A lit cigarette was blamed 

for an oil tank explosion 

that killed two 14-year-old 

boys playing on the tanks. 

No 

11 6/22/1997 Konawa OK 2 0 

Two teenagers, 15 and 13, 

died when they climbed a 

20,000-gallon oil tank and 

lit fireworks, triggering an 

explosion. 

No 

12 7/29/1997 Chandlersville OH 2 0 

Two teenagers, 17 and 15, 

died when a 15-ft oil tank 

exploded, throwing their 

bodies more than 200 feet. 

The teens appeared to 

have been climbing the 

tank at the time of the 

explosion. 

No 

13 8/14/1998 Logan OH 1 1 

One young man was killed 

and a 16-year-old girl was 

seriously injured when an 

oil storage tank exploded, 

throwing their bodies 

about 100 feet. The oil 

tanks were not in use at 

the time of the explosion. 

No 

14 1/29/2000 Flora Vista NM 1 1 

A gas tank explosion killed 

one teenager and critically 

injured another when one 

of the boys apparently 

threw a lighter into the 

12,000-gallon tank. 

No 

15 5/26/2001 Sibley LA 1 1 

One teenager was killed 

and another critically 

burned when an oil tank in 

an oil field exploded. Two 

of the five teens were 

sitting on the tank, and 

one was smoking a 

cigarette at the time of the 

explosion. 

No 

001128
Final Report September 2011 

60 

 Date City State Fatality Injury Incident Summary Fencing 

Required

16 11/30/2001 Duson LA 0 1 

An explosion in a crude oil 

storage tank threw a 14-

year-old boy more than 

100 feet as he was 

reportedly walking his dog 

in the surrounding fields. 

No 

17 4/11/2003 Long Lake 

(Palestine) TX 4 0 

Four teenagers died in an 

oil storage tank explosion 

when five teens climbed 

the tank and one opened 

the hatch. A cigarette 

lighter triggered the blast 

and the victims were 

thrown nearly 75 yards. 

No 

18 9/6/2003 Blue Rock OH 0 2 

Four individuals were 

socializing at an oil tank 

site when a tank exploded 

causing head injuries to 

two of the men. One of the 

men apparently lit a 

cigarette after climbing 

atop the tank. 

No 

19 5/14/2005 Ripley OK 2 0 

Two men ages 19 and 20 

died from third-degree 

burns over 90 percent of 

their bodies after an oil 

storage tank exploded 

while they and two others 

were drinking at the site. 

No 

20 12/18/2006 Springtown TX 1 1 

Two teenagers, 16 and 14, 

at a tank battery dropped a 

burning paper into an 

unlocked tank hatch 

located inside a 5-ft high 

unlocked cattle fence. 

One victim was killed and 

the other injured. 

No* 

(cattle 

fence) 

21 3/12/2007 Oklahoma 

City OK 0 1 

A 15-year-old boy was 

critically injured after an 

explosion and fire at an oil 

tank battery burned more 

than 45 percent of his 

body. The cause of the 

explosion was unclear. 

Yes 

(Urban) 

22 5/18/2007 Mercedes TX 3 0 

Three teenagers were 

killed when a liquid 

storage tank exploded in a 

field after one of the teens 

apparently climbed onto 

the abandoned tank and 

opened the hatch. 

No 

001129
Final Report September 2011 

61 

 Date City State Fatality Injury Incident Summary Fencing 

Required

23 6/23/2007 Oak Creek CO 2 0 

A group of 15-20 teens 

partying at an oil storage 

site triggered a tank 

explosion killing two teens 

as they jumped on and 

smoked near the oil tanks. 

Yes 

(Wildlife) 

24 10/31/2009 Carnes MS 2 0 

Two teenagers socializing 

at a tank site were killed 

when an oil tank exploded 

in a wooded clearing 

approximately 150 yards 

from one of the victims' 

homes. 

No 

25 4/14/2010 Weleetka OK 1 1 

A group of 6 teenagers 

and young adults were 

socializing at an oil 

storage site when a tank 

exploded, fatally injuring 

one and causing second 

degree burns to another. 

No 

26 4/26/2010 New London TX 1 1 

Two young adults were 

socializing at an oil tank 

site when an explosion 

killed one and critically 

injured the other. 

No 

Sources: 1) Associated Press; 2) Chicago Tribune; 3) USA Today; 4) Washington Post; 5) Daily Oklahoman; 6) 

San Antonio Daily Express; 7) New York Times; 8) Associated Press/CSB Documents; 9) Daily Oklahoman; 10) 

Pittsburgh Gazette; 11) Associated Press; 12) Columbus Dispatch; 13) Associated Press/CSB Documents; 14) 

Albuquerque Tribune; 15) Associated Press/CSB Documents; 16) Daily Advertiser; 17) Associated Press; 18) 

Associated Press/CSB Documents; 19) Associated Press; 20) CSB Documents; 21) Daily Oklahoman; 22) 

Associated Press; 23) CSB Documents; 24) CSB Investigation; 25) CSB Investigation; 26) CSB Investigation

001130
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

CATASTROPHIC RUPTURE OF HEAT EXCHANGER

(SEVEN FATALITIES) 

TESORO ANACORTES REFINERY

ANACORTES, WASHINGTON

APRIL 2, 2010 

KEY ISSUES

 INHERENTLY SAFER DESIGN

 TESORO PROCESS SAFETY CULTURE

 CONTROL OF NONROUTINE WORK

 MECHANICAL INTEGRITY INDUSTRY STANDARD DEFICIENCIES

 REGULATORY OVERSIGHT OF PETROLEUM REFINERIES

REPORT 2010-08-I-WA 

MAY 2014

001131
Tesoro Anacortes Refinery Investigation Report May 2014

   

i U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

[This page left intentionally blank.] 

 

001132
Tesoro Anacortes Refinery Investigation Report May 2014

   

ii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Dedication 

This report is dedicated to the two women and five men 

who lost their lives as a result of the Tesoro Anacortes 

Refinery incident on April 2, 2010. 

Daniel Aldridge 

Matthew Bowen 

Matthew Gumbel 

Darrin Hoines 

Lew Janz 

Kathryn Powell 

Donna Van Dreumel 

 

001133
Tesoro Anacortes Refinery Investigation Report May 2014

   

iii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table of Contents 

1.0 Executive Summary .......................................................................................................................... 1

1.1 Incident Summary .............................................................................................................................. 1

1.2 Key Findings ...................................................................................................................................... 2

1.2.1 Technical Findings ..................................................................................................................... 2

1.2.2 Organizational Findings ............................................................................................................. 4

1.2.3 Industry Codes and Standards Findings ..................................................................................... 7

1.2.4 Regulatory Findings ................................................................................................................... 8

1.2.5 Similar Findings in CSB Investigations of the Tesoro Anacortes and Chevron Richmond 

Refinery Incidents ................................................................................................................................ 11

1.3 Recommendations ............................................................................................................................ 13

2.0 Tesoro Refining & Marketing Company LLC ............................................................................ 15

2.1 Anacortes Refinery ........................................................................................................................... 15

2.2 Other Tesoro Refineries ................................................................................................................... 16

2.3 Tesoro Anacortes Refinery NHT Unit .............................................................................................. 17

2.3.1				Catalytic Reformer .................................................................................................................... 17

2.3.2 Naphtha Hydrotreater – A/B/C & D/E/F Feed/Product Heat Exchangers ................................ 17

3.0 Incident Description ....................................................................................................................... 20

3.1 Pre-Incident Operations .................................................................................................................... 20

3.2 Night of the Incident ......................................................................................................................... 21

3.3 The Incident ...................................................................................................................................... 22

4.0 Technical Analysis .......................................................................................................................... 26

4.1 High Temperature Hydrogen Attack ................................................................................................ 26

4.1.1				Predicting the Occurrence of HTHA ........................................................................................ 31

4.1.2 Conditions that increase HTHA susceptibility ......................................................................... 33

4.1.3 Inherently Safer Design ............................................................................................................ 34

4.1.4				HTHA Inspection Strategy Limitations .................................................................................... 36

4.2 Tesoro Heat Exchanger Failure ........................................................................................................ 37

4.2.1				NHT Heat Exchanger Construction .......................................................................................... 37

4.2.2				Post-Incident Metallurgical Analysis ........................................................................................ 40

4.3 Timing of the Incident ...................................................................................................................... 43

4.3.1				NHT Heat Exchanger Startup Conditions ................................................................................. 44

4.4 Process Conditions of the B and E Heat Exchangers ....................................................................... 45

001134
Tesoro Anacortes Refinery Investigation Report May 2014

   

iv U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.4.1 CSB Modeling of the NHT Heat Exchangers .......................................................................... 46

4.4.1.1 HTHA Occurred Below the Nelson Curve ...................................................................... 49

4.4.1.2 Estimate That a Portion of the B and E Heat Exchangers Operated Above the Nelson 

Curve..... ......................................................................................................................................... 50

4.4.1.3 Tesoro’s Replacement Heat Exchangers ......................................................................... 50

5.0 Organizational Deficiencies ........................................................................................................... 51

5.1 NHT Heat Exchanger Flanges – A History of Leaking .................................................................... 51

5.1.1				Incident Report That Demonstrates Normalization of Hazardous Conditions ......................... 52

5.1.2				TOP Investigation of Fires ........................................................................................................ 52

5.1.3				MOCs Did not Effectively Control Hazardous Conditions ...................................................... 53

5.1.4 Unsuccessful Tesoro Attempts to Prevent Heat Exchanger Flange Leaks ................................ 55

5.2 Hazardous Nonroutine Work ............................................................................................................ 57

5.2.1 CSB Investigation of Tosco Avon Refinery ............................................................................. 58

5.2.2				NHT Heat Exchanger Cleaning and Startup ............................................................................. 59

5.2.3				Tesoro Failure to Control Heat Exchanger Startup Hazards ..................................................... 59

5.3 Process Hazard Analyses Failed to Prevent or Reduce the Consequences ....................................... 63

5.3.1				Hazardous Nonroutine Operations ............................................................................................ 63

5.3.2 Access Was Not Controlled During Hazardous NHT Heat Exchanger Startup ....................... 64

5.3.3 Failure to Effectively Identify and Evaluate HTHA Hazards .................................................. 65

5.3.3.1 Insufficient Process Instrumentation ............................................................................... 68

5.3.4 HTHA Hazards Were Not Effectively Controlled ................................................................... 69

5.3.4.1 PHA Assumptions That Contributed to Ineffective Control of HTHA Hazards ............. 70

5.4 CSB Conclusions on Organizational Deficiencies ........................................................................... 73

6.0 Industry Codes and Standards ...................................................................................................... 75

6.1 API RP 941 Operating Limits and Material Selection for HTHA .................................................... 75

6.1.1				No Minimum Requirements to Prevent HTHA ........................................................................ 75

6.1.2				History of the Nelson Curves .................................................................................................... 75

6.1.3 Industry Critiques of Nelson Curves ........................................................................................ 76

6.1.4				Unreliable Carbon Steel Nelson Curve ..................................................................................... 78

6.1.4.1 ExxonMobil HTHA Incident Below the Carbon Steel Nelson Curve ............................. 79

6.1.4.2 Other Industry Reports of HTHA Damage to Equipment that Operated Below the 

Carbon Steel Nelson Curve ............................................................................................................. 79

6.1.5 Essential Adjustments Are Needed to API RP 941 .................................................................. 79

6.1.6				ANSI Z10, Exemplifies Standards Clarity ................................................................................ 81

6.2 API RP 580 Risk Based Inspection / API 581 Risk Based Inspection Technology ........................ 82

001135
Tesoro Anacortes Refinery Investigation Report May 2014

    v U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.0 Regulatory Oversight of Petroleum Refineries in Washington .................................................. 84

7.1 Background....................................................................................................................................... 85

7.2 L&I Division of Occupational Safety and Health (DOSH) .............................................................. 86

7.2.1 Causal Findings Analysis ......................................................................................................... 86

7.3 OSHA National Emphasis Program ................................................................................................. 92

7.3.1 Federal National Emphasis Program ........................................................................................ 92

7.3.2 Washington State National Emphasis Program ........................................................................ 93

7.3.3 Tesoro National Emphasis Program Audit ............................................................................... 95

7.3.3.1 Tesoro NEP Results Associated with the E Heat Exchanger .......................................... 95

7.4 Risk Reduction and Continuous Improvement ................................................................................. 97

7.5 Workforce Participation ................................................................................................................. 101

7.6 Funding and Regulator Competency .............................................................................................. 102

7.7 Similar Deficiencies in the Anacortes and Richmond Refinery Incidents ..................................... 102

7.7.1				Reliance on Inspection Instead of Inherently Safer Design in Mechanical Integrity Programs at 

Tesoro and Chevron Refineries .......................................................................................................... 103

7.7.2				Ineffective PHAs at Tesoro and Chevron ............................................................................... 104

7.7.3				Applicable API Standards Lack Minimum Requirements to Control Hazards ...................... 104

7.7.4				Weak Regulations and Ineffective Regulators ........................................................................ 104

7.8 Environmental Protection Agency and Chemical Accident Release Programs ............................. 105

7.8.1 Background ............................................................................................................................ 105

7.8.2 Enforcement of Inherent Safety in the United States ............................................................. 107

7.8.3 The EPA RMP Program ......................................................................................................... 107

7.8.4 The General Duty Clause ....................................................................................................... 108

7.8.5				The EPA’s Authority to Enforce Inherent Safety ................................................................... 110

7.8.6				The Role of Inherent Safety in Major Accident Prevention ................................................... 113

8.0 Recommendations ......................................................................................................................... 114

8.1 The U.S. Environmental Protection Agency .................................................................................. 114

8.2 Washington State Legislature, Governor of Washington ............................................................... 115

8.3 Washington State Department of Labor & Industries - Division of Occupational Safety and 

Health...............................................................................................................................118

8.4 American Petroleum Institute ......................................................................................................... 119

8.5 Tesoro Refining & Marketing Company LLC ............................................................................... 120

8.6 Tesoro Anacortes Refinery ............................................................................................................. 121

8.7 United Steelworkers Local 12-591 ................................................................................................. 122

Appendix A AcciMap Causal Analysis ........................................................................................... 123

001136
Tesoro Anacortes Refinery Investigation Report May 2014

    vi U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix B NHT A/B/C Heat Exchanger Startup Trend Data ................................................... 128

Appendix C CSB Simulation of the NHT Heat Exchangers ......................................................... 131

Appendix D Evaluation of Current Tesoro Programs to Identify and Control Damage 

Mechanism Hazards .................................................................................................... 137

Appendix E Inspection Techniques................................................................................................. 140

Appendix F CSB Chevron Reports Incorporated by Reference .................................................. 142

Appendix G Spectrum Inspection Reports ..................................................................................... 143

Appendix H Beta Laboratory Reports ............................................................................................ 144

Appendix I Metallurgical Review .................................................................................................. 145

Appendix J Additional HTHA Evaluation Report ....................................................................... 146

001137
Tesoro Anacortes Refinery Investigation Report May 2014

    vii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

List of Figures 

Figure 1. Schematic of the Tesoro Anacortes Refinery NHT Unit Heat Exchangers .................................. 2

Figure 2. Tesoro Anacortes Refinery ......................................................................................................... 15

Figure 3. Aerial View of the Tesoro Anacortes Refinery. ......................................................................... 16

Figure 4. Process Flow of NHT Unit ......................................................................................................... 18

Figure 5. Example of Fouling Deposits on the Inside of Heat Exchanger Tubes. ..................................... 20

Figure 6. Aerial View of CR/NHT Unit .................................................................................................... 21

Figure 7. CSB Animation of Operator Opening Long-Winded Valve on Night of Incident ..................... 22

Figure 8. Post-Incident View of D/E/F NHT Heat Exchanger Bank ......................................................... 23

Figure 9. CSB Animation of the Fire Following the NHT Heat Exchanger Failure .................................. 24

Figure 10. Six NHT Heat Exchangers in Two Banks of Three Heat Exchangers Each ............................ 25

Figure 11. Atomic Hydrogen Diffuses Through Steel.. ............................................................................. 27

Figure 12. Decarburization Process. .......................................................................................................... 28

Figure 13. Methane Fissures. ..................................................................................................................... 29

Figure 14. Methane Blisters.. ..................................................................................................................... 29

Figure 15. Microcrack Resulting from Linked-HTHA Fissures ................................................................ 30

Figure 16. Nelson Curves from Current API RP 941 ................................................................................ 32

Figure 17. Hierarchy of Controls. .............................................................................................................. 35

Figure 18. Fabrication Layout of the B and E Heat Exchangers................................................................ 37

Figure 19. Cross-Section of Sample NHT Heat Exchanger Weld ............................................................. 39

Figure 20. E Heat Exchanger Failure Schematic ....................................................................................... 40

Figure 21. Circumferential Weld Damage in the B Heat Exchanger. ........................................................ 41

Figure 22. Comparison of Damage Locations in the B and E Heat Exchangers. ...................................... 42

Figure 23. Temperature and Pressure Trends before the Anacortes Incident ............................................ 44

Figure 24. Temperature and Pressure Indicators for the NHT Heat Exchanger Banks ............................. 45

Figure 25. Model Results for Can 4. .......................................................................................................... 47

Figure 26. Model Results for the Weld Downstream of Can 4 .................................................................. 48

Figure 27. Model Results for the Coldest Region of the E Heat Exchanger .............................................. 49

Figure 28. Steam Station and Steam Lance. .............................................................................................. 54

Figure 29. Post-Incident Steam Lance ....................................................................................................... 56

Figure 30. Unit structure (left) and manual block valve (right) ................................................................. 60

Figure 31. DMHR and CSB Findings on Anacortes HTHA and Heat Exchangers (1990–2008) ............. 67

Figure 32. Temperature and Pressure Instruments on the NHT Heat Exchanger Banks ........................... 69

Figure 33. CSB Modeling Results of HTHA and the Nelson Curve at the Tesoro Anacortes Refinery ... 80

001138
Tesoro Anacortes Refinery Investigation Report May 2014

    viii U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 34. Example of ANSI Z10 Obligations Formatting ........................................................................ 82

Figure 35. Gaps Within the Washington and Federal PSM Regulations ................................................... 92

Figure 36. AcciMap of April 2, 2010 Tesoro Anacortes Refinery Explosion and Fire ........................... 124

Figure 37. Location of the Two Outlet Temperature Measurements ....................................................... 128

Figure 38. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on Night of the Incident

 ............................................................................................................................................. 129

Figure 39. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on August 29, 2009 . 129

Figure 40. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on April 2, 2009 ...... 130

Figure 41. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on February 3, 2008. 130

Figure 42. NHT Heat Exchanger Configuration with Known Process Conditions Indicated .................. 132

Figure 43. NHT Heat Exchanger Fouling Distributions Analyzed .......................................................... 133

Figure 44. Visualization of Possible Tube-Side Fouling Distributions ................................................... 134

Figure 45. Calibration of HYSYS Model with Actual Process Data ....................................................... 135

Figure 46. Estimated Operating Conditions of the B and E Heat Exchangers ......................................... 136

001139
Tesoro Anacortes Refinery Investigation Report May 2014

   

ix U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Acronyms and Abbreviations 

0F degrees Fahrenheit 

AcciMap Accident Map 

ALARP As Low As Reasonably Practicable 

AIHA American Industrial Hygiene Association 

ANSI American National Standards Institute 

API American Petroleum Institute 

API RP 571 API RP 571—Damage Mechanisms Affecting Fixed Equipment in the 

Refining Industry 

API RP 580 API RP 580—Risk-Based Inspection 

API RP 581 API RP 581—Risk-Based Inspection Technology 

API RP 941 API RP 941—Steels for Hydrogen Service at Elevated Temperatures and 

Pressures in Petroleum Refineries and Petrochemical Plants 

API RP1

 API Recommended Practices. API standards that communicate 

recognized industry practices. Recommended practices (RPs) may include 

both mandatory and non-mandatory requirements. 

 Shall: As used in a standard, “shall” denotes a minimum requirement in 

order to conform to the standard. 

 Should: As used in a standard, “should” denotes a recommendation or that 

which is advised but not required in order to conform to the standard. 

API Standard2

 API Standards include Specifications, Recommended Practices, Standards, 

and Codes. Standards combine elements of both specifications and 

recommended practices. “Standard” is also a broad term covering all API 

documents that have been developed in accordance with API procedures 

for standards development. 

API TR 941 API Technical Report 941—The Technical Basis Document for API RP 

941 

APOSC Assessment Principles for Offshore Safety Cases 

ASNT American Society for Nondestructive Testing 

AUBT Advanced Ultrasonic Backscatter Technique 

bpd Barrels Per Day 

CAA Clean Air Act 

 

1

 http://www.api.org/publications-standards-and-statistics/~/media/Files/Publications/FAQ/2011-ProceduresFinal.ashx API Procedures for Standards Development. 2011; p 3. 2

 Ibid at pp 2-3. 

001140
Tesoro Anacortes Refinery Investigation Report May 2014

    x U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Cal/OSHA California Occupational Safety and Health Administration 

CCPS Center for Chemical Process Safety (American Institute of Chemical 

Engineers) 

CFR Code of Federal Regulations 

CSB U.S. Chemical Safety and Hazard Investigation Board 

CSHO Compliance Safety and Health Officer 

DCS Distributed Control System 

DOSH Division of Occupational Safety and Health (within Washington L&I) 

DMHR Damage Mechanism Hazard Review (also known as a corrosion review) 

EPA U.S. Environmental Protection Agency 

HAZ Heat Affected Zone 

HSE Health and Safety Executive 

HTHA High Temperature Hydrogen Attack 

IOW Integrity Operating Window 

IST Inherently Safer Technology 

L&I Washington State Department of Labor & Industries 

MOC Management of Change 

MOOC Management of Organizational Change 

MSDS Material Safety Data Sheet 

NDE Nondestructive Examination 

NDT Nondestructive Testing 

NEJAC National Environmental Justice Advisory Council 

NEP OSHA Petroleum Refinery Process Safety Management National 

Emphasis Program 

NHT Catalytic Reformer / Naphtha Hydrotreater Unit 

NIST National Institute of Standards and Technology 

OSHA U.S. Occupational Safety and Health Administration 

OSHAct Occupational Safety and Health Act of 1970, 29 U.S.C. 667 

PHA Process Hazard Analysis 

PQV PSM Program Quality Verification Inspection—referenced in OSHA’s 

1994 PSM Compliance Directive3

PSIA Pounds Per Square Inch Absolute 

 

3

 OSHA Instruction CPL 2-2.45A CH-1 September 13, 1994 Directorate of Compliance Programs, 29 CFR 1910.119, Process Safety 

Management of Highly Hazardous Chemicals -- Compliance Guidelines and Enforcement Procedures. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=1559 (accessed December 28, 2013). 

001141
Tesoro Anacortes Refinery Investigation Report May 2014

    xi U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

PSIG Pounds Per Square Inch Gauge 

PSM Process Safety Management 

PSM Standard OSHA Process Safety Management of Highly Hazardous Chemicals 

Standard, 29 CFR §1910.119 

PWHT Post-Weld Heat Treatment 

RAGAGEP Recognized and Generally Accepted Good Engineering Practice 

RBI Risk-Based Inspection 

RMP Risk Management Plan (EPA), as defined in U.S.C. Section 42, Chapter 

85, Subchapter I, Part A, Section 7412(r) 

RP Recommended Practice (API) 

S-Scan Sectorial Scan 

SS Stainless Steel 

TOP Triangle of Prevention 

UK United Kingdom 

USW United Steelworkers Union 

UT Ultrasonic Technique 

WAC Washington Administrative Code 

WFMT Wet Fluorescent Magnetic Particle Testing 

 

001142
Tesoro Anacortes Refinery Investigation Report May 2014

    1 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1.0 Executive Summary 

1.1 Incident Summary 

On April 2, 2010, the Tesoro Refining and Marketing Company LLC (“Tesoro”) petroleum refinery4 in 

Anacortes, Washington (“the Tesoro Anacortes Refinery”), experienced a catastrophic rupture of a heat 

exchanger in the Catalytic Reformer / Naphtha Hydrotreater unit (“the NHT unit”). The heat exchanger, 

known as E-6600E (“the E heat exchanger”), catastrophically ruptured because of High Temperature 

Hydrogen Attack (HTHA).5

 Highly flammable hydrogen and naphtha at more than 500 degrees 

Fahrenheit (oF) were released from the ruptured heat exchanger and ignited,6

 causing an explosion and an 

intense fire that burned for more than three hours. The rupture fatally injured seven Tesoro employees 

(one shift supervisor and six operators) who were working in the immediate vicinity of the heat exchanger 

at the time of the incident. To date this is the largest fatal incident at a US petroleum refinery since the 

BP Texas City accident in March 2005.7

 

The NHT unit at the Tesoro Anacortes Refinery contained two parallel groups, or banks, of three heat 

exchangers (A/B/C and D/E/F) used to preheat process fluid before it entered a reactor, where impurities 

were treated for subsequent removal. The E heat exchanger was constructed of carbon steel.8

 A 

schematic of the six heat exchangers is illustrated in Figure 1. 

At the time of the release, the Tesoro workers were in the final stages of a startup activity to put the 

A/B/C bank of heat exchangers back in service following cleaning. The D/E/F heat exchangers remained 

in service during this operation. Because of the refinery’s long history of frequent leaks and occasional 

fires during this startup activity, the CSB considers this work to be hazardous and nonroutine.9

 While the 

operations staff was performing the startup operations, the E heat exchanger in the middle of the 

operating D/E/F bank catastrophically ruptured. 

 

4

 Tesoro purchased all of the Shell Oil Company’s stock in the Shell Anacortes Refining Company in 1998. 

Approximately 350 employees are at the Anacortes refinery and 185 of them are operations and maintenance 

workers who are represented by the United Steelworkers union (USW). 5

 HTHA is a damage mechanism that results in fissures and cracking and occurs when carbon steel equipment is 

exposed to hydrogen at high temperatures and pressures. 6

 The autoignition temperature of a material is defined as the temperature at which it will ignite spontaneously on 

contact with oxygen, without spark or flame. The Tesoro Material Safety Data Sheet (MSDS) for naphtha listed 

autoignition temperature as 437 oF. As the process temperature was more than 500 0F, autoignition was likely. 7

 The 2005 BP Texas City incident resulted in 15 fatalities and 180 injuries. 

8

 The portion of the E heat exchanger that failed was constructed of carbon steel. The details of the exchanger 

materials are addressed in Section 4.2.1, NHT Heat Exchanger Construction. 9

 Nonroutine does not refer to the frequency at which the activity occurs. Nonroutine refers to whether the activity 

is part of the normal sequence of converting raw materials to finished products. Startup is considered a 

nonroutine activity. Center for Chemical Process Safety (CCPS), Guidelines for Risk Based Process Safety. 

2007; p 286. 

001143
Tesoro Anacortes Refinery Investigation Report May 2014

    2 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 1. Schematic of the Tesoro Anacortes Refinery NHT Unit Heat Exchangers. There are two 

banks of three heat exchangers: A/B/C bank and D/E/F bank. The E heat exchanger catastrophically 

ruptured on April 2, 2010. 

1.2 Key Findings 

1.2.1 Technical Findings 

1. The rupture of the E heat exchanger was the result of the carbon steel heat exchanger being 

severely weakened by a damage mechanism known as HTHA. The B heat exchanger did not fail, 

but was constructed with the same materials and operated under the same conditions as the E heat 

exchanger. The B heat exchanger was also severely weakened by HTHA damage. HTHA is a 

damage mechanism that results in fissures and cracking and occurs when carbon steel equipment 

001144
Tesoro Anacortes Refinery Investigation Report May 2014

    3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

is exposed to hydrogen at high temperatures and pressures.10 The resulting damage severely 

degrades the mechanical properties of the steel.11 (Section 4.1) 

2. HTHA can accumulate in high-stress areas in carbon steel, such as non-post-weld heat-treated 

welds. The welds of the B and E carbon steel heat exchangers were not post-weld heat-treated. 

The high stress areas near the welds of these heat exchangers were found to contain HTHA 

damage. The rupture location of the E heat exchanger was along these high-stress weld regions 

and was attributable to cracks caused by HTHA. (Sections 4.1.2 and 4.2.1) 

3. In 1970, the American Petroleum Institute (API) published API Recommended Practice (RP) 941 

Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants. This document provides Nelson curves to predict the occurrence of HTHA 

in various materials of construction as a function of temperature and hydrogen partial pressure.12 

The Nelson curves are predicated on past equipment failure incidents and are plotted based on 

self-reported process conditions that are ill-defined and lack consistency. (Section 4.4.1.1) 

4. The CSB performed computer reconstruction13 of the process conditions within the NHT heat 

exchangers. The results of the computer reconstruction show that the portion of the carbon steel 

E heat exchanger that ruptured was estimated to have operated below the applicable Nelson 

curve. This was considered the safe region of operation where HTHA could not occur. 

Therefore, the carbon steel Nelson curve methodology is inaccurate, cannot be depended on to 

prevent HTHA equipment failures, and cannot be reliably used to predict the occurrence of 

HTHA equipment damage. (Section 4.4.1.1) 

5. The hottest portion of the B and E heat exchangers was clad with stainless steel, which improved 

resistance to HTHA. On the basis of CSB computer reconstruction of the process conditions in 

the heat exchangers, the CSB estimates that this stainless steel-clad portion of the heat exchangers 

operated at process conditions that were at times above the carbon steel Nelson curve. However, 

the unclad portion where the rupture of the E heat exchanger occurred, and where HTHA existed 

in the B and E heat exchangers, was estimated to have operated below the Nelson curve. 

(Sections 4.2.1 and 4.4.1.2) 

 

10 McIntyre, Vogelsange, Progress in Corrosion- The First 50 Years of the EFC; Maney Publishing 2009; Section 

12.5.1. 11 Shih, H.M. and Johnson, H.H. A Model Calculation of the Nelson Curves for Hydrogen Attack; Acta 

Metallurgica, Volume 30. 1982; pp 537-545. 12 Hydrogen partial pressure is a calculated parameter. It is the pressure that would be exerted by a single 

component of a gas mixture. For example, the hydrogen partial pressure of a 500 psia gas mixture in a vessel 

that contains 50 mol% hydrogen and 50 mol% propane equals 250 psia. 13 The CSB modeled the exchanger process conditions using Aspen HYSYS® and Aspen Exchanger Design and 

Rating. The model required the use of several assumptions, such as fouling distribution, because of a lack of 

both process and fouling data gathered by Tesoro. As a result, all model results are estimates. Due to limitations 

in historical data, modeling estimates were limited to 2007-2010. See Appendix C for a detailed description of 

the modeling assumptions and results. 

001145
Tesoro Anacortes Refinery Investigation Report May 2014

    4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

6. It is very difficult to inspect for HTHA because the damage might not be detected; it can be 

microscopic and may be present only in small localized areas of equipment. In addition, 

equipment must already be damaged by HTHA for equipment inspection to identify HTHA. 

Successful identification of HTHA is highly dependent on the specific techniques employed and 

the skill of the inspector, and there are few inspectors who have this expertise. Inspection is 

therefore not sufficiently reliable to ensure mechanical integrity and prevent HTHA equipment 

damage. (Section 4.1.4) 

7. Equipment inspections and post-weld heat treating rely on procedures and human 

implementation, which are low on the hierarchy of controls14 and thus are weaker safeguards to 

prevent HTHA failures than the use of materials that are less susceptible to HTHA damage. 

(Section 4.1.2) 

8. Inherently safer design is a better approach to prevent HTHA. API has identified high chromium 

steels that are significantly more resistant to HTHA than carbon steel. The B and E heat 

exchangers were not constructed from these inherently safer materials. (Sections 4.1.3 and 4.1.4) 

1.2.2 Organizational Findings 

9. The startup of the NHT heat exchangers was hazardous nonroutine work. Leaks routinely 

developed that presented hazards to workers conducting the startup activities. Process Hazard 

Analyses (PHAs) 15 at the refinery repeatedly failed to ensure that these hazards were controlled 

and that the number of workers exposed to these hazards was minimized. (Section 5.2.3) 

10. The Shell Anacortes Refining Company was owned and operated by the Shell Oil Company 

(“Shell Oil”) prior to 1998. The 1996 Shell Oil NHT unit PHA simply cited ineffective, nonspecific, judgment-based, qualitative safeguards to prevent equipment failure from HTHA. 

However, the effectiveness of these safeguards was neither evaluated nor documented; instead the 

PHA merely listed general safeguards. Had the adequacy of the safeguards been verified, 

improved safeguards intended to protect against HTHA failure could have been recommended. 

The 2001 and 2006 Tesoro PHA revalidations did not address or modify the analysis performed 

 

14 An effectiveness ranking of techniques used to control hazards and the risk they represent can be described as a 

hierarchy of controls – the higher up (further left) on the hierarchy, the more effective the risk reduction achieved 

(Figure 17). 15 A PHA is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a 

threshold quantity of hazardous materials, such as the Tesoro Anacortes Refinery, are required to conduct a PHA 

per the Washington Administrative Code (WAC) Title 296 Chapter 67, Safety standards for process safety 

management of highly hazardous chemicals (1992). See: http://apps.leg.wa.gov/wac/default.aspx?cite=296-67

(accessed September 29, 2013) PHAs are also required by the federal EPA Risk Management Program. 

001146
Tesoro Anacortes Refinery Investigation Report May 2014

    5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in the 1996 Shell Oil PHA. The Tesoro 2010 NHT unit PHA failed to identify HTHA as a hazard 

for the shell of the B and E heat exchangers.16 (Sections 5.3.4.1, 5.3, and Appendix D) 

11. For the 15 years before the April 2010 incident, assumptions used by PHA teams at the Anacortes 

refinery contributed to ineffective safeguards, ineffective hazard identification, and ineffective 

control of hazards to prevent equipment failures from HTHA damage, such as the E heat 

exchanger in the NHT unit.17 (Section 5.3.4.1 and Appendix D) 

12. Shell Oil completed a PHA in 1995 related to process modifications that could increase the 

hydrogen partial pressure in the NHT heat exchangers. However, when managing this change no 

consideration, evaluation, or recommendations were made to address the potential for HTHA 

damage to the NHT heat exchangers. (Section 5.3.4 and Appendix D) 

13. Shell Oil and Tesoro periodically performed damage mechanism hazard reviews (DMHRs), 

called corrosion reviews. However, these reviews did not identify HTHA as a credible failure 

mechanism for the B and E heat exchangers. These reviews were weakened by primarily relying 

on design operating parameters for these heat exchangers rather than data from actual process 

operating conditions.18 (Section 5.3.3 and Appendix D) 

14. Tesoro did not monitor actual operating conditions of the B and E heat exchangers within the 

NHT heat exchanger banks, even though it would have been technically feasible to do so. Rather, 

corrosion experts hired by Tesoro primarily relied on design operating conditions that when 

evaluated using the Nelson curve indicated lower susceptibility to HTHA damage than the 

operating conditions estimated by CSB models.19 The use of the design temperatures contributed 

to the incorrect conclusion that the heat exchangers were not susceptible to damage from HTHA. 

As a result, Tesoro was not aware that the hottest section of the B and E heat exchangers (Can 

 

16 The term “shell” in this context refers to the pressure containing carbon steel wall of the heat exchanger. The 

2010 Tesoro NHT unit PHA did identify HTHA as a possible hazard for the tube side of the B and E exchangers. 

Heat exchangers of this design have process flow through two sides, separated by mechanical design. Heat is 

transferred from one side to the other to exchange heat. Flow on the inside of the tubes through the heat 

exchanger is commonly referred to as “tube-side,” while flow on the outside of the tubes is called “shell-side.” 

The B and E exchangers had HTHA damage to the pressure containing portion on the shell-side. The 2010 

Tesoro NHT unit PHA did not identify HTHA as a hazard where HTHA occurred on the shell-side of the 

exchanger. 17 Tesoro issued a new PHA procedure in 2012 that removed the list of assumptions that had previously limited the 

PHA teams’ analyses. Now, the PHA procedure requires that all assumptions can and should be challenged at 

any point in the PHA process. Furthermore, if a credible challenge is made, the assumption is eliminated for the 

duration of the study. This change to Tesoro’s PHA procedure should help ensure that process safety hazards 

and proposed safeguards are more effectively evaluated in the future. 18 Design operating conditions include estimated and calculated conditions used to design the exchangers and the 

thermal profile developed. 

19 Tesoro hired corrosion experts to evaluate damage mechanisms at the Anacortes refinery. These external experts 

were not Tesoro employees. 

001147
Tesoro Anacortes Refinery Investigation Report May 2014

    6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4)20 at times likely operated above the carbon steel Nelson curve. If Tesoro had measured or 

otherwise technically evaluated the actual operating conditions of these heat exchangers, existing 

company procedures required HTHA inspection.21 Although HTHA may have been identified, 

inspection for HTHA is not sufficiently reliable. (Sections 5.3.3.1, 4.1.4, and Appendix D) 

15. Tesoro procedures did not prohibit or effectively limit the use of additional personnel during the 

nonroutine hazardous startup of the NHT heat exchangers. The heat exchanger startup procedure 

specifies the use of only one outside operator to perform startup operations of the NHT heat 

exchanger banks. However on the day of the incident, a supervisor requested five additional 

operators to assist with the startup of the A/B/C heat exchanger bank. (Section 5.2.3) 

16. The NHT heat exchangers frequently leaked flammable hydrocarbons during startup, sometimes 

resulting in fires. Tesoro management had been complacent about these hazardous leaks and did 

not always investigate the cause of the leaks. Tesoro did take some actions to prevent the leaks, 

but these actions did not effectively prevent the leaks before the April 2010 incident. Additional 

operators, such as those present during the April 2010 heat exchanger startup, were frequently 

needed during startup of the NHT heat exchanger banks to respond to potential hydrocarbon leaks 

or fires. This past practice contributed to the presence of the six additional workers in the unit 

during the April 2010 incident. (Sections 5.1 and 5.2) 

17. The NHT heat exchanger banks were designed with large, difficult-to-manipulate manual block 

valves on different levels of the NHT heat exchanger structure. These valves were used to start 

up the NHT heat exchanger banks and typically required numerous adjustments to maintain 

temperature specifications. The difficulties with valve operation during startup typically resulted 

in the need for additional operator assistance. This past practice contributed to the presence of 

some of the six additional workers in the NHT unit during the April 2010 incident.22 

(Section 5.2.3) 

18. The CSB found several indications of process safety culture deficiencies at the Tesoro Anacortes 

Refinery. Refinery management had normalized the occurrences of hazardous conditions, 

including frequent leaks from the NHT heat exchangers, by using steam to mitigate leaks, 

ineffectively identifying methods to prevent leaks from the heat exchanger flanges and gaskets, 

 

20 The general construction of each heat exchanger shell consisted of a series of four steel sections, called “Cans” 

welded to form a cylinder (exchanger shell). This construction required a longitudinal weld to form each “Can” 

or section, and three circumferential welds to join the four sections end to end. The temperature profile is such 

that Can 1 is the coolest and temperature increase towards the hottest section at Can 4. 21 Tesoro’s inspection procedure would have required HTHA inspection if operating conditions were found to be 

within 25 pounds per square inch absolute (psia) or 25 oF of the Nelson curve. 22 The new design of the NHT heat exchangers has eliminated the need to clean the exchangers while the unit is 

operating. Post-incident, Tesoro performed a study to evaluate hazardous equipment that is cycled more 

frequently than the unit. This study took two months to complete and resulted in 53 recommendations. One of 

the recommendations is intended to ensure that a hazard review is conducted before cycling equipment that was 

not included in this study. 

001148
Tesoro Anacortes Refinery Investigation Report May 2014

    7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

commonly requiring additional operators during NHT heat exchanger startups, and exceeding the 

staffing levels that procedures specified. (Section 5.0) 

19. The refinery process safety culture required proof of danger rather than proof of effective safety 

implementation. For years, technical experts used design parameters to evaluate the B and E heat 

exchangers for HTHA susceptibility. Data for actual operating conditions were not readily 

available, and these technical experts were not required to prove safety effectiveness in reaching 

their conclusion that the B and E heat exchangers were not susceptible to HTHA damage. 

(Section 5.0) 

1.2.3 Industry Codes and Standards Findings 

20. API RP 941 - Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum 

Refineries and Petrochemical Plants is written permissively such that there are no minimum 

requirements to prevent HTHA failures. Currently API RP 941 uses the term “should” 27 times 

and the word “shall” only once. As used in a standard, “shall” denotes a minimum requirement to 

conform to the standard, while “should” denotes a recommendation that is advised but not 

required to conform to the standard. API RP 941 does not require users to verify actual operating 

conditions when establishing operating limits or to confirm that the selection of construction 

materials will prevent HTHA. (Section 6.1.1) 

21. API RP 941 provides industry guidance to predict the occurrence of HTHA in various materials 

of construction by using the Nelson curves. The Nelson curves are predicated on past equipment 

failure incidents and are plotted based on self-reported process conditions that are ill-defined and 

lack consistency. The API Technical Report 941 notes, “The concept of a simple boundary 

between safe and unsafe operating conditions in hydrogen for common alloys, of the type 

depicted by the Nelson curves should not be expected.” 23 (Sections 4.1.1 and 6.1.3) 

22. The CSB has learned of at least eight recent refinery incidents where HTHA reportedly occurred 

below the carbon steel Nelson curve. In 2011, API issued an industry alert on HTHA in refinery 

service.24 The API alert noted multiple incidents of carbon steel equipment at operating 

conditions where carbon steel was previously thought to be resistant to HTHA. These refinery 

incidents and the subsequent API response strongly suggest an industry-wide problem with the 

carbon steel Nelson curve. (Section 6.1.4.2) 

23. The CSB found that the carbon steel Nelson curve is inaccurate and cannot be relied on to prevent 

HTHA equipment failures or accurately predict HTHA equipment damage. (Section 6.1.4) 

 

23 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; p 47. 

24 See: http://www.api.org/publications-standards-and-statistics/hidden-pages/industry-alert (accessed January 19, 

2014). 

001149
Tesoro Anacortes Refinery Investigation Report May 2014

    8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

24. API RP 941 does not require industry to use inherently safer materials to prevent HTHA failures. 

(Section 6.1.1) 

25. API RP 581: Risk-Based Inspection Technology allows users to calculate a damage factor to 

determine the HTHA susceptibility of various materials of construction. Tesoro hired damage 

mechanism experts to help ensure that damage mechanism hazards were properly identified. API 

RP 581 does not require users to verify actual operating conditions when determining applicable 

damage mechanisms. The calculation for carbon steel using the design conditions applied in 

damage mechanism reviews results in the conclusion that the B and E heat exchangers had a 

“Low Susceptibility” to HTHA. The API RP 581 calculation is therefore unreliable for 

preventing HTHA failure or predicting the probability of HTHA damage in carbon steel 

equipment. (Section 6.2) 

26. API RP 581: Risk-Based Inspection Technology is written permissively, so that there are no 

minimum requirements to prevent HTHA failures. There are 19 uses of “shall” in RP 581, but 

none is substantive—nearly all the uses of “shall” are in formulas or requirements for damage 

factor or inspection effectiveness calculations that are themselves non-mandatory. There are 

three uses of “shall” in the HTHA section, but they are again used for calculations that are not 

required, preceded by language such as “the following procedure may be used” or if HTHA is 

detected, “fitness for service should be performed.” An instructive example of the 

permissiveness of API RP 581 is the important guidance that the document provides for 

conditions that would make equipment susceptible to HTHA damage. However, if the equipment 

is identified as meeting the criteria that would indicate HTHA is a credible damage mechanism, 

according to API RP 581 guidance, the equipment “should” be evaluated for HTHA 

susceptibility.25 (Section 6.2) 

1.2.4 Regulatory Findings 

27. Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small fraction 

of the thousands of chemical processing facilities throughout the United States, the CSB has 

noted a considerable frequency of significant and deadly incidents at refineries over the last 

decade. In 2012 alone, the CSB tracked 125 significant incidents at US petroleum refineries.26 

(Section 7.1) 

28. The draft CSB Chevron Regulatory Report recommends that the state of California improve the 

oversight of petroleum refineries by supplementing the existing process safety management 

regulations with more rigorous features such as requiring companies to reduce risks to as low as 

reasonably practicable, or ALARP; requiring the effective implementation of safeguards and the 

 

25 API RP 581, Risk-Based Inspection Technology. 2008; pp 252-258. 

26 These incidents were reported to the Department of Energy or the National Response Center and were examined 

by the CSB Incident Screening Department. The CSB has concluded that incidents that result in disruptions to 

the national energy supply, produce serious injuries, or receive high levels of media attention are all significant. 

001150
Tesoro Anacortes Refinery Investigation Report May 2014

    9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

use of the hierarchy of controls; and providing for the development of a more well-funded, 

technically competent regulator. In the draft Chevron Regulatory Report, the CSB concluded that 

the existing regulatory regimes for onshore petroleum refineries in the United States and 

California: (Appendix F) 

a. Rely on a safety and environmental management system framework that is primarily activitybased rather than goal-based risk reduction to as low as reasonably practicable (ALARP) or 

equivalent. 

b. Are static, unable to adapt to innovation and advances in the management of major hazard 

risks. 

c. Place the burden on the regulator to verify compliance with the regulations rather than 

shifting the burden to industries by requiring duty holders to effectively manage the risks they 

create and also ensure regulator acceptance of their plans for controlling those risks. 

d. Do not effectively incorporate lessons learned from major accidents; nor do they have the 

regulatory authority to require duty holders to address newly-identified safety issues resulting 

from such incidents. 

e. Do not effectively collect or promote industry use of major accident performance indicators 

to drive industry to reduce risks to ALARP. 

f. Do not require the use or implementation of inherently safer systems analysis or hierarchy of 

controls. 

g. Do not effectively involve the workforce in hazard analysis and prevention of major 

accidents. 

h. Do not provide the regulator with the authority to accept or reject a company’s hazard 

analysis, risk assessment, or proposed safeguards; and 

i. Do not employ the requisite number of staff members with the technical skills, knowledge, 

and experience necessary to provide sufficient direct safety oversight of petroleum refineries. 

29. The Washington State Department of Labor and Industries (L&I), which oversees workplace 

safety in the state, does not have sufficient personnel resources to verify that process safety 

management (PSM) requirements are being implemented adequately. L&I enforces state PSM 

requirements that are based on the federal OSHA PSM standard for hazardous chemical facilities. 

However, the state of Washington has only four PSM specialists in its compliance section to 

regulate and inspect nearly 270 PSM-covered facilities, including five petroleum refineries. Of 

these four specialists only one has a technical background. (Section 7.2) 

30. Washington L&I completed an audit of the Tesoro NHT unit under the refinery National 

Emphasis Program (NEP) in March 2009, one year before the incident. The Tesoro Anacortes 

NEP audit is noteworthy, as it was the only audit conducted pursuant to the federal OSHA NEP 

that focused on a unit that subsequently experienced a catastrophic accident that the CSB has 

investigated. The heat exchanger that failed, the E heat exchanger, was a fundamental component 

001151
Tesoro Anacortes Refinery Investigation Report May 2014

    10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the Tesoro NEP audit. However, no citable mechanical integrity or other process safety 

management deficiencies related to the heat exchanger were found. (Section 7.3.3.1) 

31. Shell Oil and Tesoro PHAs conducted on the NHT unit cited non-specific, judgment-based 

qualitative safeguards that in light of the April 2010 incident were not effective. Following the 

April 2010 incident the L&I Division of Occupational Safety and Health (DOSH) issued citations 

to Tesoro relating to its PHA program, but they were not associated with evaluating the 

effectiveness of safeguards such as the robustness of the HTHA prevention program. If the 

Washington PSM standard had required an evaluation and documentation of safeguard 

effectiveness, Shell Oil and Tesoro would have been obligated to conduct such an analysis. 

(Section 7.4) 

32. In the 2006 Tesoro NHT unit PHA, Tesoro discontinued a review of its corrosion control program 

and a specific mechanical integrity checklist associated with the corrosion program after 

concluding that they were “not a legal requirement.” The state of Washington PSM regulation 

did not require this review. Tesoro conducted the optional review ineffectively and then 

terminated it when the company determined that it was not strictly required. An enhanced 

regulatory system with goal-setting attributes would require continual risk reduction and 

performance of an effective DMHR. This review is not just an activity but must meet the goal of 

preventing equipment failures. (Sections 5.3.4 and 7.2.1) 

33. Under the existing US and Washington regulatory systems, including the PSM standard and the 

U.S. Environmental Protection Agency (EPA) Risk Management Program (RMP), there is no 

requirement to reduce risks to a specific risk target such as ALARP. While the Clean Air Act 

(CAA) directed the EPA to promulgate the RMP regulations “to provide, to the greatest extent 

practicable, for the prevention and detection of accidental releases of regulated substances,”27

there is no RMP ALARP requirement. Under both the PSM and RMP regulations, an employer 

must “control” hazards when conducting a PHA of a covered process. However, there is no 

requirement to address the effectiveness of the controls or to use the hierarchy of controls. Thus, 

a PHA can satisfy the regulatory requirements even though it might inadequately identify or 

control major hazards. In addition, there is no requirement to submit PHAs to the regulator, and 

the regulator is not responsible for assessing the quality of the PHA or the effectiveness of 

proposed safeguards, resulting in a regulatory system that is often reactive and frequently 

becomes involved in examining the details of process safety programs only after a major process 

accident. (Section 7.4) 

 

27 42 U.S.C. §7412(r)(7)(B)(i) (1990). 

001152
Tesoro Anacortes Refinery Investigation Report May 2014

    11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1.2.5 Similar Findings in CSB Investigations of the Tesoro Anacortes and Chevron 

Richmond Refinery Incidents 

34. The CSB conducted an investigation of the August 6, 2012, Chevron Richmond Refinery 

incident. That incident was also the result of a metallurgical failure caused by a well-known 

damage mechanism called sulfidation corrosion, and Chevron process safety programs failed to 

effectively control the hazard before the major incident that endangered the lives of 19 Chevron 

employees. The CSB identified a number of similar causal findings common to both the April 

2010 Tesoro Anacortes Refinery incident and the August 2012 Chevron Richmond Refinery 

incident. (Section 7.7) 

35. Mechanical integrity programs at both Tesoro and Chevron emphasized inspection strategies 

rather than the use of inherently safer design to control the damage mechanisms that ultimately 

caused the major process safety incidents. These inspections were unreliable and failed to 

prevent the incidents. Since the Richmond and Anacortes incidents, both Chevron and Tesoro 

have upgraded the materials of construction for the equipment that failed, using inherently safer 

design that significantly reduced the risk of the applicable damage mechanism hazards. 

(Section 7.7.1) 

36. Both Tesoro and Chevron PHAs were ineffective in identifying the significant hazards of HTHA 

and sulfidation corrosion, respectively. Rather than performing rigorous analyses of damage 

mechanisms during the PHA process, both companies simply cited non-specific, judgment-based 

qualitative safeguards to reduce the risk of damage mechanisms. The effectiveness of these 

safeguards was neither evaluated nor documented; instead, the PHA merely listed general 

safeguards. (Section 7.7.2) 

37. The Anacortes and Richmond refineries relied on API standards to assist in the selection of 

construction materials for the Tesoro NHT heat exchangers and the Chevron piping circuit, 

specifically API RP 941 and API RP 939-C Guidelines for Avoiding Sulfidation (Sulfidic) 

Corrosion Failures in Oil Refineries. The documents provide guidance on how to avoid HTHA 

and sulfidation corrosion failures, respectively, but neither document establishes minimum 

requirements to evaluate and minimize the risks of equipment failure from the damage 

mechanism hazard. (Section 7.7.3) 

38. Neither the Washington nor the California process safety regulations were successful in 

preventing major process safety incidents. Neither set of regulations required DMHRs, reduction 

of risk to ALARP, evaluation of effectiveness of controls, or use of the hierarchy of controls. In 

addition, there is no requirement to submit PHAs to the regulator, and the regulator is not 

responsible for assessing the quality of the PHA or the proposed safeguards. Furthermore, neither 

Washington nor California required the use of inherently safer design to the greatest extent 

practicable. A regulatory system that contains more robust goal-setting attributes would help to 

ensure that all of the refineries in these states rigorously apply process safety concepts that focus 

001153
Tesoro Anacortes Refinery Investigation Report May 2014

    12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

more effectively on prevention. The new regulatory framework would also emphasize the 

implementation of inherently safer designs and the hierarchy of controls to prevent major process 

safety incidents. (Section 7.7.4) 

39. Both Washington and California have significant weaknesses in the staffing of PSM inspectors. 

Both Washington L&I (the Washington PSM regulator) and the California Occupational Safety 

and Health Administration (Cal/OSHA) (the California PSM regulator) lack sufficient technically 

experienced and qualified staff members to verify that PSM requirements are being implemented 

adequately. It is essential that regulators of high-hazard facilities are independent, well funded, 

well staffed, and technically qualified. These individuals must be able to communicate 

effectively with refinery personnel and to monitor the adequacy of refinery process safety 

practices. (Section 7.7.4) 

40. Both the Chevron and Tesoro incidents could have been prevented if inherently safer equipment 

construction materials had been used. Although inherently safer technology (IST) is the most 

effective major accident prevention approach in the hierarchy of controls it is not enforced by the 

EPA through the General Duty Clause or other provisions of the Clean Air Act. The EPA has the 

authority to require the application of IST through the General Duty Clause. Furthermore, the 

Clean Air Act provides the authority for the EPA to develop and implement new regulations 

requiring the use of inherently safer systems analysis and the hierarchy of controls to establish 

more effective safeguards for identified process hazards to prevent major accidents. (Section 7.8)

001154
Tesoro Anacortes Refinery Investigation Report May 2014

    13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1.3 Recommendations 

As a result of the findings and conclusions of this report, the CSB makes recommendations, summarized 

below, to the following recipients: 

The U.S. Environmental Protection Agency 

Revise the Chemical Accident Prevention Provisions under 40 CFR Part 68 to require the documented use 

of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in 

establishing safeguards for identified process hazards. Until this revision is in effect, enforce through the 

Clean Air Act’s General Duty Clause the use of inherently safer systems analysis and the hierarchy of 

controls to the greatest extent feasible when facilities are establishing safeguards for identified process 

hazards. In addition, effectively participate in the oversight of the process safety culture program at the 

Tesoro Anacortes Refinery. 

_________________________________________________________________ 

Washington State Legislature, Governor of Washington 

Augment the existing process safety management regulatory framework with the more rigorous safety 

management attributes identified in this report for petroleum refineries in the state of Washington. 

_________________________________________________________________ 

Washington State Division of Occupational Safety and Health – Labor 

and Industries 

Perform verifications at all Washington petroleum refineries to ensure prevention of equipment failure 

because of HTHA and that effective programs are in place to manage hazardous nonroutine work. In 

addition, effectively participate in the oversight of the process safety culture program at the Tesoro 

Anacortes Refinery. 

_________________________________________________________________ 

American Petroleum Institute

Revise API RP 941 and API RP 581 to prohibit the use of carbon steel equipment in HTHA-susceptible 

service and require verification of actual operating conditions. Make additional revisions to API RP 941 

to establish minimum requirements to prevent HTHA failures and to require the use of inherently safer 

design. 

_________________________________________________________________ 

001155
Tesoro Anacortes Refinery Investigation Report May 2014

    14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Tesoro Refining & Marketing Company LLC 

Participate with API in the API RP 941 revisions to establish minimum requirements to prevent HTHA 

failures and to require the use of inherently safer design. Following the API RP 941 revisions, develop 

and implement a plan to meet the new API RP 941 requirements. Improve process safety management 

programs for damage mechanism hazards to require the hierarchy of controls and the use of inherently 

safer design. 

_________________________________________________________________ 

Tesoro Anacortes Refinery

Implement a process safety culture program that will assess and continually improve any identified 

process safety culture issues at the Tesoro Anacortes Refinery. 

_________________________________________________________________ 

United Steelworkers Local 12-591

Effectively participate in the process safety oversight committee to continually improve any identified 

process safety culture issues at the Tesoro Anacortes Refinery. 

_________________________________________________________________ 

Section 8.0 details the recommendations. 

 

001156
Tesoro Anacortes Refinery Investigation Report May 2014

    15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2.0 Tesoro Refining & Marketing Company LLC 

Tesoro Corporation was founded in 1968 as a petroleum exploration and production company. In 1969, 

Tesoro began operating its first refinery near Kenai, Alaska. A Fortune 100 company, Tesoro now 

operates six refineries in the western United States. These refineries have a combined capacity of 

approximately 850,000 barrels per day (bpd).28

2.1 Anacortes Refinery 

Tesoro purchased the Anacortes refinery from Shell Oil Company in August 1998. Located 

approximately 70 miles north of Seattle (Figure 2 and Figure 3), the Tesoro Anacortes refinery has a total 

crude-oil capacity of 120,000 bpd. The refinery has been in operation since 1955.29 

The Anacortes refinery primarily supplies gasoline, jet fuel, and diesel to markets in Washington and 

Oregon. It also manufactures heavy fuel oils, liquefied petroleum gas, and asphalt. Approximately 350 

employees and 50 contractors work at the refinery.30 

Figure 2. Tesoro Anacortes Refinery 

 

28 See http://tsocorp.com/about-tesoro/locations/ and http://tsocorp.com/about-tesoro/company-history/ (accessed 

January 4, 2014). 

29 Statement of Basis for the Final Air Operating Permit – Final, July 26, 2010, p 6. 

30 The United Steelworkers (USW) represents approximately 185 of the operations and maintenance workers at the 

refinery. See http://www.usw.org/media_center/releases_advisories?id=0521, (accessed November 9, 2013). 

001157
Tesoro Anacortes Refinery Investigation Report May 2014

    16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 3. Aerial View of the Tesoro Anacortes Refinery. 

2.2 Other Tesoro Refineries 

Beginning in the late 1990s, Tesoro made a series of refinery acquisitions. In 1998, Tesoro acquired 

refineries in Kapolei, Hawaii31 (from BHP Americas), and Anacortes, Washington (from Shell Oil 

Company). In 2001, the company purchased refineries in Mandan, North Dakota, and Salt Lake City, 

Utah (both from Amoco). In 2002, Tesoro acquired the Golden Eagle refinery in Martinez, California 

 

31 Tesoro no longer owns this refinery. 

001158
Tesoro Anacortes Refinery Investigation Report May 2014

    17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

(from Ultramar, now Valero), and in 2007 Tesoro acquired its Los Angeles refinery (from Shell Oil) and 

USA Gasoline retail stations (from Chevron).32 Tesoro purchased its Carson, California, refinery in 2013 

(from BP).33

2.3 Tesoro Anacortes Refinery NHT Unit 

The April 2, 2010, incident occurred in the Tesoro Anacortes Refinery Catalytic Reformer / Naphtha 

Hydrotreater unit (“the NHT unit”), which includes a naphtha hydrotreating process unit. Hydrotreating 

is a process that removes sulfur, nitrogen, and oxygen impurities from petroleum feedstock and 

intermediate products by reacting with hydrogen in the presence of a catalyst. Hydrotreating serves two 

purposes: 34

1. It improves the quality and environmental impact of products, especially quality specifications 

mandated by law (for example, benzene reduction in motor gasoline). 

2. It protects sensitive and costly downstream catalysts from contamination. 

The Tesoro NHT unit was originally constructed in 1972 with a rated capacity of 24,800 bpd. 

Modifications and upgrades resulted in a rated capacity at the time of the incident of 40,550 bpd, a 64% 

capacity increase. 

2.3.1 Catalytic Reformer 

Catalytic reforming is a chemical process used to convert petroleum refinery naphtha,35 typically having 

low-octane ratings,36 into high-octane liquid products called reformates. The Catalytic Reformer uses a 

system of fixed bed catalytic reactors to increase the octane rating of gasoline blending stock. The 

reformate product is then sent to gasoline component storage for use in fuel blending. The reforming 

reaction generates hydrogen, which is used in the NHT. 

2.3.2 Naphtha Hydrotreater – A/B/C & D/E/F Feed/Product Heat Exchangers 

The removal of sulfur, nitrogen, and oxygen impurities in the NHT unit requires heating the naphtha to 

over 600 °F at greater than at 600 pounds per square inch gauge (psig) and mixing it with hydrogen. The 

initial portion of this heating took place in the NHT unit’s E-6600 A/B/C and D/E/F feed and product 

 

32 See http://www.tsocorp.com/TSOCorp/AboutUs/CompanyHistory/061236, (accessed April 24, 2013). 

33 See http://tsocorp.com/about-tesoro/company-history/ (accessed January 4, 2014). 34 Hydrocarbon Publishing Company, Worldwide Refinery Processing Review (Individual Technology), 

Hydrotreating summary. 2Q 2012, Item No. B1014 

35 Naphtha is a fraction of crude oil that boils between approximately 85 0F and 400 0F. It includes hydrocarbons 

ranging from C5 to C12. Naphtha comprises approximately 15-30 weight % of raw crude oil. See Prestvik, R.; 

Moljord, K.; Grande, K.; Holmen, A. Compositional Analysis of Naphtha and Reformate. In G.J. Antos & A.M. 

Aitani (Eds.), Catalytic Naphtha Reforming (p. 2). New York, NY: Marcel Dekker, Inc. 36 Octane rating represents gasoline-burning efficiency. The higher the octane rating, the less likely it is for gasoline 

to knock, or produce harmful, small explosions that reduce efficiency, in an engine. See Van Dyke, K. (1997). 

Fundamentals of Petroleum (4th ed.) (p 318). Austin, Texas: The University of Texas at Austin. 

001159
Tesoro Anacortes Refinery Investigation Report May 2014

    18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

(effluent) heat exchangers,37 as depicted in Figure 4. (These heat exchangers are referenced throughout 

this report as the NHT heat exchangers.) 

Figure 4. Process Flow of NHT Unit 

The function of the NHT A/B/C and D/E/F heat exchangers is to conserve energy by using the hot NHT 

reactor effluent to heat the cooler reactor feed and thus reduce the energy input needed for the reactor 

furnace. The cool NHT liquid naphtha feed is pumped from storage and/or other active units and mixed 

with a stream of hydrogen-rich gas, becoming a combined liquid and gas feed stream. The resulting 

liquid-gas mixture is then fed to the tube-side38 of two parallel groups, or banks of three heat exchangers 

(A/B/C and D/E/F) to be heated by the shell-side39 fluid. As the liquid-gas mixture inside of the tubes is 

 

37 The A/B/C and D/E/F exchangers are single-pass shell and tube heat exchangers. A heat exchanger allows heat 

to be transferred from one process fluid to another. One fluid gets hotter while the other gets cooler. A shell and 

tube–type heat exchanger consists of a large pressure vessel exterior (shell) with a group (bundle) of small thinwalled pipes (tubes) that reside inside the shell. One process fluid flows through the tubes, and the other process 

fluid flows through the shell, over the tubes. Heat is transferred (exchanged) from one to the other through the 

walls of the tubes. 38 “Tube-side” refers to process fluid that flows inside of heat exchanger tubes. 

39 “Shell-side” refers to process fluid that flows inside of the heat exchanger shell and on the outside of the tubes. 

001160
Tesoro Anacortes Refinery Investigation Report May 2014

    19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

heated, the liquid portion vaporizes completely. Now liquid free, the naphtha and hydrogen vapors enter 

a furnace where they are further heated and then fed to the NHT reactor. The reactions to remove sulfur, 

nitrogen, and oxygen take place in this reactor. The hot reactor effluent40 is then fed through the shellside of the heat exchangers to preheat the incoming tube-side feed. The impurity-free naphtha is then fed 

to other processes in the refinery. 

 

 

40 Effluent is flow exiting a vessel or piece of equipment. 

001161
Tesoro Anacortes Refinery Investigation Report May 2014

    20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

3.0 Incident Description 

3.1 Pre-Incident Operations 

During normal operation at the Tesoro Anacortes Refinery, the A/B/C and D/E/F heat exchangers were all 

in use. Because of the original Shell Oil Company design and the process operating conditions, the heat 

exchangers would foul during operation; that is, they would develop a buildup of process contaminant 

byproducts both inside of the heat exchanger tubes, as illustrated in Figure 5, and outside of the tubes. 

The fouling inhibited heat transfer between the tube-side and shell-side process fluid, thus reducing the 

heat transfer efficiency. 

Figure 5. Example of Fouling Deposits on the Inside of Heat Exchanger Tubes. Fouling greatly 

reduces heat transfer between the shell-side and tube-side process fluids.41 

Because the heat exchangers fouled, they required periodic cleaning so that process temperature 

requirements could be maintained. Cleaning was typically required after about six months of continuous 

operation. When performing this cleaning, one bank of heat exchangers was taken out of service while 

the other bank continued operating. The cleaned heat exchangers would then be placed back into service 

by slowly introducing the hot naphtha and hydrogen feed into the heat exchangers. Because of a long 

history of frequent leaks and occasional fires when putting these heat exchangers back into service 

(Section 5.1), startup, shutdown, and cleaning activities were a hazardous nonroutine operation.42 By 

employing this nonroutine operation, Shell Oil and Tesoro avoided a total shutdown of the NHT unit. 

On March 28, 2010, five days before the incident, the A/B/C heat exchanger bank was taken offline so 

that the fouled tubes in each heat exchanger could be cleaned. The D/E/F heat exchanger bank and the 

 

41 Photograph of fouled tube from http://www.tekleen.com/it/water-filtration-101/ (accessed December 4, 2013). 

42 Nonroutine does not refer to the frequency at which the activity occurs. Nonroutine refers to whether the activity 

is part of the normal sequence of converting raw materials to finished products. Startup and shutdown of 

equipment are considered a nonroutine activity. Center for Chemical Process Safety (CCPS), Guidelines for Risk 

Based Process Safety. 2007; p 286. 

001162
Tesoro Anacortes Refinery Investigation Report May 2014

    21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

rest of the NHT unit remained in operation. On March 31, 2010, the three-day maintenance cleaning 

activity was completed and the equipment was reassembled and prepared for operation. 

3.2 Night of the Incident 

On the evening of April 1, 2010, Tesoro initiated startup of the A/B/C heat exchanger bank. The NHT 

unit was staffed in a typical manner, with one inside board operator who monitored the console and one 

outside operator. An aerial view of the unit is shown in Figure 6. 

Source: Google Earth 

Figure 6. Aerial View of CR/NHT Unit 

The inside NHT operator and the outside NHT operator began the process of placing the heat exchangers 

back in service. The inside operator used a step-by-step task list for the startup process, physically 

checking off the steps on a hardcopy of the procedure while maintaining radio communication with the 

outside operator. Interviews conducted by the CSB indicate that the startup of the heat exchangers was a 

very difficult assignment for only a single outside operator. The startup procedure required manipulation 

of several isolation block valves as illustrated in Figure 7, which necessitated a significant amount of 

manual effort to open. 

001163
Tesoro Anacortes Refinery Investigation Report May 2014

    22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 7. CSB Animation of Operator Opening Long-Winded Valve on Night of Incident. Valves on 

heat exchanger structure had to be opened concurrently when performing the heat exchanger bank 

startup 

These valves had to be gradually and concurrently opened, so the operator could not simply stay by each 

valve until it was fully opened or closed. Also, four steam lances were staged and ready for use during 

the startup to mitigate any leaks or fires that might occur.43 These valves and steam lances were located 

at different positions in the vicinity of the A/B/C and D/E/F heat exchangers. At approximately 10:30 

p.m., six additional Tesoro employees (five operators and one supervisor)44 joined the outside operator, at 

the request of the supervisor, to assist in bringing the A/B/C heat exchanger bank online. The startup 

procedure did not specify defined roles for these six additional personnel. 

3.3 The Incident 

The operators continued the A/B/C heat exchanger bank startup as planned. Two leaks from the heat 

exchangers were reported during the startup. These leaks did not stop operations however, because leaks 

during startup of these heat exchangers were frequent and had become a “normal” part of the startup. 

Furthermore, based on past operating experience, these leaks were expected to cease when the heat 

exchangers reached typical operating temperature. 

 

43 Three of the four steam lances were likely in use at the time of the incident. See Section 5.0 for additional 

discussion on the use of steam lances. 44 The five additional operators that assisted in the NHT heat exchanger startup were assigned to the Crude, 

Utilities, Vacuum Flasher, ROSE, and CFH/DHT units. 

001164
Tesoro Anacortes Refinery Investigation Report May 2014

    23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At 12:30 a.m. on April 2nd, while the seven outside personnel were still performing A/B/C heat exchanger 

bank startup operations, the E heat exchanger on the adjacent, in-service bank catastrophically ruptured. 

The pressure containing “shell” of the heat exchanger separated at weld seams,45 as depicted in Figure 8, 

expelling a large volume of very hot hydrogen and naphtha.46

Figure 8. Post-Incident View of D/E/F NHT Heat Exchanger Bank 

The naphtha and hydrogen likely autoignited upon release into the atmosphere, creating a large fireball as 

depicted in Figure 9. 

 

45 The failure occurred at both circumferential and longitudinal weld seams from fabrication of the exchanger. 

46 The naphtha began to condense to liquid in the B and E heat exchangers. The material in the process was above 

its atmospheric boiling temperature, so it vaporized when released to atmospheric conditions. 

001165
Tesoro Anacortes Refinery Investigation Report May 2014

    24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 9. CSB Animation of the Fire Following the NHT Heat Exchanger Failure. The hot naphtha 

and hydrogen likely autoignited upon release to the atmosphere. The fire engulfed the entire heat 

exchanger structure. 

The operator in the NHT control room told the CSB that he felt the impacts of the rupture at his desk 350 

feet away. The CSB determined that at the time of the incident two of the outside operators were likely 

on the top level of the heat exchanger structure (Figure 10), and the remaining five operators were most 

likely at ground level. All seven outside operations personnel were badly burned, and within 22 days of 

the incident, all succumbed to their injuries. 

001166
Tesoro Anacortes Refinery Investigation Report May 2014

    25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 10. Six NHT Heat Exchangers in Two Banks of Three Heat Exchangers Each 

 

001167
Tesoro Anacortes Refinery Investigation Report May 2014

    26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.0 Technical Analysis 

4.1 High Temperature Hydrogen Attack 

Post-incident metallurgical analysis determined that the carbon 

steel E heat exchanger ruptured because it was in a highly 

weakened state because of high temperature hydrogen attack 

(HTHA). The HTHA damage mechanism occurs when steel 

equipment is exposed to hydrogen at high temperatures and partial 

pressures. The resulting damage severely degrades the mechanical 

properties of the carbon steel.47

HTHA occurs when atomic hydrogen diffuses into the steel walls of 

process equipment, as illustrated in Figure 11. The hydrogen 

reacts48 with carbon in the steel, producing methane gas,49 as 

depicted in Figure 12. This reaction removes carbon from the steel, 

a process commonly referred to as “decarburization.”50 

 

47 Shih, H.M. and Johnson, H.H. A Model Calculation of the Nelson Curves for Hydrogen Attack; Acta 

Metallurgica, Volume 30. 1982; pp 537-545. 48 Sources differ on whether atomic hydrogen directly reacts with carbon in steel to produce methane or whether 

the hydrogen recombines inside the steel to form molecular (diatomic) hydrogen before reacting with carbon to 

form methane. 

49 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; pp 7-8. 50 Weiner, L.C. Kinetics and Mechanism of Hydrogen Attack of Steel. Corrosion, 1961, Volume 17, pp 109-115. 

001168
Tesoro Anacortes Refinery Investigation Report May 2014

    27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 11. Atomic Hydrogen Diffuses Through Steel. In HTHA, molecular hydrogen dissociates at the 

vessel wall to form atomic hydrogen, which diffuses through the steel. 

001169
Tesoro Anacortes Refinery Investigation Report May 2014

    28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 12. Decarburization Process. When the atomic hydrogen encounters free carbon inside of the 

steel, hydrogen and carbon react to produce methane gas. 

Methane, a much larger molecule than atomic hydrogen, cannot diffuse out of the steel. Rather, it 

accumulates inside the vessel walls,51 exerting force on the surrounding steel. As more methane gas is 

formed, the methane pressure increases. The very high pressure exerted by the methane gas inside the 

steel can form fissures, as illustrated in Figure 13 or blisters in the steel, as shown in Figure 14.52 

 

51 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; pp 7-8. 

52 Allen, R.E., Jansen, R.J., Rosenthal, P.C., and Vitovec, F.H., The Rate of Irreversible Hydrogen Attack of Steel 

at Elevated Temperatures. 26th Midyear meeting of AIChE. May 9, 1961. 

001170
Tesoro Anacortes Refinery Investigation Report May 2014

    29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 13. Methane Fissures. When methane molecules cannot diffuse out of the steel, they 

accumulate inside of the steel, creating high pressure that forms fissures in steel. 

Figure 14. Methane Blisters. Accumulation of methane in steel can also form blisters in the metal. 

001171
Tesoro Anacortes Refinery Investigation Report May 2014

    30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

As more fissures are formed, they can link, forming microcracks in the steel.53 The linkage of fissures 

into microcracks is shown in Figure 15. Microcracks can also link to form larger cracks, which greatly 

weaken the steel and can lead to rupture of the vessel.54 This process occurred in the E heat exchanger at 

the Tesoro Anacortes Refinery. 

Source: API RP 941, Figure 2 

Figure 15. Microcrack Resulting from Linked-HTHA Fissures. This image from API RP 941 shows 

fissures formed as a result of HTHA linked together to form a microcrack. Decarburized regions 

appear lighter in color (because of an absence of carbon) than unaffected regions. 

 

 

53 Lai, George. High Temperature Corrosion and Materials Applications. Materials Park: ASM International, 

2007. 54 Ibid. 

001172
Tesoro Anacortes Refinery Investigation Report May 2014

    31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.1.1 Predicting the Occurrence of HTHA 

Industry relies on a graph in API RP 941 Steels for Hydrogen Service at Elevated Temperatures and 

Pressures in Petroleum Refineries and Petrochemical Plants to predict the occurrence of HTHA in 

various steels. The lines in that graph are known as Nelson curves, developed in 1949 by George 

Nelson,55 who created these curves based on observed industry experience with HTHA. The curves have 

been adjusted over the years based on additional industry experience.56 The most recent version of the 

API RP 941 Nelson curves is shown in Figure 16. Industry uses these curves as a line of demarcation to 

predict HTHA. At temperatures above each curve, HTHA is possible for that material of construction, 

and at temperatures below the curve, the 

prediction is that HTHA will not occur for that 

material. 

The Nelson curves predict HTHA based on 

process temperature, hydrogen partial pressure,57

and material of construction. Carbon steel is 

represented by the lowest curve, indicating that 

this material is the most susceptible to HTHA 

when compared to the other materials of 

construction shown in Figure 16. For a given 

material of construction, the Nelson curve 

indicates that a higher temperature increases the 

probability that HTHA will occur.58,59 

 

55 G. A. Nelson, Hydrogenation Plant Steels. 1949 Proceedings, Volume 29M, API; pp. 163 -174. 56 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; p 127. 

57 Hydrogen partial pressure is a calculated parameter. It is the pressure that would be exerted by a single 

component of a gas mixture. For example, the hydrogen partial pressure of a 500 psia gas mixture in a vessel that 

contains 50 mole percent (mol%) hydrogen and 50 mol% propane equals 250 psia. 58 For most materials included on the Nelson curves, increasing hydrogen partial pressure also increases the 

probability of HTHA. However, in some areas for some materials, the Nelson curves do not predict a higher 

probability of HTHA when hydrogen partial pressure is increased. 

59 Low carbon steels, which contain very little alloying additions of chromium and molybdenum, are the most 

susceptible to HTHA. Chromium-rich and molybdenum-rich carbides are inherently more stable than iron 

carbides, and they resist dissolution of carbon with hydrogen to form methane. Therefore, the alloys containing 

chromium and molybdenum resist HTHA at higher temperatures and hydrogen pressures. See CSB’s E-6600E 

and E-6600B Metallurgical Analysis report (Appendix I). 

001173
Tesoro Anacortes Refinery Investigation Report May 2014

    32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 16. Nelson Curves from Current API RP 941. These Nelson curves are used to predict the 

occurrence of HTHA in various materials of construction. 

001174
Tesoro Anacortes Refinery Investigation Report May 2014

    33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.1.2 Conditions that increase HTHA susceptibility 

Welding performed on steel process vessels creates additional HTHA risk factors, such as residual 

stress.60 Post-weld heat treatment is a method that can reduce the stress in steel that was generated from 

the welding process. The process of post-weld heat treatment consists of a sequence of controlled heating 

and cooling steps applied to the welded structure using externally applied heating elements.61 This 

process gives the metal time to readjust to its original, prefabrication state62 and removes residual stress. 

The carbon in the steel becomes less reactive, inhibiting the reaction with hydrogen to form methane. 

Chemical resistance to HTHA is thus modestly improved in post-weld heat-treated steels.63

As will be discussed in Section 4.2.1, the carbon steel shells of 

the B and E heat exchangers were not post-weld heat-treated, and 

therefore the steel surrounding the welds may have been highstress areas.64 HTHA was only found in the areas near the welds 

in both the B and E heat exchangers. 

Post-weld heat treating is a manual activity and therefore low on 

the hierarchy of controls.65 Consequently, post-weld heat 

treating carbon steel is a weaker safeguard to prevent HTHA 

failures than the use of materials that are not susceptible to 

HTHA damage.66,67 

 

60 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; p 163. 61 Krishnan, J. and Ahmed, Khaleel; Post-Weld Heat Treatment- Case Studies. BARC Newsletter. Centre for 

Design and Manufacture, Bhabha Atomic Research Centre, May 2002. 62 Gillissie, J.G., Heat Treatment- What Is It?. The National Board of Boiler and Pressure Vessel Inspections. 

October 1981. 63 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; p 162. 

64 Post-weld heat treatment is generally avoided unless specified as mandatory by codes or standards. Incorrect 

post-weld heat-treatment procedures can result in metal that is out of specification for the service. In the United 

States, the ASME Boiler Code is the authority that mandates post-weld heat treatment. If the code requires postweld heat treatment, it is performed, but if the code does not specify the requirement for post-weld heat 

treatment, then the heat treatment is generally not performed. The ASME Boiler Code did not require post-weld 

heat treatment for the B and E heat exchangers. See 2011 ASME Boiler and Pressure Vessel Code; Paradowska 

A., Price J.W.H, and Dayawansa P. Measurement of Residual Stress Distribution in Tubular Joints Considering 

Postweld Heat Treatment Materials Forum Volume 30- 2006. Institute of Materials Engineering Australasia 

Ltd.; and Funderburk, R. Scott, Postweld Heat Treatment. Welding Innovation, Vol. XV, No. 2, 1998. 65 An effectiveness ranking of techniques used to control hazards and the risk they represent can be described as a 

hierarchy of controls – the higher up (further left) on the hierarchy, the more effective the risk reduction achieved 

(Figure 17). 66 Improper post-weld heat treating can lead to vessel failure. Steward, M. and Lewis, O. Pressure Vessels Field 

Manual Common Operating Problems and Practical Solutions, 2013; pp 236-237. 67 Post-weld heat treating problems include heat treating errors such as inadequate time at temperature, inadequate 

or excessive temperature rate, inadequate temperature, cooled too rapidly, cooled too slowly, and cooled to the 

001175
Tesoro Anacortes Refinery Investigation Report May 2014

    34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Despite the improved HTHA resistance of post-weld heat-treated vessels compared with non-post-weld 

heat-treated vessels, upgrading vessel materials to inherently safer materials of construction is a better 

approach to prevent equipment failure from HTHA. This approach is discussed further in Section 4.1.3. 

4.1.3 Inherently Safer Design 

As defined in the Center for Chemical Process Safety (CCPS)68 book Inherently Safer Chemical 

Processes, 2nd ed., inherently safer design is the process of identifying and implementing inherent safety 

in a specific context that is permanent and inseparable from the process.69 In the book Guidelines for 

Engineering Design for Process Safety, 2nd ed., the CCPS states that “inherently safer design solutions 

eliminate or mitigate the hazard by using materials and process conditions that are less hazardous.”70

Inherently safer technologies are relative; a technology can be described as inherently safer only when 

compared to a different technology with regard to a specific hazard or risk.71 A technology can be 

inherently safer with respect to one risk but not inherently safer from another risk. Consequently, it is 

important to carry out a comprehensive documented hazard analysis to identify the individual and overall 

risks in a process and assess how the risks can be effectively minimized to control hazards. An inherently 

safer systems or hierarchy of control review details a list of choices that offer varying degrees of 

inherently safer implementation. The review should include risks of personal injury, environmental harm, 

and lost production, as well as an evaluation of economic feasibility.72

It is simpler, less expensive, and more effective to introduce inherently safer features during the design 

process of a facility rather than after the process is already operating.73 Process upgrades, rebuilds, and 

repairs offer additional opportunities to implement inherently safer design concepts. Conducting a 

comprehensive hazard review to determine risks and identify ways to eliminate or reduce those risks 

constitutes an important step in implementing an inherently safer process. 

 

 

wrong temperature. Canale, L., Mesquita, R., and Totten, G., Failure Analysis of Heat Treated Steel 

Components, 2008; pp 106-109. 68 The Center for Chemical Process Safety (CCPS) is a corporate membership organization that identifies and 

addresses process safety needs within the chemical, pharmaceutical, and petroleum industries. 69 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 

2009; section 2.2. 70 Ibid at Section 5.1.1. 

71 Ibid at Section 5.2. 72 Ibid at p 184. 73 Kletz, Trevor and Amyotte, Paul. Process Plants: A Handbook for Inherently Safer Design. 2010; p 14. 

001176
Tesoro Anacortes Refinery Investigation Report May 2014

    35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An effectiveness ranking of techniques used to control hazards 

and their associated risks can be described as a hierarchy of 

controls. As depicted in Figure 17, the further left on the 

hierarchy continuum, the more effective the technique is in 

reducing risk. All concepts in the hierarchy of controls should 

be included in the process of risk assessment and reduction. 

Upgrading the equipment material of construction to a more 

HTHA-resistant steel is a high-ranking, inherently safer choice 

in material selection. Holding other variables constant, 

upgrading the material of construction can eliminate the 

potential for HTHA. As previously discussed, post-weld heat 

treating to modestly reduce HTHA susceptibility is low on the 

hierarchy of controls and thus is a weaker safeguard to prevent 

HTHA failures than the use of materials that are not susceptible 

to HTHA damage. 

Figure 17. Hierarchy of Controls. The highlighted boxes reflect inherently safer controls, based on 

Process Plants: A Handbook for Inherently Safer Design Second Edition; Kletz, Trevor Amyotte, Paul; 

CRC Press 2010. 

Since the April 2010 incident, Tesoro has installed new NHT heat exchangers, incorporating aspects of an 

inherently safer design.74 As discussed in Section 4.4.1.3, the materials of construction of two heat 

exchangers have been upgraded to significantly reduce the potential for HTHA. 

 

 

74 While the material of construction is upgraded in the new exchangers, portions of the heat exchangers that are 

manufactured with carbon steel are still designed to operate at temperatures higher than 400 0F. 

001177
Tesoro Anacortes Refinery Investigation Report May 2014

    36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.1.4 HTHA Inspection Strategy Limitations 

While inspection is an important mechanical integrity program component, there are significant 

limitations with relying solely on inspection strategies to prevent equipment failure from HTHA. For 

example, refinery equipment must already be damaged by HTHA for equipment inspection to identify 

HTHA. HTHA damage is also extremely difficult to identify by conducting an inspection. API RP 941 

includes a discussion of these difficulties: 

High temperature hydrogen attack is a difficult inspection challenge. 

The early stages of attack with fissures, or even small cracks, can be 

difficult to detect. The advanced stage of attack with significant cracking 

is much easier to detect, but at that point there is already a higher 

likelihood of equipment failure.75 

Some existing inspection methods attempt to 

identify HTHA, as described in Appendix E. 

However, inspection should not be solely relied 

on to identify and control HTHA. Inspection 

results can be unreliable and misleading. 

Successful identification of HTHA is highly 

dependent on the specific techniques employed 

and the skill of the inspector, and few inspectors 

have this level of expertise.76 

Inspection thus ranks very low on the hierarchy of 

controls. API RP 571 Damage Mechanisms 

Affecting Fixed Equipment in the Refining 

Industry implicitly supports the concept of 

inherently safer design by describing material 

selection to avoid HTHA failures noting, “300 

Series SS, as well as 5Cr, 9Cr and 12Cr alloys, 

are not susceptible to HTHA at conditions 

normally seen in refinery units.”77

 

 

75 API RP 941. Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants. 2008; p 11. 76 “HTHA is dangerous, difficult to detect and can be missed. The reliability of HTHA inspections depends on the 

skill of the inspector.” See: Birring, A., Ultrasonic Testing - Detection of Hydrogen Attack, See:

http://www.nde.com/hydrogen.htm, (accessed June 13, 2013). 77 API RP 571. Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. 2003; p “5-83”. 

001178
Tesoro Anacortes Refinery Investigation Report May 2014

    37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.2 Tesoro Heat Exchanger Failure 

4.2.1 NHT Heat Exchanger Construction 

The NHT heat exchangers were constructed in 1971 and installed and placed in service in Anacortes. The 

two banks of three heat exchangers were metallurgically identical; the pressure containing “shell” base 

material for each heat exchanger in the bank was specified based on the design operating conditions. 

Exchanger Shell-Side Materials of Construction 

 A/D Mn-0.5Mo steel (SA-302-B), factory clad78 with 1/8” thick Type 304 stainless 

steel.

 B/E Carbon steel (SA-515-70), factory clad with 1/8” thick Type 316 

stainless steel applied to the 4’ Section 4 (Can 4) as shown in Figure 18.79

 C/F Carbon steel (SA-515-70). 

The general construction of each heat exchanger shell consisted of a series of four steel sections, called 

“Cans” welded to form a cylinder (exchanger shell). This construction required a longitudinal weld to 

form each “Can” or section, and three circumferential welds to join the four sections end to end. The B 

and E heat exchanger design is shown in Figure 18. 

Figure 18. Fabrication Layout of the B and E Heat Exchangers 

Design data representing anticipated normal operation and the API RP 941 Nelson curves were used to 

select materials of construction for the NHT heat exchangers. Carbon steel was selected for the B and E 

heat exchangers because the design temperatures were below the carbon steel Nelson curve. “Can” 4 of 

the B and E heat exchangers, the hottest portion of the heat exchangers, was lined on the interior surface 

with a layer of Type 316 stainless steel on top of the carbon steel. The interior stainless steel was applied 

in a process known as “cladding.” The stainless steel was selected for protection against another damage 

 

78 Cladding is a process used to join dissimilar metals together to form a single metal piece. 

79 The remaining portions of the exchanger shell (Cans 1, 2, and 3) did not have a 316 stainless steel cladding. 

001179
Tesoro Anacortes Refinery Investigation Report May 2014

    38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

mechanism called sulfidation corrosion.80 Although protection from sulfidation corrosion is the intent of 

the stainless steel cladding, the cladding also can be used to reduce the risk of HTHA. The stainless steel 

cladding reduces the effective hydrogen partial pressure that is acting on the carbon steel beneath the 

cladding.81 

The welding construction method used to manufacture the B and E heat exchangers resulted in a large 

heat-affected zone (HAZ).82 An example of the welds used to construct the E heat exchanger is shown in 

a cross-section micrograph in Figure 19.83 The top of the micrograph is the outside of the heat exchanger 

shell carbon steel wall.84 

 

80 Sulfidation is a damage mechanism that causes thinning in iron-containing materials, such as steel, because of the 

reaction between sulfur compounds and iron at temperatures ranging from 450 °F to 800 °F. This damage 

mechanism causes the metal to gradually thin over time. 81 API RP 941. Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants. 2008; p 10. 82 The process of welding requires substantial heat that alters the material properties of the material near the weld. 

This affected area near the weld is commonly referred to as the “heat-affected zone” or “HAZ”, shown in Figure 

19. 83 Beta Laboratory, Beta Lab No.M10198, Tesoro Ls2 And Ls2/Cs2 Tee Findings, October 13, 2010 (Appendix H) 84 Figure 19 also shows the elements of a typical weld in the B and E heat exchangers. 

001180
Tesoro Anacortes Refinery Investigation Report May 2014

    39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 19. Cross-Section of Sample NHT Heat Exchanger Weld.85 The cross-section of a multipass 

weld in the upper graphic is typical of the heat exchangers, and the schematic in the lower graphic 

defines the terms associated with the weld. 

The welds in the B and E heat exchanger shells were not post-weld heat-treated.86 As a result, the heataffected zones illustrated in Figure 19 were likely high-stress areas where HTHA damage ultimately 

accumulated. 

 

 

85 See Appendix I, Figure 5. 86 Some components of the heat exchangers were post-weld heat-treated, where wall thickness was at least one inch. 

001181
Tesoro Anacortes Refinery Investigation Report May 2014

    40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.2.2 Post-Incident Metallurgical Analysis 

BETA Laboratory, located in Mayfield Village, Ohio, conducted metallurgical testing of the B and E heat 

exchangers through an agreement among Tesoro, the Washington Division of Occupational Safety and 

Health (DOSH), and the CSB. BETA Laboratory compiled a series of reports, included in Appendix H, 

on the failed heat exchanger (E) and the exemplar heat exchanger (B)87 that was removed from service 

after the accident at Tesoro. Test results indicate that the E heat exchanger failed at the heat-affected 

zones of the welds surrounding and within “Can” 3, as illustrated in Figure 20. 

Figure 20. E Heat Exchanger Failure Schematic 

The CSB contracted with the National Institute of Standards and Technology (NIST)88 to perform an 

independent analysis of the BETA Laboratory reports and to prepare a report that states a professional 

opinion of the failure mechanism that caused the rupture of the E heat exchanger.89 NIST metallurgical 

experts conducted the analysis. 

NIST determined that the metallurgical damage that caused the 

failure of the E heat exchanger was a result of HTHA, with other 

possible contributing co-mechanisms such as hydrogen-induced 

cold cracking that may have served as HTHA initiation points in 

the heat affected zones. The full metallurgical analysis is 

included in Appendix I. 

The documented HTHA damage for the failed E heat exchanger 

is extensive. Damage is evident in the base metal but only in the 

heat-affected zone adjacent to welds and along fusion boundaries 

 

87 The B exchanger was used as an exemplar during metallurgical testing because it experienced nearly identical 

process conditions and had the same geometry and materials as the E exchanger. 88 NIST is a non-regulatory federal agency in the U.S. Department of Commerce. The NIST mission is to promote 

US innovation and industrial competitiveness by advancing measurement science, standards, and technology in 

ways that enhance the economic security of the nation and improve the quality of life of citizens. See

http://www.nist.gov/public_affairs/general_information.cfm (accessed December 30, 2013). 

89 See CSB’s E-6600E and E-6600B Metallurgical Analysis report (Appendix I). 

001182
Tesoro Anacortes Refinery Investigation Report May 2014

    41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in the welds. No HTHA damage is evident in the base metal outside of the heat-affected zone.90 Because 

the fracture paths followed the narrow damaged regions along the welds, much of the damage in these 

regions was incorporated into the fracture surfaces during the failure as these damaged regions connected 

to form the macro-fracture. 

Similar HTHA damage is also evident and documented in the exemplar B heat exchanger that was 

unaffected by the incident. The HTHA damage in this heat exchanger is similar to the damage 

documented in the uncompromised portions of the E heat exchanger. Long and deep subsurface cracks 

are evident. In the case of the B heat exchanger, one circumferential weld heat-affected zone crack 

extends over 50 percent of the way around the circumference and more than one third of the way through 

the thickness of the heat exchanger shell wall,91 as shown in Figure 21 and Figure 22. 

Figure 21. Circumferential Weld Damage in the B Heat Exchanger. This photograph from the 

Spectrum inspection report on the B heat exchanger (Appendix G) shows the large crack directly 

downstream of the stainless steel clad portion of the heat exchanger. (The light green line below the 

dark black area is the crack; the dark portion is the edge of the stainless steel cladding.) This 

macrocrack formed in the high-stress region near the weld because of the linkage of microcracks and 

fissures caused by HTHA. 

 

90 See Appendix J 

91 See CSB’s E-6600E and E-6600B Metallurgical Analysis report (Appendix I). 

001183
Tesoro Anacortes Refinery Investigation Report May 2014

    42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 22. Comparison of Damage Locations in the B and E Heat Exchangers. Severe HTHA damage 

is found in the B heat exchanger in the same locations where the E heat exchanger ruptured. 

NIST determined that without the HTHA damage, it is unlikely that the E heat exchanger would have 

ruptured under the conditions that occurred during the April 2010 start-up. However, both the B and E 

heat exchangers were severely degraded and had the potential to suffer a catastrophic rupture because of 

the advanced stages of HTHA evident in both heat exchangers. 

 

001184
Tesoro Anacortes Refinery Investigation Report May 2014

    43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.3 Timing of the Incident 

Process data indicate that the D/E/F tube outlet temperature increased about 75 °F over a span of three 

minutes immediately before the rupture, as graphed in Figure 23. The CSB compared these changes in 

temperatures to those from the previous three startups. This magnitude of temperature increase is typical 

compared to the previous startups (Appendix B) and is likely explained by the difficulty of trying to 

maintain process control by manually operating large isolation block valves that were not designed as 

flow control valves.92

The E heat exchanger was in a severely degraded mechanical condition because of long-term cracking 

damage from HTHA. In addition to the increased mechanical stress from the startup of the A/B/C heat 

exchangers, this momentary increasing temperature appears to have been sufficient to cause the actual 

material strength of the critically weakened heat exchanger to be exceeded, rupturing the E heat 

exchanger at its weakest point – the area of the heat exchanger that was most damaged by HTHA. This 

scenario is the most likely explanation of the timing of the failure of the heat exchanger during the A/B/C 

heat exchanger startup, but it did not cause the failure. 

 

92 A block valve is a manually operated valve that is normally fully open or fully closed. Block valves are typically 

designed for tight shutoff when closed and for minimal obstruction of flow when open. These valves are not 

designed to throttle or control flow. 

001185
Tesoro Anacortes Refinery Investigation Report May 2014

    44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 23. Temperature and Pressure Trends before the Anacortes Incident 

4.3.1 NHT Heat Exchanger Startup Conditions 

The CSB examined startup activities and process data at the time of the incident and concluded that no 

equipment mechanical integrity code parameters were exceeded. Temperature trends from the time when 

the A/B/C heat exchanger bank was coming on-line were compared to those from the three previous 

startups (as explained in Appendix B). All of the temperature trends are similar. The maximum 

allowable working pressure of the E heat exchanger was 655 psig at 650 oF. The operating data indicate 

that the design temperature of 650 oF was not exceeded before the rupture. 

The E heat exchanger was protected from excessive pressure by a pressure relief valve on a downstream 

vessel, which was set to relieve the pressure at 585 psig.93 Operating data indicate that the pressure relief 

valve was not challenged and did not open before the incident. The relief valve was inspected and tested 

after the incident, and it opened at the designated set pressure. 

 

93 This relief valve is located further downstream in the process. As a result the exchanger pressure is higher than 

the relief valve set pressure. This pressure difference is accounted for by the engineering design and documented 

in the relief system calculations. 

001186
Tesoro Anacortes Refinery Investigation Report May 2014

    45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

As a result of this analysis, the CSB excluded improper operation of the NHT heat exchangers during 

startup as a plausible contributing cause of the incident. 

4.4 Process Conditions of the B and E Heat Exchangers 

In refineries and chemical plants, key temperatures, pressures, flow rates, and other data are typically 

measured using a distributed control system (DCS). This system tracks and records data reported to the 

system via instrumentation in the plant and can visibly display important variables to control room 

operators. Operators also can manually record data from field instrumentation that does not report to the 

DCS. 

Tesoro monitored temperatures and pressures of the process fluid entering and exiting the NHT heat 

exchanger banks, via both local field instrumentation and instrumentation that reported to the DCS. The 

locations of the temperature (TI) and pressure (PI) indicators are shown in Figure 24. 

Figure 24. Temperature and Pressure Indicators for the NHT Heat Exchanger Banks. This isometric 

process flow view depicts the lack of temperature indication on both the shell-side and tube-side of the 

B and E heat exchanger inlets and outlets. 

 

001187
Tesoro Anacortes Refinery Investigation Report May 2014

    46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Although some temperature and pressure measurements were 

taken surrounding the NHT heat exchanger banks, no temperature 

measurements were made between the heat exchangers. Thus, 

Tesoro did not know the operating temperature of the process fluid 

entering and exiting the B and E heat exchangers.94 Had Shell Oil 

or Tesoro performed a technical evaluation or installed 

instrumentation to monitor temperatures at these locations, a better 

evaluation of potential HTHA hazards could have been performed, 

and more effective safeguards could have been implemented. 

4.4.1 CSB Modeling of the NHT Heat Exchangers 

Because of the minimal temperature measurements of the NHT heat exchanger banks, the CSB performed 

process modeling to estimate the operating temperatures and hydrogen partial pressures of the B and E 

heat exchangers by using computer-based chemical process design software packages.95 The model 

required the use of several assumptions, such as fouling distribution, because of a lack of both process 

and fouling data gathered by Shell Oil and Tesoro. Consequently, all model results are estimates of the 

actual process conditions experienced by the NHT heat exchangers. The CSB used the model to estimate 

the operating conditions of each heat exchanger based on the available Tesoro operating data, including 

temperatures, pressures, flow rates, and fluid composition data. The model development process and 

associated results are described in Appendix C. A summary of the modeling results is depicted in Figure 

25, Figure 26, and Figure 27. 

 

94 A single external surface temperature measurement of 455 oF was taken in October 1998 on the inlet to either the 

B or E exchanger. 

95 Aspen HYSYS and Aspen Exchanger Design and Rating. 

001188
Tesoro Anacortes Refinery Investigation Report May 2014

    47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 25. Model Results for Can 4. The stainless-steel-clad portion of the carbon steel B and E heat 

exchangers was estimated to occasionally operate above the carbon steel Nelson curve. No HTHA was 

found in this region, likely because stainless steel cladding reduced the potential for HTHA in the 

carbon steel beneath it. Tesoro’s design B and E process condition used for HTHA evaluation (504 F 

and 291 psia hydrogen partial pressure) did not represent the entire range of heat exchanger operating 

conditions. 

001189
Tesoro Anacortes Refinery Investigation Report May 2014

    48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 26. Model Results for the Weld Downstream of Can 4. The circumferential weld immediately 

downstream of the stainless-steel-clad portion of the carbon steel B and E heat exchangers was 

estimated to operate just below the carbon steel Nelson curve. Extensive HTHA was found in this 

region, the hottest rupture location of the E heat exchanger and the major crack location of the B heat 

exchanger. 

001190
Tesoro Anacortes Refinery Investigation Report May 2014

    49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 27. Model Results for the Coldest Region of the E Heat Exchanger. The coldest region of the E 

heat exchanger with evident HTHA was estimated to operate as much as 120 0F below the carbon steel 

Nelson curve. 

4.4.1.1 HTHA Occurred Below the Nelson Curve 

CSB process modeling estimates demonstrated that the hottest 

portion of the B and E heat exchangers with evident HTHA, the 

circumferential weld between “Can” 3 and “Can” 4, operated below 

the carbon steel Nelson curve. HTHA was also identified at the 

circumferential welds between “Can” 2 and “Can” 3, and also 

between “Can” 1 and “Can” 2. Modeling results also indicate that 

HTHA was found 

in locations that were 

estimated to operate 

up to 120 0F below 

the carbon steel 

Nelson curve. 

001191
Tesoro Anacortes Refinery Investigation Report May 2014

    50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the coldest region in the E heat exchanger96 with identified HTHA was estimated to have operated up to 

120 0F below the carbon steel Nelson curve. This finding suggests that the long-standing industry carbon 

steel Nelson curve is inaccurate—it cannot be relied on to prevent HTHA equipment failures, and it 

cannot be reliably used to predict HTHA equipment damage. 

4.4.1.2 Estimate That a Portion of the B and E Heat Exchangers Operated Above the 

Nelson Curve 

The CSB modeling analysis estimated that during operation while fouled, the stainless-steel-clad portion 

of the B and E heat exchangers at times likely operated above the carbon steel Nelson curve. This section 

was not damaged by HTHA, probably because the stainless steel cladding protected the carbon steel 

beneath it. As discussed in Section 5.3.3, operation near or above the carbon steel Nelson curve should 

have triggered an inspection for HTHA by Tesoro, but the company never performed such an inspection. 

4.4.1.3 Tesoro’s Replacement Heat Exchangers 

Since the April 2010 incident, Tesoro has installed new NHT heat exchangers with upgraded materials of 

construction to significantly reduce the potential for HTHA.97 In addition, an advanced process control 

system is in place to minimize fouling. The heat exchangers are also constructed using only one bank of 

exchangers. The entire NHT unit now must be shut down for cleaning, eliminating the hazards of online 

switching and creating a much safer approach for maintenance. The new heat exchangers also 

incorporate additional instrumentation to allow the monitoring of each heat exchanger for fouling and 

decrease the likelihood of operation in HTHA-susceptible conditions. 

 

 

96 HTHA was not conclusively identified in the B heat exchanger in this region. Only a limited metallurgical 

analysis was performed on the seam between Can 1 and Can 2 of the B heat exchanger. 97 Although the materials of construction are upgraded in the new exchangers, portions of the heat exchangers that 

use carbon steel are designed to operate at temperatures of more than 400 0F. 

001192
Tesoro Anacortes Refinery Investigation Report May 2014

    51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.0 Organizational Deficiencies 

Similar to the results of the CSB investigation of the disastrous March 2005 explosion at the BP Texas 

City site, the CSB identified deficiencies in the process safety culture and organization at the Tesoro 

Anacortes Refinery that contributed to the April 2, 2010, incident. At the time of the incident, 

deficiencies in the Tesoro process safety culture and organization coincided, with catastrophic 

consequences. The organizational deficiency allowed many personnel in a hazardous region, and the 

process safety culture problems led to a failure to control HTHA hazards, resulting in a major fire and the 

loss of seven lives. 

5.1 NHT Heat Exchanger Flanges – A History of Leaking 

During startup following cleaning, the NHT heat exchangers would frequently leak from flanges, 

occasionally resulting in fires that created hazardous conditions for workers. This hazard had persisted 

for more than a decade; the CSB found that the earliest documentation of these leaks was from 1997, 

when Shell Oil owned the refinery. 

Over the years, Tesoro attempted maintenance and engineering 

solutions to stop the heat exchanger leaks. In 2008, management 

and labor even jointly conducted a triangle of prevention (TOP)98

investigation that analyzed, in part, the NHT heat exchanger 

leaks. However, these attempts did not effectively resolve the 

problem of the heat exchangers leaking during startup; as a result, 

various operational techniques were developed to accommodate 

the fact that the leaking would typically cease once the heat 

exchangers stabilized at their normal operating temperatures. The 

leaks were very hazardous as the hot naphtha was highly 

flammable99 and had the potential to be operating above its 

autoignition temperature. However, because these leaks were 

never effectively prevented, the leaks from the NHT heat 

exchangers during startup became an accepted and normalized condition at Tesoro. 

 

98 The TOP program is a joint union-management workplace safety program that applies the knowledge of the 

workforce to understand and eliminate workplace hazards. 99 The flash point is defined as the minimum temperature at which a liquid gives off sufficient vapor to form an 

ignitable mixture with air near the surface. The Tesoro Material Safety Data Sheets (MSDSs) for naphtha list its 

flash point as -7.1 oF. Liquids with a flash point of less than 23 oF fall into the highest hazard category of the 

Globally Harmonized System of Classification and Labeling of Chemicals (known as the GHS). See: 

https://www.osha.gov/dsg/hazcom/ghs.html#3.1 (accessed December 31, 2013). 

001193
Tesoro Anacortes Refinery Investigation Report May 2014

    52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.1.1 Incident Report That Demonstrates Normalization of Hazardous Conditions 

The CSB identified an incident report describing a startup of the NHT D/E/F heat exchanger banks in 

March 2009, a year before the April 2010 incident, that resulted in the exposure of workers to hazards 

from both hot steam and leaking hydrocarbons while they put the NHT heat exchangers back in service. 

This incident report demonstrates the normalization of hazardous conditions that had been established at 

the refinery. 

The 2009 report states that the “exchangers leaked substantially” and that the leaks were “steady streams” 

flowing from each of the three heat exchangers being put in service. The incident report then describes 

how workers responded to the leaks by continuing the startup, while wearing only standard refinery 

personal protective equipment, to reach the desired heat exchanger temperatures. This long-standing 

practice was used to stop atmospheric hydrocarbon releases from the NHT heat exchangers. The report 

states that “[s]team lances were positioned at all leak locations.” Tesoro employees “continued the 

startup of the heat exchangers while monitoring leak status....” Eventually, the target exchanger 

temperatures were achieved, and the leaks stopped. 

This continuation of the startup – despite the exposure of workers to significant hazards – demonstrates 

the normalization of the extremely hazardous NHT heat exchanger leaks. The leaking of hightemperature, highly flammable process fluids constitutes a serious process safety incident. However, 

during the 2009 incident, the refinery alarm was not sounded; an emergency response team was not 

activated; the leak was not isolated from the unit; and the unit was not shut down. The incident report 

also did not address the need for permanent corrections to stop the leaks. Although Tesoro did make 

additional attempts to correct the heat exchanger leaks as discussed in Section 5.1.4, ultimately these 

efforts were unsuccessful and the CSB found that leaks did occur during the startup of the NHT heat 

exchangers on the night of the April 2010 incident. 

5.1.2 TOP Investigation of Fires 

In 2008, a TOP investigation team was assembled to begin what would become a ten month investigation 

into a series of loss of containment incidents at the Tesoro Anacortes Refinery, including some that 

resulted in fires. In all, fourteen refinery incidents that occurred between May 2003 and December 2007 

were investigated during this process. The TOP team investigation included the frequent leaks from the 

NHT heat exchangers during startup. 

The findings of the Tesoro TOP investigation team included the following: 

 Tesoro classified incidents involving incipient fires100 as “level 1” incidents that are reported but 

do not require investigation. The 2008 TOP investigation was launched after multiple level 1 

 

100 In 29 CFR 1910.155(c)(26), OSHA defines “incipient stage fire” as a fire that is in the initial or beginning stage 

and that can controlled or extinguished by portable fire extinguishers, a class II standpipe, or small hose systems 

without the need for protective clothing or breathing apparatus. 

001194
Tesoro Anacortes Refinery Investigation Report May 2014

    53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incidents appeared to have common causal factors. The report noted that it was very difficult to 

complete a proper TOP investigation when many of the incidents were so far in the past. 

 NHT heat exchanger leaks were common during startup. However, because the leaks tended to 

stop after operating temperatures were reached, incident reports were sometimes not filed. The 

incidents were treated as “normal” startup events, and steam lances were considered to be 

acceptable leak mitigation. The TOP investigation team noted complacency at the refinery 

because these events were so common and also cited a growing lack of concern toward activating 

emergency response. 

 A Tesoro mechanical engineer had at one time actively pursued mitigation of NHT heat 

exchanger leaks. Procedural changes for startup and shutdown were made, and the heat 

exchanger gasket surfaces were repaired. However, the engineer left Tesoro, and no further 

progress was made because of a combination of poor communication and a lack of 

implementation tracking. 

 Only one of the fourteen incidents investigated had prompted a previous TOP investigation, even 

though five of the fourteen investigated incidents involved fires in process units. The TOP 

investigation team concluded that this complacency in investigation practices caused associated 

complacency in the workforce toward process-related fires. 

5.1.3 MOCs Did not Effectively Control Hazardous Conditions 

A contributing factor to the presence of some of the six additional personnel in the NHT unit at the time 

of the April 2010 incident was likely the need for them to assist with steam lance use in anticipation of 

leaks during startup.101 Relying on steam suppression to mitigate leaks during NHT heat exchanger 

startups was a common practice and was part of the startup procedure. In October 2009, Tesoro approved 

a Management of Change (MOC) to install two new permanent steam stations near the NHT heat 

exchangers, shown in Figure 28.102

 

101 The CSB identified four steam lances near the NHT heat exchangers following the April 2010 incident. Three of 

the four steam lances were likely active at the time of the incident. 102 The “Purpose” of the change was to “Provide improved response time and safety when responding to flange fires 

in the vicinity of the E-6600 exchanger structure.” However, the steam equipment was installed in the 

immediate vicinity of the exchangers and nothing prohibited this steam suppression equipment from being used 

to mitigate a leak from the exchangers. The project to install additional steam suppression equipment was 

competed in January 2010. One of the new steam stations is shown in Figure 28. 

001195
Tesoro Anacortes Refinery Investigation Report May 2014

    54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 28. Steam Station and Steam Lance. This post-incident photograph shows a new steam station 

(left) with a connected steam lance (right). 

MOC is one of the 14 elements of the state of Washington PSM regulations.103 Although the PSM 

regulations impose a general requirement to perform a PHA 104 at least every 5 years, a formal hazard 

evaluation is not required for an MOC. The Tesoro MOC policy states, “Management of Change helps 

ensure that changes to a process do not inadvertently introduce new hazards or unknowingly increase the 

risk of existing hazards.” However, Tesoro decided that a hazard evaluation of the addition of steam 

stations was not required under their procedures because additional steam stations only involved a minor 

change to a utility system. Yet, the installation of the additional steam equipment enhanced the ability of 

the field operator(s) to confront hazardous leaks and extinguish fires in the area of the NHT heat 

exchangers, and the safety implications of these activities were not considered. 

 

103 MOC is one of the 14 elements of the WAC rules for PSM of highly hazardous chemicals. See

http://www.lni.wa.gov/wisha/rules/hazardouschemicals/#WAC296-67-045 (accessed December 25, 2013). 

MOC is also required by EPA RMP (See http://www.epa.gov/oem/content/lawsregs/rmpover.htm. (accessed 

December 25, 2013)) and is an element of the federal OSHA PSM regulations (See

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9760 (accessed 

December 25, 2013). 104 A PHA is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a 

threshold quantity of hazardous materials, such as the Tesoro Anacortes Refinery, are required to conduct a PHA 

per the WAC Title296 Chapter 67, Safety standards for PSM of highly hazardous chemicals (1992). See:

http://apps.leg.wa.gov/wac/default.aspx?cite=296-67 (accessed September 29, 2013) PHAs are also required by 

the federal EPA RMP. 

001196
Tesoro Anacortes Refinery Investigation Report May 2014

    55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Good practice guidelines such as those published by the CCPS advise that a hazard assessment should be 

performed during MOC reviews.105 Tesoro should have conducted a formal hazard evaluation for the 

MOC and should have considered more robust alternatives to steam lances such as protecting workers by 

effectively correcting the mechanical problems that were causing the leaks. 

Washington PSM regulations require MOC reviews to consider the impact of proposed changes on 

operating procedures.106 However, operating procedures were not reviewed or modified as part of the 

MOC review conducted for the new steam suppression equipment. The existing NHT heat exchanger 

startup procedure only addressed field tasks for a single NHT outside operator. The procedure instructed 

the operator to have a steam hose (lance) ready in case a leak developed and to warm the heat exchangers 

slowly to prevent leaks, but if leaks did occur, to continue the startup as follows: 

Keep an active steam hose on hand in case of leaks. 

Slowly heating the bundle up to prevent leaks. 

Heating the exchanger too fast can cause leaks. If the heads begin to 

leak, they will usually reseal themselves as they come up to temperature. 

When the ability to use multiple steam lances on the NHT heat exchanger leaks was provided, the 

operating procedure was not updated to reflect the ability for, and likely presence of, additional personnel 

to operate those steam lances. In addition, no guidance was developed or provided to establish how large 

a leak or fire the field operator(s) was expected to fight and no evaluation was made to assure there was 

proper allowance for emergency egress from a large leak or fire. Tesoro did not view the NHT heat 

exchanger startup and history of leaks as high hazard activity—a reflection of the normalization of the 

hazardous conditions. 

5.1.4 Unsuccessful Tesoro Attempts to Prevent Heat Exchanger Flange Leaks 

Tesoro sporadically made attempts to prevent the leaking of the NHT heat exchangers. These attempts 

included: gasket modifications, changes to torque and bolting practices, resurfacing of flange surfaces, 

and the installation of warm-up piping to smooth the transition from cold to hot equipment during heat 

exchanger startup. Following the severe leaks from the NHT heat exchangers during the March 2009 

startup, in August 2009 Tesoro installed a different type of gasket in the NHT heat exchangers. During 

the startup that followed, Tesoro records indicate that no leaks from the heat exchangers occurred. Tesoro 

representatives told the CSB that this startup was evidence of “success” in correcting the NHT heat 

 

105 An important aspect of an MOC is assessing the hazards associated with proposed changes. The MOC team 

should determine the level of hazard evaluation needed for specific types of changes, but site management may 

decide that formal hazard evaluations are necessary for certain types of changes. The MOC process should 

provide sufficient information about the change to conduct a hazard evaluation. Center for Chemical Process 

Safety (CCPS). Guidelines for the Management of Change for Process Safety. 2008; pp 52-54. 106 Modification to operating procedures is part of the MOC requirements addressed by the WAC process safety 

management regulations. See http://www.lni.wa.gov/wisha/rules/hazardouschemicals/#WAC296-67-045

(accessed December 25, 2013). 

001197
Tesoro Anacortes Refinery Investigation Report May 2014

    56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

exchanger leaks. However, this was the last startup before the April 2010 incident, and a single 

successful startup without leaks is not evidence of long-term success.107 One of the four steam lances 

likely used for leak mitigation on the night of the April 2010 incident is shown in Figure 29. 

Figure 29. Post-Incident Steam Lance. This photograph shows a steam lance that was likely used 

during the startup. 

In addition, the Tesoro Anacortes Refinery has a history of incidents related to flange leaks.108 Despite 

industry best practices that require use of new heat exchanger gaskets, Tesoro documents indicate that the 

company noted that the new NHT heat exchanger gaskets, installed to prevent future startup leaks, could 

be re-used after subsequent cleaning cycles.109 In contrast, gasket manufacturer guidance and industry 

 

107 On the night of the April 2010 incident, two different operators reported two leaks during the startup of the heat 

exchangers. One leak was reported just before the incident. 

108 Tesoro incident reports document a history of gasket failures at the refinery. A variety of causes were identified 

for these past failures including loose bolts, damaged gaskets, installation of the wrong gasket, defective gaskets, 

and other installation-related causes. The Tesoro 2008 TOP investigation identified a contributing cause to the 

fires in the NHT unit was that “[f]langes and/or gaskets may have been damaged due to poor access and high 

maintenance frequency.” 

109 The notation indicated that the gasket vendor informed Tesoro that these gaskets could be re-used. Maintenance 

records indicate that the job plan did call for new gaskets. 

001198
Tesoro Anacortes Refinery Investigation Report May 2014

    57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

best practice guidance indicate that new gaskets should be installed and that gaskets should not be reused.110,111 

Regardless, Tesoro’s perceived “success” in resolving the NHT heat exchanger leaks in August 2009 did 

not result in the presence of fewer personnel during the April 2010 startup. In fact, Tesoro normalization 

of the hazardous NHT heat exchanger leaks ultimately contributed to the presence of a significant number 

of additional workers near the NHT heat exchangers at the time of the incident and thus a larger number 

of fatalities as a result of the heat exchanger failure. 

5.2 Hazardous Nonroutine Work 

Nonroutine work can be a highly hazardous operation. Work is performed on equipment that might or 

might not be shut down while adjacent equipment containing hazardous process material continues to 

operate. This type of operation places maintenance and operations personnel at risk. The CCPS provides 

the following guidance: 

Experience indicates that many accidents do not occur during “normal” 

operation but, rather, during such nonroutine modes of operation.112 

By its nature, nonroutine work carries with it the potential for 

unrecognized hazards that sometimes has led to a catastrophic 

incident.113

During the period 1970 to 1989, 60 to 75% of major incidents in 

continuous processes occurred during “non-routine” modes of operation; 

i.e., in operating phases other than the continuous operation of the 

process after start-up.114 

The 1989 Phillips Houston Chemical Complex fire and explosion, which killed 23 workers, expedited 

issuance of the PSM standard. Similar to the April 2010 Tesoro Anacortes Refinery incident, it involved 

the performance of hazardous nonroutine work in a running process unit.115

 

110 When a flanged joint is opened, the gasket should be not be re-used. A new gasket should always be installed. 

Mannan, S. Lee’s Loss Prevention in the Process Industries, Hazard Identification, Assessment and Control. 

Chapter 21, “Equipment Maintenance and Modification.” p 25. 111 Lamons. Gasket Handbook. 2012; p 113. See

http://www.lamons.com/public/pdf/lit_reference/LamonsGasketHandbook2012.pdf (accessed December 27, 

2013). 112 Center for Chemical Process Safety (CCPS). Revalidating Process Hazard Analyses. 2001; pp 31-32. 113 Center for Chemical Process Safety (CCPS). Guidelines for Auditing Process Safety Management Systems. 

2011; p 393. 114 Center for Chemical Process Safety (CCPS), Guidelines for Hazard Evaluation Procedures. 2008; p 257. 115 U.S. Department of Labor. A Report to the President: Phillips 66 Company Houston Chemical Complex 

Explosion and Fire. April 1990; p 21. 

001199
Tesoro Anacortes Refinery Investigation Report May 2014

    58 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The state of Washington’s PSM regulations also stress the importance of employers identifying the 

hazards of nonroutine work in process areas and then communicating such hazards to those employees 

performing the work.116 

Tesoro acknowledged both the potential hazards and relevance of nonroutine work to the Anacortes 

refinery incident in its own investigation report on the April 2010 incident. 

Continuous petroleum or chemical processes operate most effectively 

when they are in a steady state. Non-routine activities, including startup 

or shutdown, can create additional risks because parameters such as flow, 

temperature and pressure are in a state of flux.117

5.2.1 CSB Investigation of Tosco Avon Refinery 

On February 23, 1999, a fire occurred in the crude unit at the Tosco Corporation’s Avon oil refinery in 

Martinez, California.118 Workers were attempting to replace piping attached to a 150-foot-tall distillation 

column119 while the process unit was in operation. During removal of the piping, naphtha was released 

onto the hot distillation column and ignited. The flames engulfed five workers located at different heights 

on the column. Four workers were killed, and one worker sustained serious injuries. 

The CSB investigated the incident and determined that the refinery’s management system did not 

recognize or control the serious hazards posed by performing nonroutine repair work while the crude 

processing unit remained in operation.120 Although the piping replacement activities at Tosco were 

dissimilar to starting up the heat exchanger bank at the Tesoro refinery’s NHT unit, both involved 

hazardous nonroutine work. 

A key conclusion and recommendation from the CSB 1999 Tosco investigation addressed the importance 

of advance planning and thorough hazard evaluations for the safe performance of higher hazard 

nonroutine work. Management has the obligation to identify hazards, implement effective controls and 

 

116 See WAC 296-67-291 Appendix C, Compliance guidelines and recommendations for process safety management 

(nonmandatory) http://www.lni.wa.gov/WISHA/Rules/hazardouschemicals/default.htm#WAC296-67-021

(accessed December 3, 2013). 117 See TOP Investigation Team Report. Naphtha Hydrotreater E-6600E Failure, 12:35 a.m., April 2, 2010, 

Anacortes Refinery, Washington. p 21. http://tsocorp.com/wp‐

content/uploads/2014/01/Anacortes_final_report.pdf (accessed April 2, 2014). 118 Ultramar Diamond Shamrock Corporation purchased the Avon oil refinery in September 2000 and renamed it the 

Golden Eagle Refinery. Tesoro purchased the Golden Eagle Refinery in 2002 and was the final party to respond 

to the CSB site-based safety recommendations from the 1999 Tosco incident. 

119 A distillation column is an oil refinery processing vessel that separates preheated hydrocarbon mixtures into 

various components based on boiling point. The separated components are referred to as fractions or cuts. Inside 

the column some trays draw off the fractions as liquid hydrocarbon products (such as naphtha), and piping 

transports them to storage or other units for further processing. 120 CSB Investigation Report, Refinery Fire Incident – Tosco Avon Refinery, March 2001. See

http://www.csb.gov/assets/1/19/Tosco_Final_Report.pdf (accessed December 4, 2013). 

001200
Tesoro Anacortes Refinery Investigation Report May 2014

    59 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

limit personnel exposure to higher-hazard work – but not meeting this obligation is a common failing, 

identified in both the Tesoro and Tosco investigations, that led to the catastrophic incidents. The CCPS 

recommends that companies considering tasks that entail employee access to hazardous areas should 

“minimize the number of people in harm's way should an incident occur.”121

The likelihood of leaks occurring during the startup of the NHT heat exchangers made returning them to 

service a serious hazard to the workers involved. Similar to the Tosco incident, the serious hazards could 

have been more effectively controlled through the use of hazard evaluation techniques and more effective 

management control of the nonroutine work. 

Unlike Tosco, Tesoro had years to evaluate the hazards and effectively control the frequent NHT heat 

exchanger leaks. Multiple incident reports were developed and hazard reviews were conducted. Each of 

these events presented opportunities for Tesoro to recognize the hazardous nonroutine work and 

effectively control the hazards. However, Tesoro never effectively corrected the hazardous startups and 

failed to limit access to a minimum number of essential personnel. 

5.2.2 NHT Heat Exchanger Cleaning and Startup 

While in operation, the NHT heat exchangers fouled, reducing heat transfer between the tube-side and 

shell-side process fluids. This reduction in heat transfer both increased shell-side outlet temperatures and 

decreased tube-side outlet temperatures. To maintain process requirements, the heat exchangers were 

periodically cleaned. Tesoro accomplished this task with hazardous nonroutine work, cleaning one bank 

of heat exchangers at a time while the remainder of the process continued to operate. 

During this nonroutine work, one bank of heat exchangers was isolated, opened, and cleaned, while the 

other bank of heat exchangers remained in operation. This maintenance activity typically lasted at least 

three days. During some of the cleaning operations – for example, when the tubes were removed from the 

heat exchanger to facilitate the cleaning – contractors and specialized equipment were needed in the unit. 

In the past, this operation involved as many as fourteen personnel in the NHT unit at one time while the 

other heat exchanger bank and the remainder of the process continued to operate around them. 

5.2.3 Tesoro Failure to Control Heat Exchanger Startup Hazards 

On April 1, 2010, Tesoro operations staff began implementing the procedure to startup the clean A/B/C 

heat exchanger bank. The startup procedure only described roles for the two NHT operators normally 

assigned to a shift, one in the control room and one outside in the field. However, additional outside 

operators from other units frequently assisted in the heat exchanger startup. In addition to responding to 

potential leaks, supplemental personnel were sometimes requested to assist in the NHT heat exchanger 

startup operations because of the difficult labor-intensive process involved. When starting up a bank of 

NHT heat exchangers, the operator was required to open several large block valves to introduce the 

 

121 Minimize the number of people in harm’s way should an incident occur. See Center for Chemical Process Safety 

(CCPS). Guidelines for Risk Based Process Safety. 2007; p 296. 

001201
Tesoro Anacortes Refinery Investigation Report May 2014

    60 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

process fluid to the heat exchanger bank that was shut down. The block valves were located on three 

different levels of the NHT structure, as illustrated in Figure 30. The geared mechanisms that opened and 

closed these valves were of a type referred to as “long-winded” because they were physically demanding, 

requiring over a hundred turns (by hand) of large wheels to fully open the valves. In addition, the heat 

exchanger procedures required deliberate and coordinated manipulation of these valves. As a result, 

startup by only the one official NHT outside operator was complex and difficult, and additional personnel 

often assisted with the heat exchanger bank startups. 

Figure 30. Unit structure (left) and manual block valve (right) 

Tesoro routinely relied on additional staff members during NHT heat exchanger startups but never 

assessed the risks or made any attempts to control them. Tesoro did not conduct an MOC to consider the 

risks of these organizational changes, despite its policy that required the performance of such a risk 

assessment.122

 

122 The performance of a MOC review to examine the safety implications of organizational change is not required by 

either the federal OSHA PSM standard or the Washington PSM regulation. Although it is noted that Tesoro 

MOC procedures went beyond regulatory requirements, its failure to apply its own policy to circumstances that 

should trigger a MOOC review underscores the need for a PSM regulatory revision to help ensure that needed 

MOOC safety reviews are not voluntary. In the 2007 BP Texas City investigation report, the CSB recommended 

to the federal OSHA that it revise the PSM standard to require MOC reviews for organizational changes, 

including staffing changes. In response, OSHA sent a memorandum in 2009 to its Regional Administrators, 

stating the new agency position that changes to operating procedures that include organizational changes are 

subject to MOC requirements, even though they are not explicitly applicable. In August 2013, the CSB Board 

voted that the OSHA response was “open-unacceptable.” In December 2013, OSHA published a Request for 

Information (RFI) as a step in the rule-making process to revise the chemical accident prevention regulations, 

including the PSM standard. The RFI seeks public input on whether to revise the PSM standard to explicitly 

require MOC reviews for organizational changes, citing the BP Texas City CSB recommendations. See: 

(https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=24053) 

001202
Tesoro Anacortes Refinery Investigation Report May 2014

    61 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The Tesoro MOC policy includes a requirement for Management of Organizational Change (MOOC), 

which recognizes that “... changes in an organization can ... sometimes result[] in unrecognized negative 

effects.” For examples, an MOOC is needed in the case of staffing modifications, changes in 

maintenance practices, and shifting of personnel roles and responsibilities – all typical practices used at 

the refinery to provide additional operators from other units to assist in startup of the NHT heat 

exchangers. The MOOC policy includes provisions for providing “[c]lear documentation and 

communication of why the change is necessary” and “[a] clear understanding of the risks involved and 

application of effective measures to reduce, eliminate, or mitigate those risks.” The Tesoro MOOC policy 

covers “non-routine tasks” and includes requirements for the following: 

Document all identified risks; include methods to reduce, eliminate or 

mitigate them [...] 

Review the risks involved with the changes. Ensure discussions include 

human factors, competence, workload issues, and sufficient resources to 

ensure the change can be carried out safely. 

In post-incident interviews, Tesoro employees described the number of employees in the unit at the time 

of the explosion (seven workers) as unusually high. Yet, the CSB learned that it was not unusual for a 

shift supervisor to enlist one to four additional staff members from other units to perform the hazardous 

nonroutine work associated with the NHT heat exchanger startups. Although some employees might 

have perceived this as positive (e.g., reflection on individual willingness to help), the practice actually 

exposes a poor company process safety culture. Tesoro required operators who did not have defined roles 

in the procedure to assist with the startup, a hazardous activity with a long history of incidents. 

An effective PSM system would have corrected the problems with known leaks and fires and would have 

controlled all aspects of hazardous nonroutine work. This approach would include taking proactive 

measures to eliminate worker exposure hazards and limiting access to only the minimum personnel 

needed to perform the tasks.123 The use of more personnel than the number called for in the procedure 

exposed more workers to the high-hazard activity. This higher level of risk to workers should have been 

identified in NHT unit procedural reviews, PHAs, or an organizational MOOC. 

 

(accessed January 3, 2014). While the CSB welcomes this positive step, it is important to note that more timely 

proactive federal PSM revisions requiring MOOC reviews would also require similar PSM revisions in 

Washington’s State Plan OSHA program. If implemented, the revised regulations would have required a safety 

review of staffing changes for the NHT exchanger startup and could have had a preventive impact. 123 Minimize the number of people in harm’s way should an incident occur. Center for Chemical Process Safety 

(CCPS), Guidelines for Risk Based Process Safety; 2007; p.296. 

001203
Tesoro Anacortes Refinery Investigation Report May 2014

    62 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

For example, in such a review, Tesoro could have 

recommended automating the NHT heat exchanger 

startup or redesigning the heat exchangers to a single 

bank so that online switching was not possible. 

Automation could have limited the role of the single 

outside NHT operator and minimized exposure to 

hazards. With automation, the task for the outside 

operator could have been reduced to simply opening 

the primary isolation block valves for the A/B/C heat 

exchangers. If the heat exchanger leaks had been 

corrected, there would no longer be a need for multiple 

operators to be actively prepared to mitigate a leak or 

fire during the startup, and the single necessary operator 

could leave the immediate area. The remainder of the 

startup could have been performed by the automatic 

system and controlled remotely by the NHT operator in 

the control room. Such approaches could have 

eliminated the need to station personnel in the 

immediate vicinity of the heat exchangers. Since the 

incident, Tesoro has redesigned the NHT heat 

exchangers to create a single heat exchanger bank. 

Now, online switching is not possible, and automated 

startup can be used to minimize hazards to personnel. If 

Tesoro had taken such an approach before the incident, 

the consequences of the April 2010 incident could have 

been significantly reduced. 

 

001204
Tesoro Anacortes Refinery Investigation Report May 2014

    63 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.3 Process Hazard Analyses Failed to Prevent or Reduce the Consequences 

CSB process modeling estimates suggest that HTHA occurred at the Tesoro Anacortes Refinery at 

temperatures and hydrogen partial pressures below the carbon steel Nelson curve. However, the CSB has 

found that both Shell Oil and Tesoro had many opportunities to prevent the damage caused to the B and E 

heat exchangers by HTHA long before the April 2010 catastrophic failure. Such opportunities included 

the following: 

 DMHRs to predict potential HTHA damage 

 Verification of operating conditions 

 PHAs to identify hazards, evaluate safeguards, and assess considerations for inherently safer 

design. 

The PSM-required PHAs124 conducted on the NHT heat exchangers failed to prevent the April 2010 

incident or to reduce the consequences by limiting personnel access to potentially dangerous areas during 

the hazardous startup activity. The Shell Oil and Tesoro PHAs conducted on the Anacortes refinery NHT 

unit failed to accomplish the following: 

 Effectively evaluate and control hazardous nonroutine operations 

 Effectively evaluate and control the frequent leaks during startup 

 Restrict or limit the number of personnel present during the hazardous nonroutine startup of the 

NHT heat exchangers 

 Identify effective safeguards to control hazards from damage mechanisms such as HTHA. 

5.3.1 Hazardous Nonroutine Operations 

None of the Anacortes refinery PHAs effectively evaluated and controlled hazards associated with the 

nonroutine work necessary to periodically clean the NHT heat exchangers. The Washington PSM 

regulations address the need for nonroutine operations to be evaluated and require that at least one 

member of the PHA team has expertise in nonroutine tasks.125 The CCPS describes the importance of 

PHA evaluations, as well as the hazardous potential and frequent problems of PHAs that lack sufficient 

analysis of nonroutine work as follows:126

 

124 A PHA is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a 

threshold quantity of hazardous materials, such as the Tesoro Anacortes Refinery, are required to conduct a PHA 

per the WAC, Title 296, Chapter 67, Safety standards for process safety management of highly hazardous 

chemicals (1992). See: http://apps.leg.wa.gov/wac/default.aspx?cite=296-67 (accessed September 29, 2013). 

PHAs are also required by the federal EPA Risk Management Program. 125 See WAC 296-67-291 Appendix C--Compliance guidelines and recommendations for process safety management 

(nonmandatory) http://www.lni.wa.gov/WISHA/Rules/hazardouschemicals/default.htm#WAC296-67-021

(accessed December 3, 2013). 126 Center for Chemical Process Safety (CCPS). Revalidating Process Hazard Analyses. 2001; pp 31-32. 

001205
Tesoro Anacortes Refinery Investigation Report May 2014

    64 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

It is not uncommon for initial PHAs of continuous processes to focus 

only on normal operations, failing to address nonroutine, critical 

operating modes such as startup, shutdown, preparation for maintenance, 

emergency operations, emergency shutdown, and other activities whose 

characteristics may differ considerably from normal operations. 

Experience indicates that many accidents do not occur during “normal” 

operation but, rather, during such nonroutine modes of operation. 

Consequently, it is important that a PHA evaluate the hazards of a 

process during nonroutine as well as normal (routine) operating modes.

The 1996 Shell Oil PHA for the NHT unit did not evaluate or identify any issues related to nonroutine 

hazardous work associated with the frequent NHT heat exchanger cleaning operations. The 2006 Tesoro 

NHT unit PHA revalidation identified startup as a nonroutine operation but noted that existing procedures 

were adequately addressing nonroutine work. 

5.3.2 Access Was Not Controlled During Hazardous NHT Heat Exchanger Startup 

The 1996 Shell Oil NHT unit PHA did not identify or analyze leaks from the NHT heat exchangers, and 

no recommendations were made to prevent these leaks. The 2001127 and 2006 Tesoro NHT unit PHA 

revalidations also did not mention the frequent leaks from the NHT heat exchangers.128 The 2010 Tesoro 

NHT unit PHA team reviewed the March 2009 NHT heat exchanger startup incident where a steady 

stream of flammable hydrocarbons leaked from the exchangers near workers. In its evaluation of this 

incident, the PHA team reviewed unspecified “administrative controls” and determined that they were “in 

place and effective.” However, the CSB identified no administrative controls in place to minimize the 

number of workers present or their exposure to these startup hazards. In April 2010, less than two months 

after the PHA team determined that the “administrative controls” were in place and effective, seven 

workers were asked to be present during the hazardous nonroutine startup of the NHT heat exchangers. 

According to the Tesoro procedure, a single field operator should have conducted this startup work. 

 

 

127 The 2001 PHA revalidation conducted by Tesoro did not raise issues related to the NHT heat exchangers. The 

only mention of these exchangers is in the process description. 128 The 2008 TOP investigation of fires in the Anacortes refinery NHT unit concluded that complacency about 

exchanger leaks was a contributing factor in allowing the problem to persist. 

001206
Tesoro Anacortes Refinery Investigation Report May 2014

    65 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.3.3 Failure to Effectively Identify and Evaluate HTHA Hazards 

During the 38 years that the NHT heat exchangers were in operation, the Anacortes Refinery had many 

opportunities to prevent the April 2010 incident by identifying and effectively controlling the potential for 

HTHA in the B and E heat exchangers. Both Shell Oil and Tesoro performed DMHRs, commonly known 

as corrosion reviews, of the Anacortes refinery’s process equipment to determine the susceptibility to 

damage mechanisms such as HTHA.129 The first documented corrosion study for the NHT unit occurred 

in 1990, with subsequent studies in 1999, 2003, and 2008.130 

A problem common to all of the DHMRs conducted over the 20 years before the April 2010 incident is an 

inaccurate understanding the extent of stainless steel cladding covering the inside surface of the of the B 

and E heat exchanger shell wall. Each damage mechanism review documents that the B and E heat 

exchangers had a protective 316 stainless steel cladding covering the carbon steel wall. However as 

shown in Section 4.2.1, the 316 stainless steel cladding was installed only on the hottest section (Can 4) 

of the heat exchanger. The other three sections of the B and E heat exchanger shell walls were carbon 

steel without any protective cladding. 

The 1999 and 2003 DMHRs document both recognition of the need for proper materials of construction 

and a good understanding of the need to determine accurate equipment operating conditions: 

The prevention of HTHA begins with proper materials selection for the 

anticipated process conditions, i.e., hydrogen partial pressure and 

temperature. Careful review of these process variables must be made not 

only for normal operation but also for any other routine or non-routine 

mode of operation to determine the controlling set of conditions for the 

materials selection. 

Off-normal conditions must be considered in addition to normal 

operating conditions. 

Despite this recognition that the full range of operating conditions should be determined, none of the 

DMHRs requested that a technical evaluation, such as process simulation, be conducted for estimation or 

required that instrumentation be installed to measure the full range of operating conditions of the B and E 

heat exchangers. There were no temperature instruments installed on the B and E heat exchangers, and 

the hydrogen partial pressure is a parameter that must be calculated. Because these values were not 

 

129 Corrosion reviews consist of a process-by-process review of the plant for the susceptibility of API RP 571 

damage mechanisms. A process flow diagram is marked up with process variables (temperature, flow, pressure, 

etc.) and evaluated based on current operating data and past equipment repair history. 130 The 1990 review occurred while Shell Oil still owned the refinery, and was conducted by Shell Oil employees 

and the Shell Westhollow Corporation of Texas. Following the purchase of the refinery in 1998, Tesoro 

contracted with Shell Westhollow for preparation of the 1999 and 2003 study. The 2008 study was conducted by 

Lloyd’s Register Capstone. 

001207
Tesoro Anacortes Refinery Investigation Report May 2014

    66 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

rigorously evaluated, the Tesoro and Shell damage mechanism hazard reviews relied on design data that 

did not reflect all operating conditions. 

DMHRs were conducted in 1990, 1999, 2003, and 2008. Highlights of the analyses related to HTHA and 

the NHT heat exchangers are summarized in Figure 31. 

001208
Tesoro Anacortes Refinery Investigation Report May 2014

    67 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

DMHR Author Significant HTHA Information and CSB Findings 

January 

1990131

Shell Oil 

Company 

 DMHR: HTHA inspection of carbon steel is never required for 

operation more than 25 °F below carbon steel Nelson curve. 

 DMHR: Inspection is required every 2 to 3 years if operation is less than 

25 °F below carbon steel Nelson curve. 

 CSB: No specific recommendations are made for B and E heat 

exchangers. 

 CSB: Entire shells of B and E heat exchangers are listed as fully clad in 

Type 316 stainless steel, a material resistant to HTHA. However, only 

the hottest section (Can 4) of the heat exchanger is clad in Type 316 

stainless steel. 132

March 1999 

Reviewed 

again in 

September 

2003 

Shell Oil 

Company 

 DMHR: HTHA occurs before it is detectable. 

 DMHR: HTHA control requires knowing and accommodating actual 

operating conditions. 

 DMHR: In many older units operation of the reactors and heat 

exchangers up to the HTHA limits is economically attractive. 

 DMHR: Operating close to the Nelson curves requires very close 

control and monitoring of operating parameters, coupled with frequent 

inspection for HTHA. 

 CSB: The B and E heat exchanger shells are considered members of the 

same HTHA operating condition – based risk group as the A/D heat 

exchangers. However, no specific guidance is offered for the B and E 

heat exchangers. 

 CSB: Entire shells of B and E heat exchangers are listed as fully clad in 

Type 316 stainless steel, a material resistant to HTHA. However, only 

the hottest section (Can 4) of the heat exchanger is clad in Type 316 

stainless steel.

October 

2008 

Lloyd’s 

Register 

Capstone 

 DMHR: HTHA not a concern since operating conditions are below the 

Nelson curve. 

 CSB: Tesoro process engineering provides B and E heat exchanger 

shell-side temperatures. The values are lower than design, implying less 

risk of HTHA: 

Capstone data: 500 °F  (B and E shell-side)  350 °F 

Design: 504 °F  (B and E shell-side)  405 °F 

Capstone data: hydrogen partial pressure  240 psia 

Design: hydrogen partial pressure  291 psia 

Figure 31. DMHR and CSB Findings on Anacortes HTHA and Heat Exchangers (1990–2008) 

 

 

131 Recommendations reviewed in December 1993. 

132 API RP 941. Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants. Figure 1, Note 2, August 2008. Section 5.5 of API RP 941 states that it is not advisable 

to take credit for the presence of a stainless steel cladding. However, the CSB learned that some experts were 

less concerned about HTHA in the B and E exchangers when information provided to them indicates a Type 316 

stainless steel cladding is present. 

001209
Tesoro Anacortes Refinery Investigation Report May 2014

    68 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

None of these DMHRs conducted in the 20 years before the incident identified the potential danger of 

HTHA in the B and E heat exchangers because they primarily relied on design data instead of measured 

process conditions.133 Although all of these design data indicated operation below the Nelson curve, CSB 

modeling estimated that the hottest portions (Can 4) of the heat exchangers at times operated above the 

Nelson curve. As a result, the B and E heat exchangers were never inspected for HTHA and more 

HTHA-resistant materials were never considered until after the April 2010 incident. It is vitally important 

to fully understand actual operating conditions of refinery processes to ensure that all damage mechanism 

hazards are adequately analyzed. 

5.3.3.1 Insufficient Process Instrumentation 

An important factor in determining HTHA susceptibility is operating temperature. The Anacortes 

refinery HTHA inspection procedure “required” instrumentation to ensure and periodically document that 

the operation was appropriately monitored. However, for the instrumentation to be “required” a 

determination first had to be made that the process equipment was operating within 25°F or 25 psia134 of 

the appropriate Nelson curve. The procedure did not clarify how to make such a determination (which 

would necessitate accurate measurement capability) without already having an accurate measurement. 

The procedure stated the following:

Accurate measurements/determinations of temperature and 

hydrogen partial pressure should be made routinely and the 

records maintained to provide assurance that operating 

conditions remain compatible with Nelson Curve limits. 

Such measurements/determinations/records are required for 

equipment/piping that operate[s] within 25°F or 25 psia of the 

appropriate Nelson Curve.135

No temperature instrumentation was on the B or E heat exchangers. Figure 32 shows where temperature 

and pressure measurement instruments were located on the heat exchanger banks. Intermediate 

temperature and pressure instrumentation was nonexistent. This hazard evaluation barrier adversely 

affected all DMHRs at the Anacortes refinery. The operating temperature was unknown at the B and E 

heat exchangers, specifically as it increased significantly from heat exchanger fouling. With these key 

data absent from the analysis, the technicians, engineers, and damage mechanism experts relied on design 

operating conditions. 

 

133 The 2008 Capstone review used a partial pressure of 240 psia based on a modeling effort associated with an 

engineering project. Also, as previously noted in Section 4.4, a single external surface temperature measurement 

of 455 oF was taken in October 1998 on the inlet to either the B or E heat exchanger. 134 Absolute pressure measured in units of pounds force per square inch, or pounds per square inch absolute (psia). 

135 Although dated January 30, 2006 this procedure appears to have been developed by Shell Oil. The accuracy of 

the data used to develop the Nelson curve is described as being +/- 20 oF. The procedure also describes the 

benefit of stainless steel cladding on the inside surface of equipment to prevent HTHA damage. 

001210
Tesoro Anacortes Refinery Investigation Report May 2014

    69 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 32. Temperature and Pressure Instruments on the NHT Heat Exchanger Banks. This 

isometric process flow view shows the lack of temperature indication on both shell-side and tube-side 

of the E and B heat exchanger inlets and outlets. 

5.3.4 HTHA Hazards Were Not Effectively Controlled 

In 1995,136 Shell Oil completed a project PHA related to process modifications that could increase the 

hydrogen partial pressure in the NHT heat exchangers; however, no consideration, evaluation, or 

recommendation was made to account for the impact of this change on the potential for heat exchanger 

damage from HTHA. 

The initial NHT unit PHA completed by Shell Oil in 1996 identified the potential for HTHA in the NHT 

heat exchangers. The PHA cited ineffective, non-specific, judgment-based qualitative safeguards such as 

the facility’s inspection program, unit monitoring, procedures, practices, and limits on key and critical 

 

136 When this project was implemented, a Management of Change (MOC) review was also conducted. The MOC 

did not consider or evaluate the potential impact of increased hydrogen partial pressure on equipment 

susceptibility to HTHA. 

001211
Tesoro Anacortes Refinery Investigation Report May 2014

    70 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

variables for temperature (based on the Nelson curve) as safeguards. However, the B and E heat 

exchangers were never inspected for HTHA, no instrumentation was in place to monitor the inlet 

temperature of the B or E heat exchangers for Nelson curve limits, and no procedures or practices were in 

place to provide effective protection from HTHA. The effectiveness of these safeguards was neither 

evaluated nor documented; instead, the PHA merely listed general safeguards. If the adequacy of these 

safeguards had been analyzed, improved safeguards to protect against HTHA-related failure of the B and 

E heat exchangers could have been recommended. 

 The 2001137 and 2006 Tesoro PHA revalidations do not address or modify the analysis from the 1996 

Shell Oil PHA. In the 2001 PHA Tesoro included a review of the corrosion control program and a 

specific mechanical integrity checklist associated with the corrosion program. In 2006, the Tesoro 

corrosion program was still using these documents. However, in the 2006 PHA, Tesoro discontinued a 

review of these mechanical integrity programs in part because they were “not a legal requirement.” The 

following CCPS guidance on mechanical integrity does not recommend a focus on minimum compliance 

with regulation and notes: 

...[A] compliance-only program may miss out on many of the 

benefits of a more holistic approach, such as reduced risks for 

employees, the neighboring community, and the facility.138

... the more holistic approach helps to ensure compliance with governing 

regulations and, ultimately, often turns out to be less expensive than the 

minimum compliance effort would have been.139

5.3.4.1 PHA Assumptions That Contributed to Ineffective Control of HTHA Hazards 

For the sixteen year period starting in 1996 and ending in 2012, Shell Oil and Tesoro conducted PHAs at 

the Anacortes refinery that used a set of assumptions for the hazard scenarios and risk assessments 

generated by the PHA team. The purpose of these assumptions was documented as helping the team to 

assess “the worst credible scenarios not the worst imaginable scenarios.” However, based on the CSB 

investigation of the April 2010 incident, the use of these assumptions contributed to PHAs that were not 

effective in controlling process hazards. 

The CSB determined that several of the Tesoro process unit PHA assumptions, shown in boxes in the rest 

of this section, could lead to ineffective evaluation of significant hazards and proposed safeguards 

associated with the immediate causes of the April 2010 incident. 

 

137 The 2001 PHA revalidation conducted by Tesoro did not raise any issues related to the NHT heat exchangers. 

The only mention of these exchangers is in the process description. 138 Center for Chemical Process Safety (CCPS). Guidelines for Mechanical Integrity Systems. 2006; pp 3-5 

139 Ibid at 5. 

001212
Tesoro Anacortes Refinery Investigation Report May 2014

    71 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Tesoro’s PHA assumptions included: 

This assumption likely adversely influenced the evaluation of damage mechanism hazards and contributed 

to these hazards being ineffectively evaluated during the PHA. Equipment damage is a significant causal 

factor for loss of containment, and loss of containment is a primary process hazard. The immediate cause 

of the April 2010 incident was a damage mechanism – HTHA – that the Shell Oil PHA team in 1996 did 

not effectively evaluate. The 1996 PHA team significantly underestimated the risk of NHT heat exchanger 

failure. The frequency was appropriately estimated as being less than three percent, which was considered 

a “Low” frequency in the Shell Oil methodology. However, the consequence of the scenario was 

determined to be “Low to Medium” and significantly less than the actual consequence of the April 2010 

incident. A “Low to Medium” consequence, according to the Shell Oil guidance documents, would include 

the following: 

 A hydrocarbon release of a few hundred to 2,000 pounds; 

 Moderate property damage in the $500,000 to $2 million range; 

 Some recordable injuries140 to workers; or 

 Moderate disruption to refinery operations, with a return to operation within a few weeks. 

As previously noted, to control HTHA hazards the 1996 Shell Oil NHT unit PHA team cited non-specific, 

judgment-based qualitative safeguards, such as the facility’s inspection program, unit monitoring, 

procedures, practices, and limits on key and critical variables for temperature (based on the Nelson curve) 

as safeguards. None of these safeguards were effective, and they did not prevent the catastrophic E heat 

exchanger failure as a result of HTHA damage. 

The 1996 Shell Oil NHT unit PHA was revalidated by Tesoro in 2001 and 2006, but these PHA teams did 

not address or modify the analysis from the 1996 Shell Oil NHT unit PHA. 

The Tesoro 2007 PSM and RMP compliance audit indicated that previous PHAs at the Tesoro Anacortes 

Refinery lacked sufficient detail and did not identify all of the hazards of the process.141 As a result, in 

 

140 OSHA provides the following as examples of recordable injuries, “Cut, puncture, laceration, abrasion, fracture, 

bruise, contusion, chipped tooth, amputation, insect bite, electrocution, or a thermal, chemical, electrical, or 

radiation burn. Sprain and strain injuries to muscles, joints, and connective tissues are classified as injuries when 

they result from a slip, trip, fall or other similar accidents.” See https://www.osha.gov/recordkeeping/newosha300form1-1-04.pdf (accessed January 2, 2014). 

141 The compliance audit was conducted pursuant to the requirements in 40 CFR 68.79 and to the OSHA PSM 

Standard, 29 CFR 1910.119, paragraph (o) triennial compliance audit requirement. As an example of the lack of 

detail in the 2006 Tesoro NHT unit PHA, the 2007 audit compared the NHT unit PHA to the Alkylation unit 

Corrosion Inspection Program 

Assumption: The System has a corrosion inspection program. Leaks or 

loss of containment due to corrosion of pipes and vessels is not credible 

 for pipes and vessels included in these programs. 

001213
Tesoro Anacortes Refinery Investigation Report May 2014

    72 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2010 Tesoro conducted a new PHA that was a complete line-by-line evaluation. The 2010 NHT unit PHA 

evaluated hazards associated with the NHT heat exchangers in February 2010, just 38 days before the April 

2010 incident. With the “assumptions” still being used and, notably, the corrosion control and mechanical 

integrity programs no longer being reviewed as part of the PHA program, the 2010 Tesoro NHT unit PHA 

team did not identify the potential hazard of B or E heat exchanger shell failure because of HTHA 

damage.142 

Using this assumption contributed to PHA teams not effectively evaluating proposed inspection-related or 

maintenance-related safeguards. The 1996 Shell Oil NHT unit PHA stated that the inspection program was 

a safeguard to prevent HTHA failure of the NHT heat exchangers. However, the B and E heat exchangers 

were never inspected for potential HTHA damage. 

Using this assumption contributed to the PHA teams not considering the susceptibility of materials to 

failure from damage mechanisms such as HTHA, or recommending inherently safer materials such as 300 

series stainless steel to mitigate damage mechanisms such as HTHA.143

 

PHA. The 2007 audit found that although the Alkylation unit had approximately half the complexity of the NHT 

unit, the Alkylation unit PHA conducted four times more hazard evaluation scenarios and made nearly 15 times 

more recommendations than the 2006 Tesoro NHT unit PHA. 142 The term “shell” in this context refers to the pressure containing carbon steel wall of the heat exchanger. The 

2010 Tesoro NHT unit PHA did identify HTHA as a possible hazard for the tube side of the B and E exchangers. 

Heat exchangers of this design have process flow through two sides, separated by mechanical design. Heat is 

transferred from one side to the other in order to exchange heat. Flow on the inside of the tubes through the heat 

exchanger is commonly referred to as “tube-side”, while flow on the outside of the tubes is called “shell-side”. 

The B and E exchangers had HTHA damage to the pressure containing portion on the shell-side. The 2010 

Tesoro NHT unit PHA did not identify HTHA as a hazard where HTHA occurred on the shell-side of the 

exchanger. 143 As previously discussed, API RP 571 identifies inherently safer materials to prevent HTHA noting, “300 Series 

SS, as well as 5Cr, 9Cr and 12Cr alloys, are not susceptible to HTHA at conditions normally seen in refinery 

units.” See API RP 571. Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. 2003; p “5-

83”. 

Inspection and Maintenance Program 

Assumption: The equipment is inspected per the plant preventive 

maintenance standards, and maintenance is performed promptly. 

Materials of Construction 

Assumption: The materials of construction of piping, gaskets, vessels, and valves 

have been correctly selected according to Shell design standards. 

001214
Tesoro Anacortes Refinery Investigation Report May 2014

    73 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.4 CSB Conclusions on Organizational Deficiencies 

For years, management at the refinery under both Shell Oil and Tesoro failed to effectively evaluate the 

potential for HTHA in the B and E heat exchangers. External corrosion experts repeatedly and 

erroneously assumed that heat exchanger design conditions were representative of actual process 

operating conditions despite knowing that these heat exchangers experienced severe heat transfer 

performance deterioration and required frequent cleaning. 

Tesoro management also allowed worker exposure to hazards from fires and significant hydrocarbon 

leaks during startup of the NHT heat exchangers to become an accepted “normal” practice. Relying on 

steam suppression to mitigate leaks during NHT heat exchanger startups was a common and acceptable 

practice and was part of the startup procedure. Tesoro made attempts to correct the heat exchanger design 

problem that caused the leaks that sometimes resulted in fires, but ultimately these were ineffective. 

Additional employees were frequently brought in to assist the NHT field operator with the labor-intensive 

heat exchanger startup and hydrocarbon leak mitigation. On the night of the incident seven workers were 

performing the role that procedurally was intended for a single outside operator. 

Well-known industrial safety and accident analysis experts James Reason and Andrew Hopkins indicate 

that safety culture is defined by collective practices, arguing that this is a useful definition because it 

suggests a practical way to create cultural change. More succinctly, safety culture can be defined as “the 

way we do things around here.”144,145

Employees respond to issues that capture the attention of leaders.146 Hopkins notes that leadership 

qualities that minimize, downplay, or deny risk will erode a process safety culture. A culture of risk 

denial can include the following characteristics: 

 Belief that it cannot happen here 

 Normalization of deviance (normalization of hazardous conditions) 

 Ad hoc criteria for danger 

 Downgrading intermittent warnings 

 Burden (onus) of proof – requiring proof of danger rather than proof of safety 

 Group think (eliminates minority voices in deference to consensus)147

Several of these characteristics were identified during the CSB investigation of the Tesoro Anacortes 

April 2010 incident, including normalization of hazardous conditions and a misplaced burden of proof of 

 

144 Hopkins, Andrew. Safety, Culture and Risk; The Organisational Causes of Disasters. Sydney, New South 

Wales: CCH Australia Limited. 2005; p 7. 145 Center for Chemical Process Safety (CCPS), Guidelines for Risk Based Process Safety. 2007; p 40. 146 Hopkins, Andrew. Safety, Culture and Risk. 2005; p 8. 147 Ibid at 20-22. 

001215
Tesoro Anacortes Refinery Investigation Report May 2014

    74 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

safety.148 It is an important distinction that a company culture, including its process safety culture, is the 

embodiment of its practices and not the sum of its beliefs. Consequently, a process safety culture can be 

objectively measured by examining the process safety practices and outcomes. The practices of the 

Tesoro Anacortes Refinery – the use of excessive number of personnel to participate in hazardous 

activities, the lack of verification of actual process conditions, normalization of hazardous leaks of the 

NHT heat exchangers, and PHA assumptions that contributed to ineffective hazard evaluation of major 

hazards – are all indications of a deficient process safety culture at the Tesoro Anacortes refinery. 

 

 

148 Burden of proof means to require proof of danger rather than proof of safety. It is applicable to the process safety 

culture at the Anacortes refinery and is shown through the repeated use of design data to evaluate the NHT 

exchangers for HTHA susceptibility. Rather than obtain data on actual operating conditions, Shell Oil and 

Tesoro corrosion experts were allowed to repeatedly rely on design operating conditions. Such design operating 

conditions were readily available, but there was no instrumentation to obtain actual operating conditions for the 

B or E exchangers. Refinery management did not require that these experts obtain data on and use the actual 

operating conditions to prove safety when reaching their conclusion that the B and E exchangers were not 

susceptible to HTHA damage. 

001216
Tesoro Anacortes Refinery Investigation Report May 2014

    75 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

6.0 Industry Codes and Standards 

6.1 API RP 941 Operating Limits and Material Selection for HTHA 

API RP 941 is the industry guidance document that describes how to predict and manage HTHA. API RP 

941 was initially published in 1970 to communicate broadly industry’s experience with HTHA – both 

HTHA occurrences and conditions where HTHA did not occur. 

6.1.1 No Minimum Requirements to Prevent HTHA 

As discussed in Section 4.1.1, industry uses the Nelson curves as lines of demarcation to predict HTHA. 

Above each curve, HTHA is possible for that material of construction, and below the curve, the prediction 

is that HTHA will not occur. Industry also uses these curves to select materials of construction based on 

the anticipated operating conditions and to create an HTHA inspection and prevention program. 

However, API RP 941 is written permissively, and there are no minimum requirements for refiners to take 

any action to prevent HTHA failures.149 Specifically, there are no user requirements as follows: 

 There are no minimum requirements for users to perform HTHA susceptibility evaluations; 

 There are no requirements for users to select inherently safer materials of construction; and 

 There are no minimum requirements for users to verify process operating conditions of 

equipment that is potentially susceptible to HTHA. 

6.1.2 History of the Nelson Curves 

The Nelson curves are based on industry experience with HTHA and were first developed in 1949 by 

George Nelson,150 who gathered the original data to create the Nelson curves. After his death, none of his 

original data were found; only the information contained on the actual Nelson curves was available to API 

and the rest of industry.151 On the basis of the Nelson curves, in 1970 the API published API RP 941 

Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants.

152

API RP 941 contains a submittal sheet for companies to report their experience with HTHA.153 It tasks 

the company reporting HTHA equipment damage to provide a limited and simplistic history of operating 

conditions. API requests only the average and maximum process and metal temperature and a single 

 

149 API RP 941 uses the term “should” 27 times and the word “shall” once. As used in a standard, “shall” denotes a 

minimum requirement to conform to the standard, while “should” denotes a recommendation which is advised 

but not required to conform to the standard. 150 G. A. Nelson, “Operating Limits and Incubation Times for Steels in Hydrogen Service,” Proceedings, 1965, 

Volume 45, American Petroleum Institute, Washington, D.C. pp. 190-195. 151 API TR 941. The Technical Basis Document for API RP 941. 2008; p 128. 152 Ibid at 127. 153 HTHA experience includes both reports of HTHA damage and equipment that was not damaged by HTHA. 

001217
Tesoro Anacortes Refinery Investigation Report May 2014

    76 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

value for hydrogen partial pressure to represent equipment operating conditions. API provides very 

limited instructions on completing the datasheet to report HTHA equipment damage. There is no 

assurance that the data are representative of actual operating conditions. The datasheet reported to API 

does not ensure that the data cover the life of the equipment versus the year, month, or even week before 

equipment failure. The use of a single hydrogen partial pressure value does not ensure that the variability 

of the process is appropriately represented by the data reported. 

As demonstrated in the CSB analysis of the B and E heat exchanger operating conditions in Section 4.4.1, 

refinery equipment often operates at a range of temperatures and hydrogen partial pressures. The API RP 

941 technical report acknowledges this, stating that the authors “find it difficult to obtain accurate 

operating data and material damage assessments.”154 In addition, not all companies report their HTHA 

failures to API (for example, Tesoro did not formally report the failure information to API following the 

April 2010 incident). Furthermore, the consequences of HTHA equipment damage, such as a multifatality incident, are not included as part of the data submitted to API. These are significant weaknesses 

in relying on empirical, self-reported data. 

6.1.3 Industry Critiques of Nelson Curves 

The applicability and accuracy of the Nelson curves have been called into question within the refining 

industry. Two comprehensive reports analyze the Nelson curves: the Hydrogen Attack Project and API 

TR 941, The Technical Basis Document for API RP 941. 

The Hydrogen Attack Project is a report by the Materials Property Council155 and the API.156 The report 

presents a history of HTHA analysis, the Nelson curves, and API RP 941. The report highlights problems 

in obtaining accurate data on operating conditions, analogous to the problems that the CSB identified at 

Tesoro, stating:

The only really reliable way to get an equipment exposure temperature is 

to properly measure the actual temperature of the component. Many 

times the process thermocouples are not well located for measuring the 

temperature of a particular component or in the case of exchangers, a 

particular exchanger in a multi-exchanger train. The design and/or 

process flow diagrams may not provide a very good estimate of actual 

operating temperatures.157

 

154 API TR 941. The Technical Basis Document for API RP 941. 2008; pp 45-46. 155 The Materials Properties Council (est. 1966) was founded by the American Society of Mechanical Engineers, 

ASM International, ASTM and the Engineering Foundation and supported by industry, technical organizations, 

codes and standards developers, and government agencies in order to provide valid data on the engineering 

properties of metals. See: http://www.forengineers.org/mpc/index.html (accessed November 21, 2013). 

156 Hydrogen Attack Project, Materials Property Council / American Petroleum Institute, undated. 

157 In this context, the term “train” is synonymous with “bank” and is used to describe multiple heat exchangers in 

series. Hydrogen Attack Project, Materials Property Council / American Petroleum Institute, p 19, undated. 

001218
Tesoro Anacortes Refinery Investigation Report May 2014

    77 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

API TR 941 was issued as the technical basis 

document for API RP 941.158 This technical report 

addresses several possible limitations of the Nelson 

curves, such as the location and shape of the 

curves.159 API TR 941 acknowledges that there is 

still more to learn about HTHA, stating “We are still 

far from being able to make quantitative predictions 

about the behavior of steels subject to HTHA.”160 

Critics of the Nelson curves also contend that, 

although the curves are easy to apply, their simplicity 

minimizes their effectiveness.161 Critics of the curves 

say that HTHA is a complex phenomenon. The risk 

of HTHA is a function of more than solely the three 

variables described by the Nelson curves (material of 

construction, temperature, and hydrogen partial 

pressure).162 Other variables that are not addressed by 

the curves affect the potential for HTHA, such as 

stress,163 carbide stability,164,165 grain size,166 type of 

weld,167 and time in operation.168 

 

158 API Technical Report 941. The Technical Basis Document for API RP 941. 2008. 

159 Ibid at 2. 160 Ibid at 45. 161 Van der Burg, M.W.D., Van der Giessen, E., and Tvergaard, V. “A continuum damage analysis of hydrogen 

attack in a 2.25Cr-1Mo pressure vessel,” Materials Science and Engineering A241 (1998) 1-13, p1. 162 Ibid at 12. 163 API RP 941. Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants. 2008; Section 3.2. 164 A carbide is an intermetallic compound containing carbon. There are many possible combinations of carbon and 

other atoms (such as iron, titanium, niobium, vanadium) that combine to form carbides in steel. Each of these 

carbides has an effect on the properties of the steel. 165 Van der Burg, M.W.D, Van der Giessen, E., and Tvergaard, V. “A continuum damage analysis of hydrogen 

attack in a 2.25Cr-1Mo pressure vessel,” Materials Science and Engineering A241 (1998) 1-13, p12. 166 Grain size is a fundamental characteristic of steel microstructure, indicating the size of each individual crystalline 

packet of iron atoms (known as a “grain”). 167 Manna, G., P. Castello, and F. Harskamp. “Testing of welded 2.25CrMo steel, in hot, high-pressure hydrogen 

under creep conditions” Engineering Fracture Mechanics 74 (2007) 956-968, p.956. 168 Shewmon, Paul. Hydrogen Attack of Carbon Steel. Metallurgical Transactions A Vol 7A February 1976, p 280. 

001219
Tesoro Anacortes Refinery Investigation Report May 2014

    78 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

API TR 941 warns that applying API RP 941 has become less conservative as equipment is pushed to the 

limits of the Nelson curves for economic reasons.169 API TR 941 notes the following: 

The concept of a simple boundary between safe and unsafe operating 

conditions in hydrogen for common alloys, of the type depicted by the 

Nelson curves should not be expected. Certainly material composition, 

heat treatment and stress are well accepted as variables that influence 

behavior. 

Experience shows damage accumulation is time dependent. However, 

the methods of detection and quantification of damage are so inadequate, 

operating conditions so poorly recorded, failure analyses so cursory and 

materials characterization so primitive, that life prediction is on shaky 

grounds today.170

6.1.4 Unreliable Carbon Steel Nelson Curve 

As discussed in Section 4.4.1, CSB process modeling of the Tesoro NHT heat exchangers estimates that 

HTHA occurred below the carbon steel Nelson curve. 

As previously discussed, post-incident analysis of the 

NHT heat exchangers determined that damage from 

HTHA was occurring in portions of the B and E heat 

exchangers that were estimated to have operated 

below the carbon steel Nelson curve. The coldest 

region in the E heat exchanger with identified HTHA 

was estimated to operate up to 120 0F below the 

carbon steel Nelson curve. This finding indicates that 

the industry developed carbon steel Nelson curve is 

inaccurate and cannot be relied on to prevent HTHA 

equipment failures or to predict HTHA equipment 

damage. 

 

 

169 API Technical Report 941. The Technical Basis Document for API RP 941 . 2008; p 45. 170 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; p 47. 

001220
Tesoro Anacortes Refinery Investigation Report May 2014

    79 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

6.1.4.1 ExxonMobil HTHA Incident Below the Carbon Steel Nelson Curve 

ExxonMobil also experienced equipment damage from HTHA at process conditions that were noted as 

being immediately below the carbon steel Nelson curve.171 Similar to Tesoro, the ExxonMobil incident 

included damage to a heat exchanger of a hydrotreating unit.172 This failure has many similarities to the 

Tesoro April 2010 incident and further highlights that the carbon steel Nelson curves cannot be relied 

upon to prevent HTHA equipment failures.173 Similar to the Tesoro April 2010 incident, cracking was 

observed in non-PWHT carbon steel constructed in the early 1970’s and operating at conditions reported 

as being below the Nelson curve.174 The ExxonMobil HTHA failure also occurred adjacent to weld 

seams in the heat affected zone of the vessel.175 

6.1.4.2 Other Industry Reports of HTHA Damage to Equipment that Operated Below the 

Carbon Steel Nelson Curve 

The CSB has learned of at least eight recent refinery incidents where HTHA reportedly occurred below 

the carbon steel Nelson curve. In addition to the ExxonMobil incident, Valero, Shell, and ConocoPhillips 

have all reported incidents to the API 941 committee where the companies have concluded that 

equipment operating below the carbon steel Nelson curve was damaged by HTHA. Valero reported three 

incidents at their Corpus Christi refinery and one incident at their Texas City refinery. Shell reported at 

least two equipment components in one process unit had HTHA below the carbon steel Nelson curve. In 

addition, ConocoPhillips reported an incident of HTHA below the carbon steel Nelson curve at one 

facility. In 2011, API issued an industry alert on HTHA in refinery service.176 The API alert noted 

multiple incidents of carbon steel equipment at operating conditions where carbon steel was previously 

thought to be resistant to HTHA. These refinery incidents and the subsequent API response strongly 

suggest an industry-wide problem with the carbon steel Nelson curve. 

6.1.5 Essential Adjustments Are Needed to API RP 941 

Although the potential consequences of HTHA-related failure can be catastrophic, API RP 941 currently 

imposes no substantive requirements on users. API RP 941 should require companies to verify the actual 

operating conditions of equipment that is potentially susceptible to HTHA. In addition, API RP 941 

should incorporate the principles of the hierarchy of controls and inherently safer design to prevent 

equipment failures from HTHA. The CSB has identified at least eight incidents in refineries where 

HTHA equipment damage was found at operating conditions below the carbon steel Nelson Curve. 

 

171 McLaughlin, J., Krynicki, J., and Bruno, T. Cracking of non-PWHT’d Carbon Steel Operating at Conditions 

Immediately Below the Nelson Curve. ExxonMobil Research and Engineering Company, Proceedings of the 

ASME 2010 Pressure Vessels & Piping Division, 2010; pp 18-22. 172 Ibid.

173 Ibid.

174 Ibid.

175 Ibid.

176 See: http://www.api.org/publications-standards-and-statistics/hidden-pages/industry-alert (accessed January 19, 

2014). 

001221
Tesoro Anacortes Refinery Investigation Report May 2014

    80 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Furthermore, CSB modeling of the Tesoro Anacortes refinery NHT heat exchangers suggests the E heat 

exchanger failed from HTHA damage that occurred below the Nelson curve. In support of inherent safety 

to prevent equipment failures from HTHA, the CSB proposes a new boundary for the carbon steel Nelson 

curve in Figure 33. This boundary would prohibit carbon steel equipment at process conditions that API 

has identified as susceptible to HTHA, above 400 0F,177 and which operates at greater than 50 psia 

hydrogen partial pressure. 

Figure 33. CSB Modeling Results of HTHA and the Nelson Curve at the Tesoro Anacortes Refinery. 

CSB modeling estimates suggest that HTHA occurred in the B and E heat exchangers below the carbon 

steel Nelson curve. The CSB recommends that the carbon steel Nelson curve be relocated as shown to 

prevent HTHA in carbon steel. 

 

 

177 API Technical Report 941. The Technical Basis Document for API RP 941. 2008; p 6. 

001222
Tesoro Anacortes Refinery Investigation Report May 2014

    81 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

6.1.6 ANSI Z10, Exemplifies Standards Clarity 

As previously stated, API RP 941 is written permissively with no minimum requirements to prevent 

HTHA failures. In contrast, the American National Standards Institute178 (ANSI) Occupational Health 

and Safety Management Systems standard, ANSI/AIHA Z10-2012 (Z10), provides an improved example 

of how to clearly define obligations in a standard document.179 Z10 makes use of both “should” and 

“shall” language as well as explicit document formatting to differentiate mandatory requirements from 

voluntary recommendations. The following specification addresses the format, which is illustrated in 

Figure 34. 

This [Z10] standard is formatted into two columns to help distinguish 

requirements from recommended practices and explanatory information. 

Requirements are in the left column and are identified by the word 

‘shall.’ An organization that chooses to conform to this standard is 

expected to fulfill these requirements. The text in the right hand column 

uses the word ‘should’ to describe recommended practices, or 

explanatory notes to the requirements on the left. This use of the terms 

‘shall’ and ‘should’ to identify requirements and distinguish them from 

recommendations and explanatory notes is common practice in ANSI 

and international standards.180

 

178 ANSI is a group comprised of government agencies, organizations, companies, academic and international 

bodies, and individuals that oversees the development and use of industry guidelines and standards. For more 

information see http://www.ansi.org/about_ansi/overview/overview.aspx?menuid=1 (accessed January 27, 

2014). 

179 Z10 was developed by over 50 organizations and included representation workers (USW), regulators (OSHA), 

and industry (API). Section 5.1.2 requires the use of the hierarchy of controls to achieve risk reduction for 

identified hazards. ANSI/AIHA Z10-2012. Occupational Health and Safety Management Systems. 2012; p x, xi, 

15. 180 ANSI/AIHA Z10-2012. American National Standard - Occupational Health and Safety Management Systems. 

June 27, 2012; p.ix. 

001223
Tesoro Anacortes Refinery Investigation Report May 2014

    82 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Source: ANSI/AIHA Z10-2012, p.17 

Figure 34. Example of ANSI Z10 Obligations Formatting 

6.2 API RP 580 Risk Based Inspection / 

API 581 Risk Based Inspection Technology 

API intends for risk-based inspection (RBI) to be a process that enables optimization of inspection efforts 

by balancing the time between inspections against the risks of equipment failure caused by the known 

damage mechanisms.181 

API RP 581, Risk-Based Inspection Technology is used in conjunction with API RP 580, Risk-Based 

Inspection. API RP 580 is the API standard for developing an RBI program. API RP 581 is the API 

standard for implementing an RBI program. 

Unlike API RP 941, API RP 581 predicts the susceptibility of HTHA risk versus equipment service time. 

This time-based increase in risk is based on a mathematical model, associating risk with the type of steel. 

The API RP 581 model represents an early attempt to address the shortcomings of the empirical Nelson 

curves. However, API RP 581 lacks specific direction to ensure that users employ appropriate actual 

operating conditions. As a result, the CSB found that using the Tesoro design operating conditions and 

38 years of operation yields a result that the B and E heat exchangers have a “Low Susceptibility” to 

HTHA.182 

 

181 Risk Based Inspection (RBI) Best Practice: The Technical Specification for Ensuring Successful Implementation. 

by Ron Selva B.Sc., C.Eng., F. I. Mech. E; 13th International Conference on Pressure Vessel & Piping 

Technology, 20-23 May 2012, London, Keynote Paper – Technical Session: Managing Risk. 182 API 581 defines three levels of HTHA susceptibility; Low, Medium, and High. Using the E exchanger design 

operating conditions of a hydrogen partial pressure of 291 psi and a temperature of 504 oF along with 38 years of 

continuous service (333,108 hours) into equation 2.51 from API RP 581 results in a HTHA susceptibility 

parameter of 4.53. The minimum value for “Low” HTHA susceptibility is greater than or equal to 4.53. 

001224
Tesoro Anacortes Refinery Investigation Report May 2014

    83 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Like API RP 941, API RP 581 is written permissively, so there are no minimum requirements to prevent 

HTHA failures. There are 19 uses of “shall” in RP 581, but none are substantive—nearly all the uses of 

“shall” appear in formulas or requirements for damage factor or in inspection effectiveness calculations 

that are themselves non-mandatory. There are three uses of “shall” in the HTHA section, but again these 

are employed for calculations that are permissive—such as “the following procedure may be used” or if 

HTHA is detected, “fitness for service should be performed.” An instructive example of the 

permissiveness of API RP 581 is that the document provides important guidance for conditions that 

would make equipment susceptible to HTHA damage. However, if the equipment is identified as meeting 

the criteria that would indicate HTHA is a credible damage mechanism, the guidance provided by API RP 

581 is that the equipment “should” be evaluated for HTHA susceptibility. 

 

001225
Tesoro Anacortes Refinery Investigation Report May 2014

    84 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.0 Regulatory Oversight of Petroleum Refineries in Washington 

As addressed in the recently released CSB draft Chevron Regulatory Report, many regions around the 

world such as the United Kingdom (UK) and Australia have implemented regulatory systems for high 

hazards consisting of both prescriptive183 and goal-setting elements184 that place the duty on the owner or 

operator of the facility, known as the duty holder,185 to demonstrate to the regulator that they have 

reduced risks to as low as reasonably practicable, or ALARP. The CSB determined that there are key 

features of an effective major accident prevention regulatory: 

 Duty Holder Safety Responsibility, including a process safety report 

 Continuous Risk Reduction to ALARP 

 Adaptability and Continuous Improvement 

 Active Workforce Participation 

 Process Safety Indicators that Drive Performance 

 Regulatory Assessment, Verification, and Intervention; and 

 Independent, Competent, Well-Funded Regulator. 

The findings, analysis, and conclusions of the Chevron Interim Report and the draft CSB Chevron 

Regulatory Report are applicable to the CSB Tesoro investigation and are incorporated into this report by 

reference. The Chevron Interim Report and the draft Chevron Regulatory Report can be accessed in 

Appendix F. 

The United States has persisted in the use of a more activity-based186 regulatory approach that does not 

adequately engage companies and their employees in continuous improvement and risk reduction. The 

CSB has found that the existing regulatory approach for onshore petroleum refineries in Washington: 

 relies on a framework that is primarily activity-based without a risk reduction target; 

 does not effectively involve the workforce in hazard analysis and prevention of major accidents; 

and 

 does not employ a sufficient number of staff members with the technical expertise needed to 

provide sufficient oversight of petroleum refineries. 

 

183 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard 

abatement and compliance. 184 Performance or goal-based regulations state the objective to be obtained (such as risk reduction or hazard 

abatement) without describing the specific means of obtaining that objective. 185 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a 

particular activity. Those who create the risks at the workplace are responsible for controlling them.” UK 

Health and Safety Executive, Planning to do business in the UK offshore oil and gas industry? What you should 

know about health and safety; October 2011; p 2. http://www.hse.gov.uk/offshore/guidance/entrants.pdf

(accessed June 5, 2013). 186 Activity-based standards and regulations require the mere completion of an activity and do not focus on the 

effectiveness of major accident prevention or risk reduction. 

001226
Tesoro Anacortes Refinery Investigation Report May 2014

    85 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.1 Background 

The occurrence of a number of large accidents, 

including a massive explosion and fire at the Phillips 

66 Company’s Houston Chemical Complex in 

Pasadena, Texas, resulting in 23 fatalities, and the 

1984 toxic release in Bhopal, India, which caused 

several thousand known fatalities, resulted not only in 

the creation of the CSB but also in the first federal 

regulations specifically designed to prevent major 

chemical accidents that threaten workers, the public, 

and the environment. One of these regulations is the 

OSHA PSM standard, which was adopted in 1992. 

This standard applies to a process187 involving a 

chemical at or above the listed threshold quantity (also 

known as a highly hazardous chemical), or flammables 

in a quantity of 10,000 pounds or more.188 It contains 

broad requirements to implement management 

systems, identify and control hazards, and prevent 

“catastrophic releases of highly hazardous 

chemicals.”189 Many processes in a petroleum refinery 

are subject to the PSM standard. 

As discussed in the draft Chevron Regulatory Report, the CSB has concluded that the frequent occurrence 

of refinery accidents demonstrates the pressing need to examine the current regulatory structure in place 

in the US. Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small 

fraction of the thousands of industrial and chemical facilities in the US, the CSB has noted a considerable 

number of significant and deadly incidents at refineries over the last decade. In 2012 alone, the CSB 

tracked 125 significant incidents at US petroleum refineries.190 Three of these incidents took place in the 

state of Washington. 

 

187 The PSM standard defines “process” as “any activity involving a highly hazardous chemical including any use, 

storage, manufacturing, handling, or the on-site movement of such chemicals, or combination of these activities.” 

29 CFR §1910.119(b) (1992). 188 29 CFR §1910.119(a)(1) (1992). This standard also applies to the manufacture of explosives and pyrotechnics in 

any quantity [29 CFR §1910.109(k)(2) & (3)]. 

189 Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. 

Section 1 – I. Background (March 4, 1992). See 

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1039 (accessed May 

10, 2013). 

190 These incidents were reported to the Department of Energy and/or the National Response Center and examined 

by the CSB’s Incident Screening Department. 

001227
Tesoro Anacortes Refinery Investigation Report May 2014

    86 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.2 L&I Division of Occupational Safety and Health (DOSH) 

Section 18 of the Occupational Safety and Health Act of 1970 (OSHAct) encourages states to develop and 

operate their own job safety and health programs, referred to informally as an OSHA State Plan. OSHA 

approves and monitors State Plans and provides as much as 50 percent of an approved plan's operating 

costs. These programs must be “at least as effective in providing safety and healthful employment” as the 

federal PSM standard.191 DOSH administers an approved state occupational Safety and Health Plan in 

accordance with the OSHAct and enforces Washington’s PSM standard under the Washington 

Administrative Code (WAC).192 Although most State Plan states are funded through a state general fund, 

DOSH is funded mostly by an insurance group and by federal OSHA. Unlike the California Division of 

Occupational Safety and Health (Cal/OSHA), DOSH does not have a dedicated PSM unit; rather, it 

currently employs four PSM specialists, including one chemical engineer, to regulate nearly 270 PSMcovered facilities in the state, including five petroleum refineries. One of those specialists has previous 

refinery experience; the other three have experience with ammonia facilities and chemical manufacturing. 

7.2.1 Causal Findings Analysis 

The findings in this report identify a number of weaknesses with Tesoro process safety performance. In 

many of these causal issues, the existing Washington PSM regulations did not require Tesoro to perform 

at a more effective level to control hazards and prevent incidents. In Figure 35 below, the CSB identifies 

the causal issues which highlight the gaps within the Washington and federal PSM regulations, and how 

each issue is more effectively managed in a more robust goal-setting approach. In this section of the 

report, some of these examples will be examined in relation to key features of a more effective regulatory 

approach. 

 

 

191 29 U.S.C. §667(c)(2) (1970). 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=2743&p_table=OSHACT (accessed 

September 24, 2013). 

192 The Washington PSM standard is established under Title 296, Section 67 of the Washington Administrative Code 

(WAC). 

001228
Tesoro Anacortes Refinery Investigation Report May 2014

    87 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Process Safety 

Concept Causal Finding Washington and Federal PSM 

Regulation and Enforcement 

Goal-Setting 

Regulatory Approach 

MOC 

Tesoro added steam 

stations in the 

vicinity of the heat 

exchanger structure. 

This equipment 

enhanced the ability 

of the field 

operator(s) to 

confront hazardous 

leaks and extinguish 

fires in the area of 

the NHT heat 

exchangers, and the 

safety implications 

of these activities 

were not considered. 

The MOC developed 

by Tesoro did not 

evaluate or control 

hazards associated 

with the heat 

exchanger leaks, 

emergency egress, or 

with how the steam 

equipment would be 

used. Although 

affected, heat 

exchanger startup 

procedures were not 

reviewed or modified 

to account for the 

change. 

The MOC element requires 

implementation of written 

procedures to manage changes 

that shall address the impact of 

the change on health and safety; 

however the element is activity 

based rather than performance 

based and there is no 

requirement to control hazards. 

There is no WAC PSM 

requirement to actually control 

hazards through the MOC 

process. Current regulations 

allowed Tesoro’s narrow focus 

in looking at the change as a 

minor modification to a utility 

system rather than taking a 

broader view of how the change 

could impact the overall process.

The duty holder is 

required to drive risk to 

ALARP. 

Demonstration of 

MOC effectiveness in 

managing major 

accident hazard risk is 

a key requirement of a 

robust goal-setting 

regulatory system. The 

mere existence of 

MOC written 

procedures is 

insufficient under the 

more robust goalsetting regulatory 

approach. 

001229
Tesoro Anacortes Refinery Investigation Report May 2014

    88 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Process Safety 

Concept Causal Finding Washington and Federal PSM 

Regulation and Enforcement 

Goal-Setting 

Regulatory Approach 

PHA 

PHAs in 1996, 2001, 

and 2006 cited 

ineffective, nonspecific, judgmentbased, qualitative 

safeguards to prevent 

equipment failure 

from HTHA. 

However, the 

effectiveness of these 

safeguards was 

neither evaluated nor 

documented; instead 

the PHA merely 

listed them. 

Although the PHA element 

requires addressing the control 

of hazards, it does not require 

addressing the effectiveness of 

the controls or using the 

hierarchy of controls. For 

example, the standard would not 

require the use of improved 

materials of construction or 

inherently safer design to 

mitigate corrosion hazards. 

The goal-setting 

regulatory approach 

requires use of the 

most effective practical 

safeguards to achieve 

ALARP. The goalsetting approach 

requires the use of 

inherently safer design 

and the hierarchy of 

controls.193

PHA 

The 2010 Tesoro 

NHT unit PHA 

failed to identify 

HTHA as a hazard 

for the shell of the B 

and E heat 

exchangers. 

DMHRs are not required by the 

PSM regulation. The PHA 

element does not require 

consideration of RAGAGEPs 

such as API RP 571, Damage 

Mechanisms Affecting Fixed 

Equipment in the Refining 

Industry. Washington L&I did 

not cite Tesoro for this issue. 

In the UK, the Health 

and Safety Executive 

(HSE) has worked with 

industry to develop 

guidance on DMHRs in 

the UK offshore 

petrochemical industry. 

The implementation of 

best practice standards 

referenced by a duty 

holder’s process safety 

report may be 

enforced by the 

regulator to achieve 

ALARP. 

 

193 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to 

ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, 

Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE 

also notes that the guidance to Control of Major Accidents Hazards (COMAH) Regulation 4 (General Duty) 

“describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a 

hierarchical approach (inherent safety, prevention, control, mitigation).” Ibid at 8. 

001230
Tesoro Anacortes Refinery Investigation Report May 2014

    89 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Process Safety 

Concept Causal Finding Washington and Federal PSM 

Regulation and Enforcement 

Goal-Setting 

Regulatory Approach 

PHA 

PHAs identified 

HTHA as a hazard 

for the B and E heat 

exchangers, but 

ineffective 

safeguards failed to 

control the hazard. 

L&I did not 

effectively review 

the PHAs before the 

incident. 

WAC does not require 

submission of the PHA to L&I 

to be reviewed for sufficiency 

and acceptance. L&I does not 

have a sufficient number of 

technically qualified PSM 

personnel to perform effective 

reviews of PHAs. 

Under the more robust 

goal-setting regulatory 

approach, the PHA is 

part of the report 

submitted to the 

regulator for 

acceptance. The duty 

holder is required to 

drive risk to ALARP. 

Effective goal-setting 

regulatory systems 

employ sufficient 

numbers of technically 

competent personnel to 

assess, verify, and 

intervene as necessary. 

PHA 

In the 2006 NHT 

unit PHA, Tesoro 

discontinued a 

review of their 

corrosion control and 

mechanical integrity 

programs in part 

because they were 

“not a legal 

requirement.” 

Tesoro conducted the 

optional review 

ineffectively and 

then ended it when 

they determined it 

was not strictly 

required. 

There is no requirement in the 

PSM regulation for a 

performance based DMHR. 

By shifting the 

responsibility for risk 

management to the 

duty holder, the goalsetting approach would 

require continual risk 

reduction and 

performance of an 

effective DMHR. This 

review is not just an 

activity but must meet 

the goal of preventing 

equipment failures. 

001231
Tesoro Anacortes Refinery Investigation Report May 2014

    90 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Process Safety 

Concept Causal Finding Washington and Federal PSM 

Regulation and Enforcement 

Goal-Setting 

Regulatory Approach 

Incident 

Investigation 

There was a history 

of leaks and fires on 

the NHT heat 

exchangers during 

startup, as identified 

in a Tesoro 

investigation report. 

Tesoro attempted to 

address the 

problems, but the 

hazard was never 

controlled. 

Washington PSM regulations 

require incident investigation 

and preparation of a report, but 

do not require recommendations 

or control of hazards identified 

in the investigation. Although 

the regulations do not require 

recommendations to be 

developed, if recommendations 

are made the regulation requires 

them to be resolved. 

Investigation of 

incidents is required to 

demonstrate legal 

compliance with 

framework legislation. 

The ALARP 

requirement would 

require remedial action 

including crosscompany learning from 

incident investigations. 

The HSE can require 

duty holder compliance 

with investigation 

report 

recommendations. 

Nonroutine 

Work 

Tesoro failed to 

perform an 

evaluation of the 

higher hazards of the 

nonroutine work of 

starting up a bank of 

heat exchangers. 

Tesoro also did not 

define or control the 

number of workers 

required to perform 

the startup. 

Although the WAC PSM 

regulation contains guidance on 

ways to control hazards when 

performing nonroutine work, 

compliance is not mandatory. 

The WAC regulations do not 

require either a hazard 

evaluation of nonroutine work 

or limitations on essential 

personnel during higher-hazard 

activities. 

The goal-setting 

regulatory approach 

would require 

incorporation of goodpractice guidance to 

achieve ALARP, such 

as the CCPS Risk 

Based Process Safety

guidelines that address 

nonroutine work. 

001232
Tesoro Anacortes Refinery Investigation Report May 2014

    91 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Process Safety 

Concept Causal Finding Washington and Federal PSM 

Regulation and Enforcement 

Goal-Setting 

Regulatory Approach 

Mechanical 

Integrity 

API RP 941 has no 

minimum 

requirements to 

control, identify, or 

prevent the 

occurrence of HTHA 

in process 

equipment. 

The mechanical integrity 

element of PSM requires that 

employers follow RAGAGEPs 

for inspection and testing 

procedures. However, API RP 

941 has no minimum 

requirements. Post-incident, 

L&I cited Tesoro for insufficient 

testing and inspection 

procedures for the heat 

exchangers but did not 

specifically reference API RP 

941 or HTHA. 

In a goal-setting 

regulatory system, the 

regulator can reject the 

use of weak and 

inadequate standards 

referenced in a process 

safety report (by 

rejecting the report) 

and can require more 

rigorous performance 

to achieve ALARP. 

Inherently 

Safer Design 

The B and E heat 

exchangers were 

constructed of 

carbon steel – the 

most HTHAsusceptible material 

of construction used 

by industry. API RP 

571 identifies 

materials that are not 

susceptible to 

HTHA. 

Neither Washington nor federal 

OSHA requires the use or 

implementation of inherently 

safer design. 

The goal-setting 

regulatory approach 

requires the 

implementation of 

inherently safer 

systems analysis.194

 

194 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to 

ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, 

Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE 

also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures 

necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, 

prevention, control, mitigation).” Ibid at 8. 

001233
Tesoro Anacortes Refinery Investigation Report May 2014

    92 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Process Safety 

Concept Causal Finding Washington and Federal PSM 

Regulation and Enforcement 

Goal-Setting 

Regulatory Approach 

Process Safety 

Indicators 

For more than a 

decade during startup 

following cleaning, 

the NHT heat 

exchangers would 

frequently leak from 

flanges, occasionally 

resulting in fires that 

created hazardous 

conditions for 

workers. 

Federally and in the state of 

Washington, neither the PSM 

nor RMP regulations require 

companies to utilize or report 

process safety indicators. 

Process safety 

indicators that drive 

performance are a key 

feature of a goal-setting 

regulatory approach. 

Publicly reported 

indicators can reveal 

critical safety areas that 

must be targeted for 

improvement to 

prevent accidents. 

Figure 35. Gaps Within the Washington and Federal PSM Regulations. Causal findings highlight the 

gaps within the Washington and federal PSM regulations and how the process safety concept relating 

to each finding is more effectively managed in a more robust goal-setting regulatory approach. 

7.3 OSHA National Emphasis Program 

7.3.1 Federal National Emphasis Program 

In a 1992 compliance directive,195 OSHA stated that the primary enforcement model for the PSM 

standard would be planned, comprehensive, and resource-intensive Program Quality Verification (PQV) 

inspections.196 These inspections consisted of the following three parts: 

1. determining whether the elements of a PSM program are in place 

2. evaluating whether the programs comply with the requirements of the standard, and 

3. verifying compliance with the standard through interviews, data sampling, and field observations. 

The CSB noted in its BP Texas City Final Investigation Report that for the 10-year period before the 

Texas City incident, federal OSHA conducted no planned PQV inspections in petroleum refineries. As a 

result, the CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA 

PSM standard by developing more highly trained and experienced inspectors to conduct more 

comprehensive inspections similar to those under the OSHA PQV program, at facilities posing the 

greatest risk of a catastrophic accident. 

 

195 Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and 

compliance expectations to their Compliance Safety and Health Officers (CSHOs) for enforcing a new 

regulation. 

196 OSHA Instruction CPL 02-02-045 (1994). 

001234
Tesoro Anacortes Refinery Investigation Report May 2014

    93 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Spurred in part by recommendations in the CSB BP Texas City Final Investigation Report, OSHA 

adopted the Petroleum Refinery Process Safety Management NEP on June 7, 2007.197 The NEP was a 

federal program that established guidelines for inspecting petroleum refineries to ensure compliance with 

the PSM standard. The NEP was designed to address the prevention and minimization of the 

consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals in the refining 

industry.198 In adopting the NEP, OSHA noted that no other industry sector in the country had 

experienced as many fatal or catastrophic incidents related to highly hazardous chemicals.199

Unlike the PQV approach to inspections, which “employs a broad, open-ended inspection strategy and 

uses a more global approach to identify compliance deficiencies...,” the NEP “provide[d] CSHOs 

[Compliance Safety and Health Officers] with a tool to evaluate for compliance with the standard.” 200 

The tool is meant to identify “a particular set of requirements from the PSM standard from which CSHOs 

are to review documents, interview employees, and verify implementation for specific processes, 

equipment, and procedures.”201 According to CPL 03-00-004, the NEP inspections were required to be 

conducted by a team consisting of at least one Team Leader and one Level 1 Team Member.202,203 

Although the CSB called for an ongoing comprehensive inspection program, inspections being conducted 

pursuant to the NEP ended in 2011 in part because these inspections were very time consuming and 

resource intensive. OSHA has publicly stated204 that NEP inspection hours were roughly 40 times greater 

than average OSHA inspection hours. 

7.3.2 Washington State National Emphasis Program 

OSHA State Plan states such as Washington were strongly encouraged but not required to adopt the NEP. 

However, on February 8, 2008, DOSH formally adopted the NEP through DOSH Directive 2.64205 for the 

 

197 Originally Directive Number CPL 03-00-004, Petroleum Refinery Process Safety Management National 

Emphasis Program. Extended August 18, 2099 as Directive Number CPL 03-00-010 to allow more time to 

complete NEP inspections under the original CPL 03-00-004. 

198 https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES, Accessed 

October 30, 2013. 

199 OSHA Directive number CPL 03-00-004, Section VIII, Background 

200 CPL 03-00-004, Section X(D)(1). 2007. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed 

September 24, 2013). 201 Ibid 202 CPL 03-00-004, Section X(C)(1). 2007. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed 

September 24, 2013). 203 A Level 1 Team Member is considered to be Trained OSHA personnel with experience in the chemical 

processing or refining industries. CPL 03-00-004, Section X(C)(2). 204 See Barab, Jordan. OSHA’s Refinery & Chemical National Emphasis Programs. Power Point presentation made 

at CSB Public Hearing on Process Safety Indicators; July 20, 2012. 

http://www.csb.gov/UserFiles/file/Barab%20%28OSHA%29%20PowerPoint.pdf (accessed August 14, 2013). 

Also see Transcript of CSB Public Hearing on Safety Performance Indicators; p 52. 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed August 14, 2013). 

205 DOSH Directive 2.64. Petroleum Refinery Process Safety Management. February 8, 2008. 

http://www.lni.wa.gov/Safety/Rules/Policies/PDFs/WRD264.pdf (accessed September 24, 2013). 

001235
Tesoro Anacortes Refinery Investigation Report May 2014

    94 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

five refineries206 in the state of Washington. The stated purpose of DOSH Directive 2.64 was to “reduce 

or eliminate the workplace hazards associated with the catastrophic release of highly hazardous chemicals 

at petroleum refineries.”207 The directive required the DOSH staff to follow the compliance directions in 

OSHA Instruction CPL 03-00-004 when conducting NEP inspections. When CPL03-00-004 referenced 

another CPL, DOSH instead followed any existing equivalent DOSH policy and directives. DOSH also 

used WAC equivalents in place of the OSHA 1910.119 PSM standard. For example, when auditing PSM 

section 1910.119(j) “Mechanical Integrity,” DOSH instead used WAC 296-67-037. 

CPL 03-00-004 provides for a two-step NEP inspection process. The first step is a PSM compliance 

review based on a “static” list of inspection priority items. The second is a PSM compliance review 

based on a “dynamic” list of priority inspection items.208

The DOSH NEP team consisted of six people, including a team lead who had been with L&I since the 

early 1990s. The team lead had more process safety and refinery experience than the other team 

members. None of the team members had an engineering or metallurgy background, and the team as a 

whole had limited experience with PSM and with refinery operations. 

 

 

206 The five petroleum refineries in Washington are BP Cherry Point Refinery; Conoco Phillips Ferndale Refinery; 

Tesoro Anacortes Refinery; Shell Oil Products Refinery; and US Oil and Refining Refinery. 207 DOSH Directive 2.64. Petroleum Refinery Process Safety Management. February 8, 2008; p 1. 

http://www.lni.wa.gov/Safety/Rules/Policies/PDFs/WRD264.pdf (accessed September 24, 2013). 208 Static questions within the NEP are publicly available. The company can prepare for them. Dynamic questions 

are not available to the company prior to the audit. Reference: OSHA CPL 03-00-004 Section X (D)(3). (June 

7, 2007). See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES

(accessed September 24, 2013). 

001236
Tesoro Anacortes Refinery Investigation Report May 2014

    95 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.3.3 Tesoro National Emphasis Program Audit 

Following Washington’s adoption of the federal NEP, the DOSH NEP team lead developed a proposed 

refinery inspection plan. To determine the focus for the NEP audit at each facility, the DOSH NEP team 

examined the age of each process in the refinery, hazards surrounding different process units, and past 

events, including near misses. 

On October 7, 2008, the DOSH NEP team initiated a formal NEP audit of the Tesoro CR and NHT units. 

The selection of these units was based primarily on the fact that the NHT unit stood out to the team as 

problematic in terms of previous incidents and near misses. The Tesoro NEP Audit Report noted the 

following: 

Elsewhere, refinery records indicate a relatively higher incidence of 

process safety related events occurring in the Catalytic Reformer and 

Naphtha Hydrotreater (CR/NHT) process areas when compared to other 

units, with the possible exception of the Catalytic Cracking unit 

equipment when viewed in its entirety. 

From 2002 to 2007, the CR/NHT experienced a total of 117 records 

related to process safety. Of those, 36% were attributed to equipment 

failures, 33% human error, and the remaining 31% were attributed to 

failure of a process control or safeguard. 

Previous inspection activities at the refinery have included at least five 

safety and health compliance inspections since 2003. These have 

included scheduled inspections, complaints, and accident and near miss 

investigations. 

The NEP team spent several weeks at the Tesoro refinery during the NEP audit. The refinery NEP 

inspection process was a two-step process. The first step consisted of a compliance review based on a 

static list of inspection priority items. The CSHO was required to follow the list verbatim. The list of 

questions related to various aspects of process safety, such as equipment, engineering and administrative 

controls, and safe work practices. The answers to these questions were the basis for determining 

compliance with various PSM requirements. The second step focused on a dynamic list of inspection 

priority items that were directed towards the specific selected process unit.209

7.3.3.1 Tesoro NEP Results Associated with the E Heat Exchanger 

The Tesoro Anacortes NEP audit is noteworthy, as it was the only audit conducted under the federal 

OSHA NEP program that focused on a unit that subsequently experienced a catastrophic accident that the 

CSB investigated. The heat exchanger that failed, the E heat exchanger, was a fundamental component of 

the Tesoro NEP audit. Within the scope of the NEP nine pressure vessels were selected at random; the E 

 

209 OSHA Directive CPL 03-00-004, Section X, (D) (3). 

001237
Tesoro Anacortes Refinery Investigation Report May 2014

    96 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

heat exchanger was one of the vessels reviewed. The NEP states, “Inspection records for all nine vessels 

were examined and found to be in order. No citable deficiencies found.” 

Like the CSB, the DOSH NEP identified the issue of PHA assumptions for the PHA. Reflecting the 

weakness in the current PSM requirements for PHAs, DOSH mentioned the problematic nature of using 

the assumptions but did not cite Tesoro in this area. The NEP states the following: 

Problems were identified in the area of procedures, inspection, and 

testing of devices that indicate assumptions made by PHA teams inhibits 

identification of problematic areas. 

Given the methodology used and expertise available, the mechanical integrity issues related to the failure 

of the E heat exchanger were not detected during the NEP audit. To prevent the April 2010 incident, the 

NEP audit needed to identify the susceptibility of the E heat exchanger to HTHA and to recognize that 

Tesoro had incorrectly concluded that it was not susceptible. The topics investigated during the NEP 

audit were contained in prescriptive questions for the individual unit, which resulted in a shallow 

technical review. For example, significant emphasis was placed on verifying the existence of basic 

protocols for conducting thickness monitoring. On the basis of the CSB review of the question sets 

applied for the Tesoro refinery, there was no mention of HTHA, corrosion studies, or failure mechanisms 

and no references to the API RP 571 damage mechanisms. The NEP team lead confirmed that little 

emphasis was placed on possible damage mechanisms that could be present, including HTHA. The NEP 

found the following: 

In general, the refinery maintains corrosion control documentation that 

attempts to identify corrosivity data and potential failure mechanisms. 

The inspection procedure I-08.01 addresses metallurgy and corrosion in 

the refinery. 

The refinery has a procedure for conducting corrosion awareness training 

of staff and managing corrosion control procedures. 

Unless a member of the NEP audit team had a personal interest in metallurgical damage mechanisms, or 

had experience to prompt investigation into the area of metallurgy, reliance on these static and dynamic 

lists would not lead to the conclusion that the B and E heat exchangers were susceptible to HTHA. 

The NEP inspection was formally closed on March 12, 2009; at that time, a summary of the audit findings 

was presented to Tesoro. The NEP inspection team identified 17 process safety code violations under 

Chapter 296-67 of the WAC,210 but only two of these addressed mechanical integrity,211 and neither 

related to the NHT heat exchangers or to identification or control of HTHA. 

 

210 See http://apps.leg.wa.gov/wac/default.aspx?cite=296-67 (accessed September 25, 2013). 

211 Mechanical integrity violations of WAC 296-67-037 were issued for the following: 

a. No written procedures for controls and emergency shutdowns; 13 instances were documented in which the 

employer did not have written procedures for the inspection and testing of emergency equipment; and 

001238
Tesoro Anacortes Refinery Investigation Report May 2014

    97 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

On October 23, 2009, six months before the incident, a settlement agreement was reached between L&I 

and Tesoro whereby Tesoro agreed to perform a PSM compliance audit with an industry recognized PSM 

consultant within 60 days of the agreement date and to commit to a completed compliance audit within 

six months of the consultant’s contract initiation date. In exchange for the audit, L&I agreed to reduce the 

citations from seventeen (17) to three (3) citations. Subsequently, the total penalty was reduced from 

$85,700 to $15,450.212 The same consulting firm that Tesoro hired for its most recent OSHA-mandated 

compliance audit also conducted the audit under the settlement agreement. However, the compliance 

audit conducted by the consulting firm was not a comprehensive audit of the entire refinery PSM 

program. It was limited only to those areas covered by the fourteen eliminated citations from settlement 

agreement between L&I and Tesoro. 

7.4 Risk Reduction and Continuous Improvement 

The CSB Chevron Regulatory Report provides a detailed discussion of the advantages of adding robust 

goal-setting regulatory attributes to make the PSM standard more effective in preventing major accidents. 

Many countries throughout the world implement a goal-setting regulatory approach, which provides the 

regulator with the tools needed to drive continuous improvement among facilities and to ensure that duty 

holders are identifying and controlling hazards and reducing risks to ALARP. The existing federal and 

state of Washington PSM standards, on the other hand, are more reactive in nature and contain activitybased requirements that do not focus on specific risk reduction; rather, the mere completion of the 

activities satisfies the requirements. 

Highlighting the reactive nature of the Washington PSM standard, following the Tesoro incident, DOSH 

initially cited Tesoro for 39 willful violations and five serious violations related to the incident, with a 

total proposed fine of $2.39 million.213 Four of the citations were issued to Tesoro for failing to follow 

recognized and generally accepted good engineering practice (RAGAGEP) for mechanical integrity under 

WAC 296-67-(4)(b) “such as those published by the American Petroleum Institute.”214 No RAGAGEPs 

were specified in the citations. RAGAGEPs are technologically focused, with no emphasis on 

organizational issues, human factors, or culture-based measures. OSHA developed the mechanical 

integrity RAGAGEP requirement to “make sure that process equipment is inspected and tested properly, 

and that the inspections and tests are performed in accordance with appropriate codes and standards.”215

However, as in this case, OSHA mainly enforces RAGAGEP reactively. Here, DOSH used unspecified 

 

b. Documenting inspections and tests – 24 instances identified in which the employer did not document testing of 

emergency field devices or where the record did not identify what testing procedure was used. 212 See http://www.osha.gov/pls/imis/establishment.inspection_detail?id=312459290; (accessed on June 19, 2013). 

213 Tesoro has appealed these citations. 

214 State of Washington Department of Labor and Industries, Division of Occupational Safety and Health. Tesoro 

Citation – Notice Inspection. October 1, 2010; p 9. http://www.lni.wa.gov/Main/Docs/TesoroCitationNoticeInspectionNo314251315.pdf (accessed September 25, 2013). 215 OSHA. Preamble to 29 CFR Part 1910, Process Safety Management of Highly Hazardous Chemicals, Section 3, 

Title III. Summary and Explanation of the Final Rule, 1992. Available at 

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed June 

6, 2013). 

001239
Tesoro Anacortes Refinery Investigation Report May 2014

    98 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

RAGAGEPs to issue a citation to Tesoro post-incident, rather than working to drive continuous 

improvement and risk reduction through preventative NEP inspections. Although many OSHA inspectors 

have cited to RAGAGEPs following NEP refinery audits, DOSH did not cite any RAGAGEPs for 

mechanical integrity following its NEP audit of the Tesoro refinery in 2008. 

Similar to OSHAct Section 5(a)(1), also known as the General Duty Clause, the WAC requires employers 

to provide employees a workplace “free from recognized hazards216 that are causing, or are likely to 

cause, serious injury or death.”217 Similar to federal OSHA, DOSH may use this provision following an 

incident to cite a company for hazards not addressed by the regulations, but these citations are often 

difficult to prove especially if the regulator lacks industry-specific expertise, and are resource intensive to 

sustain. DOSH did not cite Tesoro for General Duty Clause violations following the April 2010 incident. 

Washington’s Safety Standards for Process Safety Management of Highly Hazardous Chemicals were 

established to “prevent[] or minimiz[e][] the consequences of catastrophic releases of toxic, reactive, 

flammable, or explosive chemicals.”218 Washington’s PSM standard contains many activity-based 

elements that are almost identical to those in the federal PSM standard. For example, an employer must 

perform a PHA “appropriate to the complexity of the process and shall identify, evaluate, and control the 

hazards involved in the process.”219 This language does not support the principle of ALARP and makes 

no mention of reduction of risk or continuous improvement. As a result, PHAs may satisfy Washington’s 

PSM requirement by merely listing safeguards, and there is no requirement to evaluate or document the 

effectiveness of those safeguards, or to show that the safeguards reduce risks. 

Following the April 2010 incident DOSH issued two citations to Tesoro for its 2006 PHA revalidation.220

One of these citations was dismissed and the second citation addressed Tesoro’s failure to establish and 

implement written procedures to manage the change made by discontinuing the PHA revalidation system 

that included mechanical integrity and corrosion control review in 2006. 221 However, as discussed in 

Section 5.3, PHAs conducted on the NHT unit cited non-specific, judgment-based qualitative safeguards 

that in light of the April 2010 incident were not effective. If the Washington PSM standard had required 

an evaluation and documentation of safeguard effectiveness, Shell Oil and Tesoro would have been 

obligated to conduct this analysis, and DOSH inspectors could have relied on the regulation for support 

during inspections. 

 

216 According to L&I, “A hazard is recognized if it is commonly known in the employer’s industry, or if there is 

evidence that the employer knew or should have known of the existence of the hazard, or if it can be established 

that any reasonable person would have recognized the hazard.” 296 WAC 800-11005 (2012). 217 296 WAC 800-11005 (2012). http://www.lni.wa.gov/wisha/rules/corerules/PDFs/296-800-110.pdf (accessed 

September 26, 2013). 218 26 WAC 67-001(1) (1992). 

219 26 WAC 67-017(1) (1992). 

220 Under appeal, citation item 1-37 was dismissed. 

221 In the 2001 PHA, Tesoro included a review of the corrosion control program and a specific mechanical integrity 

checklist associated with the corrosion program. In 2006, Tesoro excluded these items because they were being 

used in the DMHR and it was “not a legal requirement” for PHAs. 

001240
Tesoro Anacortes Refinery Investigation Report May 2014

    99 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Tesoro conducted a PHA for the NHT unit between February 1, 2010, and May 21, 2010. Despite the 

fact that the PHA was being conducted at the time of the April 2010 incident, the PHA failed to identify 

significant hazards associated with the immediate 

causes of the incident, including damage 

mechanisms such as HTHA. The PHA also took 

credit for inspection safeguards that did not exist. 

The PHA failed to address HTHA damage in the B 

or E heat exchangers on the shell-side and the PHA 

used inspection as a safeguard to mitigate HTHA 

consequences on the tube side. As discussed in 

Section 5.3.3, no inspection for HTHA was ever 

conducted on the B or E heat exchangers. No 

evaluation was documented to demonstrate the 

effectiveness of the inspection safeguards claimed 

by the PHA team; that is a manual activity and 

thus low in the hierarchy of controls. The PHA 

analysis concluded that the worst consequence 

resulting from a loss of primary containment 

(catastrophic failure of the E heat exchanger) was a 

disabling injury and substantially understated the 

actual consequence of seven worker fatalities. The 

combination of understating the consequence and 

overstating the safeguards resulted in 

underestimating the risk of a catastrophic failure of the E heat exchanger, despite the fact that the incident 

took place 50 days before completion of the PHA. 

In a robust goal-setting regulatory approach, a risk assessment such as this would be part of the process 

safety report submitted to the regulator to demonstrate and ensure that the hazards are adequately 

identified and that risks are being reduced to ALARP. If the hazards are not sufficiently identified and 

controlled, the regulator may reject the process safety report and require improvements and further risk 

reduction. In this case, because mere completion of the PHA satisfied the PSM requirements, DOSH did 

not analyze or address Tesoro’s failure to adequately identify and control hazards. In addition, DOSH did 

not issue any post-incident citations to Tesoro regarding its 2010 NHT unit PHA. 

The existing regulatory approaches in the US and Washington, such as the PSM and RMP programs, do 

not require companies to reduce risks to ALARP. While the Clean Air Act (CAA) directed the EPA to 

promulgate the RMP regulations “to provide, to the greatest extent practicable, for the prevention and 

detection of accidental releases of regulated substances,” 222 there is no RMP ALARP requirement. Under 

both the PSM and RMP regulations, an employer must “control” hazards when conducting a PHA of a 

covered process. However, there is no requirement to address the effectiveness of the controls or the 

 

222 42 U.S.C. §7412(r)(7)(B)(i) (1990). 

001241
Tesoro Anacortes Refinery Investigation Report May 2014

    100 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

hierarchy of controls. Thus, a PHA that meets the regulatory requirements might still inadequately 

identify or mitigate major hazard risks. In addition, there is no requirement to submit PHAs to the 

regulator, and the regulator is not responsible for assessing the quality of the PHA or the proposed 

safeguards. 

The Tesoro PHA goals encourage the PHA team to identify high-consequence, low-frequency hazards 

that are possible but might not be realized. The company’s PHA goal supports the principle of ALARP. 

The Tesoro PHA policy states the following: 

In the end, the reduction of RISK is the goal. 

Any improvement in a layer of protection that is permanent and 

inseparable, and not easily weakened or removed from the system, is 

considered to be a process safety improvement in an inherently safer 

direction. 

Can the Likelihood be reduced? 

If the Hazard cannot be removed, and Consequences cannot be reduced, 

then what can be done to reduce the likelihood of the event(s) occurring? 

None of the Tesoro PHA teams ever considered applying the principles of inherently safer design by 

upgrading the heat exchangers before the incident; yet, following the April 2, 2010, incident, more 

HTHA-resistant materials were used for the replacement equipment. In conducting its PHA of the NHT 

unit, which was required under the state of Washington PSM standard,223 Tesoro did not address 

inherently safer design or implement effective safeguards to prevent HTHA. However, there is no 

Washington (or federal) PSM requirement to consider inherently safer design or to evaluate the 

effectiveness of safeguards. Thus, Tesoro was never cited for failure to evaluate or implement inherently 

safer design or for the PHA claim of HTHA inspection as a safeguard despite the company never 

inspecting the E heat exchanger for possible presence of HTHA. 

Under a robust goal-setting regulatory approach, Tesoro would be required to apply the hierarchy of 

controls and inherently safer design to achieve ALARP. As detailed in the CSB Chevron Regulatory 

Report, a company must demonstrate how inherently safer design concepts were applied in the design 

decisions that were taken. This principle applies to all life cycle stages of a facility, and includes 

materials selection and corrosion management in the design. 224

 

223 Under WAC 296-67-001 Process safety management of highly hazardous chemicals. See: 

http://www.lni.wa.gov/wisha/rules/hazardouschemicals/default.htm#WAC296-67-001 (accessed September 28, 

2013). 224 HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006; p 7. 

http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013). 

001242
Tesoro Anacortes Refinery Investigation Report May 2014

    101 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.5 Workforce Participation 

As the CSB noted in its Chevron Interim and draft Chevron Regulatory Reports, workforce participation 

is a key element of process safety and effective major accident prevention. The CCPS lists workforce 

involvement as one of 20 essential management components necessary to reduce process safety risks and 

prevent major chemical accidents.225 In one of its publications, the CCPS states that workforce 

participation leads to worker empowerment, management responsiveness, and process safety performance 

improvement.226 The OSHA PSM standard provides for participation by workers and their 

representatives. It requires employers to consult with employees and their representatives on the 

performance and development of PHAs and on the development of the 13 remaining PSM elements, and 

to develop a written plan of action regarding the implementation of the employee participation required 

under this section.227 However, other regions such as the UK go further to ensure effective worker 

participation by specifying the election of safety representatives by the workers to serve many functions 

related to health and safety, including investigating complaints and accidents and conducting 

inspections.228 UK regulations also require employers to establish a safety committee when one is 

requested by at least two health and safety representatives.229

 Like the federal PSM standard, the WAC provides for workforce participation in a company’s PSM 

program and has implemented language identical to that contained in the federal PSM standard.230 

However, throughout its investigation of the Tesoro incident, the CSB has seen that the Tesoro refinery 

workforce and its representative, the United 

Steelworkers Union (USW), expressed concerns 

regarding the NHT unit that were not adequately 

addressed by Tesoro managers in the lead-up to the 

incident. During a 2006 PHA revalidation on the NHT 

unit at the Tesoro Anacortes Refinery, workers noted 31 

near misses in the NHT unit in the last 5 years because 

of many possible factors, including too many outside 

tasks and continual rotation of the field and control 

room operators. The PHA team requested a review of 

experience and training for NHT operators to address 

these workload concerns. A manager at the refinery 

closed the action item with one simple statement: “Experience levels of teams, where and when 

individuals are trained on the NHT are managed by team supervisor.” The action item was closed without 

resolution of the concerns expressed by the Tesoro workers on the PHA team. 

 

225 CCPS. Guidelines for Risk Based Process Safety; March 2007; p liv. 226 Ibid at 125. 227 29 CFR §1910.119(c) (2012). 228 See: the Safety Representatives and Safety Committees Regulations, 1977, and the Health and Safety 

(Consultation with Employees) Regulations 1996. 

229 Ibid. 

230 See: WAC §296-67-009 (1992). http://apps.leg.wa.gov/wac/default.aspx?cite=296-67-009 (accessed September 

26, 2013). 

001243
Tesoro Anacortes Refinery Investigation Report May 2014

    102 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.6 Funding and Regulator Competency 

The CSB stated in both its BP Texas City Final Investigation Report (issued in March 2007) and its draft 

Chevron Regulatory Report (Appendix F) the importance of having a well-resourced, competent regulator 

consisting of individuals with the necessary training, education, and experience to conduct comprehensive 

and robust inspections of facilities with the goal of preventing catastrophic accidents. As noted above, 

currently DOSH employs only four Process Safety Specialists to cover approximately 270 PSM facilities 

within the state of Washington, and only one of those has significant refinery experience. None have 

metallurgical experience and only one has an engineering background. Despite the fact that DOSH 

performed a detailed NEP inspection at the Tesoro refinery, the team did not have the technical expertise 

to inspect for and identify possible damage mechanisms present in the NHT unit such as HTHA. 

Individuals within L&I have expressed to the CSB that there is currently no funding in the state of 

Washington to form a multi-disciplinary process safety group to conduct more thorough facility 

inspections. This was also the case in California at the time of the Chevron incident in August 2012. 

Despite the fact that Cal/OSHA had formed a dedicated PSM unit, it did not have the staffing, funding, or 

experience to oversee the state’s 15 petroleum refineries. Following the Chevron incident, the California 

State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department 

of Industrial Relations to charge state petroleum refineries a “fee” by March 31, 2014, to help pay for at 

least 15 new positions in Cal/OSHA’s Process Safety Unit, which enforces the California PSM standard 

throughout the state.231

Adding more robust goal-setting regulatory attributes to the existing PSM regulation will require a full 

commitment and extensive effort by the Washington legislature, regulators, and Washington petroleum 

refineries. The CSB believes that this effort is necessary to ensure that Washington, like other regions 

around the world, is effectively managing process safety and risk, and in the process, preventing major 

accidents such as the April 2, 2010, Tesoro incident. 

7.7 Similar Deficiencies in the Anacortes and Richmond Refinery Incidents 

The CSB identified a number of similar causal findings for both the April 2010 Tesoro Anacortes 

Refinery incident and the August 2012 Chevron Richmond Refinery incident. These findings included 

ineffective PHAs, lack of effective safeguards to prevent damage mechanism hazards, no requirements to 

use the hierarchy of controls or to implement inherently safer design to the greatest extent possible, weak 

and permissive industry standards that lack minimum requirements to control damage mechanism 

hazards, and regulators that lack sufficiently qualified personnel to provide effective oversight. 

 

231 See: http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013). 

001244
Tesoro Anacortes Refinery Investigation Report May 2014

    103 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.7.1 Reliance on Inspection Instead of Inherently Safer Design in Mechanical 

Integrity Programs at Tesoro and Chevron Refineries 

The August 6, 2012, Richmond, California, Chevron refinery incident occurred when a severely thinned, 

low-silicon carbon steel pipe component ruptured, releasing hot hydrocarbons that autoignited and 

endangered the lives of 19 employees.232 Like HTHA, low-silicon areas that result in rapid corrosion are 

very difficult to identify by inspection. Identification of this hazard requires the inspection of every 

single component in a carbon steel piping circuit to identify the quickly corroding pieces. Despite this 

difficulty and despite Chevron’s notable expertise on sulfidation corrosion,233 the refinery still operated 

the high-risk piping circuit with a carbon steel material of construction, the steel that is most susceptible 

to rapid rates of sulfidation corrosion in low-silicon components. The refinery then relied on its 

inspection program to identify any quickly corroding pieces, a very low-ranking method on the hierarchy 

of controls, to prevent process safety incidents. Ultimately, the inspection program failed to detect the 

low-silicon component in the piping circuit. Had Chevron designed the piping circuit by using an 

inherently safer material of construction, such as high-chromium steel, the corrosion rates in the piping 

circuit would have been much slower and much more uniform, and the incident would not have occurred. 

The Anacortes refinery also in effect relied on its mechanical integrity program to identify damage 

mechanisms such as HTHA in its NHT heat exchangers instead of incorporating design elements that 

would eliminate the risk of HTHA. Although Tesoro was not actively looking for HTHA in the B and E 

heat exchangers, this is the only mechanical integrity component that could identify the damage in the 

heat exchangers. As described previously, inspection for HTHA is very difficult and not sufficiently 

reliable. The use of inherently safer materials of construction, such as high-chromium steels, significantly 

lowers the risk of HTHA in this type of service. 

Both Tesoro and Chevron had the expertise and capability needed to design the damage mechanisms out 

of the equipment by incorporating inherently safer design. However, both companies continued to rely on 

mechanical integrity programs, such as inspection, to identify the damage after it had already occurred in 

the system. Although inspection programs are needed they are very low on the hierarchy of controls, and 

in both cases the inspection strategies failed to prevent a major process safety incident. Since the 

incidents, both Chevron and Tesoro redesigned the equipment that failed, incorporating inherently safer 

design practices. Now, sulfidation corrosion in Chevron’s new piping circuit will be significantly reduced 

and without risk of variable corrosion rates. Tesoro installed new NHT heat exchangers, using materials 

of construction that are highly resistant to HTHA. 

 

232 The CSB plans to release three separate reports on the Chevron incident. All draft and final reports can be found 

at http://www.csb.gov/chevron-refinery-fire/ (accessed January 6, 2014). 

233 Chevron employees were leaders in the development of the industry standard on sulfidation corrosion, API RP 

939-C. 

001245
Tesoro Anacortes Refinery Investigation Report May 2014

    104 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.7.2 Ineffective PHAs at Tesoro and Chevron 

PHAs are a crucial opportunity to identify hazards in a refinery process unit. However, neither Tesoro 

nor Chevron PHAs identified the significant hazards that led to the April 2010 and August 2012 incidents, 

respectively. The CSB found similar deficiencies in the PHA of both companies. Instead of performing a 

rigorous analysis of damage mechanisms present in the refinery during the PHA process, both companies 

simply cited non-specific, judgment-based qualitative safeguards to reduce the risk of damage 

mechanisms. The effectiveness of these safeguards was neither evaluated nor documented; instead, the 

PHAs merely listed general safeguards. If the adequacy of these safeguards to control and prevent 

damage mechanisms had been verified, recommendations could have been made to improve safeguards 

intended to protect against the failure of the highly susceptible carbon steel equipment. 

7.7.3 Applicable API Standards Lack Minimum Requirements to Control Hazards 

The Anacortes and Richmond refineries relied on API standards to assist in the selection of materials of 

construction for both Tesoro NHT heat exchangers and the Chevron piping circuit: specifically, API RP 

941, Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and 

Petrochemical Plants, and API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion 

Failures in Oil Refineries. Both documents provide guidance on how to avoid HTHA and sulfidation 

corrosion failures, respectively, but neither document imposes minimum requirements on the user to 

adequately control hazards. In fact, the CSB found in its Chevron investigation that API RP 939-C was 

specifically written to not require any action by the user (emphasis added). Thus, API’s current 

consensus, standard creating process is not effective in ensuring that companies perform essential safety 

practices that can prevent fatal process safety incidents. 

7.7.4 Weak Regulations and Ineffective Regulators 

The CSB found significant gaps in the regulations and the technical abilities of the regulators in both 

Washington and California. Refineries in both states are required to comply with requirements in the 

state OSHA PSM and EPA RMP regulations. However, neither state’s regulations were successful in 

preventing the April 2, 2010, and August 6, 2012, major process safety incidents. 

Under the existing regulatory systems in both Washington and California, there is no requirement to 

conduct DMHRs or to reduce risk to ALARP. Both Tesoro and Chevron were required to “control” 

hazards, but there was no requirement to evaluate the effectiveness of the controls or to ensure the use of 

the hierarchy of controls. In addition, there is no requirement to submit PHAs to the regulator, and the 

regulator is not responsible for assessing the quality of the PHA or the proposed safeguards. 

Furthermore, neither Washington nor California requires the use of inherently safer design to the greatest 

extent practicable. A more robust goal-setting regulatory approach in both states would help to ensure 

that all of the refineries in these states rigorously apply process safety concepts that focus more 

effectively on prevention. The PSM regulations in the state of Washington should be augmented with 

more robust goal-setting attributes including requirements to implement inherently safer designs and the 

hierarchy of controls to prevent major process safety incidents. 

001246
Tesoro Anacortes Refinery Investigation Report May 2014

    105 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Both states also have significant weaknesses in their PSM staffing resources. Washington L&I (the 

Washington PSM regulator) and Cal/OSHA (the California PSM regulator) lack sufficient technically 

experienced and qualified staff members to verify that PSM requirements are being implemented 

adequately. Cal/OSHA has only seven inspectors, and only one with a technical background, for 1,700 

PSM-covered facilities including 14 petroleum refineries, and Washington L&I has only four inspectors, 

and only one with a technical background, for more than 270 PSM-covered facilities including five 

petroleum refineries. 

As described in the CSB Chevron Regulatory Report and in Section 7.0 of this report, it is essential that 

regulators of high-hazard facilities are independent, well funded, well staffed, and technically qualified. 

These regulators must be able to communicate effectively with refinery personnel and to monitor the 

adequacy of refinery process safety practices. 

7.8 Environmental Protection Agency and Chemical Accident Release Programs 

The CSB determined that a key causal factor of the 

April 2010 incident was Tesoro’s failure to 

implement more effective safeguards to prevent the 

heat exchanger failure, such as the use of inherently 

safer materials that are resistant to HTHA. In a 

number of recent CSB investigations, such as the 

Chevron Richmond Refinery incident, the CSB 

found that the implementation by the company of the 

hierarchy of controls and inherent safety could have 

helped to prevent the incident. A number of these 

incidents had significant offsite consequences or had 

the potential to do so. The CSB has determined that 

Tesoro policies and relevant API standards do not 

require the application of inherently safer systems 

analysis or use of the hierarchy of controls to more 

effectively prevent chemical accidents. In this 

section of the report the CSB will examine the 

requirements of the use of inherent safety under the 

Clean Air Act and EPA’s Risk Management Program. 

7.8.1 Background 

Under the authority of the Clean Air Act (CAA) section 112(r),234 the EPA adopted the Risk Management 

Program regulations at 40 CFR Part 68, which went into effect in 1999. The CAA provides that the 

 

234 42 U.S.C. §7412(r)(7)(B)(ii) requires the Administrator to promulgate regulations that “shall require the owner or 

operator of stationary sources at which a regulated substance is present in more than a threshold quantity to 

prepare and implement a risk management plan to detect and prevent or minimize accidental releases of such 

001247
Tesoro Anacortes Refinery Investigation Report May 2014

    106 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

regulations and appropriate guidance developed “provide to the greatest extent practicable, for the 

prevention and detection of accidental releases of regulated substances and for response to such releases 

by the owners or operators of the sources of such releases.”235 The EPA’s Risk Management Program 

requires facilities that contain more than the threshold quantity of any of the 77 listed toxic chemicals or 

63 flammable substances236 to prepare and submit to the regulating agency emergency contact 

information, descriptions of processes and hazardous chemicals onsite, an accident history, and worstcase release scenarios.237 The regulation defines three different Program levels (Program 1, 2, or 3) based 

on a process unit’s potential for impact to the public and the requirements to prevent accidents.238 

Program 3 processes are subject to additional, more stringent requirements to prevent accidents similar to 

those of the OSHA PSM standard. Program 3 facilities must implement elements of a prevention 

program, including: process safety information (PSI), PHA, standard operating procedures (SOPs), 

training, mechanical integrity, compliance audits, incident investigations, MOC, pre-startup reviews, 

employee participation, and hot work permits. These prevention program elements are based primarily on 

the OSHA PSM standard, and much of the language contained in each element is identical to the PSM 

standard. 

Each covered facility is required to submit a risk management plan (RMP) to EPA for all covered 

processes239 and update and resubmit these plans at least once every five years, or whenever a major 

accident occurs or the emergency contact information changes. Completing and submitting the RMP 

satisfies the regulatory requirement; again, the effectiveness of the RMP in risk reduction is not assessed 

by the EPA, rendering this another activity-based requirement for a covered facility. There is no approval 

of the RMP by the EPA, and there is no additional duty on the facility to implement what it says it is 

doing in the RMP, unlike the more robust goal-setting regulatory approach. 

Any facility with one or more covered processes must include in its RMP an executive summary; the 

registration for the facility; the certification statement; a worst-case scenario for each process involving 

flammables or toxics; the five-year accident history for each process; information concerning emergency 

response at the facility; at least one alternative release scenario analysis for each regulated toxic substance 

or flammable; a summary of the prevention program for each Program 2 process; and a summary of the 

prevention program for each Program 3 process.240 

 

substances from the stationary source, and to provide a prompt emergency response to any such releases in order 

to protect human health and the environment.” (1990). 235 42 U.S.C. §7412(r)(7)(B)(i) (1990). 

236 According to 40 CFR §68.10(a), “[a]n owner or operator of a stationary source that has more than a threshold 

quantity of a regulated substance in a process, as determined under §68.115, shall comply with the requirements 

of this part no later than the latest of the following dates...” 237 See 40 CFR §68.12. General Requirements. 

238 See 40 CFR §68.10. Applicability. 

239 40 CFR §68.150 (1999). 

240 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for 

Chemical Accident Prevention (40 CFR Part 68); March 2009; pp 9-1 and 9-2. See

http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 

001248
Tesoro Anacortes Refinery Investigation Report May 2014

    107 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The Tesoro Anacortes Refinery is a covered facility under the RMP program, and its CR/NHT unit is 

considered to be a Program 3 process, as it contains more than the threshold quantity of a flammable 

mixture including butane, ethane, hydrogen, methane, and propane.241 The refinery last submitted an 

updated RMP to EPA on March 28, 2011. The RMP contained a five-year accident history that listed the 

April 2, 2010, NHT catastrophic heat exchanger failure as well as a section on worst-case scenarios, 

which stated that the worst-case scenario associated with a release of flammable substances at Tesoro 

would be a vapor cloud explosion involving the full inventory of the largest storage tank containing an 

RMP regulated flammable mixture.242 

7.8.2 Enforcement of Inherent Safety in the United States 

Although industry good practice guidance provides243 that inherently safer technology (IST) is the 

preferable and often the most effective safety precaution in the hierarchy of controls to prevent major 

accidents it is not enforced by the EPA through its RMP program or through its General Duty Clause or 

other provisions of the Clean Air Act. 

7.8.3 The EPA RMP Program 

As discussed in Section 4.1.3, the hierarchy of controls is a well-recognized safety tool to rank the 

effectiveness of techniques to control hazards, with inherent safety being the most effective choice. The 

CCPS defines inherently safer design as the process of identifying and implementing inherent safety in a 

specific context that is permanent and inseparable.244 The CCPS also notes that “inherently safer design 

solutions eliminate or mitigate the hazard by using materials and process conditions that are less 

hazardous.”245 Regulatory systems around the world have recognized the importance of inherent safety; 

for example, the HSE requires major hazard facilities in the UK to implement inherently safer systems 

analysis including at the design stage in order to satisfy the risk reduction requirement of as low as 

reasonably practicable, or ALARP.246

The RMP program regulations under 40 CFR Part 68 do not require the use or implementation of 

inherently safer design or the hierarchy of controls. This is reflected in both the regulatory language, 

 

241 See http://data.rtknet.org/rmp/rmp.php?database=rmp&detail=3&datype=t&facility_id=100000028034 (accessed 

January 23, 2014). 242 Ibid. 

243 CRC Press, Process Plants: A Handbook for Inherently Safer Design Second Edition; Kletz, Trevor and 

Amyotte, Paul; 2010; pp 15-16. 244 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd

ed., Section 2.2, 2009. 245 Ibid at Section 5.1.1. 246 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to 

ALARP include “the adoption of inherently safer designs....” HSE. The Safety Report Assessment Manual, 

Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE 

also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures 

necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, 

prevention, control, mitigation).” Ibid at 8. 

001249
Tesoro Anacortes Refinery Investigation Report May 2014

    108 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

which does not mention either concept, as well as citations issued by the EPA to companies following an 

incident. As of January 2014, the EPA had issued no civil enforcement penalties to Tesoro as a result of 

its April 2010 incident that resulted in seven fatalities. The EPA did conduct “post-incident” inspections 

of the Tesoro Anacortes Refinery in January and October of 2011. However, no violations were issued 

related to the implementation of inherently safer systems analysis or the hierarchy of controls. In 

December 2013 the EPA also issued a Finding of Violations relating to the Chevron Richmond Refinery 

incident of August 2012. Again, no violations related to either accident prevention approach. 

The CSB found in both its Chevron and Tesoro investigations that the incidents could have been 

prevented if inherently safer materials of construction had been used. In the years leading up to the 

Chevron incident, Chevron employees repeatedly recommended implementing inherently safer designs 

through the management of change (MOC) process, incident investigations, technical reports, and 

recommendations from employees in the past. However, despite the fact that Chevron’s training 

programs on inherently safer systems stated that “the greatest opportunity to eliminate or minimize 

hazards [is] during the development phase of new projects or major revamps of existing facilities,” the 

CSB did not identify any documented, thorough analysis of these proposed inherently safer solutions. 

Instead, Chevron repeatedly failed to implement proposed inherently safer recommendations to upgrade 

crude unit piping from carbon steel to metallurgy that was less susceptible to sulfidation corrosion. This 

led to extremely thinned piping which ultimately ruptured on August 6, 2012. 

At Tesoro, the CSB found that the carbon steel E heat exchanger ruptured because it was in a highly 

weakened state because of HTHA. As discussed in Section 7.4 the Tesoro PHA goals encourage PHA 

teams to seek inherently safer safeguards to reduce risk. However, these approaches were never 

implemented until after the April 2010 incident. As discussed in Section 4.1.3, the CSB determined that 

implementing inherently safer design by using materials that are HTHA-resistant, such as stainless steel, 

is higher on the hierarchy of controls than post-weld heat treating or reliance upon inspections, and is 

therefore a better approach to prevent HTHA damage. 

7.8.4 The General Duty Clause 

Section 112(r)(1) of the Clean Air Act, known as the General Duty Clause, states the following: 

It is the objective of the regulations and programs authorized under this 

subsection to prevent the accidental release and to minimize the 

consequences of any such release of any substance listed pursuant to 

paragraph (3) or any other extremely hazardous substance. Owners and 

operators of stationary sources producing, processing, handling, or 

storing such stances under paragraph (3) have a general duty to identify 

hazards which may result from accidental releases using appropriate 

hazard assessment techniques, to design and maintain a safe facility 

001250
Tesoro Anacortes Refinery Investigation Report May 2014

    109 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

taking such steps as are necessary to prevent releases, and to minimize 

the consequences of accidental releases which do occur.247

The General Duty Clause has been in effect since November 15, 1990, when Congress adopted the Clean 

Air Act Amendments of 1990. According to EPA guidance on the General Duty Clause, “EPA believes 

that owners and operators who have [] [extremely hazardous] substances must adhere, at a minimum, to 

recognized industry standards and practices (as well as any government regulations) in order to be in 

compliance with the general duty clause.”248 The EPA notes that to comply with the General Duty 

Clause, “many industries have developed standards and generally recognized safe practices to manage the 

risks associated with extremely hazardous substances.”249

The application of IST is considered by many to be 

good industry practice. Yet inherent safety concepts 

are not enforced by the EPA through the General Duty 

Clause. According to process safety expert Dr. Paul 

Amyotte in a presentation at the CSB’s April 2013 

Chevron Interim Report Public Meeting in Richmond, 

California, there are numerous resources available on 

the topic of inherent safety, most of which are written 

by “industrial practitioners.” The call for widespread 

use of inherently safer design principles in industry is 

being made mainly by people in industry.250 For 

example, as discussed in Section 4.1.4, API RP 571 

Damage Mechanisms Affecting Fixed Equipment in the 

Refining Industry implicitly supports the concept of 

inherently safer design by describing material selection 

to avoid HTHA failures, noting “300 Series SS, as well 

as 5Cr, 9Cr and 12Cr alloys, are not susceptible to 

HTHA at conditions normally seen in refinery units.”251 

In addition, the CCPS has stated in its 2009 book 

Inherently Safer Chemical Processes A Life Cycle 

Approach, which was written by 18 committee members, 16 of which were listed as having affiliation 

with industrial companies, that the modern approach to chemical process safety “is to apply risk 

 

247 42 U.S.C. §7412(r)(1) (1990). 

248 EPA. Guidance for Implementation of the General Duty Clause Clean Air Act Section 112(r)(1). May 2000; p 2. 

http://www.epa.gov/oem/docs/chem/gdcregionalguidance.pdf (accessed January 23, 2014). 

249 Ibid. 250 Dr. Paul Amyotte. Presentation to the U.S. Chemical Safety and Hazard Investigation Board Public Meeting to 

Release Interim Report and Safety Recommendations Resulting from Chevron Refinery Investigation. 

Richmond, CA April 19, 2013; p 2. 251 API RP 571. Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. 2003; page ‘5-83’. 

001251
Tesoro Anacortes Refinery Investigation Report May 2014

    110 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

management systems theory...[which] includes recognition of the hazards posted by the process, and a 

continual effort to analyze the risks, and to reduce or control them to the lowest levels practical....”252

7.8.5 The EPA’s Authority to Enforce Inherent Safety 

The EPA has acknowledged that it has the authority to require the application of IST through the General 

Duty Clause. In an August 2013 letter responding to a Congressional inquiry that specifically asked, 

among other things, whether the EPA believes it “has the authority to mandate the use and/or 

consideration of Inherently Safer Technologies 

under Section 112(r) of the Clean Air Act[,]” EPA 

Assistant Administrator Mathy Stanislaus stated 

that the EPA has “broad authority to promulgate 

regulations for chemical accident prevention...” 

and can “consider factors such as facility design, 

equipment, and quantity of substances handled 

(and other factors).” He also stated that the EPA 

was currently evaluating various methods of 

improving increased chemical plant safety 

including safer management, increased 

preparedness management, and facility design and 

operations, and would also be examining best 

practices being utilized by industry leaders. 

Others have argued that the EPA has additional authority under Clean Air Act section 112(r)(7)(A) to 

promulgate a new rule requiring industries to implement IST. This section authorizes the EPA 

Administrator to “promulgate release prevention, detection, and correction requirements which may 

include monitoring, record-keeping, reporting, training...and other design, equipment, work practice, and 

operational requirements.”253 Section 112(r) further requires that the risk management plan include 

“safety precautions and maintenance, monitoring and employee training measures” to prevent accidental 

releases.254 As described in Section 4.1.3, inherent safety and the hierarchy of controls are long 

established, widely recognized methods for achieving more effective safety precautions to prevent 

chemical accidents. Incorporating requirements for the implementation of inherent safety and the 

hierarchy of controls is not only consistent with the 112(r) proscribed features of the risk management 

plan but in fact serves to make the safety precautions more effective in preventing accidental releases. 

Despite its acknowledged authority to do so, to date the EPA has not required industries to implement IST 

through either the creation of a new rule or the enforcement of the Clean Air Act General Duty Clause. In 

the wake of Bhopal and more recently the 9/11 tragedy, many groups have urged the EPA to create a new 

regulation requiring the implementation of IST or at a minimum, use its authority under the General Duty 

 

252 CCPS. Inherently Safer Chemical Processes – A Life Cycle Approach. 2nd ed.; 2009; p 9. 

253 42 U.S.C. §7412(r)(7)(A) (1990). 

254 42 U.S.C. §7412(r)(7)(B)(ii)(II) (1990). 

001252
Tesoro Anacortes Refinery Investigation Report May 2014

    111 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Clause to require industries to implement IST. On March 14, 2012, the National Environmental Justice 

Advisory Council255 (NEJAC) sent a letter to the EPA urging the agency to promulgate new rules or 

guidance to “utilize its authority under the ‘General Duty Clause’ of the 1990 Clean Air Act section 

112(r) (also known as the Bhopal clause) to require covered chemical facilities to prevent, where feasible, 

catastrophic chemical releases.”256 The NEJAC noted that flaws in the chemical security law 

administered by the U.S. Department of Homeland Security (DHS) prohibited the agency from requiring 

the use of safer chemical processes at facilities. The group also reiterated that the EPA had made a 

proposal in 2002 to implement the General Duty Clause to make chemical plants safer. According to the 

proposal, chemical plants would be made “inherently safer by reducing quantities of hazardous chemicals 

handled or stored, substituting less hazardous chemicals for extremely hazardous ones, or otherwise 

modifying the design of processes to reduce or eliminate chemical hazards.”257 The NEJAC also stated 

that in 2003, the Government Accountability Office (GAO) concluded that the EPA could “’interpret the 

Clean Air Act’s general duty clause to address chemical facility security... According to EPA, it would 

not have to make any regulatory changes as it currently implements the general duty clause through 

guidance... to address the specific threat of disastrous risks to vulnerable communities.”258 The NEJAC 

concluded by recommending that “EPA use its authority under the 1990 Clean Air Act, Section 112(r), to 

reduce or eliminate these catastrophic risks, where feasible, by issuing new rules and guidance to fully 

implement the General Duty Clause. This action would reduce the danger and imminent threat that 

chemical plants, chemical manufacturing, and the transport and storage of hazardous chemicals pose to 

environmental justice and communities.”259 

 On July 25, 2012, the Coalition to Prevent Chemical Disasters260 (“the Coalition”) petitioned the EPA to 

“commence a rulemaking [pursuant to the Administrative Procedure Act (AP), 5 U.S.C. §553(e), and 

section 112(r)(7)(A)261 of the Clean Air Act (CAA), 42 U.S.C. §7412(r)(7)(A)] to require the use of 

inherently safer technologies, where feasible, by facilities that use or store hazardous chemicals.” The 

petition also requested that, pending completion of the rulemaking, EPA revise its guidance concerning 

 

255 NEJAC is a federal advisory committee to EPA that was established on September 30, 1993. It provides advice 

and recommendations about issues related to environmental justice. For more information see 

http://www.epa.gov/Compliance/ej/nejac/index.html (accessed January 24, 2014). 256 See https://www.documentcloud.org/documents/332041-nejac-letter.html (accessed January 22, 2014). 

257 Ibid. 258 Ibid. 

259 Ibid. 

260 The Coalition consists of over 100 organizations formed to prevent chemical disasters and protect workers. For 

more information see http://preventchemicaldisasters.org/ (accessed January 24, 2014). 261 42 U.S.C. §7412(r)(7)(A) states: “In order to prevent accidental releases of regulated substances, the 

Administrator is authorized to promulgate release prevention, detection, and correction requirements which may 

include monitoring, record-keeping, reporting, training, vapor recovery, secondary containment, and other 

design, equipment, work practice, and operational requirements. Regulations promulgated under this paragraph 

may make distinctions between various types, classes, and kinds of facilities, devices and systems taking into 

consideration factors including, but not limited to, the size, location, process, process controls, quantity of 

substances handled, potency of substances, and response capabilities present at any stationary source. 

Regulations promulgated pursuant to this subparagraph shall have an effective date, as determined by the 

Administrator, assuring compliance as expeditiously as practicable.” 

001253
Tesoro Anacortes Refinery Investigation Report May 2014

    112 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the enforcement of the CAA’s general duty clause, section 112(r)(1), 42 U.S.C. §7412(r)(1), to “make 

clear that the duty to prevent releases of extremely hazardous substances includes the use, where feasible, 

of safer technologies to minimize the presence and possible release of hazardous chemicals.”262 

In the wake of the April 2013 explosion and fire that occurred at a facility in West, Texas, and resulted in 

fifteen fatalities and hundreds of injuries, President Obama issued Executive Order 13650 on August 1, 

2013. It established the Chemical Facility Safety and Security Working Group, which includes OSHA 

and the EPA, and tasked the group with, among other things, developing options for enhancing and 

modernizing policies, regulations, and standards to improve the safety and security of chemical 

facilities.263 A senior EPA official overseeing implementation of the Executive Order has stated the EPA 

is examining the successes of a New Jersey program that requires facilities to consider IST, such as safer 

chemicals, as a possible model for a federal IST policy.264 New Jersey’s 2008 IST rule has led facility 

owners and operators to take a “hard look at opportunities to reduce risk” at industrial plants.265 

New Jersey is the only state that currently implements and enforces IST requirements.266 The Toxic 

Catastrophe Prevention Act (TCPA) implements IST requirements in New Jersey, and covers 

approximately 90 facilities in the state.267 An owner or operator of a covered facility must complete an 

IST review report and must submit it to the New Jersey Department of Environmental Protection (DEP). 

The report “...shall identify available inherently safer technology alternatives or combinations of 

alternatives that minimize or eliminate the potential for an EHS [extraordinarily hazardous substance] 

release.”268 

IST alternatives that are identified must be determined as “feasible” in order for implementation to be 

required. Feasible means “capable of being accomplished in a successful manner, taking into account 

environmental, public health and safety, legal, technological, and economic factors.”269 If IST is not 

implemented, they must provide a written justification using a qualitative and quantitative evaluation of 

 

262 https://www.documentcloud.org/documents/404584-petition-to-epa-to-prevent-chem-disasters-filed.html

(accessed January 22, 2014). 263 Improving Chemical Facility Safety and Security. Exec. Order No. 13650, 78 Fed. Reg. 48029 (August 1, 

2013). http://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facilitysafety-and-security (accessed January 24, 2014). 264 http://insideepa.com/Risk-Policy-Report/Risk-Policy-Report-12/03/2013/epa-looks-to-new-jersey-program-aspossible-model-for-ist-requirements/menu-id-1098.html (accessed January 22, 2014). 

265 Ibid. 266 Contra Costa County, California has a guidance document entitled “Attachment C: Inherently Safer Systems 

Checklist” which is provided as a tool for facilities to utilize during the PHA process. The actual use of the 

checklist is not required. See http://cchealth.org/hazmat/pdf/iso/attachment_c.pdf (accessed April 17, 2013). 267 Under Title 7 of the New Jersey Administrative Code. See N.J.A.C. Section 7:31-4.12 (2010). Available at 

http://www.nj.gov/dep/rpp/brp/tcpa/downloads/conrulerev9_no%20fonts.pdf (accessed January 23, 2014). 268 N.J.A.C. Section 7:31-4.12 (d) (2010). 

269 N.J.A.C. Section 7:31-1.5 (2010). 

001254
Tesoro Anacortes Refinery Investigation Report May 2014

    113 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

environmental, public health and safety, legal, technological, and economic factors. If they decide to 

implement the IST, they must provide a schedule of when they will do it.270

An update is required every five years for all covered processes and at the same time as the updates of 

applicable hazard reviews or process hazard analysis. An update of the IST review is also required when 

there is a major change. While New Jersey’s IST rule contains positive features, it is primarily focused 

on the activity of the production of the IST report and lacks rigorous goal setting elements such as 

requiring facilities to reduce risks to as low as reasonably practicable, or ALARP or requiring that the use 

of IST prevent accidental chemical releases. 

7.8.6 The Role of Inherent Safety in Major Accident Prevention 

In 2011, Dr. Paul Amyotte released an article analyzing 63 CSB reports, studies, and bulletins resulting 

from CSB incident investigations to identify examples related to inherent safety and risk reduction 

measures. The article identified over 200 examples of the hierarchy of controls, with 36 percent of those 

being inherent safety.271 He concluded that the CSB products contained numerous examples where the 

use of the hierarchy of controls, including inherent safety, would be helpful in reducing risk in the process 

industries.272 The four main principles of inherent safety (minimization, substitution, moderation, and 

simplification) all play a role in the prevention and mitigation of process incidents. 

Simply put, the CSB has investigated numerous major process safety incidents over the years, including 

the Chevron and Tesoro incidents, where the implementation of inherently safer design and materials of 

construction could have prevented the incident. The EPA should work with industry and stakeholders to 

develop and implement a new regulation requiring companies to use inherently safer systems analysis and 

the hierarchy of controls in establishing safeguards for identified process hazards to help prevent these 

major process safety incidents from occurring in the future. While the new regulation is being adopted, 

the EPA should use its existing authorities under the CAA General Duty Clause to implement inherently 

safer systems and the hierarchy of controls to the greatest extent feasible for chemical accident 

prevention. 

 

270 N.J.A.C. Section 7:31-4.12 (e) and (f) (2010). 

271 Amyotte, Paul; MacDonald, Dustin K.; and Khan, Faisal I. An Analysis of CSB Investigation Reports 

Concerning the Hierarchy of Controls. 2011; p 1. 272 Ibid.

001255
Tesoro Anacortes Refinery Investigation Report May 2014

    114 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.0 Recommendations 

Pursuant to its authority under 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer 

operations at petroleum refineries and protecting workers and communities from future accidents both in 

the state of Washington and nationally, the CSB makes the following safety recommendations: 

8.1 The U.S. Environmental Protection Agency 

2010-08-I-WA-R1 

Revise the Chemical Accident Prevention Provisions under 40 CFR Part 68 to require the documented use 

of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible when 

facilities are establishing safeguards for identified process hazards. The goal shall be to reduce the risk of 

major accidents to the greatest extent practicable, to be interpreted as equivalent to as low as reasonably 

practicable (ALARP). Include requirements for inherently safer systems analysis to be automatically 

triggered for all management of change, incident investigation, and process hazard analysis reviews and 

recommendations, prior to the construction of a new process, process unit rebuilds, significant process 

repairs, and in the development of corrective actions. 

2010-08-I-WA-R2 

Until Recommendation 2010-08-I-WA-R1 is in effect, enforce through the Clean Air Act’s General Duty 

Clause, section 112(r)(1), 42 U.S.C. §7412(r)(1) the use of inherently safer systems analysis and the 

hierarchy of controls to the greatest extent feasible when facilities are establishing safeguards for 

identified process hazards. 

2010-08-I-WA-R3 

Develop guidance for the required use of inherently safer systems analysis and the hierarchy of controls 

for enforcement under 40 CFR Part 68 and the Clean Air Act’s General Duty Clause, section 112(r)(1), 

42 U.S.C. §7412(r)(1). 

2010-08-I-WA-R4 

Effectively participate in the Tesoro Anacortes Refinery process safety culture survey oversight 

committee as recommended under recommendation 2010-08-I-WA-R15. Incorporate the expertise of 

process safety culture experts in the development and interpretation of the safety culture surveys. Ensure 

the effective participation of the workforce and their representatives in the development of the surveys 

and the implementation of corrective actions. 

 

001256
Tesoro Anacortes Refinery Investigation Report May 2014

    115 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.2 Washington State Legislature, Governor of Washington 

2010-08-I-WA-R5 

Based on the findings in this report, augment your existing process safety management regulations for 

petroleum refineries in the state of Washington with the following more rigorous goal-setting attributes: 

a. A comprehensive process hazard analysis written by the company that includes: 

i. Systematic analysis and documentation of all major hazards and safeguards, using the 

hierarchy of controls to reduce those risks to as low as reasonably practicable (ALARP); 

ii. Documentation of the recognized methodologies, rationale and conclusions used to claim that 

safeguards intended to control hazards will be effective; 

iii. Documented damage mechanism hazard review conducted by a diverse team of qualified 

personnel. This review shall be an integral part of the Process Hazard Analysis cycle and shall be 

conducted on all PSM-covered process piping circuits and process equipment. The damage 

mechanism hazard review shall identify potential process damage mechanisms and consequences 

of failure, and shall ensure effective safeguards are in place to control hazards presented by those 

damage mechanisms. Require the analysis and incorporation of applicable industry best practices 

and inherently safer design to the greatest extent feasible into this review; and 

iv. Documented use of inherently safer systems analysis and the hierarchy of controls to the 

greatest extent feasible in establishing safeguards for identified process hazards. The goal shall 

be to drive the risk of major accidents to As Low As Reasonably Practicable (ALARP). Include 

requirements for inherently safer systems analysis to be automatically triggered for all 

Management of Change and Process Hazard Analysis reviews, prior to the construction of new 

processes, process unit rebuilds, significant process repairs, and in the development of corrective 

actions from incident investigation recommendations. 

b. A thorough review of the comprehensive process hazard analysis by technically competent regulatory 

personnel; 

c. Required preventative audits and preventative inspections by the regulator; 

d. Require that all safety codes, standards, employer internal procedures and recognized and generally 

accepted good engineering practices (RAGAGEP) used in the implementation of the regulations contain 

adequate minimum requirements; 

e. Require an increased role for workers in management of process safety by establishing the rights and 

responsibilities of workers and their representatives on health and safety-related matters, and the election 

of safety representatives and establishment of safety committees (with equal representation between 

management and labor) to serve health and safety-related functions. The elected representatives should 

have a legally recognized role that goes beyond consultation in activities such as the development of the 

001257
Tesoro Anacortes Refinery Investigation Report May 2014

    116 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

comprehensive process hazard analysis, management of change, incident investigation, audits, and 

identification and effective control of hazards. The representatives should also have the authority to stop 

work that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to 

resolve the safety concern. Workforce participation practices should be documented by the company to 

the regulator; and 

f. Requires reporting of information to the public to the greatest extent feasible such as a summary of the 

comprehensive process hazard analysis which includes a list of safeguards implemented and standards 

utilized to reduce risk, and process safety indicators that demonstrate the effectiveness of the safeguards 

and management systems. 

 

001258
Tesoro Anacortes Refinery Investigation Report May 2014

    117 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2010-08-I-WA-R6 

Establish a well-funded, well-staffed, technically qualified regulator with a compensation system to 

ensure the Washington Department of Labor and Industries regulator has the ability to attract and retain a 

sufficient number of employees with the necessary skills and experience to ensure regulator technical 

qualifications. Periodically conduct a market analysis and benchmarking review to ensure the 

compensation system remains competitive with Washington petroleum refineries. 

2010-08-I-WA-R7 

Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the 

state of Washington to develop and implement a system that collects, tracks, and analyzes process safety 

leading and lagging indicators from operators and contractors to promote continuous process safety 

improvements. At a minimum, this program shall: 

a. Require the use of leading and lagging process safety indicators to actively monitor the 

effectiveness of process safety management systems and safeguards for major accident 

prevention. Include leading and lagging indicators that are measureable, actionable, and 

standardized. Include indicators that measure safety culture, such as incident reporting and action 

item implementation culture. Require that the reported data be used for continuous process safety 

improvement and accident prevention; 

b. Analyze data to identify trends and poor performers and publish annual reports with the data at 

facility and corporate levels; 

c. Require companies to publicly report required indicators annually at facility and corporate levels; 

d. Use process safety indicators (1) to drive continuous improvement for major accident prevention 

by using the data to identify industry and facility safety trends and deficiencies and (2) to 

determine appropriate allocation of regulator resources and inspections; and 

e. Be periodically updated to incorporate new learning from world-wide industry improvements in 

order to drive continuous major accident process safety improvements in Washington. 

 

001259
Tesoro Anacortes Refinery Investigation Report May 2014

    118 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.3 Washington State Department of Labor & Industries - Division of 

Occupational Safety and Health 

2010-08-I-WA-R8 

Perform a verification audit at all Washington petroleum refineries to ensure: 

a. Prevention of HTHA equipment failure and safe operation of the equipment. Audit HTHA 

prevention and process condition monitoring techniques used at all Washington petroleum 

refineries. Verify that all affected equipment in use meets the requirements contained in 

Recommendation 2010-08-I-WA-R10; 

b. For nonroutine work, a written hazard evaluation is performed by a multidisciplinary team and, 

where feasible, conducted during the job planning process prior to the day of the job execution. 

Verify that each facility has an effective written decision-making protocol used to determine 

when it is necessary to shut a process down to safely perform work or conduct repairs. Ensure 

the program reflects the guidance in the CCPS Risk Based Process Safety book related to 

hazardous nonroutine work; and 

c. Effective programs are in place to control of the number of essential personnel present during all 

hazardous nonroutine work. 

2010-08-I-WA-R9

Effectively participate in the Tesoro Anacortes Refinery process safety culture survey oversight 

committee as recommended under recommendation 2010-08-I-WA-R15. Incorporate the expertise of 

process safety culture experts in the development and interpretation of the safety culture surveys. Ensure 

the effective participation of the workforce and their representatives in the development of the surveys 

and the implementation of corrective actions. 

 

001260
Tesoro Anacortes Refinery Investigation Report May 2014

    119 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.4 American Petroleum Institute 

2010-08-I-WA-R10 

Revise American Petroleum Institute API RP 941: Steels for Hydrogen Service at Elevated Temperatures 

and Pressures in Petroleum Refineries and Petrochemical Plants to: 

a. Clearly establish the minimum necessary “shall” requirements to prevent HTHA equipment 

failures using a format such as that used in ANSI/AIHA Z10-2012, Occupational Health and 

Safety Management Systems;

b. Require the use of inherently safer materials to the greatest extent feasible; 

c. Require verification of actual operating conditions to confirm that material of construction 

selection prevents HTHA equipment failure; and 

d. Prohibit the use of carbon steel in processes that operate above 400 oF and greater than 50 psia 

hydrogen partial pressure. 

2010-08-I-WA-R11 

Revise American Petroleum Institute API RP 581: Risk-Based Inspection Technology to: 

a. Clearly establish the minimum necessary “shall” requirements to prevent HTHA equipment 

failures using a format such as that used in ANSI/AIHA Z10-2012, Occupational Health and 

Safety Management Systems;

b. Prohibit the use of carbon steel in processes that operate above 400 oF and greater than 50 psia 

hydrogen partial pressure; and 

c. Require verification of actual operating conditions to determine potential equipment damage 

mechanisms. 

 

001261
Tesoro Anacortes Refinery Investigation Report May 2014

    120 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.5 Tesoro Refining & Marketing Company LLC 

2010-08-I-WA-R12 

Actively participate with API in the completion of recommendation 2010-08-I-WA-R10. Document this 

participation. 

2010-08-I-WA-R13 

Once recommendation 2010-08-I-WA-R12 is in effect, develop and implement a plan to meet the 

requirements established through the acceptable completion of recommendation 2010-08-I-WA-R10. 

Document the implementation of the plan and the corrective actions taken.

2010-08-I-WA-R14 

Revise and improve the Process Hazard Analysis (PHA), the Integrity Operating Window (IOW), and the 

damage mechanism hazard review (DMHR) programs and cross-linking among these three programs such 

that all identified hazards are effectively managed in each program. For all Tesoro refineries require: 

a. the IOW to review damage mechanism hazards from the most recent PHA and safeguards 

identified to control these hazards; 

b. the IOW review or revalidation to be conducted at least every five years; 

c. the IOW to analyze and incorporate applicable industry best practice, the hierarchy of controls, 

and inherently safer design to the greatest extent reasonably practicable; 

d. the DMHR report to be developed by the DMHR team and not just the “corrosion expert;” 

e. the DMHR team to review the operating data to verify an accurate understanding of how the data 

was obtained, what it represents, and that it appropriately addresses both routine and nonroutine 

operations; 

f. the DMHR and/or IOW review to identify and review gaps between current industry best 

practices and existing Tesoro practices with regard to material selection and process controls and 

make recommendations that reduce risks from damage mechanism hazards; 

g. the DMHR and IOW review to review applicable Tesoro and industry-wide damage mechanism 

incidents as part of the respective DMHR or IOW review; 

h. the DMHR to review relevant MOCs to fully evaluate the impact of the MOC on damage 

mechanism hazards; 

i. the identification of minimum qualifications for the “corrosion expert” and ensure that the 

DMHR team has the necessary skills to meet these requirements; 

j. for sites that have a corrosion/materials engineer, the corrosion/materials engineer shall be a 

required participant in the DMHR; 

001262
Tesoro Anacortes Refinery Investigation Report May 2014

    121 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

k. the PHA to review the most recent DMHR and IOW reviews in order to contain a complete 

record of all identified damage mechanism hazards, evaluate existing safeguards, and propose 

new safeguards to control the identified hazards; 

l. the PHA to review the consequence of damage mechanism hazards identified in the risk-based 

inspection (RBI) program and IOW reviews to ensure effective safeguards are present to control 

the damage mechanism hazard; and 

m. the PHA to use the hierarchy of controls and implement opportunities for inherently safer design 

to the greatest extent reasonably practicable. 

8.6 Tesoro Anacortes Refinery 

2010-08-I-WA-R15 

Implement a process safety culture continuous improvement program at the Tesoro Anacortes Refinery 

including a written procedure for periodic process safety culture surveys across the work force. The 

process safety culture program shall be overseen by a tripartite committee of Tesoro management, USW 

representatives, Washington State Department of Labor and Industries – Division of Occupational Safety 

and Health, and the U.S. Environmental Protection Agency. This oversight committee shall: 

a. Select an expert third party that will administer a periodic process safety culture survey; 

b. Review and comment on the third party expert report developed from the survey; 

c. Oversee the development and effective implementation of action items to address identified 

process safety culture issues; and 

d. Develop process safety culture indicators to measure major accident prevention performance. 

The process safety program shall include a focus on items that measure, at a minimum, willingness to 

report incidents, normalization of hazardous conditions, burden of proof of safety in plant process safety 

programs and practices, and management involvement and commitment to process safety. The periodic 

process safety culture report shall be made available to the plant workforce. The minimum frequency of 

process safety culture surveys shall be at least once every three years. 

 

001263
Tesoro Anacortes Refinery Investigation Report May 2014

    122 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.7 United Steelworkers Local 12-591 

2010-08-I-WA-R16 

Effectively participate in the Tesoro Anacortes Refinery process safety culture survey oversight 

committee as recommended under recommendation 2010-08-I-WA-R15. 

001264
Tesoro Anacortes Refinery Investigation Report May 2014

    123 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix A AcciMap Causal Analysis 

The CSB team has developed an accident map (AcciMap) as a visual depiction of the casual factors of the 

April 2, 2010 Tesoro Anacortes Refinery explosion and fire (Figure 36).273 An AcciMap is a multilayered causal diagram that provides visualization of higher level causes at the company, industry and 

governmental levels. This diagram is especially useful for developing broadly applicable 

recommendations for accident prevention, 274 and includes five levels: 

- Outcome: Consequences of the incident 

- Physical Events and Conditions: The immediate causes of the incident.275

- Tesoro: Latent causes of the incident associated with company rules and policies. 

- Industry Codes and Standards: Latent causes of the incident associated with industry 

recommended practices, codes, and standards. 

- Government: Latent causes associated with government laws and legislation developed to 

manage highly hazardous industries.

 

273 A full-size, high resolution version of the Tesoro AcciMap is located on the CSB website. 

274 The AcciMap tool was developed by Jens Rasmussen and popularized by Andrew Hopkins. Rasmussen, J., &. 

A. Hopkins. Risk Management in a Dynamic Society: A Modeling Problem. Safety Science, 27 (2.3), 1997; pp 

183-213 275 Immediate causal factors are the actions and conditions that directly lead to the consequence. However, while 

understanding immediate causal factors is vital, they are typically symptoms of systemic, or latent, causal 

factors. Latent causal factors are the pre-actions and pre-conditions that enabled the immediate causal factors to 

occur. It is these latent causal factors that must be alleviated in order to provide broad corrective change and 

prevent recurrence of similar incidents. 

001265
Tesoro Anacortes Refinery Investigation Report May 2014

    124 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 36. AcciMap of April 2, 2010 Tesoro Anacortes Refinery Explosion and Fire

001266
Tesoro Anacortes Refinery Investigation Report May 2014

    125 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

A.1 AcciMap Outcomes 

Seven Tesoro operations personnel were fatally injured following the sudden catastrophic failure of the 

in-service E heat exchanger that resulted in an explosion and fire. The fire burned for more than three 

hours and resulted in a seven month shutdown. 

A.2 Physical Events and Conditions 

The explosion and fire resulted from the sudden catastrophic rupture of the E heat exchanger, releasing 

flammable material that ignited likely because it was above its autoignition temperature. 

The seven fatally-injured employees, a more-than-typical number of workers for this job, were in the 

process of putting a bank of three heat exchangers (A/B/C) back in service. These heat exchangers were 

taken out of service several days before the incident for a maintenance cleaning operation to remove 

fouling, a deposit that greatly reduced heat transfer efficiency of the heat exchangers. While the A/B/C 

bank of heat exchangers was being cleaned, the NHT Unit continued to operate on the other bank, a 

matching series of three heat exchangers (D/E/F). 

When returning the three clean heat exchangers back to service, the middle heat exchanger of the D/E/F 

heat exchanger bank (the E heat exchanger) catastrophically ruptured. Post-incident metallurgical 

analysis determined that the E heat exchanger ruptured because of an advanced stage of HTHA. The 

HTHA occurred in both the B and E heat exchangers in the high stress, non post-weld heat-treated welds. 

The heat exchangers were in service for 38 years and were constructed of carbon steel, a material that is 

highly vulnerable to HTHA damage. 

A.3 Tesoro 

The intention of the established Tesoro procedures for startup of a bank of these heat exchangers was to 

require only one operator to be in the unit for the startup activity that was proceeding at the time of the 

incident. However, the more common practice was for additional operators to assist with this physical, 

labor-intensive startup activity. On the night of the incident, the operations supervisor requested five 

additional personnel to assist with the startup. All seven were present at the time of the incident and were 

working near the site of the explosion and fire. 

During startups of these heat exchangers, Tesoro routinely relied on the addition of ad hoc operations 

staff from other nearby operating units. This use of such additional personnel was explained as a result of 

both a collaborative culture and a need driven by task requirements. The startup of the heat exchangers 

required coordinated manual labor. In addition, a history of leaks was seen by the company as “normal” 

because of the high frequency of such leaks. The mitigation of these leaks required personnel standing by 

with steam lances, which some of the additional workers were likely doing on the night of the incident. 

001267
Tesoro Anacortes Refinery Investigation Report May 2014

    126 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The startup of the NHT heat exchangers was hazardous nonroutine work. Leaks routinely developed that 

posed hazards to workers conducting the startup activities. Shell Oil and Tesoro PHAs at the refinery 

repeatedly failed to ensure that these hazards were controlled and that the number of workers exposed to 

these hazards was minimized. 

Tesoro was not aware of the severe HTHA damage in the B and E heat exchangers because it never 

performed any type of HTHA examination of the heat exchangers. Tesoro took this approach because 

corrosion experts had concluded HTHA was not a credible damage mechanism in these heat exchangers. 

This conclusion was based on a combination of reliance on the carbon steel Nelson curve (which the CSB 

has found to be unreliable) and a lack of knowledge of the actual operating conditions of the NHT heat 

exchangers. Instead of monitoring or modeling process conditions for use in PHAs and damage 

mechanism reviews, corrosion experts relied on process design data that suggested a lower HTHA 

susceptibility than indicated by the CSB modeling estimates. Therefore, these opportunities to identify 

the risks of HTHA were unsuccessful in preventing the April 2010 incident. 

A.4 Industry Codes and Standards 

API RP 941 is the industry standard for preventing equipment failure from HTHA by establishing 

equipment operating limits. This standard contains empirical industry HTHA experience based on 

temperature and hydrogen partial pressure. It notes operating boundaries at locations where various 

materials of construction have failed because of HTHA and where they apparently have not failed. Over 

the years, the boundaries have become more conservative in response to industry failures that occurred 

outside of the previously experienced operating limits. 

API RP 941 is written with permissive language. It is presented as a guideline that “is often used when 

selecting materials in hydrogen service.” It is also described as “an aide for materials selection.” API RP 

941 does not establish minimum requirements to prevent HTHA failures: 

 There are no minimum requirements for performing HTHA susceptibility evaluations. 

 There are no minimum requirements for selection of materials of construction to ensure that 

inherently safer design is employed. 

Analysis of the metal recovered from the B and E heat exchanger shell walls revealed a significant 

occurrence of HTHA well within the “safe” operating limits established by API RP 941, indicating that 

the current location of the carbon steel Nelson curve cannot be trusted to prevent equipment failure and 

cannot be relied on to predict the occurrence of HTHA. Damage from HTHA was occurring in portions 

of the B and E heat exchangers that CSB process modeling determined were operating as much as 120 °F 

degrees below the carbon steel Nelson curve. 

Other industry standards, such as API RP 581, offer guidance on how to predict, mitigate, and control the 

occurrence of HTHA. However, such standards share similar weaknesses with API RP 941. API 581 

does not require verification of actual operating conditions when identifying applicable damage 

mechanisms. API RP 581 calculations to determine susceptibility of equipment to HTHA confirmed that 

the B and E heat exchangers were not susceptible to HTHA. 

001268
Tesoro Anacortes Refinery Investigation Report May 2014

    127 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

A.5 Government 

The existing federal and state of Washington regulations for PSM of highly hazardous chemicals were not 

sufficient to prevent this incident as they were primarily activity based and did not focus on specific risk 

reduction (such as ALARP), inherently safer design, require leading and lagging process safety indicators, 

or require continuous improvement. For example, the unit PHA ineffectively identified and managed 

hazards, but its completion still satisfied the state of Washington’s PSM standard. In addition, despite its 

ability to do so, the EPA does not require facilities to analyze opportunities to implement inherently safer 

design. 

The state of Washington’s L&I completed a formal inspection of the CR and NHT process units as part of 

the OSHA Refinery NEP in March 2009, just more than one year before the incident. However, the NEP 

inspection lacked the level of detail required to detect the technical deficiencies in the Tesoro refinery’s 

mechanical integrity program. No HTHA issues were identified, and no citations relating to the E heat 

exchanger were issued. The state of Washington did not have sufficient personnel resources with the 

required technical knowledge and experience to seek out and oversee the highly technical area of failure 

mechanisms. The state of Washington has only four PSM specialists in its compliance section to regulate 

nearly 270 PSM-covered facilities, including five petroleum refineries. 

001269
Tesoro Anacortes Refinery Investigation Report May 2014

    128 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix B NHT A/B/C Heat Exchanger Startup Trend Data 

Trends of tube-side outlet temperatures are shown in Figure 38 through Figure 41 for the night of the 

incident and for the three previous startups for the A/B/C heat exchangers. The locations of the two 

temperature measurements are shown in Figure 37. 

Figure 37. Location of the Two Outlet Temperature Measurements 

D/E/F outlet temperature 

A/B/C outlet temperature 

001270
Tesoro Anacortes Refinery Investigation Report May 2014

    129 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 38. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on Night of the 

Incident 

Figure 39. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on August 29, 2009 

001271
Tesoro Anacortes Refinery Investigation Report May 2014

    130 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 40. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on April 2, 2009 

Figure 41. Temperature Data During NHT A/B/C Heat Exchanger Bank Startup on February 3, 2008 

001272
Tesoro Anacortes Refinery Investigation Report May 2014

    131 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix C CSB Simulation of the NHT Heat Exchangers 

C.1 Background

Process conditions (temperature, pressure, flow, and composition data) were available for the NHT feed 

streams entering and exiting the two banks of the NHT heat exchangers (Figure 42). However, the 

system lacked instrumentation between the individual heat exchangers. Therefore, the actual process 

conditions of the fluid entering and exiting the B and E heat exchangers were not available. The CSB 

used the Aspen HYSYS® and Aspen Exchanger Design and Rating process simulation computer software 

to model the A/B/C and D/E/F heat exchanger banks for estimating process conditions in the B and E heat 

exchangers where HTHA occurred. 

Of particular importance was the capability to model the qualitative fouling observations documented by 

Shell Oil workers.276 These observations indicate that the heat exchangers primarily fouled within the 

tubes. The observations also indicate that fouling in the A and D tubes was “Heavy”, fouling in the B and 

E tubes was “Moderate”, and fouling in the C and F tubes was “Light.”277 The documented observations 

show that the shell-side of the NHT heat exchangers experienced the formation of a light scale. 

 

276 These observations were made when Shell Oil owned the refinery. 

277 Other qualitative descriptions were also noted. However, these conditions were most frequently reported. 

001273
Tesoro Anacortes Refinery Investigation Report May 2014

    132 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 42. NHT Heat Exchanger Configuration with Known Process Conditions Indicated 

C.2 Modeling Approach 

The computer program Aspen Exchanger Design and Rating is a tool that allows the development of a 

rigorous mechanical model of a heat exchanger based on the actual mechanical details. The heat 

exchanger design data entered into the program included specific construction details such as the heat 

exchanger type; the shell dimensions; the number, diameter, and length of tubes; the baffle configuration; 

and the material of construction. 

The model developed using Aspen Exchanger Design and Rating was then used as an input to another 

Aspen computer program, Aspen HYSYS®. This software provides the capability to combine the heat 

exchanger mechanical model into a process model of an entire section of a refinery process, such as the 

NHT heat exchangers. Model inputs include data from the process, such as flow rates, temperature, 

pressures, process compositions and process physical properties. The CSB used the Aspen HYSYS®

001274
Tesoro Anacortes Refinery Investigation Report May 2014

    133 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

model to simulate past performance of the NHT feed/effluent heat exchangers. Historical DCS data and 

composition data were input into the model to reflect actual operating conditions. 

C.3 Fouling Distribution 

A key focus of the CSB modeling effort was to estimate operating conditions of the heat exchangers when 

they were fouled. Fouling results in higher shell-side temperatures, and the potential for HTHA would 

have been most severe during higher-temperature periods. The model includes input parameters, called 

fouling resistance, for estimating heat exchanger fouling. The CSB calibrated these fouling parameters 

by matching actual operating data under fouled conditions. Next, the CSB apportioned the level of 

fouling among the various heat exchangers. In both the model results and the data for actual heat 

exchangers in the unit, distribution of fouling among the A/D, B/E, and C/F heat exchanger tubes greatly 

affects the process conditions within the B and E heat exchangers. 

Because actual fouling distribution throughout the heat exchangers was not known, the CSB performed a 

sensitivity analysis of possible fouling distributions on the tube-side of the heat exchangers to 

approximate conditions that existed based on the available qualitative visual observations. For example, 

these observations described a uniformly light scale on the shell-side of each heat exchanger. As a result, 

a constant, light fouling resistance was incorporated in the model to represent this light scale. Qualitative 

observations also described fouling inside the tubes, with the extent of observed fouling increasing from 

C/F to B/E and then to A/D. The tube-side fouling distributions analyzed for the sensitivity analysis are 

shown in Figure 43. Distribution 2 was selected for the model because it best matched the overall 

documented observations of heat exchanger fouling. 

Percent fouling resistance 

in A/D exchangers 

Percent fouling 

resistance in B/E 

exchangers 

Percent fouling 

resistance in C/F 

exchangers 

Distribution 1 60% 30% 10% 

Distribution 2 55% 32.5% 12.5% 

Distribution 3 50% 35% 15% 

Figure 43. NHT Heat Exchanger Fouling Distributions Analyzed 

A schematic of how these distributions may appear visually is shown in Figure 44. 

001275
Tesoro Anacortes Refinery Investigation Report May 2014

    134 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 44. Visualization of Possible Tube-Side Fouling Distributions 

C.4 DCS Data and Composition Data Availability 

The necessary DCS and fluid composition data needed to model the heat exchangers were only available 

between 2007 and 2010.278 As a result, all modeled values represent estimates of process conditions 

causing HTHA from 2007 through 2010. HTHA degradation of the B and E heat exchangers during this 

time period is likely because the heat exchangers had experienced higher temperature and greater 

mechanical stress in the 2007 to 2010 time period than on the night of the incident.279 

 

278 The Tesoro Anacortes, Washington refinery first installed its DCS system in 2002. However, not all variables 

necessary for process simulation of the NHT heat exchangers were measured until 2007. 

279 On February 23, 2008, the D/E/F heat exchanger tube outlet temperature increased by 100 F over a 10 minute 

period before being brought down for a cleaning operation, reaching a maximum temperature of 

681 F. On August 22, 2009, during a startup of the D/E/F heat exchanger bank following a cleaning operation, 

the D/E/F exchanger bank tube outlet temperature increased by 100 F over a four minute period, reaching a 

maximum temperature of approximately 641 F during the startup. Other high-stress events during exchanger 

001276
Tesoro Anacortes Refinery Investigation Report May 2014

    135 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The CSB modeled 10 days of operation during this 2007 to 2010 time period. Two of the periods 

modeled were characterized by clean heat exchanger conditions; during three of the periods modeled, 

middle-of-run operation conditions existed; and five of the periods modeled were characterized by fouled 

heat exchanger conditions near the end of a run. 

C.5 Calibration of Model with Actual Process Data 

Figure 45. Calibration of HYSYS Model with Actual Process Data. The fouling resistances (fouling 

factors), maintaining the 55%, 32.5%, 12.5% split, were adjusted until the tube-side and shell-side 

outlet model temperature results closely matched actual DCS-measured temperatures. 

Shown in Figure 45, actual composition data, flow rates, temperatures, and pressures were available for 

the process fluid entering both the tube-side and shell-side of the heat exchanger banks. Measured 

temperature values were available for the fluid exiting both the tube-side and shell-side of the heat 

exchanger banks. The fouling resistances (fouling factors) were adjusted in the model, maintaining the 

55%, 32.5%, and 12.5% split until the model’s tube and shell outlet temperatures closely matched the 

actual, measured process temperatures. This method resulted in an average of 2.5% error between the 

model’s outlet temperatures and the actual, measured tube and shell outlet temperatures. The temperature 

profile of the B and E heat exchangers was then analyzed to determine temperatures and hydrogen partial 

pressures along the length of the heat exchangers. 

 

startup are also shown in Appendix B. The E heat exchanger did not rupture as a result of the temperature and 

mechanical stresses of these startups. 

001277
Tesoro Anacortes Refinery Investigation Report May 2014

    136 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

C.6 Modeling Results 

The resulting plot of modeled operating conditions of the B and E heat exchangers is shown in Figure 46, 

which illustrates the full operating region of the B and E heat exchangers, the operating conditions at the 

rupture location, and the operating conditions at the CS2 seam (the coldest location where signs of HTHA 

were evident in the E heat exchanger). All graphed regions use the Distribution 2 fouling allocation. 

The estimated operating regions for the stainless steel clad portion of the B and E heat exchangers 

extended above the carbon steel Nelson curve. At the rupture location, the estimated operating conditions 

are just below the carbon steel Nelson curve. Model results for the coldest area of the E heat exchanger 

where signs of HTHA were evident (the CS2 weld between Cans 1 and 2) indicate HTHA damage in 

equipment that operated between 70 °F to 120 °F below the carbon steel Nelson curve. All graphed 

regions use the Distribution 2 fouling allocation. The model results illustrate the imprecision of the 

carbon steel Nelson curve. 

Figure 46. Estimated Operating Conditions of the B and E Heat Exchangers 

001278
Tesoro Anacortes Refinery Investigation Report May 2014

    137 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix D Evaluation of Current Tesoro Programs to Identify 

and Control Damage Mechanism Hazards 

In developing a recommendation for Tesoro to address several of the findings in Section 1.2.2, the CSB 

evaluated current Tesoro standards for conducting DMHRs, PHAs, and Integrity Operating Window 

(IOW). In addition to the incident-specific analyses described in the report, this evaluation provides the 

necessary detail and support for recommendation 2010-08-I-WA-R14. 

DMHRs evaluate a subset of hazards within the scope of a PHA.280 Because of the specialized focus and 

expertise required to properly assess damage mechanism hazards, Tesoro has developed a program to 

evaluate these hazards outside of the PHA process, using external hired experts. The PHA team is then 

required to review this information and incorporate it into the applicable PHA. 

The Tesoro PHA standard includes a requirement for the PHA team to review the most recent DMHR. 

This requirement establishes a link between the DMHR and the PHA, but it is not currently sufficient. To 

provide a better connection between the DMHR and the PHA, the DMHR team should be required to 

review the most recent PHA and validate the damage mechanism hazards and the safeguards identified to 

control these hazards. The PHA standard does not include a link between the IOW and the PHA. The 

PHA team should be required to review IOWs and validate the damage mechanism hazards and the 

safeguards identified to control these hazards. 

IOWs are intended to address operating limits to prevent unexpected degradation of equipment. Like 

DMHRs, IOW reviews evaluate a subset of hazards within the scope of a PHA. The IOW standard 

addresses 51 degradation mechanisms that Tesoro has determined should be evaluated outside of the PHA 

process. The results of the IOW review must be integrated into the PHA; however, the PHA standard 

does not currently contain language to ensure that this requirement is completed. Although IOWs provide 

a mechanism to qualitatively rank degradation hazard risks, there is no provision to evaluate the 

effectiveness of safeguards, consider the hierarchy of controls, or evaluate opportunities for inherently 

safer design to the greatest extent feasible. The results of the DMHR are reviewed and incorporated into 

the development of IOWs. Although degradation hazards are evaluated in the IOW review process, 

IOWs are only revalidated every 10 years, twice the 5-year revalidation frequency allowed by the PSM 

regulations.281 The IOW does evaluate incidents, but there is no provision to evaluate or consider 

industry-wide incidents. The IOW process does consider both routine and nonroutine operations. 

The Tesoro PHA standard includes guidance to provide direction to the PHA team on its responsibilities. 

This guidance suggests that the PHA team is responsible only for a review of the completed critical 

 

280 The state of Washington PSM rule requires that the PHA shall address the hazards of the process. See: 

http://www.lni.wa.gov/wisha/rules/hazardouschemicals/#WAC296-67-017 (accessed December 29, 2013). 

These regulations do not specifically require a DMHR. 281 WAC 296-67-017(6), “Process hazard analysis,” requires the PHA to be updated and revalidated at least every 5 

years. See: http://www.lni.wa.gov/wisha/rules/hazardouschemicals/#WAC296-67-001 (accessed January 11, 

2014). 

001279
Tesoro Anacortes Refinery Investigation Report May 2014

    138 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

process data sheet that the corrosion expert produces as part of the DMHR. A specific requirement is 

never explicitly made for the PHA team to identify damage mechanism hazards, evaluate existing 

safeguards, and propose new safeguards to control these hazards. 

None of the Tesoro PHA, DMHR, or IOW standards ensure that effective safeguards are identified and 

evaluated to control damage mechanism hazards. Such a review is implied by the overarching 

requirements in the Tesoro PHA standard. However, the language used in the standard could functionally 

reduce the responsibility of the PHA team to a mere review of the critical process data sheet developed by 

the corrosion expert as part of the DMHR. No formal evaluation of safeguards is ever described as a 

requirement for damage mechanism hazards or for the establishment of IOWs. 

To improve the DMHR, this team should conduct a review of the relevant PHA hazards that address 

damage mechanisms. For these hazards, the DMHR should validate consequence, frequency, and 

proposed safeguards to control damage mechanism hazards. The DMHR should also evaluate alternatives 

that consider the hierarchy of controls and opportunities for inherently safer design to the greatest extent 

feasible. 

The final deliverable from a Tesoro DMHR is a written report that the corrosion expert prepares. Because 

the DMHR team does not review and approve this final report, it does not meet OSHA PSM requirements 

for a PHA. There is an OSHA interpretation letter from October 31, 1996, that essentially states that a 

“team”282 must perform the hazard analysis. OSHA’s intent appears to be that the analysis and 

recommendations developed remains a team product. As written, the Tesoro DMHR results in a team 

analysis but with a report developed by an individual. 

Under the Tesoro DMHR standard, the corrosion expert is required to assemble a critical process data 

spreadsheet. This spreadsheet is submitted to someone who has process expertise to provide the required 

process operating data. However, there is no guidance on how these data should be obtained or assurance 

that the data are appropriate to properly evaluate a given damage mechanism. In light of the April 2010 

incident at the Anacortes refinery, for each identified damage mechanism, there should be a clear 

understanding of what process data are required as well as a provision to ensure that design operating data 

are not used in lieu of obtaining actual measurements or performing a technical evaluation such as a 

process simulation to estimate needed process data. The DMHR team should review the operating data 

and collection techniques to verify an accurate understanding of how the data were obtained and what 

they represent, and it should appropriately consider routine and nonroutine operations as well as the full 

range of operating conditions. 

Before the April 2010 incident, in 2003, API identified materials that are not susceptible or are highly 

resistant to HTHA damage.283 Neither Shell Oil nor Tesoro damage mechanism reviews considered these 

materials as inherently safer controls for HTHA hazards. The Tesoro DMHR and IOW processes do not 

 

282 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=22289

(accessed December 29, 2013). 283 API RP 571. “Damage Mechanisms Affecting Fixed Equipment in the Refining Industry.” Pages 5–56, 2003. 

001280
Tesoro Anacortes Refinery Investigation Report May 2014

    139 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ensure that gaps between current industry best practices and existing Tesoro practices are identified, 

evaluated, and considered when creating recommendations to reduce risk of damage mechanism hazards. 

Tesoro should maintain an incident database on damage mechanism incidents, both for Tesoro and 

industry-wide. The DMHR and IOW teams should conduct a review of these incidents that should be 

included in the DMHR and IOW reports.284

As a result of separating the evaluation of damage mechanisms from the formal PHA process, potential 

gaps exist when the PHA team reviews MOCs and incident reports during the PHA process.285 In 

addition to a review by the PHA team, MOCs relevant to potential damage mechanisms should be 

reviewed by the IOW team to fully evaluate the impact of proposed and planned changes within the 

refinery on relevant damage mechanism hazards. The IOW standard requires integration of IOWs into 

the MOC process, but the MOC standard currently has no provision to consider IOWs. 

The Tesoro DMHR is one component of the Tesoro RBI program, which determines potential 

consequences for hazards such as equipment failure from damage mechanisms. Tesoro currently 

determines the consequences of damage mechanism hazards as a separate activity from the PHA, and 

there is no verification that the consequences determined by the DMHR are consistent with the PHA. To 

improve the Tesoro PHA process, PHA teams should review and validate the relevant consequence of 

hazards identified by the RBI program.286 

Tesoro requires a corrosion expert to lead the DMHR process. However, the qualifications of the 

corrosion expert are not defined. Minimum qualifications should be clearly defined, and additional 

personnel should be added to the team if the identified corrosion expert does not meet all of the minimum 

qualifications. 

The Tesoro requirement for DMHR meeting participants is confusing and should be clarified. The 

refinery corrosion and materials engineer is listed as a required participant, but then the DMHR document 

uses the language “if present.” It is not clear why or under what conditions Tesoro would conduct a 

DMHR without the participation and expertise of the refinery corrosion and materials professional. 

 

284 The identification of any previous incident that had a likely potential for catastrophic consequences in the 

workplace is a requirement of the State of Washington PSM rule. See: 

http://www.lni.wa.gov/wisha/rules/hazardouschemicals/#WAC296-67-017 (accessed December 29, 2013). 285 The Tesoro PHA standard requires PHA revalidations to address “Changes since the last PHA(s)—Management 

of Change (MOC).” The Tesoro PHA standard also requires the PHA to evaluate previous incidents. The 

standard requirements mirror the language of the State of Washington PSM rule, “The identification of any 

previous incident which had a likely potential for catastrophic consequences in the workplace.” 286 For these hazards, the PHA team should ensure that there are effective safeguards to control damage mechanism 

hazards. The PHA team should also evaluate alternatives that consider the hierarchy of controls and 

opportunities for inherently safer design to the greatest extent feasible. 

001281
Tesoro Anacortes Refinery Investigation Report May 2014

    140 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix E Inspection Techniques 

The most basic nondestructive examination (NDE) technique is simply a visual examination that typically 

evaluates for physical damage such as dents or cracks, discoloration, or the presence of foreign material 

(such as process fouling or corrosion products similar to rust). However, significant damage is not 

always visible to the naked eye. Much like a doctor uses of X-rays or an MRI, or a CAT scan, the 

inspector uses more sophisticated tools and techniques to determine the condition of the refinery 

equipment. Typical NDE techniques include the following: 

 Ultrasonic Technique (UT)—is the primary NDE technique for determining the extent of general 

corrosion attack. UT uses high frequency sound waves that are transmitted into a material and 

travel in a straight line and at a constant speed until they encounter a surface. The surface 

interface causes some of the wave energy to be reflected, and the rest of it is transmitted. The 

quantity of reflected versus transmitted energy is detected. Expert examination of the data 

provides information such as the presence of discontinuities and the thickness of the material or 

coating.287

 Radiographic Technique (RT)—also referred to as X-ray, is commonly performed using two 

different sources of radiation, X-ray and gamma ray. Advantages include a minimum surface 

preparation requirement and sensitivity to changes in thickness, corrosion, voids, cracks, and 

material density. The disadvantages are safety precautions required for the safe use of radiation, 

and access constraints in the field.288

 Dye Penetrant Inspection (DPI)—also called Liquid Penetrant Inspection (LPI) or Penetrant 

Technique (PT), is a widely applied and low-cost inspection method used to locate surfacebreaking defects in all non-porous materials (such as metals, plastics, or ceramics). DPI is used 

to detect cracks, surface porosity, lack of penetration in welds and defects resulting from inservice conditions (for example fatigue cracks of components or welds) in castings, forgings, and 

welding surface defects.289

 Magnetic Particle (MT)—is used for finding surface and near surface defects in ferromagnetic 

material and is a versatile inspection method for field and shop applications. Magnetic particle 

testing works by magnetizing a ferromagnetic specimen using a magnet or special magnetizing 

equipment. If the specimen has discontinuity, the magnetic field flowing through the specimen is 

interrupted and leakage field occurs. Finely milled iron particles coated with a dye pigment are 

applied to the specimen. These are attracted to leakage fields and cluster to form an indication 

directly over the discontinuity. The indication is visually detected under proper lighting 

 

287 See: http://www.mistrasgroup.com/services/traditionalndt/ut.aspx (accessed August 1, 2013). 

288 See: http://www.mistrasgroup.com/services/traditionalndt/rt.aspx (accessed August 1, 2013). 

289 See: http://www.eceglobal.com/services/inspection-approvals/non-destructive-examination-nde/penetrant-testingpt/, (accessed June 3, 2013). 

001282
Tesoro Anacortes Refinery Investigation Report May 2014

    141 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

conditions. Wet Fluorescent Magnetic Particles (WFMPT) is sometimes applied to increase 

sensitivity for locating very small defects.290

 Ultrasonic Shear Wave—also called Angled Beam Ultrasonic Technique, can be used to inspect 

pipe, critical welds in pressure vessels and plate weldments, and can be used to inspect cracks for 

depth, size, length and orientation. This is a common technique used for weld inspection, which 

provides a sensitive, fast and cost effective method to detect, locate, and validate a range of large 

to small defects and deterioration. 291

 Phased Array Ultrasonic Technology (PAUT)—has the capability of creating multiple beam 

angles and focal points with the use of a multi-element ultrasonic transducer, and providing full 

volumetric sectorial scans (S-Scans), a feature unique to this technology. S-Scans are real-time 

side view images generated from a single inspection point; in essence, it depicts an internal view 

of the component being inspected. With this technology, weld flaw and crack detection and 

sizing can be achieved at a high rate of speed, many times faster than conventional shear wave 

inspection can achieve.292

 Advanced Ultrasonic Backscatter Technique (AUBT)—developed by Shell Oil in the early 

1990s, is currently the best NDE method for detecting and quantifying damage from HTHA. The 

technique uses conventional UT probes and a digital oscilloscope to provide both an A-Scan 

display and frequency analysis.293 AUBT is a sophisticated technique and requires a very high 

level of expertise.294 There is no general certification of inspector competence in the application 

of HTHA detection techniques. 

 Velocity Ratio: HTHA reduces the velocity of both shear and longitudinal waves. When a 

material is attacked by HTHA, the velocity reduction is slightly more with longitudinal than with 

shear waves. This in effect increases the ratio of shear wave to longitudinal wave velocities or 

the ratio of the transit times. This ratio of transit times can be used as an indicator of HTHA. 

Tests have shown that the velocity-ratio approach is only effective at high levels of HTHA and is 

limited to the base metal.295

 

290 See: http://www.mistrasgroup.com/services/magnetic-particle-testing.aspx, (accessed June 3, 2013). 

291 See: http://techcorr.com/services/Inspection-and-Testing/Ultrasonic-Shear-Wave.cfm (accessed July 16, 2013). 

292 See: http://www.autsolutions.net/Phased_array.html (accessed July 16, 2013). 

293 See: http://www.spi-matrix.com/advanced-ultrasonic-backscatter.php (accessed July 16, 2013). 

294 See: http://www.nde.com/hydrogen.htm (accessed June 13, 2013). 

295 See: http://www.ndt-ed.org/EducationResources/CommunityCollege/Ultrasonics/Physics/modeconversion.htm

(accessed January 13, 2013). 

001283
Tesoro Anacortes Refinery Investigation Report May 2014

    142 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix F CSB Chevron Reports Incorporated by Reference 

Both the CSB Chevron Interim Report and the draft Chevron Regulatory Report have been incorporated 

into this report on the Tesoro Anacortes Refinery incident by reference to support the regulatory analysis 

and recommendations. The Chevron Interim Report can be accessed at 

http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf and the draft Chevron 

Regulatory Report can be accessed at http://www.csb.gov/chevron-refinery-fire/. 

001284
Tesoro Anacortes Refinery Investigation Report May 2014

    143 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix G Spectrum Inspection Reports 

The Spectrum Inspection Reports can be accessed at http://www.csb.gov/tesoro-refinery-fatal-explosionand-fire/. 

001285
Tesoro Anacortes Refinery Investigation Report May 2014

    144 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix H Beta Laboratory Reports 

The Beta Laboratory Reports can be found at http://www.csb.gov/tesoro-refinery-fatal-explosion-andfire/. 

001286
Tesoro Anacortes Refinery Investigation Report May 2014

    145 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix I Metallurgical Review 

The metallurgical report can be accessed at http://www.csb.gov/tesoro-refinery-fatal-explosion-and-fire/. 

 

001287
Tesoro Anacortes Refinery Investigation Report May 2014

    146 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Appendix J Additional HTHA Evaluation Report 

This report can be accessed at http://www.csb.gov/tesoro-refinery-fatal-explosion-and-fire/. 

001288
Tesoro Anacortes Refinery Investigation Report May 2014

    147 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Thank you for reading this CSB report. 

[This page left intentionally blank.] 

 

001289
Tesoro Anacortes Refinery Investigation Report May 2014

    148 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

001290
CSB • US Ink Case Study 1

US Ink Case Study Case Study January 2015

Case Study

US Ink/Sun Chemical Corporation

Ink Dust Explosion and Flash Fires in 

East Rutherford, New Jersey 

October 9, 2012

Seven Employee Injuries

No. 2013-01-I-NJ

This case study examines the explosion and flash fires that occurred at the US Ink manufacturing facility in East Rutherford,

New Jersey, on Tuesday, October 9, 2012. Seven workers suffered burn injuries when they congregated at the entrance to the 

ink mixing room after hearing a loud thump from the newly installed dust collection system on the top of the facility and seeing 

signs of an initial flash fire from a bag dumping station. A second flash fire then occurred that led to the employee injuries.

KEY ISSUES:

•Combustible Dust

•Engineering Design 

•Management of Change

•Process Hazard Analysis

•Hazard Communication

•Management Oversight

•Regulatory Oversight 

U.S. Chemical Safety and Hazard Investigation Board

001291
CSB • US Ink Case Study 2

US Ink Case Study Case Study January 2015

1.0 INTRODUCTION

On October 9, 2012, at approximately 1:15 

pm Eastern Standard Time (EST), a flash fire 

caused burn injuries to seven workers, including 

three who sustained third-degree burns, at 

the US Ink/Sun Chemical Corporation ink 

manufacturing facility in East Rutherford, 

New Jersey. Workers were drawn to a black 

ink mixing room (commonly called the premix room at US Ink) by the initial flash of 

the fire from a bag dumping station and by 

a loud thumping noise from the rooftop. As 

the workers congregated at the doorway, they 

observed a small fire in the ductwork of a 

newly installed dust collection system above a 

process mixing tank. Suddenly, a large flash fire 

emerged from the pre-mix room and engulfed the seven employees in flames. Coworkers 

responded to the seven injured employees and took them out of the building. Emergency 

responding units from the East Rutherford Volunteer Fire Department arrived on scene 

at 1:20 pm EST. Emergency responders transported the victims to the local hospital while 

firefighters began combating the fire. After the incident, production was suspended pending 

internal and external investigation by the company, U.S. Occupational Safety and Health 

Administration (OSHA), and U.S. Chemical Safety and Hazard Investigation Board (CSB). 

Some production of colored inks resumed about a week later, but black ink production was 

halted until the end of December.

1.1 COMPANY BACKGROUND

US Ink1, a division of Sun Chemical Corporation, is an ink manufacturer established 

in 1993 through the merger of two organizations, U.S. Printing Ink and the News Ink 

Division of Sun Chemical Corporation. US Ink maintains headquarters in Carlstadt, New 

Jersey, and had seven regional manufacturing locations across the country, including the 

East Rutherford facility, at the time of the incident. Sun Chemical Corporation is a global 

graphic arts corporation divided into a number of subsidiaries that encompass different 

segments of the market (such as ink, plates, pigments, and films). Sun Chemical owns 

and operates 143 active manufacturing facilities in and outside of the United States, with 

approximately 9,000 employees worldwide. At the time of the incident, the US Ink East 

Rutherford facility had 34 employees, and 28 employees were on shift.

TABLE OF CONTENTS

1.0 Introduction 2

2.0 Incident Description 9

3.0 Incident Analysis 13

4.0 Sample Test Results and Implications 16

5.0 Engineering Design Analysis 20

6.0 Safety Management Analysis 26

7.0 Regulatory Analysis 29

8.0 Key Findings 35

9.0 Reiterated Recommendations 37

10.0 Recommendations 38

1 See http://www.usink.com/about-us.html.

001292
CSB • US Ink Case Study 3

US Ink Case Study Case Study January 2015

1.2 BLACK INK PROCESS DESCRIPTION

The US Ink East Rutherford plant (built in the 1920s) manufactures both black and color 

oil-based ink for various commercial clients. A key step in the ink production process is 

mixing solid and liquid ingredients to produce a liquid suspension. The mixing operation 

for black ink ingredients is performed in the pre-mix room, where the October 9, 2012, 

incident occurred. Figure 1 depicts a simplified plan view of the pre-mix room containing 

three large mixing tanks in which the various ink formulations are made. The room is 30 

feet wide by 17 feet deep and has cinder block walls up to the 30-foot ceiling height. The 

black ink manufacturing process at US Ink involved the pneumatic transfer2

 of bulk solid 

powder under vacuum to one of three mixing tanks, labeled as 106, 206, and 306 (T-106, 

T-206, and T-306, respectively).

FIGURE 1

Pre-mix room layout3

Two solid ingredients, carbon black and kaolin clay, are received by rail (while Gilsonite is 

shipped by truck) to the facility and are transported to the mixing tanks by vacuum through 

piping from a manual raw material feeding station (known at US Ink as the bag dump 

station,4

 shown in Figure 2) or by gravity from three overhead receiver hoppers containing 

carbon black and kaolin. The liquid ingredients are transported to the facility via rail and 

are pumped into the mixing tanks via pipes connected to the bottom of the tanks. All 

three mixing tanks are 5 feet in diameter and about 10 feet high. Operators coordinate 

2 The pneumatic transfer process is a mechanical method of conveying materials via compressed or pressurized gases.

3 This diagram is not drawn to scale.

4 The bag dump station was positioned in the doorway of the pre-mix room. An overhead rollup service door was installed for access to the premix room. At the time of the incident, the CSB found that the rollup service door was chained into a fixed rolled-up position to provide easier entry 

into the room. Witness accounts from plant employees and contractors indicated that Gilsonite dust generated from the bag dumping operation 

often accumulated around the facility but particularly on flat surfaces. US Ink did not provide an effective means of containing fugitive dust at the 

bag dumping station because emptied bags were often stacked alongside the bag dump, which in turn lofted dust into the air.

001293
CSB • US Ink Case Study 4

US Ink Case Study Case Study January 2015

the ingredient mixing process and monitor tank weights and temperatures from a control 

room adjacent to the pre-mix room. An automatic sprinkler system5

 was installed as a fire 

protection feature in the pre-mix room.6

When complete, the mixed suspension contains both combustible and noncombustible 

particulate ink components. The heat generated as the solids are dissolved in the mixing 

tank increases the solution temperature to about 240°F. This increase in operating temperature 

is useful because it ensures complete dispersion of the solid materials into the liquid phase; 

it also contributes to greater evolution of condensable vapors. Once mixing is completed, 

a laboratory technician analyzes ink quality. If cleared, the batch is pumped into an empty 

tank for further processing (milling) and then to another tank in preparation for delivery to 

customers. Each batch weighs about 6,600 pounds when completed. 

1.3 DUST COLLECTION SYSTEM

Before October 2012, the facility used a wet scrubber system7 to collect particulate materials 

during the dry material charging stages of the ink mixing process. However, the scrubbing 

system deteriorated over the years. In addition, the wet scrubber system did not prevent the 

release of fugitive dust into the pre-mix room when new ink formulations used higher 

powdery clay content, producing higher levels of particulate emissions. Therefore, a new 

particulate dust collection system was needed. The new dust collection system was installed 

to improve the management of particulate material and produce an overall improvement in 

the operating conditions of the black ink production process. 

5 The sprinkler system was also connected to an automatic audible alarm. Once the sprinkler system was activated, an automatic signal was 

relayed via an external central monitoring station to the local fire department for immediate response. 

6 During the incident, the sprinklers were activated after the second flash event. 

7 Wet scrubber systems are devices that remove pollutants from a furnace flue gas or from other gas streams. In a wet scrubber, the polluted 

gas stream is brought into contact with the scrubbing liquid by spraying it with the liquid, forcing it through a pool of liquid, or using some other 

contact method to remove the pollutants. Wet scrubbers remove dust particles by capturing them in liquid droplets.

FIGURE 2

Bag dump station

001294
CSB • US Ink Case Study 5

US Ink Case Study Case Study January 2015

A US Ink lead engineer worked in collaboration with the manufacturer of the dust collection 

system8 to design the new dust collection system. The engineer retired before the dust 

collection system was installed and commissioned on Friday, October 5, 2012.9

 The dust 

collection system illustrated in Figure 3 consisted of a branching system of various sizes of 

ducts, including flexible connectors attached to the top of each mixing tank and to the bag 

dump station. The flexible ducts joined an 8-inch duct, which transitioned to a 9-inch duct 

and ultimately a vertical 12-inch duct (riser) going up through the pre-mix room ceiling. 

Dust particles were suctioned though the ducts and riser into the exhaust fan–driven dust 

collector, located on the roof of the facility (Figure 3).

8 Additional design specifications and support were provided by other US Ink engineers and by representatives of the manufacturers of the ductwork, dust collector, and fire explosion suppression and isolation system that was coupled to the dust collection system.

9 In Section 6, Safety Management Analysis, of this report, the CSB concludes that the engineer’s retirement led to a less comprehensive design 

review and commissioning process for the dust collection system.

FIGURE 3

Overview of the newly 

installed dust collection 

system

001295
CSB • US Ink Case Study 6

US Ink Case Study Case Study January 2015

The roof-mounted dust collector used an eight (four rows of two each) cylindrical filter 

cartridge system to remove the residual particulate dust. Dust-laden air and vapor from 

the mixing tanks entered the collector above the four cylindrical filter cartridges and was 

drawn down over the cartridges, where the dust was removed from the air stream. The 

dust collector was mounted with a 25-horsepower (hp) fan and an inlet total static pressure 

rating of a 17-inch water column. The 25-hp fan was designed to convey dust up to the 

collector at an airflow volume rate of 3,300 cubic feet per minute. The dust collector was 

mounted with a system fan with a 25-hp motor. The mounted fan for the dust collector 

discharged through a high-efficiency particulate air (HEPA) filter and then into the atmosphere. 

Compressed air periodically pulsed through the filter cartridges to dislodge the filtered 

dust into the hopper of the dust collection system. The collected dust was recycled into the 

ink-making process. A rotary airlock on the bottom of the hopper used gravity to control 

the discharge of recycled fugitive dust from the collector and back into the mixing tank 

(T-106) for reprocessing in the pre-mix room. Beyond the rotary air lock valve, the 10-inchdiameter pipe reduced to 4 inches in diameter at T-106.

The company added three housekeeping connections, not included in the initial design, to 

the vacuum system of the dust collection system for operator use in picking up dust and 

other debris in the pre-mix room.10 This auxiliary equipment attached to the ductwork 

associated with the bag dump station and to the main ducts above T-206 and T-306. The 

dust collector included an explosion suppression system (shown in Figure 4 and Figure 5), 

which would actuate and release the suppressant, sodium bicarbonate, if a rapid pressure 

increase occurred in the dust collector. The design intent focused on preventing damaging 

explosive overpressures in the collector and inlet duct in the event of a drastic pressure rise 

and on containing any explosion hazard within the dust collector.11 Fike Corporation12

manufactured the explosion suppression and chemical isolation system, and the designers 

recognized the explosion hazard associated with dust. 

US Ink/Sun Chemical Corporation provided information—including specification of the raw 

materials utilized in the black ink pre-mix process, flash point of oils, and dust deflagration 

index (KST) values for solid ingredients—to the manufacturer of the explosion suppression 

and isolation system. Although US Ink/Sun Chemical originally considered a roof-mounted 

dust collector equipped with explosion vent panels for explosion protection and with a 

mechanical isolation valve, US Ink decided instead to use an explosion suppression and 

chemical isolation system. US Ink based this decision on reduced installation costs and 

external recommendations (from Fike and the third-party property loss prevention and risk 

management consultants hired by US Ink) to avoid any potential environmental releases of 

combustible dust particulates (or fire) into areas near residences.

The new dust collection system was commissioned at the facility in the week preceding the 

incident. The flash fire occurred in the dust collection system during the first day of normal 

production after initial equipment start-up, on Tuesday, October 9, 2012. 

10 The dust collection system design included four dust pickup points: three housekeeping connections and the opening at the bag dump station. 

The ductwork at the top of each mixing tank had a connection (6 inches in diameter) for dust collection, and two 6-inch connections at the bag 

dump hood allowed suctioning of dust particles from the dumping station. In addition, three 3-inch ducts were reduced to 1.5 inches in diameter 

for vacuum cleaning hoses that were added to the ductwork design for housekeeping purposes.

11 The explosion suppression system would actuate and inject sodium bicarbonate via an independent suppression container and chemical isolation 

container located at two injection points in the system: the dust collector hopper (Figure 4) and the collector inlet riser (Figure 5). The suppressant 

was designed to be injected if a rapid pressure rise occurred in the dust collector and was intended to suppress a flame front from propagating 

from the dust collector back through the riser into the interconnected ductwork and pre-mix room.

12 See www.fike.com.

001296
CSB • US Ink Case Study 7

US Ink Case Study Case Study January 2015

FIGURE 4

Dust collector with 

explosion suppressant

FIGURE 5

Dust collector inlet with 

explosion isolation

Inlet riser (to dust collector) Explosion isolation container

Dust 

collector 

hopper

Explosion suppression 

container

001297
CSB • US Ink Case Study 8

US Ink Case Study Case Study January 2015

1.4 MATERIALS INVOLVED IN THE INCIDENT

The US Ink facility produces black and color oil-based inks for various clients but primarily 

for the print media industry. A typical black ink formulation at the East Rutherford plant 

includes the following ingredients: 

• Petroleum napthenic distillate13 (product name: Raffene® 750K oil)

• An alternative petroleum distillate (product name: mineral seal oil)

• Natural asphalt resin particulate (product name: Gilsonite14)

• Carbon black particulate pigment (product name: Printex 31015)

• Bentonite (aluminum silicate clay) particulate (product name: Bentone 34)

• An alternative aluminum silicate clay (product name: kaolin)

• Tall oil fatty acid, a minor ingredient (additive)

Gilsonite and carbon black are combustible while the petroleum distillate is flammable, 

so they can be considered as possible contributors to the formation of the explosive 

atmosphere on the day of the incident.16 The boiling points and flash points of the two oils 

are listed in Table 1. 

Mineral seal oil18 is more volatile than Raffene oil, but the flash points of both oils are 

sufficiently high (more than 200°F) to make them Class IIIB liquids according to the 

combustible liquids classification in the National Fire Protection Association (NFPA) code 

NFPA 30, Flammable and Combustible Liquids Code.19 Occasionally, US Ink also used 

linseed oil, but not in the batches blended before the incident.

13 Petroleum distillates (e.g., hydrocarbons such as mineral spirits, kerosene, white spirits, and naphtha) are often used as an organic solvent in 

painting and decorating (http://www.northerntails.com/images/What_are_Petroleum_Distillates.pdf). Heavier fractions such as naphthenic or 

paraffinic distillates are often used in ink manufacturing processes.

14 Gilsonite, a resinous hydrocarbon, is widely used as the primary carbon black wetting agent for black news inks and heat set and gravure inks. 

Gilsonite has a National Fire Protection Association (NFPA) flammability rating of 1, and special precautions warn that dust is subject to explosion 

upon contact with sparks, open flames, or temperatures in excess of 1,000°F (570°C).

15 Carbon black, with a particle size of PM-10 (particles with a diameter of 10 micrometers or less), is an odorless and insoluble powder with an 

atoignition temperature greater than 284°F. It can burn or smolder (decompose) at temperatures greater than 572°F and is virtually pure elemental 

carbon in the form of colloidal particles that are produced by incomplete combustion or thermal decomposition of gaseous or liquid hydrocarbons 

under controlled conditions. Although some grades of carbon black are sufficiently electrically nonconductive to allow a static charge buildup 

during handling, dust at sufficient concentrations can form explosive mixtures with air. Carbon black has an NFPA flammability rating of 1. 

16 The American Gilsonite Company Material Safety Data Sheet (MSDS) for Gilsonite resin indicates that Gilsonite is not hazardous; however, in the 

storing and handling section, the MSDS states, “Avoid raising any powdered material into dust explosion hazard.” The MSDS for carbon black 

states that OSHA classifies the product as hazardous and that dust at sufficient concentrations can form explosive mixtures with air. The MSDSs 

do not reference NFPA standards except in a carbon black MSDS where NFPA ratings are provided. Sun Chemical did have guidance on 

combustible dust (SunCare HSE Procedure 065, Combustible Dust), which included a section for references that listed NFPA 35, 68, 77, 484, 

and 654.

17 Citgo Petroleum Corporation, Mineral Seal Oil Material Safety Data Sheet (http://www.docs.citgo.com/msds_pi/19540.pdf). 

18 The Citgo mineral seal oil MSDS suggests that it can burn but does not readily ignite. Mineral seal oil releases vapors when heated above the 

flash point temperature. In addition, it can ignite when exposed to a source of ignition. In enclosed spaces (such as the ductwork of the dust 

collection system), heated mineral seal oil vapor can ignite with explosive force. Mists or sprays can burn at temperatures below the flash point 

(http://www.docs.citgo.com/msds_pi/19540.pdf).

TABLE 1. OIL PROPERTIES (FROM MATERIAL SAFETY DATA SHEETS)

Property Raffene Oil 

750K

Mineral Seal 

Oil17

Open cup flash point 360°F 275°F

Initial boiling point 550°F 492°F

Autoignition temperature Not given Not given

001298
CSB • US Ink Case Study 9

US Ink Case Study Case Study January 2015

2.0 INCIDENT DESCRIPTION

2.1 EVENTS BEFORE THE INCIDENT

The new dust collection system for the pre-mix room was commissioned for service on the 

morning of Friday, October 5, 2012, and then operated until the end of the production 

shift at 3:00 pm EST.20 At commissioning, US Ink employees who would operate the system 

(several black ink production supervisors and one of the day-shift operators) received 15 

minutes of operational training and instruction as well as a walkthrough of the Fike 

explosion suppression and isolation system.21 Both the dust collection system and the Fike 

explosion suppression and isolation system were equipped with control panels (containing 

system status indicator lights), installed on the wall near the pre-mix room (Figure 1). As 

designed, the dust collection system started automatically when any of the mixing tank 

motors was energized and automatically shut off (after a specified delay) when all mixers 

were inactive. However, the dust collection system actually continued to run overnight, even 

when all the ink mixers were shut off.22

On Saturday, October 6, 2012, the plant maintenance employees used housekeeping 

connections on the new dust collection system to vacuum dust and debris in the pre-mix 

room. A US Ink maintenance employee reported in an interview that upon his arrival on 

Saturday, although the mixing tanks were shut down the night before, the dust collection 

system had run all night, a departure from the initial design intent of automatic start-up 

and shutdown, in sync with the mixing tanks.23 At the end of housekeeping activities, 

a maintenance employee manually shut down the dust collection system. Although the 

maintenance employee reported the dust collection system equipment malfunction to his 

superiors and to the electrical contractor that wired the dust collection system, US Ink/

Sun Chemical Corporation management took no action to immediately investigate the 

failure or to shut down the ink mixing operation until the malfunction was corrected.24

Employees restarted the mixing tanks and the dust collection system on the Monday night 

shift, October 8, 2012, in preparation for the production runs scheduled for Tuesday, 

October 9, 2012.

19 NFPA, a nonprofit standards organization, has been developing standards since 1896 that directly affect fire services at the department level. 

NFPA produces more than 300 consensus codes and standards intended to minimize the possibility and effects of fire and other risks (http://

www.nfpa.org/about-nfpa). The codes are voluntary standards that industry can adopt and regulatory agencies can enforce. Standards are an 

attempt by an industry or profession to self-regulate by establishing minimal operating, performance, or safety criteria.

20 Representatives from Fike had earlier provided a system orientation of the explosion suppression and isolation system to the US Ink maintenance 

staff on October 1, 2012.

21 Section 5, Engineering Design Analysis, includes a discussion of the failure to conduct system performance measurement at start-up and commissioning of the dust collection system.

22 The dust collection system was designed to be controlled by a controller whenever it was running, and the controller was set up to continuously 

control the fan and pulse jets whenever the dust collection system was in operation. However, the automatic shutoff did not engage as designed 

once the system was energized and thus had to be manually turned off and on by US Ink maintenance employees and pre-mix room operators.

23 The CSB did not find any evidence that the automatic start system worked in sync with the mixing tanks at commissioning.

24 US Ink/Sun Chemical Corporation management did not give stop-work authority to the maintenance employee or the night-shift pre-mix room 

operator to shut down dust collection system operation once a malfunction was reported. US Ink claimed it encouraged employees to report 

unsafe acts; however, the CSB did not find any record of a US Ink requirement for employees to shut down any equipment perceived as faulty 

that could lead to an unsafe condition or hazards. This lapse in management oversight allowed the dust collection system to continue running 

during the ink mixing operation until the system eventually failed on Tuesday, October 9, 2012.

001299
CSB • US Ink Case Study 10

US Ink Case Study Case Study January 2015

2.2 ONSET OF FLASH FIRE AND EXPLOSION 

On Tuesday morning, October 9, 2012, black ink production continued, with batches being 

run in all three mixers. When the batch in T-306 was completed, the pre-mix room operator 

emptied the tank. The operator left for lunch at about noon and returned to the pre-mix 

room at about 12:30 pm EST. At that time, a new ink batch was started in T 306. At about 

1:00 pm, the pre-mix room operator was loading Gilsonite into the bag dump station 

(Figure 1) when he heard a strange (squealing)25 noise from T-206. Because of the odd noise, 

the operator went to the control room to check the mixing tank temperature and speed to 

confirm that the equipment was working properly. As he left the control room, he saw a 

flash fire originating from the bag dump station where he had just been working. Without 

shutting down the mixing operation and the dust collection system from the control panels 

near the pre-mix room, the operator immediately proceeded to his supervisor’s office to alert 

him of the fire, moving away from the pre-mix room. At about the same time, other workers 

heard a loud thump that shook the building. 

In response to the flash from the bag dump station and the subsequent loud thump, workers 

congregated at the entrance to the pre-mix room. Employees stated that the rubberized 

spiral-wound duct hose material that connected T-306 to the dust collection riser appeared 

to be melting and dripping onto the tank (Figure 6).

25 The squealing noise signaled a possible increase in the amperage, which would have necessitated the addition of more oil to the mixing tank. The 

pre-mix room operator testified to the CSB that upon checking the amperage chart for the mixing tanks, he discovered that everything was fine.

FIGURE 6

Burned ductwork over 

T-306

001300
CSB • US Ink Case Study 11

US Ink Case Study Case Study January 2015

2.3 INCIDENT AND INJURIES

Two employees retrieved fire extinguishers to put out the flames. One employee ascended 

the stairs near T-306 in an attempt to extinguish the flames. The employee reported 

that before he was in position to discharge the extinguisher, he heard a “sizzling” sound 

from T-306 and saw an orange fireball erupt, advancing toward him. He squeezed the 

extinguisher handle and jumped from the stairs as fire erupted from the tank. The flames 

engulfed him and six other employees who were positioned outside the pre-mix room 

doorway. 

Another employee who approached the pre-mix room area noticed that the lights on 

the alarm panel for the dust collector explosion suppression system were red, indicating 

detection of a pressure rise and activation of the system. However, this system did not 

produce an audible alarm.26 The employee alerted the other workers in the area that the 

explosion suppression system had activated and there was a fire. Just seconds before 

the large flash fire at T-306, the employee retreated from the pre-mix room area to call 

911, but after running 25 to 30 feet, he was knocked to the ground by the pressure wave 

caused by the fireball. Witnesses observed not only the initial fireball from T-306 but also 

a thick black cloud venting into the corridor27 just ahead of the fireball, and they reported 

an audible “whoosh.” These observations are consistent with the sights and sounds of a 

combustible dust deflagration.28

All employee burn injuries resulted from the large flash fire and heated dust mixture 

that originated from above T-306 and propagated into the corridor from the entrance of 

the pre-mix room. The injured employees had clothing covered in black dust, and they 

experienced burns to exposed skin. Some burns occurred after their clothing ignited from 

the fireball. The injuries consisted mostly of burns to upper torsos, arms, necks, and heads. 

Other employees helped the injured employees out of the plant, and emergency responders 

transported the injured to hospitals. One of the injured employees was wearing a shortsleeve T-shirt that day and sustained third-degree burns on his left arm, neck, and upper 

torso. The employees were not wearing flame-resistant clothing (FRC). 

To reduce the risk of thermal injury from flash fire incidents in production-related 

operations, workers are required to wear FRC. As part of its personal protective equipment 

(PPE) standard (29 CFR 1910.132), OSHA requires employers to provide workers with 

FRC in workplaces when flash fire or explosion hazards are present.29 This standard 

also mandates that employers must conduct a hazard assessment of their workplaces to 

identify hazards that require the use of protective equipment. Because the US Ink facility 

26 US Ink/Sun Chemical maintained that Fike did not fulfill its requirement to fully install and ensure the operation of an audible alarm, despite providing 

an initial specification that indicated the presence of an audible alarm. Best practices indicate that US Ink should not have accepted the new dust 

collector as complete if system start-up checks revealed that the audible alarms were not working as expected. Fike attested that the local visual 

and audible alarm for the explosion suppression and isolation control was operating when verified on October 1, 2012. However, the local audible 

output might not have been heard by US Ink employees on the day of the incident due to the room ambient noise in the room. Also, US Ink did 

not incorporate any other area or building -wide audible or visual alarm or emergency responder notifications into their notification strategy.

27 CSB investigator observations of the ceiling of the US Ink East Rutherford facility shortly after the incident indicated the outward L-shaped path of 

the fireball along the corridor near the pre-mix room.

28 A deflagration is the propagation of a flame through a fuel-air mixture at less than the speed of sound. It can be either a flash fire or an explosion, 

depending on the level and consequences of the pressure generated during flame propagation.

29 FRC can reduce the severity of burn injuries sustained during a flash fire when engineering and administrative controls fail. Usually worn as coveralls, 

FRC is made of treated natural or synthetic fibers that resist burning and withstand heat.

001301
CSB • US Ink Case Study 12

US Ink Case Study Case Study January 2015

did generate dusts, the potential existed for a dust explosion, flash fire, or both. If US Ink 

had followed OSHA standards on hazard assessment and PPE selection, the US Ink/Sun 

Chemical safety managers would have identified “harmful dust” and provided additional 

PPE. NFPA 2113 provides guidance for the selection, use, and maintenance of FRC.30 NFPA 

2113 states, “Factors in determining if flame-resistant garments are required shall include 

the presence of flammable materials in the environment during process operations.” This 

standard would include dust generated during the ink mixing process. The CSB learned that 

no corporate policy required the use of FRC by US Ink plant employees.31

2.4 FIRE DEPARTMENT AND EMERGENCY RESPONSE

The flash fire triggered the fire sprinkler system in the pre-mix room. Firefighters and other 

first responders arrived at the scene of the incident within 3 minutes of the first alarm.32

After they arrived and entered the plant, East Rutherford Fire Department personnel did 

not see any flames in the pre-mix room because the sprinklers had extinguished fires outside 

of the enclosed equipment. 

Although they observed no visible signs of flames after the large flash event at T-306, 

responding firefighters reported that after checking with their heat sensors, they detected 

several ductwork fires and extinguished them with water after separating the affected 

ducts. The firefighters went up to the dust collector on the roof and opened the four covers 

on the cartridges but did not need to extinguish any residual burning materials in the 

collector because the explosion suppression and isolation system, which was designed to 

respond to any explosion within the dust collector, had already prevented the fire from 

entering the dust collector after the initial event. The design of the chemical suppression and 

isolation system protected the dust collector from explosion within the collector but did not 

extinguish any external fires.33

30 National Fire Protection Association, NFPA 2113: Standard on Selection, Care, Use, and Maintenance of Flame-Resistant Garments for Protection 

of Industrial Personnel Against Short-Duration Thermal Exposures, 2012 Edition (Quincy, MA: NFPA, 2012).

31 Sun Chemical Corporation, “Sun Chemical Material Safe Handling Form.” This form indicated the following for recommended personal protective 

equipment (PPE): respirator (organic vapor cartridge) or self-contained breathing PPE apparatus, disposable sleeves worn over long-sleeved uniform tops or disposable Tyvek suit, nitrile or Neoprene gloves, and safety glasses with side shields. In addition, the corporate Health, Safety and 

Environment (HSE) PPE policy lists examples of types of PPE that could be used, including protective clothing; however, FRC is not listed as a 

specific type of protective clothing. Although employees received some communications regarding appropriate PPE, the CSB investigation could 

not find any evidence to indicate that US Ink actually supplied FRC to employees.

32 East Rutherford Fire Department, East Rutherford Fire Department Inspection and Incident Report, October 22, 2012.

33 National Fire Protection Association, NFPA 654-2006: Standard for the Prevention of Fire and Dust Explosions from the Manufacturing, Processing, 

and Handling of Combustible Particulate Solids, Section 7.13.1.2.1. This section states that where both an explosion hazard and a fire hazard 

exist in an air material separator, protection for each type of hazard shall be provided.

001302
CSB • US Ink Case Study 13

US Ink Case Study Case Study January 2015

The CSB investigated three possible points of origin of the fire: within the dust collector, 

within the ductwork above T-306, or within T-306. Chemical test results,34 engineering 

design analysis,35 physical evidence of excessive deformation, heat charring of the ductwork 

directly above T-306, and corroborated witness testimony all indicated that the fire 

originated within the ductwork of the dust collection system. 

3.1 SEQUENCE OF FIRE AND EXPLOSION EVENTS

The CSB concluded that the explosion and flash fires occurred because of continuous 

manually controlled heating of the mixing tanks and operation of the dust collection system 

for several hours after commissioning, with the system continuing to draw condensable 

vapors into the duct. Continuous operation of the dust collection system led to self-heating 

and spontaneous self-ignition of the accumulated sludge-like material and the powdery 

dust mixture of Gilsonite, carbon black, and clay in the ductwork above T-306. As a result 

of this activity, the dust collection system drew air past the site where the spontaneous 

ignition occurred, thereby enhancing combustion of the condensed vapors and combustible 

dust. With the dust collection system still in operation, the air in the system blew the dust 

mixture toward the collector while the fire burned. This situation caused ignition and a 

pressure rise in the dust collector, which was already filled with the blend of Gilsonite, 

carbon black, and clay. 

Although the ignition led to a dust explosion within the dust collector, the pressure rise 

activated the Fike explosion suppression system, which prevented the structural failure of 

the dust collector.36 The pressurized discharge of the explosion suppression canister caused 

the thumping sound that employees heard coming from outside the building. At the same 

time, the ignition at the dust collector and discharge of the 5-liter suppression and 9-liter 

3.0 INCIDENT ANALYSIS 

THREE DISTINCT EVENTS OCCURRED DURING THIS INCIDENT:

1. An employee observed a flash originating from the bag dump station, which attracted 

the attention of several workers in the area.

2. At about the same time, workers heard a large thumping sound that they described 

as coming from overhead, accompanied by a pulse that shook the entire building, 

drawing more workers from their respective workplaces to investigate.

3. After about 2 minutes, seven workers observed an approximately 1-foot flame 

directly over T-306. The flame then gained additional energy from the powdery 

mixture of accumulated carbon black, Gilsonite, and clay in the ductwork of the dust 

collection system. The mixture acted as fuel, and the fire flashed over the assembled 

workers in the doorway of the pre-mix room. 

34 Chemical test results are discussed in detail in Section 4, Sample Test Results and Incident Implications.

35 Engineering design analysis is covered in detail in Section 5, Engineering Design Analysis.

36 The Fike explosion suppression and isolation system prevented the structural failure of the dust collector by suppressing the deflagration and 

isolating the dust collector as designed. 

001303
CSB • US Ink Case Study 14

US Ink Case Study Case Study January 2015

isolation canisters created a pressure spike of 4.4 pounds per square inch gauge (psig) in 

the dust collector and caused the flame front to propagate counter-current toward the 

mixing tanks. This rapid pressure rise (and the associated rapid flame propagation back 

through the ducting) triggered an initial flash fire at the bag dump station and within the 

rubberized ducts above T-306 (where the second and more volatile flash fire occurred). 

After the incident, the CSB learned that the design total suppression pressure (maximum 

design pressure for suppressed explosion) predicted for the dust collector was 3.8 psig. The 

increase in the total suppression pressure occurred because of the higher rate of pressure 

rise of the dust mixture compared to the expected design KST of 165 bar-meters per second 

(bar-m/sec).37

3.2 FIKE EXPLOSION SUPPRESSION SYSTEM DATA

Suppression Systems Incorporated (SSI)38, a Fike distributor, provided pressure sensor data 

retrieved from the memory of the Fike system, using plots attached to a December 2012 

Fike incident report. The report indicated that both the 5-liter extinguishing agent container 

on the dust collector and the 9-liter extinguishing agent container on the inlet duct discharged 

as designed on the day of the incident. The pressure sensor data pulled from the Fike system 

on the day of the incident shows the sequence of events in the dust collection system. The 

recorded data are shown in the graph in Figure 7.

37 This is addressed in Table 3, ASTM E1226 dust explosibility test data.

38 SSI is a Fike distributor and the installer of the Fike dust collection system at US Ink.

39 The Fike system design plot is based on a dust explosion hazard corresponding to a maximum pressure (PMax) of 10 bar gauge (barg) and a 

normalized rate of pressure rise (KST) of 165 bar-m/s.

FIGURE 7

Annotated Fike system 

pressure plot 39

001304
CSB • US Ink Case Study 15

US Ink Case Study Case Study January 2015

3.3 IMPACT OF THE ELIMINATION OF THE SCRUBBER SYSTEM

Before installation of the dust collection system, employees observed vapor escaping from 

the mixing tanks. When the wet scrubber system was removed, an unsealed makeshift 

vapor absorbent was installed at the opening of the tank heads. The operators used the 

vapor generation to gauge the speed and temperature of the mixing process. This qualitative 

information was the basis for their adjustment of the mixing process speed and served as 

their indicator of the escape of vapor from the process. Despite this, US Ink maintained 

that the operators relied on their training in the process to properly operate the mixers. In 

addition, the temperature of each of the tanks was measured and available at all times to 

the operators. Moreover, each batch ticket specified the target operating limits, which the 

operator used to prepare each batch of ink.

US Ink/Sun Chemical claimed that each operator was trained to monitor the mixer 

temperature to ensure that it remained sufficiently low and to adjust the mixing operation 

accordingly to mitigate high mixing temperatures. However, one of the plant operators 

testified to CSB investigators that he relied on his individual instincts, observations of 

combustible vapor, and sounds generated during the mixing process to manually adjust 

(from the control room) the speed of the tank mixing agitators. After examining the US 

Ink control room, the CSB concluded that despite the presence of temperature gauges 

and recorders, no temperature control system governed the mixing tanks and that the ink 

mixing process design did not define any safe temperatures. With no automatic temperature 

control and no guidelines, plant operators relied on individual instincts, observations of 

vapor from combustible liquids, and sounds generated during the mixing process as the 

basis for manually adjusting (from the control room) the speed of the tank mixing agitators. 

After installation of the dust collection system, operators in the pre-mix room could not 

observe the vapor and use it as an indicator because the dust collection system metal ducts 

were connected to the opening of the mixing tank heads. In addition, after removal of the 

scrubber system, the combustible vapor generated by the ink mixing operation could no 

longer be eliminated because the new dust collection system was not designed to release 

condensable vapor. The vapors subsequently were trapped within the ductwork of the dust 

collection system.40

3.4 PHYSICAL ANALYSIS OF THE BUILDING AND MIXING TANKS

Although minor cracks were visible on the exterior of the building wall, this incident caused 

no apparent structural damage to the building. Equipment in the pre-mix room (including 

ductwork, motors, electrical cables, and conduit) sustained extensive thermal damage. 

Portions of the dust collection ducting were separated, and at least one housekeeping 

connection end cap blew off. Moreover, extensive smoke and dust deposits accumulated 

on the structure and equipment surfaces in the hallway (ostensibly caused by the burning 

fireball) and around the pre-mix room. 

After the incident, the CSB commissioned a visual and video borescope inspection41 of the 

mixing tank (T-306) to determine whether the second flash fire originated within T-306. 

The inspectors opened the top hatch and found the liquid level just below the set of toothed 

vertical agitation blades. Thick ink coatings were apparent on the visible portions of the 

interior walls and the top of the tank. The tank and mixing elements showed no indication 

40 Section 5, Engineering Design Analysis, discusses the lack of consideration of the presence of condensable vapor in the ductwork.

41 A borescope is an optical instrument used to inspect work areas or the inside of structures that are inaccessible by other means. The 

borescope is often inserted into the structure or work area through a small hole.

001305
CSB • US Ink Case Study 16

US Ink Case Study Case Study January 2015

of thermal degradation. In addition, the inspectors removed the motor of the overhead 

agitator on T-306 to check for damage to the agitation blades and found no major damage, 

only regular wear on the blade edges.

4.0 SAMPLE TEST RESULTS 

AND INCIDENT IMPLICATIONS

The CSB observed removal of the dust collection system ductwork in December 2012. 

Investigators collected residue samples from six sections of the entire ductwork system 

(shown in Figure 8). They inspected the interior of various ductwork sections and took 

material samples from inside the ducts. These inspections revealed large accumulations of 

black, burned, and unburned materials. Most of the accumulations appeared to be black 

sludge–like material. The CSB investigators collected samples of the sludge-like material for 

further chemical composition analysis and testing to develop possible ignition scenarios.

Several different types of tests were conducted on the samples. Chemical composition 

analyses were performed, using Fourier transform infrared spectrometry and gas 

chromatography/mass spectrometry. Ignitability and dust explosibility tests were conducted, 

FIGURE 8

Ductwork sections for 

sampling

001306
CSB • US Ink Case Study 17

US Ink Case Study Case Study January 2015

using the ASTM International42 standard test method for ignition temperatures, minimum 

ignition energy, and dust explosibility. The composition analysis showed that the duct 

sludge was a mixture of hydrocarbon oil, clay, and carbon black. Table 2 lists the different 

tests performed to develop possible ignition scenarios and the associated results.

TABLE 2. TEST RESULTS

Sample Description Test Conducted Values

750 oil from supply tank Closed cup flash point 378°F

Oil from T-306 Closed cup flash point 392°F

Oil from T-206 Closed cup flash point 338°F

Oil from T-106 Closed cup flash point 361°F

Carbon black Hot air over layer ignition 

temperature

676°F

Gilsonite Hot air over layer ignition 

temperature

453°F

Carbon black Dust cloud minimum 

ignition energy

>10 J

Gilsonite43 Dust cloud minimum 

ignition energy

<3 mJ

Residue from duct section 2 Self-heating onset 

temperature

340°F

Residue from duct section 2 

(lower region)

Spontaneous heating value 1°F

Residue from duct section 2 

(upper region)

Spontaneous heating value 0°F

Residue from duct section 3 Spontaneous heating value 0°F

Residue from duct section 4 

(lower region)

Spontaneous heating value44 0°F

Residue from duct section 4 

(middle region)

Spontaneous heating value 3°F

Residue from duct section 4 

(upper region)

Spontaneous heating value 4°F

42 ASTM International (formerly the American Society for Testing and Materials) is a standards organization that develops, publishes, and delivers 

voluntary international consensus technical standards (http://www.astm.org/ABOUT/overview.html).

43 Previous incidents involving Gilsonite fires and explosions have occurred in underground mines. One such incident occurred in December 1910 in 

an asphalt mine in Oklahoma. In 1945, a fire resulted from a Gilsonite explosion at the Bonanza Mine in Utah. In 1953, a violent explosion and fire 

at the only Gilsonite mine in Utah killed eight miners (http://www3.gendisasters.com/utah/8897/bonanza-ut-mine-blast-kills-eight-nov-1953).

44 ASTM International, ASTM 3523-92: Standard Test Method for Spontaneous Heating Values of Liquids and Solids (Differential Mackey Test). 

According to this method, the spontaneous heating value of a substance is a measure of the ability of that substance to undergo self-heating 

reactions while supported by cellulosic or other fibrous materials in the air. It is an index of the autoignition tendency of the substance under such 

conditions. The spontaneous heating value can be lower than the test temperature. A negative result does not preclude spontaneous heating 

initiating at a temperature higher than the test temperature.

001307
CSB • US Ink Case Study 18

US Ink Case Study Case Study January 2015

4.1 IGNITION TEMPERATURE AND SPONTANEOUS HEATING TESTS

The oil flash points and powder layer ignition temperatures are all higher than both the 

typical 240°F temperature for the mixing tanks and the maximum 300°F recorded for T-306 

and T-106 on the day of the incident. The spontaneous heating data indicate a low tendency 

for spontaneous residue heating at temperatures around 180°F. Although the residue selfheating onset temperature was 340°F, the duct sludge before the incident would have had 

a lower self-heating onset temperature because it would have contained the more volatile 

components subsequently driven off during the incident fires.

4.2.MINIMUM IGNITION ENERGY TESTS

Minimum ignition energy (MIE)45 tests were conducted for Gilsonite and carbon black dust 

to determine their level of susceptibility to electrostatic discharge.46 The low MIE measured 

for the Gilsonite sample, less than 3 millijoules (mJ) demonstrated that Gilsonite47 dust 

clouds are susceptible to ignition from electrostatic discharges. However, the Gilsonite in the 

main trunk of the dust collector ductwork was mixed with carbon black and with oil vapor 

condensates. Because the carbon black was conductive, it greatly reduced the chances for 

electrostatic charging of high-resistivity materials such as the dust collector filter cartridges. 

Furthermore, the carbon black had a high MIE, more than 10 joules (J), making it not 

susceptible to electrostatic discharge ignitions unless mixed with enough Gilsonite to produce 

a mixture with an MIE less than 100 mJ. Therefore, electrostatic discharge ignition in the 

dust collector was less likely than the scenario described previously (i.e., duct accumulation, 

self-heating, and autoignition).

4.3.DUST EXPLOSIBILITY TESTS

The CSB conducted ASTM E122648 explosibility tests to determine the explosion severity 

of the dust involved in this incident. Table 3 shows the resulting explosion pressure (PMax) 

and normalized maximum rate of pressure rise (KST) values for carbon black, Gilsonite, and 

dust samples collected within the dust collector. 

TABLE 3. ASTM E1226 DUST EXPLOSIBILITY TEST DATA

Dust Sample Material Particle Size Tested Pmax (barg) KST (bar-m/sec)

Carbon black 98% <75 μm 8.0 98

Gilsonite (first sample) 98% <75 μm 8.1 199

Gilsonite (second sample) 97% <75 μm 7.5 235

Dust collector sample 1 98% <75 μm 8.3 123

Dust collector sample 2 98% <75 μm 7.6 102

45 MIE is the minimum amount of energy required to ignite a combustible vapor, gas, or dust cloud.

46 An electrostatic discharge occurs when two separated surfaces come into contact and then accumulated charges are transferred from one 

surface to the other via a discharge. For an electrostatic discharge to occur, one of the surfaces must be highly electrically insulating.

47 The National Institute for Occupational Safety and Health conducted explosibility testing based on experimental mine explosions that indicated 

Gilsonite is 84 percent volatile, much higher than coal dust at 36 percent volatile (http://www.msha.gov/S&HINFO/RockDusting/JLP-Exp-Minepaper%20emald.pdf).

48 ASTM International, ASTM E1226: Standard Test Method for Pressure and Rate of Pressure Rise of Combustible Dusts. This method indicates 

that the values for maximum explosion pressure (PMAX) and maximum rate of pressure rise are determined by using a 1-cubic-meter (m3) or 

20-liter sphere test apparatus. The dust sample is dispersed within the sphere and ignited by chemical igniters, and the pressure of the resulting 

explosion is measured. The cloud concentration is varied to determine the optimal dust concentration. The PMAX and maximum rate of pressure 

rise are measured and used to calculate the dust deflagration index (KST) value of the dust cloud. These data can be used to design dust explosion 

protection measures (such as explosion relief venting, suppression, and containment) and to classify the explosion severity of a material.

001308
CSB • US Ink Case Study 19

US Ink Case Study Case Study January 2015

According to an SSI system design drawing, the design for the Fike dust collector explosion 

suppression and isolation system was based on a dust explosion hazard corresponding to 

a maximum pressure (PMax) of 10 bar gauge (barg) and a normalized rate of pressure rise 

(KST) of 165 bar-m/sec.49 The PMax data for all five dust samples listed in Table 3 were less 

than 10 barg. The obtained KST values for three of the dust samples were less than 165 

bar-m/sec, but the KST values for the two Gilsonite dust samples were more than 165 bar-m/

sec (Table 3). The low MIE and higher KST values indicate that Gilsonite is a faster-burning 

dust that represents both a greater susceptibility to deflagration and a more demanding 

explosion protection system challenge than the specified KST value of 165 bar-m/s.

4.4. GO/NO-GO DUST EXPLOSIBILITY AND SPECIAL FLAMMABILITY TESTS

The go/no-go dust explosibility screening test50 (using a residue sample from the duct) and 

the special sludge oil flammability test were conducted to determine whether the burning 

sludge observed in the duct stub above T-306 after the dust collector explosion also could 

be partially responsible for the second fireball and explosion. The go/no-go explosibility test 

result demonstrated that the residue powder was indeed explosible at dust concentrations 

of 100 grams per cubic meter (g/m3) and higher. The special sludge oil flammability test 

demonstrated that the burning sludge in the duct stub would not ignite the vapors in the 

tank itself if the tank liquid were at a temperature below its flash point, even if the burning 

sludge fell into the tank.

On the basis of all the test results, the CSB concluded that the incident probably started 

with the self-heating and spontaneous ignition of the accumulated sludge (mostly Gilsonite 

and carbon black mixed with hydrocarbon oils) in the ductwork of the dust collection 

system. Transport of the burning sludge to the dust collector caused the dust collection 

explosion. The explosibility of the accumulated sludge and powder deposits in various 

sections of the duct combined with the flame propagation back from the dust collector 

explosion to cause more extensive residual burning in the various duct sections. Dust 

deposits in and around the ducting, including deposits produced from the dust collector 

explosion, dispersed as the US Ink employee climbed the stairs,51 intending to suppress 

the visible flame in the detached flexible duct above Tank 306. The residual flame ignited 

the dispersed dust, and the subsequent fireball dislodged and lifted more dust so that an 

expanding fireball vented through the doorway into the corridor. This expanding fireball (or 

flash fire) was responsible for the multiple burn injuries.

49 Engineers from US Ink provided Fike representatives with values for maximum rate of pressure rise (KST) for combustible materials used in the ink 

manufacturing process based on values that US Ink obtained from material suppliers. 

50 The explosibility screening (go/no-go) test is used in the laboratory to determine whether a powder or dust will explode while in the form of a dust 

cloud when exposed to an ignition source. The test results for a material classify it as either a go type (explosible) or a no-go type (nonexplosible). 

Thus, the test is also known as the go/no-go test.

51 The dust dispersal may have been due to one of the following phenomena: (1) thermal failure of the flexible connection to T-306, (2) vibrations 

caused by the employee climbing the stairs, (3) initiation of the extinguisher discharge, or (4) sudden vaporization of a layer of condensed water 

vapor (produced by the burning sludge and dust) after the water dripped back into the tank and started sinking into the hot oil.

001309
CSB • US Ink Case Study 20

US Ink Case Study Case Study January 2015

5.0 ENGINEERING DESIGN ANALYSIS

CSB interviews with the US Ink design engineer, manufacturer, and distributor for the newly 

installed dust collection system revealed some design deficiencies. The CSB determined that 

improper design and operation of the new dust collection system were major contributing 

factors that led to the October 9, 2012, incident. The dust pickup points in the dust 

collection system pulled excessive quantities of dust and condensable vapors into the 

ductwork, which operated at low conveying velocities (as demonstrated by the quantities 

of accumulated dust found in the ductwork after operating the system for less than 2 days). 

This accumulation in the ductwork was the fuel for the primary deflagration that initiated 

the incident chain of events. 

Other design issues contributing to material accumulation, observed post-incident in the 

ductwork of the dust collection system, include the following (each discussed in more detail 

in a subsequent section, as noted):

• Dust pickups at mix tanks that pulled air through the tank headspaces and extracted 

excessive quantities of condensable vapors and dust into the duct mains (Section 5.1)

• Dust loading from housekeeping dust pickups with insufficient makeup air (Section 5.2)

• Duct blockage because of failure to consider the effect of condensable vapors in the 

ductwork (Section 5.3)

• Blockage of the Dust Collector Dust Fines Chute Because of Design Failure (Section 5.4)

• Duct main blockage from low conveying velocity (Section 5.5)

• Ineffective system checkup at commissioning of the dust collection system (Section 5.6)

• Lack of system controlling parameters for operators to monitor performance and 

detect system degradation (Section 5.7)

• Dust collection system that was not designed to prevent and contain fires or extinguish 

fires (Section 5.8)

5.1. MIXING TANK DUST PICKUPS THAT RELEASED VAPORS AND DUST INTO DUCT MAIN

On the basis of analytical testing of the materials in the ductwork (summarized in Section 

4), the CSB concluded that excessive quantities of condensable vapors were released into 

the ductwork of the dust collection system during its operation. An essential consideration 

in the design of a dust pickup of a dust collection system is how air enters the pickup and 

travels to the connected duct. In a closed system such as the mix tanks, air from the tanks is 

displaced when the tanks are filled with liquid or powders, and air must be drawn into the 

tanks as the liquid ink mixture is pumped out of the tank. At the US Ink East Rutherford 

facility, each of the three mixing tanks in the pre-mix room had a small air bleed duct (1.5 

inches in diameter) on the rectangular powder fill chute from the carbon black delivery 

systems. Also attached was a flexible hose for delivering kaolin clay to the mixing tank. 

The tank was connected to the dust collection system through a flexible duct (6 inches in 

diameter) a few feet from the powder delivery chute (depicted in Figure 3). 

During operation of the mixing tanks and the dust collection system, air entering the tank 

through the 1.5-inch air bleed duct fluidized some of the powder in the chute on the way to 

the mixing tank during powder addition. Once in the tank, the air and some of the powder 

dust mixture traveled across the tank headspace, also picking up condensable vapors before 

exiting the tank in the flexible duct. The air volume admitted through a 1.5-inch duct is not 

001310
CSB • US Ink Case Study 21

US Ink Case Study Case Study January 2015

sufficient for an adequate conveying velocity52 in the 6-inch duct for dust, so only the finest 

particle sizes will continue moving. 

The CSB investigation revealed that the US Ink engineers initially had a design that would 

minimize high dust and condensable vapor loading of the dust collection system. However, 

the final design of the installed dust collection system did not avoid a continuous airflow 

through the tank headspace, which would discharge condensable vapors and dust mixture 

from each of the mixing tank headspaces into the moving air stream in the duct main.

5.2 DUST LOADING FROM HOUSEKEEPING DUST PICKUPS 

WITH INSUFFICIENT MAKEUP AIR 

The addition of three housekeeping hoses to the system contributed additional dust to the 

main ductwork, but not the makeup air needed to convey the additional dust to the dust 

collector. The three (1.5-inch) hoses were connected to the bottom of the adjacent mix 

tank ducts via enlargement to a hose 3 inches in diameter. The American Conference of 

Governmental Industrial Hygienists (ACGIH) Industrial Ventilation Manual (IVM) states, 

“All branches should enter the main at the center of the transition at an angle not to exceed 

45° with 30° preferred in most cases (Figure 5-23).”53 In addition, ACGIH noted, “To 

minimize turbulence and possible particulate fall out, connections should be to the top or 

side of the main with no two branches entering at opposite sides.”54 The ductwork design 

for the US Ink dust collection system did not comply with this guideline.

The 3-inch ducts were 

disassembled during 

the investigation; they 

were plugged with freeflowing dust, a sign of 

insufficient conveying 

velocity (as illustrated in 

Figure 9). The connection 

of housekeeping hoses to 

a dust collection system 

is not a good practice 

because the pressure drop 

required to move air at 

4,000 feet per minute (ft/

min) in the 1.5-inch hose (1.5 to 2.0 inches of mercury or 20 to 27 inches of water column) 

is much greater than the available system static pressure of 17 inches of water column. In 

addition, doubling the duct diameter reduced the air velocity to less than 25 percent of that 

available in the hose, plugging the 3-inch duct in less than 2 days of operation.

52 Conveying velocity is the minimum air velocity required to move or transport particles within a duct system. It is measured in feet per minute 

(ft/min).

53 At the time of the incident, the 2007 edition of the IVM provided the applicable guidance; however, since then, ACGIH revised the guidance and 

published a 2013 edition of the IVM.

54 American Conference of Governmental Industrial Hygienists, Industrial Ventilation: A Manual of Recommended Practice for Design, 26th Edition 

(Cincinnati, OH: ACGIH, 2007) 5-27.

FIGURE 9

Vacuum cleaning ducts, 

plugged after less than 2 

days of operation

001311
CSB • US Ink Case Study 22

US Ink Case Study Case Study January 2015

5.3 DUCT BLOCKAGE BECAUSE OF FAILURE TO CONSIDER EFFECT OF VAPORS AND 

DUST IN DUCTWORK

The design of ductwork for the dust collection system did not reflect consideration of the 

presence of condensable vapor generated by the high temperature of the ink mixing process. 

US Ink did not make any provisions to prevent or clean out the uncontrolled condensation. 

The ACGIH IVM states, “If solid particulates or condensable vapors are being transported 

through the system, a minimum velocity is required.”55 The CSB concluded that the failure 

to consider the effect of condensable vapors in the design of the dust collection system led 

to formation of the sludge in the ductwork. In addition, the condensable vapors mixed with 

the dust, forming either a sludge in the duct or a cohesive dust in the dust collector.

The CSB learned that the system volume capacity for the US Ink dust collection system was 

3,300 actual cubic feet56 per minute (ACFM)57 at 210°F, while the design for 6-inch duct 

velocity indicated at an estimated airflow rate of 1,150 ft/min. On the basis of a review of 

the heavy or moist dust description in Table 5-1 of the ACGIH IVM,58 a minimum duct 

conveying or transport velocity of 4,500 ft/min would have been more appropriate for the 

design of the dust collection system at US Ink.59

The ACGIH IVM provides research data and information on the design, maintenance, 

and evaluation of industrial exhaust ventilation systems that are applicable to the US Ink 

dust collection system. A design minimum conveying velocity of 4,500 ft/min could have 

provided a more effective means of moving any moist dust within the dust collection 

system. US Ink did not provide any information or record that the engineers responsible 

for design and installation of the new dust collection system measured the dust conveying 

velocity of the system at commissioning. NFPA 654-2006,60 paragraph 7.6.1, states, “Ducts 

that handle combustible particulate solids shall conform to the requirements of NFPA 

91.” NFPA 654 (2006 edition)61 and NFPA 91 (2010 edition)62 note the requirement, “All 

ductwork shall be sized to provide the air volume and air velocity necessary to keep the 

duct interior clean and free of residual material.”

55 American Conference of Governmental Industrial Hygienists, Industrial Ventilation: A Manual of Recommended Practice for Design, 26th Edition 

(Cincinnati, OH: ACGIH, 2007) 5-10.

56 An initial US Ink dust collection system design intent drawing allotted 500 cubic feet per minute (cfm) exhaust to each mix tank and 1000 cfm to 

the bag dump. Another 300 cfm was allotted for the three cleanup hoses. A later order confirmation placed the system volume capacity at 3,300 

acfm at 210oF.

57 ACFM is a unit of volumetric capacity commonly used by manufacturers of blowers and compressors. This capacity is the actual gas delivery with 

reference to inlet conditions; it is the volume of gas (air) flowing anywhere in a system, independent of its density.

58 American Conference of Governmental Industrial Hygienists, Industrial Ventilation: A Manual of Recommended Practice for Design, 26th Edition 

(Cincinnati, OH: ACGIH, 2007) 5–11.

59 International Association of Plumbing and Mechanical Officials, Uniform Mechanical Code (Ontario, CA: IAPMO, 2009), Table 5-1, 46.

60 National Fire Protection Association, NFPA 654: Standard for the Prevention of Fire and Dust Explosions from the Manufacturing, Processing, and 

Handling of Combustible Particulate Solids, 2006 Edition (Quincy, MA: NFPA, 2006).

61 National Fire Protection Association, NFPA 654: Standard for the Prevention of Fire and Dust Explosions from the Manufacturing, Processing, and 

Handling of Combustible Particulate Solids, 2006 Edition (Quincy, MA: NFPA, 2006), 13.

62 National Fire Protection Association, NFPA 91: Standard for Exhaust Systems for Air Conveying of Vapors, Gases, Mists, and Noncombustible 

Particulate Solids, 2010 Edition (Quincy, MA: NFPA, 2010), 8.

001312
CSB • US Ink Case Study 23

US Ink Case Study Case Study January 2015

5.4 BLOCKAGE OF THE DUST COLLECTOR DUST FINES CHUTE 

BECAUSE OF DESIGN FAILURE

The dust collector dust hopper and dust fines chute were filled with approximately 322 

pounds of dust fines in just 2 days of system operation. The 10-inch-diameter chute reduced 

to 4 inches in diameter to return the fines to the mix tank. The cohesive dust in the 10-inchdiameter chute bridged the opening and did not flow through the 4-inch chute. The dust 

chute design did not allow for the stop-and-start nature of dust fines return.63 If the incident 

had not halted operation of the process, the dust collector would have been plugged within 

a few more days of operation.

5.5 DUCT MAIN BLOCKAGE FROM LOW CONVEYING VELOCITY

The duct main64 had insufficient conveying velocity until the three-way junction where 

the bag dump branch and the duct-mounted air bleed joined the duct from the three mix 

tanks and the housekeeping system pickups. The small 1.5-inch-diameter mix tank air 

bleeds would not admit enough air for conveying velocity in the 6-inch mix tank ducts or 

the 8-inch and 9-inch ducts with combined mix tank exhaust; this configuration created 

conditions in this section of the dust collection system that allowed the accumulation of 

condensable vapors and dust.65 As stated previously, locating the duct air bleed ahead of the 

first mix tank would have provided a makeup air source for a reliable conveying velocity in 

the duct main.66

5.6 INEFFECTIVE SYSTEM CHECKUP AT COMMISSIONING OF THE DUST 

COLLECTION SYSTEM

Outside contractors performed all construction and installation of the new dust collector. Sun 

Chemical selected two contractors to configure the dust collection system, based on direction 

from the US Ink senior engineer. US Ink/Sun Chemical Corporation did not perform onsite 

risk and hazard assessments before start-up of the new dust collection system to determine 

the effectiveness of performance of the newly installed dust collection system. In addition, 

after contractors completed the dust collection system installation, no onsite inspection or 

measurement of system performance parameters (such as airflow rate and conveying velocity) 

was conducted to ensure that the system was working appropriately.67

No pitot tube68 holes were visible in the ducts, indicating that no system pressure 

measurements were taken at commissioning of the dust collection system. NFPA 91 and 

NFPA 654 require initial system testing, including measurement of all system branches 

to verify that the system delivers target airflows and to set the blast gates as necessary. 

63 Very low conveying velocities in the ductwork, combined with air flow through the dust powder delivered in the chute, ended up putting dust and 

vapors into the duct but did not carry sufficient dust away through the recycle process and back into T-106.

64 The duct main is the section of the ductwork where other incoming duct branches join the main duct.

65 US Ink and its contractors responsible for the efficiency of the dust collection system performance did not perform any measurements to confirm 

the designed air flow rate and conveying velocity.

66 Bag dump and duct air bleeds should have been located at the far end of the duct to provide continuous airflow.

67 US Ink/Sun Chemical maintained that a US Ink contractor engineer performed a brief system start-up to ensure that everything was working 

properly. During that time, the suction of the dust collection system was checked. In addition, the conveying velocity was intended to be manually 

adjusted as production progressed, by use of the weighted damper, to ensure that the system was getting the right amount of suction. Although 

US Ink employees claimed there was too much suction (rather than too little), iterative testing of the process could not be performed to confirm 

actual flow rates as all the drops of dry materials had been completed for the day. Despite this argument by US Ink, the CSB asserts that visual 

observation of the suction rate by US Ink employees does not convey that a system start-up check or measurements were taken to quantify the 

performance and efficiency of the new dust collection system. 

68 A pitot tube is an instrument used to measure air or fluid flow velocity under pressure. The basic pitot tube consists of a tube pointing directly into 

the air or fluid flow. Pressure can be measured based on the level of fluid in the tube. 

001313
CSB • US Ink Case Study 24

US Ink Case Study Case Study January 2015

Section 10.3.1 of NFPA 91 specifies the requirement, “When installation of a new system is 

complete, the system shall be tested to demonstrate performance before acceptance by the 

user.”69 Annex paragraph A.10.3 lists required system test activities, including:

• Measure the air volume, fan static pressure,70 motor speed and electric current, and 

temperature of air in the system

• Determine pressure drops across all components (such as air cleaning equipment)

• Record the test data and design specifications

• Compare the test data with design specifications and determine whether system 

alterations or adjustments are necessary to meet specifications71

The CSB concluded that US Ink/Sun Chemical Corporation did not perform any of 

the previously listed tests after installation of the US Ink dust collection system. The 

commissioning data are critical because they provide a reference point for ongoing system 

monitoring and maintenance to ensure that the dust collection system runs within design 

parameters.

5.7 LACK OF SYSTEM CONTROLLING PARAMETERS FOR OPERATORS 

TO MONITOR PERFORMANCE

Dust collection system designs seek to overcome the anticipated flow resistance of the 

hoods, ducts, dust collector, auxiliary equipment, and exhaust stack. Many possible causes 

for anticipated resistance in these areas could affect system performance. For example, 

dust buildup in a duct reduces flow but increases local duct pressure between the dust 

collector and the plug; an increase in filter differential pressure restricts flow to the entire 

system, reducing hood exhaust airflow and hood static pressures. By knowing the pressure 

profile of different points in the system, as established with a newly commissioned system, 

operators can monitor changes in this information to enable timely interventions to 

keep the system working. Although the US Ink dust collection system had some remote 

indicators of differential pressures for the dust collector and the HEPA filter, none of the 

pressure gauges displayed action limit information, and no local static pressure devices near 

the mixing tanks or the bag dump hood warned the operator of performance problems, as 

recommended in the ACGIH manual, “Industrial Ventilation, A Recommended Practice for 

Operation and Maintenance.”72

69 National Fire Protection Association, NFPA 91: Standard for Exhaust Systems for Air Conveying of Vapors, Gases, Mists, and Noncombustible 

Particulate Solids, 2010 Edition (Quincy, MA: NFPA, 2010), 15.

70 Static pressure (SP) is defined as the pressure in the duct that tends to burst or collapse the duct and is expressed in inches of water gauge. It 

is usually measured with a water manometer, hence the units. SP can be positive or negative with respect to the local atmospheric pressure but 

must be measured perpendicular to the air flow. American Conference of Governmental Industrial Hygienists, Industrial Ventilation Manual, 28th 

Edition (Cincinnati, OH: ACGIH, 2013).

71 National Fire Protection Association, NFPA 91: Standard for Exhaust Systems for Air Conveying of Vapors, Gases, Mists, and Noncombustible 

Particulate Solids, 2010 Edition (Quincy, MA: NFPA, 2010), 18.

72 The ACGIH IVM recommends performing system testing at the time of initial installation (commissioning) to verify the volumetric flow rates and to 

obtain other information that can be compared with the original design data. Initial system testing is also necessary to provide a baseline for periodic 

maintenance checks. The ACGIH IVM recommends static pressure measurements and close visual inspections during maintenance checks if no 

alterations have been made to the system. 

American Conference of Governmental Industrial Hygienists, Industrial Ventilation: A Manual of Recommended Practice for Operation and Maintenance, 

26th Edition (Cincinnati, OH: ACGIH, 2007), Chapter 2, “Commissioning and Proof of Performance.”

001314
CSB • US Ink Case Study 25

US Ink Case Study Case Study January 2015

5.8 DUST COLLECTION SYSTEM NOT DESIGNED TO PREVENT, CONTAIN, OR 

EXTINGUISH FIRES

US Ink employee testimonies revealed that the rubberized flexible hoses were the first part 

of the system to fail when the duct fire started. The US Ink mixing tanks had flexible hose 

lengths of 6 to 8 feet, which increased airflow restriction at the mixing tanks.73 The hose 

lengths of 8 to 10 feet at the bag dump station also added resistance to that branch. US 

Ink maintained that flexible ducts were used because the ink mixers were on weight scales. 

In addition, US Ink believed that the flexible ducts—constructed of Conduct-O-Flex, a 

material which had a conductive spiral core and was specifically intended (and used by US 

Ink) to prevent static buildup—were properly bounded and grounded to the rigid duct and 

mixer connections. The recommended best practice suggests using flexible duct only to aid 

mobility of moving parts or equipment and making lengths as short as possible (usually not 

more than 3 feet).74

In addition, rubberized flexible hoses are not electrically conductive because airborne 

powder moving through a plastic or rubberized hose can generate some static electrical 

charge. Combustible dust particles with a low MIE can ignite because of an electrostatic 

discharge from a nonconductive hose. The combustible flexible hoses used in the dust 

collection system design burned through rapidly and ultimately released the flash fire from 

the top of T-306 into the pre-mix room. The fire did not seriously damage any of the metal 

ducts, but all of the flexible hoses along the fire path suffered severe burns.

A detailed examination of the US Ink dust collection system revealed the absence of duct 

cleanout doors. Duct cleanouts are commonly needed for dust collection systems as part 

of routine system monitoring and maintenance. The ACGIH IVM states, “Where the air 

contaminant includes particulate that may settle in the duct, clean-out doors should be 

provided in horizontal runs, near elbows, junctions, and vertical runs (see Figure 5-17).”75

Cleanout doors provide access to clean out accumulated dust and also serve as locations 

where firefighters can introduce water to fight fires. Because the US Ink facility had no 

cleanout doors,76 the East Rutherford firefighters had to break a section of ductwork to 

apply water to smoldering ductwork sections.

The CSB inspection of the US Ink dust collection system indicated that ducts with crosssections larger than 75 square inches (about 9.5 inches in diameter) did not have an 

automatic fire extinguishing system.77 Chapter 9 of NFPA 91 (2010 edition)78 specifies, 

“Any portion of an exhaust system utilizing combustible components or having the 

potential for combustible residue buildup on the inside, where the duct cross-sectional 

area is greater than or equal to 75 in2

 (480 cm2), shall be provided with an automatic 

73 The flexible hoses used in the dust collection system design were longer than needed and led to failure points during the incident.

74 National Fire Protection Association, NFPA 91: Standard for Exhaust Systems for Air Conveying of Vapors, Gases, Mists, and Noncombustible 

Particulate Solids, 2010 Edition (Quincy, MA: NFPA, 2010). This standard emphasizes the need to minimize the use of flexible hose, using it only 

for equipment that needs to move and then only in lengths as short as possible.

75 American Conference of Governmental Industrial Hygienists, Industrial Ventilation: A Manual of Recommended Practice for Design, 26th Edition 

(Cincinnati, OH: ACGIH, 2007), 5-27.

76 US Ink/Sun Chemical maintained that the dust collection system featured “easy-open” connections between pieces of the ductwork, which enabled 

easy inspection (and cleaning) of the ductwork interiors. US Ink believed that the easy-open connection was used in place of duct cleanout doors 

and as such served a similar purpose. Although the easy-open connection provided a reasonable alternative to the cleanout doors, firefighters 

could not use it to apply water to burning duct sections.

77 The ductwork assembly from section 6 (ductwork that was vertically installed from the pre-mix room up to the rooftop and continuing to the dust 

collector, as shown in Figure 8) was measured at 12 inches in diameter.

78 National Fire Protection Association, NFPA 91: Standard for Exhaust Systems for Air Conveying of Vapors, Gases, Mists, and Noncombustible 

Particulate Solids, 2010 Edition (Quincy, MA: NFPA, 2010), 15.

001315
CSB • US Ink Case Study 26

US Ink Case Study Case Study January 2015

extinguishing system within the duct and at the duct intake, hood, enclosure, or canopy, 

or shall be constructed of material listed for use without sprinkler protection.”79 Although 

the Fike chemical suppression and isolation system attached to the dust collector stopped 

an explosion, it was not designed to extinguish fires, other than preventing backward flame 

propagation from the dust collector past the location of the chemical isolation device.80 In 

addition, incorporating sprinklers or some other extinguishing system in the 12-inch duct 

might have helped minimize duct damage on the day of the incident. Moreover, sprinklers 

are prudent for a dust collector protected by a chemical suppression system because an 

explosion suppression and isolation system is not designed to extinguish a fire in the 

ductwork or in the dust collector. CSB investigations revealed that US Ink engineers and 

the third-party loss prevention and risk management consultants (hired by US Ink/Sun 

Chemical Corporation) considered including internal sprinkler protection and explosion 

venting within the dust collector but ultimately decided against including sprinklers because 

of installation of the Fike explosion suppression and isolation system and because of costeffectiveness factors.

6.0 SAFETY MANAGEMENT ANALYSIS 

The lack of adequate oversight by Sun Chemical Corporation management personnel in 

the planning, design, installation, and commissioning of the dust collection system likely 

contributed to the October 9, 2012, incident. The CSB identified significant management 

issues, including inadequate project oversight, ineffective employee training on the dust 

collection mechanism, and failure to develop and implement corrective actions from a 

previous incident.

6.1 INADEQUATE PROJECT OVERSIGHT

Before design of the new dust collection system, the engineering team filed a Capital 

Appropriations/Asset Request (CAR),81 which contained various levels of approvals from 

the local plant, engineering department, local operations manager, division controller and 

accounting department, corporate environmental health and safety department, and CAR 

approval committee. Sun Chemical project management policy requires the CAR, which must 

be prepared if the total cost of a project exceeds $350,000. The estimate for the US Ink dust 

collection system exceeded $350,000 in capital costs; therefore, a CAR was required. 

In the CAR environmental health and safety section, a checkbox indicating the need for 

a process hazard analysis (PHA) or management of change (MOC) was not checked, 

indicating that neither a PHA nor a MOC was necessary for the dust collection system.82

During interviews with company engineers and senior management, CSB investigators 

79 NFPA 91 is applicable to the incorporation of a sprinkler system in the ductwork design because it is a standard for exhaust systems for air 

conveying of vapors, gases, and mists (all generated from heating of ink ingredients and oils) and for noncombustible particulate solids (such as 

bentonite, used by US Ink).

80 Fike maintains that explosion suppression and chemical isolation device prevented backward flame propagation of a more rapid flame propagation 

speed at a pressure of 4.4 psig than was expected based on the predicted maximum pressure of 3.8 psig at the specified KST value of 165 

bar-m/s. 

81 The CAR system was designed so that Sun Chemical managers, engineers, and company decision-makers could approve projects electronically 

and so that information relating to the approval and rejection of a project could be saved for later reference.

82 The requirements for PHA and MOC procedures are described in: National Fire Protection Association, NFPA 654: Standard for the Prevention of 

Fire and Dust Explosions from the Manufacturing, Processing, and Handling of Combustible Particulate Solids, 2006 Edition (Quincy, MA: NFPA, 

2006), Section 4.2 and Section 4.3.

001316
CSB • US Ink Case Study 27

US Ink Case Study Case Study January 2015

learned that the engineering team considered installation of the dust collection system as 

a replacement in kind for the old wet scrubber system.

The CSB investigation revealed that corporate engineering managers who were responsible 

for executing the US Ink dust collection system project at Sun Chemical relied on the 

judgments and decisions of their reports and did not adequately oversee the dust collection 

system project. The new dust collection system is completely different from the old wet 

scrubber system, with different functions and design specifications. US Ink/Sun Chemical 

management did not seek a building permit for a completely new process because they 

failed to acknowledge that a PHA was required for the new process.83 If a PHA had been 

conducted, it would have triggered consideration of additional safety factors, including 

the need to obtain a building permit. The CSB determined that, as a result, US Ink/Sun 

Chemical management provided inadequate oversight of the capital project.

6.2 INADEQUATE MANAGEMENT OF ORGANIZATION CHANGE AND CONTRACTOR 

OVERSIGHT

A senior engineer who retired from US Ink before completion of the project coordinated 

the design of the dust collection system.84 Upon retirement of the senior engineer, another 

US Ink engineer and an engineering contractor assumed oversight of the dust collection 

project. Although not fully involved in initial design of the dust collection system, the new 

engineers completed contractor hiring and equipment ordering and oversaw installation of 

the dust collection system. There was no record of adequate communication of transitional 

knowledge concerning the handover of the dust collection system from the retired senior 

engineer to the new engineers. External contractors (who were not fully involved in the 

design concept of the dust collection system) performed all construction and installation 

activities for the new dust collection system. The engineers communicated primarily by 

telephone and emails to the subcontractors, without observing the actual installation 

process for the dust collection system.

CSB interviews with the US Ink engineers revealed that US Ink/Sun Chemical Corporation 

lacked an adequate and effective process for management of organizational change. No 

procedures allowed for transferring and retaining design knowledge and forwarding 

information to the new engineer. In this case, the company relied on the retired senior 

engineer solely for technical guidance throughout the design, construction, and installation 

phases of the dust collection system. When the original design engineer left, accountability 

for the dust collection system fell to the new engineer, who was not directly involved in the 

initial design of the dust collection system, and to the in-house contractor engineer, who 

made frequent trips to the East Rutherford facility to observe progress on the installation 

process for the dust collection system. However, US Ink/Sun Chemical claimed to rely on 

the expertise of the manufacturers of the dust collection system and on their contractors 

for smooth operation of the system. As a result, US Ink/Sun Chemical did not provide 

additional contractor oversight for the dust collection project. In addition, the new engineer 

did not consult other company engineers who could support the design, installation, and 

commissioning of the dust collection system. 

83 The US Ink East Rutherford facility was not covered by OSHA process hazard management (PHM). However, NFPA 654 (2006 edition) requires 

that a combustible dust hazard assessment must be conducted and used as the basis for choices in fire and explosion protection systems. In 

addition, conducting an assessment of the major deficiency areas of the dust collection system would have at least triggered the need for PHA.

84 Contractors and manufacturers that specialized in dust collection systems fabricated and installed the dust collection system.

001317
CSB • US Ink Case Study 28

US Ink Case Study Case Study January 2015

6.3 INEFFECTIVE HAZARD COMMUNICATION AND EMERGENCY RESPONSE PLANNING

Employee injuries likely would have been prevented if US Ink had developed and 

implemented an effective hazard communication and emergency response plan. US Ink fire 

and explosion emergency procedures called for a designated chief coordinator to use the 

public address system to announce the fire and its location as soon as it was observed. The 

designee also had the task of pulling the alarm box outside the main office and calling the 

fire department. The plant evacuation plan required all employees to evacuate the building 

immediately after the fire alarm was pulled. On the day of the incident, the designated fire 

coordinator did not perform any of the duties (announcing the fire or pulling the alarm 

box) because he was among those injured while assembled at the entrance to the pre-mix 

room. Although the pre-mix room operator informed the designee about the first flash fire 

from the bag dump station, the employee decided to go to the pre-mix room to observe the 

situation instead of performing his duties as the plant-designated fire coordinator. 

In addition, the US Ink hazard communication and emergency response plan did not 

require that an employee attempt to control a fire with an extinguisher after a manually 

triggered fire alarm was actuated; rather, the plan required employees to evacuate the 

building immediately. Because no fire alarm sounded, employees attempted to extinguish 

the fire. Although all employees eventually evacuated the building, the evacuation did not 

occur until after the injuries were sustained. Witness interviews revealed that although 

the company occasionally conducted training and fire drills, employees did not follow the 

existing emergency response plan on the day of the incident.85 This circumstance indicated 

that the fire hazard and emergency training received by plant employees was inadequate. 

The sprinkler system in the pre-mix room was connected to an automatic audible alarm 

that was relayed to the East Rutherford Fire Department, but no record indicated that 

the automatic fire alarm provided adequate (if any) notification to employees. The CSB 

observed that no other automatic fire alarm system was located anywhere in the US Ink 

East Rutherford facility. An effective automatic fire alarm would have immediately notified 

employees of the flash fires and triggered an immediate evacuation; instead, employees 

congregated at the entrance of the pre-mix room. The manual alarm notification system 

that US Ink adopted was ineffective on the day of the incident. NFPA 72 (National Fire 

Alarm Code, 2007 edition86) specifies requirements for the installation and operation of 

automatic fire alarms and other fire detection systems, including audible and visible fire 

emergency notification systems.

6.4 INEFFECTIVE EMPLOYEE TRAINING ON DUST COLLECTION MECHANISM

After initial start-up of the dust collector, a 15-minute meeting was held on October 5, 

2012, for supervisors and one of the day-shift operators87 and was less than adequate. At 

the meeting, the system manufacturer provided a walkthrough of the dust collection system 

and a brief interpretation of visual indicators. The meeting did not include information 

on how the dust collection system was designed to work and how operators could 

troubleshoot problems. This limited training did not adequately prepare the staff to address 

a malfunction of the dust collection system. In addition, US Ink did not develop a fire or 

85 The CSB review of records for fire safety training and drills indicated that the hazards of combustible dust explosions were communicated to the 

employees; US Ink employees followed the “pre-planned” annual drills; and seven employees were injured on the day of the incident as a result of 

the failure to follow the hazard communication procedures outlined in the training and fire drills.

86 National Fire Protection Association, NFPA 72: National Fire Alarm and Signaling Code, 2007 Edition (Quincy, MA: NFPA, 2007). 

87 The night-shift pre-mix room operator did not receive the 15-minute walkthrough and instructions. 

001318
CSB • US Ink Case Study 29

US Ink Case Study Case Study January 2015

explosion incident prevention program to reinforce employee understanding of the potential 

hazard severity associated with the newly installed dust collection system. Moreover, no 

mechanism was in place for pre-mix room operators to determine changes in dust collection 

system performance.

6.5 FAILURE TO DEVELOP AND IMPLEMENT CORRECTIVE ACTIONS RESULTING FROM A 

PREVIOUS INCIDENT

Before October 9, 2012, a similar fire incident involving a mixing tank occurred at the US 

Ink East Rutherford facility on February 29, 2008, when the East Rutherford Bureau of 

Fire Safety and the East Rutherford Fire Department responded to a fire incident at the US 

Ink facility. The fire occurred in an ink mixing tank (about 80 percent oil and 20 percent 

carbon black). According to the East Rutherford Bureau of Fire Safety, the fire occurred 

because of overheating of ingredients in the mixing tank. The official report documenting 

the emergency response indicated that the ductwork at the top of the tank was consumed 

by the flames generated during the fire. An employee initially attempted to suppress the fire 

with a fire extinguisher but, after failing to do so, exited the building.88 The US Ink security 

service company notified the East Rutherford Fire Department, and responding units 

extinguished the fire. 

No injuries were reported as a result of this previous incident. US Ink did not address any 

lessons learned from this incident. It did not discourage employees from attempting to 

extinguish fires in an environment with flammable vapor and combustible dust. In addition, 

the company did not install temperature indicators and temperature interlocks that would 

activate when the temperature from the ink mixing operation became too high. 

7.0 REGULATORY ANALYSIS

7.1 U.S. OCCUPATIONAL SAFETY AND HEALTH ADMINISTRATION

7.1.1 Combustible Dust Standard

The CSB has investigated multiple combustible dust incidents since 2003. The agency 

initiated a study of dust explosions in general industry after three catastrophic incidents 

in one year, and it issued the Combustible Dust Hazard Study in 2006. This CSB study 

identified 281 combustible dust incidents between 1980 and 2005, which led to the deaths 

of 119 workers, injured 718, and extensively damaged numerous industrial facilities.89 The 

need to control the risk of dust explosions in general industry became apparent, and as a 

result, the Board issued six recommendations; one advocated a new federal OSHA standard 

based on existing NFPA standards for combustible dust. 

The CSB study found that a comprehensive federal regulation specific to combustible 

dust was necessary because the reliance on industry to voluntarily comply with consensus 

standards, fire codes, or both was insufficient to control combustible dust hazards. US Ink 

88 The US Ink hazard communication and emergency response plan did not require an employee to try to control a fire with an extinguisher but 

instead required employees to evacuate the building immediately when a fire alarm sounded. Industry best practices discourage employees from 

attempting to extinguish fires in a combustible dust environment because this approach could be deadly.

89 U.S. Chemical Safety and Hazard Investigation Board, Final Report: Combustible Dust Hazard Study, Investigation Report No. 2006-H-1 (Washington, 

DC: CSB, 2006) (http://www.csb.gov/combustible-dust-hazard-investigation/ and http://www.csb.gov/assets/1/19/Dust_Final_Report_Website_11-17-06.pdf).

001319
CSB • US Ink Case Study 30

US Ink Case Study Case Study January 2015

did not consistently follow NFPA-prescribed design requirements or ACGIH standards 

when designing its new dust collection system (discussed in Section 5). Moreover, OSHA 

enforcement of existing regulations failed to address dust hazards. OSHA initially cited US 

Ink and fined it $25,000 for the October 9, 2012, incident, characterizing the accident as 

a dust explosion. The citations included violations of OSHA standards for exit routes, 

storage and handling of liquefied petroleum gases, portable fire extinguishers, and hazard 

communication. However, many of the listed violations were not causally linked to the flash 

fire that burned the seven workers. Consequently, US Ink corrective actions to address those 

violations would not prevent or mitigate the risk of a future combustible dust incident. OSHA 

inspectors need a comprehensive standard to regulate the design and operation issues of 

processes involving combustible dust to effectively prevent combustible dust incidents. 

Since 2006, the CSB has continued to investigate catastrophic combustible dust incidents 

in all types of industries. For example, just 2 years after the CSB issued its study, an 

explosion of sugar dust at the Imperial Sugar Company manufacturing and packaging 

facility in Port Wentworth, Georgia, killed 14 workers and injured 38 others. In 2010, 

an explosion involving titanium dust ripped through the AL Solutions, Inc., processing 

facility for titanium and zirconium scrap metal in New Cumberland, West Virginia, 

killing three workers and injuring one. Just over a year before the US Ink incident, the 

CSB investigated three iron dust incidents at the Hoeganaes Corporation steel and iron 

powder manufacturing facility in Gallatin, Tennessee, that killed five workers and injured 

three others in 2011. The findings from these investigations reinforced the CSB 2006 study 

findings and led to reiteration of the CSB recommendation to OSHA to issue a combustible 

dust standard and to do so promptly. The CSB also has been tracking combustible dust 

incidents, documenting 50 accidents involving combustible dust that caused 29 fatalities 

and 161 injuries from 2008 to 2012.90

To date, OSHA has not promulgated a combustible dust standard, although it has started 

the rulemaking process. In 2009, OSHA published an Advance Notice of Proposed 

Rulemaking (ANPR) for combustible dust that defines the hazard as “all combustible 

particulate solids of any size, shape, or chemical composition that could present a fire or 

deflagration hazard when suspended in air or other oxidizing medium.” US Ink carbon 

black and Gilsonite powders are characterized as “combustible” according to Material 

Safety Data Sheets (MSDSs) and therefore would be covered by this proposed rule. 

Although the agency has continued to place the combustible dust rule on its regulatory 

agendas over the years, OSHA has not moved forward in rulemaking. As a result, the 

CSB held a public meeting in Washington, DC, on July 25, 2013, declaring OSHA actions 

“unacceptable” because of the delay in issuing a combustible dust standard, and the CSB 

also placed the issue of combustible dust on its Most Wanted Chemical Safety Improvement 

Program list.91

90 U.S. Chemical Safety and Hazard Investigation Board, Final Report: AL Solutions, Investigation Report No. 20011-3-I-WV (Washington, DC: CSB, 

2011), Appendix C (http://www.csb.gov/assets/1/19/Final_Case_Study_7.161.pdf, accessed August 13, 2014).

91 U.S. Chemical Safety and Hazard Investigation Board, U.S. Chemical Safety Board Determines OSHA Response to Seven Open CSB Recommendations on Dust, Fuel Gas, and Process Safety Management to Be “Unacceptable”; Board Votes to Designate a Combustible Dust Standard 

as “Most Wanted” (Washington, DC: CSB, 2013) (http://www.csb.gov/us-chemical-safety-board-determines-osha-response-to-seven-open-csbrecommendations-on-dust-fuel-gas-and-process-safety-management-to-be-unacceptable/). Also: U.S. Chemical Safety and Hazard Investigation 

Board, U.S. Chemical Safety and Hazard Investigation Board Recommendations Status Change Summary (Washington, DC: CSB, 2013) (http://

www.csb.gov/assets/recommendation/Status_Change_Summary_Dust.pdf, accessed August 12, 2014).

001320
CSB • US Ink Case Study 31

US Ink Case Study Case Study January 2015

OSHA does recognize that regulating combustible dust will prevent these accidents. 

Previous OSHA experience in regulating dust explosions in the grain industry proved that 

the number and severity of grain dust explosions decreased after promulgation of the Grain 

Handling Facilities Standard in 1987. During a 2003 regulatory review of the standard, 

OSHA found that grain explosions had declined by 42 percent, injuries by 60 percent, 

and fatalities by 70 percent.92

Furthermore, recent OSHA inspection data indicated that inspectors were using the general 

duty clause (GDC) almost seven times more often for citations related to combustible dust 

than for all other citations. Inspectors use the GDC when no specific standard applies to 

a recognized hazard. OSHA found that the most common GDC violations for dust hazards 

cited equipment that was not adequately equipped to prevent excessive dust accumulations, 

failure to effectively protect systems to prevent a dust explosion or deflagration, and failure 

to reduce ignition sources in the presence of dust. These hazards are addressed in consensus 

standards, which inspectors referenced when using the GDC. OSHA concluded that the 

“unusually high proportion” of GDC citations supported the need for a comprehensive 

OSHA combustible dust standard.93

7.1.2 OSHA Combustible Dust Education and Enforcement Efforts

Since the release of the CSB 2006 study, OSHA has made efforts to educate employers 

who might have combustible dust hazards. On its website, OSHA created a resource page 

(“Combustible Dust: An Explosion Hazard”) that includes guidance for workers and 

emergency responders on precautions to take when handling or responding to incidents 

involving combustible dust.94

OSHA also has increased its enforcement actions, moving toward identifying and correcting 

combustible dust hazards as a result of some of the CSB recommendations from the 2006 

study. In October 2009, OSHA reported training more than 350 compliance officers on 

combustible dust and developed other training courses that both federal OSHA and state 

personnel have attended since December 2007.95

OSHA also initiated the Combustible Dust National Emphasis Program (NEP) in 2007, 

an inspection program to target specific industry hazards during a specified time period. 

OSHA reissued the Combustible Dust NEP in 2008 after the Imperial Sugar accident to 

intensify enforcement activities for facilities that have combustible dust hazards. States that 

fall under federal jurisdiction, such as New Jersey, are required to inspect in accordance 

with the Combustible Dust NEP. Each OSHA Area Office receives a list of establishments 

in that geographical region with North American Industry Classification System (NAICS) 

codes that correspond to industry sectors identified by OSHA as “industries with more 

92 “Regulatory Review of OSHA’s Grain Handling Facilities Standard,” 29 Code of Federal Regulations (CFR) 1910.272, February 2003 (https://www.

osha.gov/dea/lookback/grainhandlingfinalreport.html, accessed August 13, 2014).

93 U.S. Occupational Safety and Health Administration, Advance Notice of Proposed Rulemaking, 29 CFR Part 1910, “Combustible Dust: Proposed 

Rule,” 74 Federal Register (FR) 22, October 21, 2009. 

94 U.S. Occupational Safety and Health Administration, Combustible Dust: An Explosion Hazard (https://www.osha.gov/dsg/combustibledust/

enforcement.html, accessed August 13, 2014).

95 U.S. Occupational Safety and Health Administration, Status Report on Combustible Dust National Emphasis Program, October 2009 (https://

www.osha.gov/dep/combustible_dust/combustible_dust_nep_rpt_102009.html, accessed August 14, 2014).

001321
CSB • US Ink Case Study 32

US Ink Case Study Case Study January 2015

frequent and/or high consequence combustible dust explosions/fires” (as listed in Appendix 

D-1 of the Combustible Dust NEP directive) or to industries “that may have potential for 

combustible dust explosions/fires” (as listed in Appendix D-2 of the Combustible Dust NEP 

directive). On the basis of its familiarity with local industries, the OSHA Area Office can 

make appropriate additions or deletions. Random number selection is then used to identify 

facilities where the area office will conduct programmed Combustible Dust NEP inspections 

in a given fiscal year. Each OSHA Area Office must conduct at least three inspections per 

year at establishments with NAICS codes that appear in Appendix D-1 of the Combustible 

Dust NEP directive and at least one inspection per year at establishments with NAICS codes 

that appear in Appendix D-2. 

The NAICS code assigned to the US Ink Facility (325910, Printing Ink Manufacturing) 

does not appear on either the Appendix D-1 list or the Appendix D-2 list of the OSHA 

Combustible Dust NEP directive. This NEP even identifies Class II locations as hazardous 

sites with the presence of certain substances, such as “carbonaceous dust” (i.e., carbon 

black).96 The OSHA Region II Area Office did not use its discretionary authority to add the 

U.S. Ink facility to either list. Therefore, the facility was never subjected to a programmed 

inspection under the Combustible Dust NEP. 

Moreover, as previously mentioned, no dust-related citations resulted from the US Ink 

inspection after the October 9, 2012, incident, although the incident was characterized as a 

dust explosion.97 The Combustible Dust NEP requires an inspection in accordance with its 

guidelines after an accident involving combustible dust and provides guidance on citations, 

noting, “A citation under section 5(a)(1) of the OSH Act (the general duty clause) may be 

issued for deflagration, explosion or other fire hazards that may be caused by combustible 

dust within a dust collection system or other containers, such as mixers.”98 No such citation 

was issued to US Ink, calling into question how effectively the Combustible Dust NEP and 

training on combustible dust are communicated to OSHA local area offices. 

7.1.3 National Impact of the NAICS Code

The latest U.S. Census data show that the total number of establishments99 in the United 

States with NAICS Code 325910 (Printing Ink Manufacturing) is 429, with 11,488 paid 

employees. Of these sites, 5 percent are in New Jersey100 and employ 364 workers.101

Because no comprehensive OSHA standard regulates the hazards of combustible dust in 

general industry, many of these employees remain at risk of a combustible dust explosion 

and fire at their workplaces. 

96 U.S. Occupational Safety and Health Administration, Combustible Dust National Emphasis Program (Reissued), CPL 03-00-0008 (Washington, 

DC: OSHA, 2008).

97 OSHA Inspection Detail, October 9, 2012, “Sun Chemical Inc. Inspection No. 704178.015” (https://www.osha.gov/pls/imis/establishment.inspection_

detail?id=704178.015, accessed November 21, 2014).

98 OSHA Instruction, “Combustible Dust National Emphasis Program (Reissued),” March 11, 2008 (https://www.osha.gov/pls/oshaweb/owadisp.

show_document?p_table=directives&p_id=3830#purpose, accessed November 21, 2014).

99 Establishment is defined as “a single physical location where business is conducted or where services or industrial operations are performed” 

(https://www.census.gov/econ/susb/definitions.html, accessed August 15, 2014).

100 New Jersey has a total of 25 establishments under NAICS Code 325910.

101 U.S. Census Bureau, Statistics of U.S. Businesses, 2011 Annual Data (http://www.census.gov/econ/susb/data/download_susb2011.html, 

accessed August 15, 2014). 

001322
CSB • US Ink Case Study 33

US Ink Case Study Case Study January 2015

7.2 STATE OF NEW JERSEY

7.2.1 New Jersey State Uniform Construction Code Act

In 1975, the New Jersey state legislature enacted the State Uniform Construction Code 

(UCC) Act, which is administered by the Department of Community Affairs (DCA), the 

primary agency in the state for building codes and standards. This act provided for a single 

mandatory construction code and for a fundamental restructuring of the enforcement 

process. Hence, the UCC—that is, New Jersey Administrative Code (N.J.A.C.) 5:23, et 

seq.—was adopted and became effective on January 1, 1977.102 Under the current New 

Jersey UCC, a number of subcodes have been adopted, such as the International Building 

Code (IBC) (2009 edition) and the National Electric Code (2011 edition). 

The New Jersey UCC mandates that any installation of new equipment requires the owner 

to file an application for a construction permit, which involves various building permits 

for electrical, fire, and plumbing.103 A permit application leads to an inspection by the local 

building authority and ensures that appropriate codes (e.g., building, electrical, plumbing, 

and fire codes) are followed. The CSB found that US Ink did not submit an inquiry to the 

local building department, the East Rutherford Building Department, to determine whether 

a construction permit for the new dust collection system was necessary. Therefore, US Ink 

never applied for a building permit, and as a result, the building department did not inspect 

the new dust collection system before the incident. 

The CSB found that US Ink did not apply for the permit because it thought an exemption 

applied under the New Jersey UCC, which excludes “manufacturing, production and 

process equipment.” Equipment covered under the exemption is defined as “all equipment 

employed in a system of operations for the explicit purpose of the production of a 

product” and lists “air pollution equipment, such as scrubbers” as the type of equipment 

that is exempted.104 US Ink applied this exemption to its dust collection system because 

it considered the system as “air pollution equipment” connected to the manufacturing 

process, capturing raw materials and recycling them back into the pre-mix room to produce 

the final ink product.

However, although the New Jersey UCC did not regulate the dust collection equipment 

at US Ink, the new structural and electrical changes involved in installing the new dust 

collection system still required US Ink to file for a construction permit. The New Jersey 

UCC states that it is unlawful to “repair, renovate, alter, reconstruct or demolish a 

structure...without first filing an application with the construction officials.”105 A 1992 

New Jersey Register notice explains: 

Highly specialized, often preassembled equipment designed for commercial or 

industrial use, manufacturing, production and process equipment, or “process 

equipment,” is often unique to its function and designed beyond the referenced 

standards in the UCC. This makes it impractical or impossible for code officials 

to review it in an appropriate way. They do, however, review electrical, water, and 

sanitary connections to such process equipment, as these can affect public safety.106

102 Bureau of Construction Project Review website (http://www.state.nj.us/dca/divisions/codes/offices/constructionprojectreview.html, accessed 

September 5, 2014).

103 N.J.A.C. 5:23-2.14.

104 N.J.A.C. 5:23-2.2(a)1.

105 N.J.A.C. 5:23-2.14(a).

106 New Jersey Register 24:19 (October 5, 1992), 4.

001323
CSB • US Ink Case Study 34

US Ink Case Study Case Study January 2015

This notice explains the intent of the exemption, to relieve code officials from inspecting 

the function and design of such equipment when the New Jersey UCC at the time referenced 

no standards on which to base their enforcement. However, the connections or structural 

building changes associated with that equipment still require a permit. Consequently, the 

East Rutherford Building Department cited the company after the October 2012 incident 

for not obtaining a construction permit.107

Nevertheless, if the construction permit had been obtained, it would only have required 

the East Rutherford facility to comply with structural and electrical code requirements. 

The New Jersey UCC would not have covered the design of the dust collection equipment 

because of the existing exemption for “manufacturing, production and process equipment.” 

New Jersey exempted that equipment because of the lack of referenced standards in the 

UCC to assist code officials. However, once New Jersey adopted the IBC,108 which includes 

engineering and fire protection standards set by consensus organizations such as the NFPA, 

the explanation from the 1992 New Jersey Register notice was no longer valid. In New 

Jersey, no current building or fire standards have jurisdiction over the design of the dust 

collection system at US Ink. The company received environmental permits for its dust 

collection system before installation.109 The New Jersey environmental standards, however, 

only set minimum emission standards to control pollution rather than safety requirements 

to prevent a fire and explosion.

If the dust collection equipment had been covered by the current New Jersey UCC, US Ink 

would have been required to follow the IBC (2009), which requires occupancies handling 

combustible dust (such as carbon black) to comply with fire protection standards such as 

NFPA 654,110 which US Ink did not apply appropriately in the design of the dust collection 

system (discussed in Section 5). The IBC defines H-2 occupancies as “buildings and 

structures containing materials that pose a deflagration hazard or a hazard from accelerated 

burning” and lists combustible dusts as a type of such material. Combustible dust in the 

code is defined as “finely divided solid material that is 420 microns or less in diameter and 

which, when dispersed in air in the proper proportions, could be ignited by a flame, spark 

or other source of ignition.” According to its MSDS, the carbon black at US Ink met this 

definition. Under these provisions, US Ink would be required to have a licensed professional 

develop and present the engineering drawings to be submitted as part of the permit 

application.111 The licensed engineer who coordinated the design of the dust collection 

system for US Ink likely would have evaluated the drawings to ensure compliance with IBC 

(2009) requirements. 

In the absence of a federal combustible dust standard, states must rely on their own 

regulations. New Jersey code officials would need authority under the New Jersey UCC 

to enforce provisions that oversee the design of dust collection equipment, which would 

107 “Notice and Order of Penalty, US Ink Corp/Sun Chemical Corporation,” February 20, 2014.

108 New Jersey first adopted the IBC in 2003 and adopted more recent revisions over the years; the last edition was adopted in 2010. New Jersey 

model code adoptions are summarized on the website (http://www.state.nj.us/dca/divisions/codes/codreg/pdf_regs_former/nj_model_code_

adopt_5_7_12.pdf).

109 US Ink Preconstruction Air Permit, Operating Certificate PCP100002.

110 International Code Council, International Building Code, 2009 Edition (Country Club Hills, IL: ICC, 2009), Chapter 4, “Special Detailed Requirements 

Based on Use and Occupancy,” Section 415.6.1.

111 N.J.A.C. 5:23-2.15.

001324
CSB • US Ink Case Study 35

US Ink Case Study Case Study January 2015

require a revision of the UCC. Such revisions are needed to require companies in New 

Jersey that use such equipment (such as US Ink) to follow minimum design standards 

intended to protect workers and the public. 

The New Jersey DCA promulgates New Jersey UCC regulations112 and also provides 

administrative guidance and technical assistance to local departments in the state. Specifically, 

the DCA provides training113 and licensing to building code officials throughout the 

state, administered by the Bureau of Code Services, Division of Codes and Standards.114

Additional training on engineering design standards for processes involving combustible 

dust will be needed for local building code officials if their authority is expanded to inspect 

this type of process equipment.

Furthermore, training is needed to ensure that facilities handling combustible dusts receive 

the appropriate occupancy classification. US Ink was not accurately classified as an H-2 

occupancy that handled combustible dust. The initial building permit identified the US 

Ink facility as an F-1 and S-1, which are for factory and storage occupancies. However, 

according to the IBC, F and S occupancies are not required to follow NFPA standards for 

combustible dust hazards. The DCA should provide training to local building officials on 

hazardous materials, such as combustible dusts, to ensure that the correct classification is 

assigned and appropriate building requirements are followed. 

8.0 KEY FINDINGS

As a result of the US Ink investigation, the CSB makes the following findings:

1. A flammable mixture consisting of hydrocarbons and combustible dusts

accumulated in the ductwork during the start up of US Ink’s dust collection system. 

The mixture spontaneously ignited leading to a series of events that caused a flash 

fire, burning 7 workers. US Ink/Sun Chemical Corporation did not obtain building, 

fire, or electrical permits for the construction and installation of the new dust 

collector. In addition, the East Rutherford Building Department does not have a 

strict permit, code notification, and enforcement process to ensure compliance 

with the New Jersey UCC.

2. The original design of the dust collection system was intended strictly for dust 

collection but was modified before commissioning to include a housekeeping

function. This also caused insufficient flow rate and contributed to an accumulation 

of a flammable mixture in the duct system. Although the design, construction, 

and installation of the new dust collector required capital project approval at 

the corporate level, US Ink/Sun Chemical Corporation did not provide adequate 

oversight of, and communications (including discussions on the possible 

implications of the presence of vapors from heated combustible liquids) with, 

contractors for the dust collection system project. 

112 N.J.A.C. 5:23-1.2.

113 DCA provides training on NFPA codes.

114 N.J.A.C. 5:23-5.2.

001325
CSB • US Ink Case Study 36

US Ink Case Study Case Study January 2015

3. System controls, such as temperature and pressure indicators, were not installed for

operators to monitor the mixing tanks and dust collection system during start up. 

This led to the overheating of the flammable dust mixture which accumulated in 

the ductwork, and ignited above T-306. The mix tank dust pickup design, which 

continuously drew air through powder and vapor in the tank headspace, led to the 

accumulation of dust and condensable vapor in sections where other duct branches 

joined the main ductwork (duct main), providing fuel for the duct fire that initiated 

the sequence of events.

4. US Ink/Sun Chemical Corporation did not provide adequate oversight into the 

planning, design, installation and commission of the dust collection system. As 

a result, safety management elements such as a Process Hazard Analysis and

Management of Change procedures were not conducted. The original design of the 

dust collection system was intended strictly for dust collection but was modified 

before commissioning to include a vacuum cleaning function, with insufficient flow 

rate that restricted air movement and contributed to an accumulation of hazardous 

materials in the duct system.

5. No processes were in place to confirm adequate start up or commissioning of the 

dust collection system. As a result, the blockage of the ductwork went undetected 

and design flaws were not revealed until after the flash fire occurred. The dust 

collection system design did not ensure adequate minimum conveying velocity in all 

dust branches, resulting in plugged ducts and a deposited mixture of carbon black, 

Gilsonite, clay, and oil within a few days of start-up and accumulating dust fuel in 

the ducts for the resulting fire. In addition, the use of combustible rubber hoses for 

ducts and powder chutes contributed to the duct fire and explosion.

6. US Ink’s hazard communication, emergency response plan, and other incident 

prevention programs did not reinforce an understanding of the potential hazard 

associated with flammable vapors entering the dust collection system and mixing 

with the combustible dust. No local temperature and pressure indicator monitored 

the mixing tanks and dust collection system. This situation likely led to the mixing 

temperature exceeding safe limits by a margin sufficient to cause the already selfheated vapors of oil and ink dust powder to ignite the accumulated materials in the 

ductwork above T-306. 

7. US Ink/Sun Chemical Corporation did not obtain construction permits for the 

installation of the new dust collection system. Because of the lack of adequate 

commissioning or confirmation of adequate performance at start-up, the design 

flaws were not revealed until the dust explosion. In addition, the dust collection 

system was not systematically monitored and maintained; no processes were in 

place to detect the duct plugging that occurred. 

8. No federal agency or state agency in New Jersey regulates combustible dust hazards.

The hazard communication and emergency response plan and other incident

prevention programs did not reinforce an understanding of the potential hazard 

severity associated with dust produced by the new dust collection system. For 

example, no automatic fire alarm system was in place in the other areas of the 

pre-mix room, as required by NFPA 72.

001326
CSB • US Ink Case Study 37

US Ink Case Study Case Study January 2015

9. A comprehensive OSHA federal regulation specific to combustible dust is needed 

because the reliance on industry to voluntarily comply with fire protection and

engineering standards is insufficient to control combustible dust hazards. The New 

Jersey DCA conducts training for internal personnel and local building code officials 

on some of the NFPA standards in the New Jersey UCC but does not provide 

training on combustible dust hazards or relevant NFPA standards that address 

combustible dust. 

10. OSHA did not include the NAICS code for printing ink manufacturing

(325910), the industry classification code for US Ink, to its list of industries 

in the Combustible Dust NEP. OSHA inspectors refer to this list as guidance 

on inspections for combustible dust hazards in their region. A comprehensive 

federal regulation specific to combustible dust is necessary because the reliance 

on industry to voluntarily comply with consensus standards and fire codes is 

insufficient to control combustible dust hazards. OSHA did not include printing 

ink manufacturing (NAICS Code 325910), the industry classification code for US 

Ink, in its Combustible Dust NEP when it was issued in 2007 or reissued in 2008.

11. The New Jersey Uniform Construction Code (UCC) adopts the International

Building Code, which does reference fire protection and engineering standards for 

facilities that handle combustible dusts, such as NFPA 654. However, the UCC 

exempts certain process equipment that could apply these provisions.

12. The New Jersey Department of Community Affairs conducts training for local 

building code officials on some of the NFPA standards in the New Jersey UCC but 

does not provide training on relevant NFPA standards that address combustible 

dust hazards.

9.0 REITERATED RECOMMENDATION

U.S. OCCUPATIONAL SAFETY AND HEALTH ADMINISTRATION

The absence of a general industry safety standard for combustible dust remains an 

important safety issue because catastrophic dust incidents continue to occur throughout 

industry. Therefore, the CSB reiterates the recommendation originally issued to OSHA in 

the 2006 Combustible Dust Hazard Study.

2006-01-I-H R1 Issue a standard designed to prevent combustible dust fires and 

explosions in general industry. Base the standard on current National 

Fire Protection Association (NFPA) dust explosion standards (including 

NFPA 654 and NFPA 484) and include at least the following:

• Hazard assessment

• Engineering controls

• Housekeeping

• Building design

• Explosion protection

• Operating procedures

• Worker training

001327
CSB • US Ink Case Study 38

US Ink Case Study Case Study January 2015

10.0RECOMMENDATIONS

As a result of its investigation of this accident at the US Ink facility, the CSB makes a 

number of safety recommendations.

U.S. OCCUPATIONAL SAFETY AND HEALTH ADMINISTRATION

2013-01-I-NJ R1 Add North American Industry Classification System (NAICS) Code 

325910, Printing Ink Manufacturing, to the list of industries in 

Appendix D-1 or Appendix D-2 of Combustible Dust National 

Emphasis Program (NEP), Directive CPL 03-00-008.

2013-01-I-NJ R2 Communicate with all OSHA Area Offices to encourage appropriate 

application of the following existing provisions of the Combustible 

Dust NEP, Directive CPL 03-00-008:

• Paragraph IX, Section A2, indicates that area offices may add

to their Combustible Dust NEP establishment lists those facilities 

in their jurisdictions with a Standard Industrial Classification 

System code, NAICS code, or both (other than those listed in 

Appendices D-1 and D-2 of the Combustible Dust NEP directive) 

if those facilities have a known pattern of combustible dust 

hazards.

• Paragraph IX, Section B4, indicates that if a fatality or 

catastrophe investigation is performed at a facility because of

a combustible dust deflagration or explosion, the inspector 

shall use the guidelines in Fatality/Catastrophe Investigation 

Procedures, Directive CPL 02-00-137, and in the Combustible 

Dust NEP, Directive CPL 03-00-008.

NEW JERSEY DEPARTMENT OF COMMUNITY AFFAIRS

2013-01-I-NJ R3 Revise the exemption for “manufacturing, production, and process 

equipment” under the New Jersey Uniform Construction Code

(N.J.A.C 5:23-2.2) to require that equipment involved in processing, 

handling, or conveying combustible dust comply with the design and 

operating requirements of the current edition of the International 

Building Code.

2013-01-I-NJ R4 Develop and implement training for local code officials on the 

National Fire Protection Association (NFPA) standards referenced in 

the New Jersey adoption of the International Building Code (IBC) for 

occupancies with a high hazard classification (Group H); specifically, 

include training on equipment that handles combustible dust and the 

hazards involved.

2013-01-I-NJ R5 Promulgate a regulation that requires all occupancies handling 

hazardous materials to inform the local enforcement agency of any 

type of construction or installation of equipment at an industrial or 

manufacturing facility. Also require local enforcement agencies to 

evaluate the information to determine whether a construction permit 

is required. 

001328
CSB • US Ink Case Study 39

US Ink Case Study Case Study January 2015

US INK/SUN CHEMICAL CORPORATION

2013-01-I-NJ R6 At the US Ink East Rutherford facility, install automatic fire alarm 

systems consistent with NFPA 72 (the National Fire Alarm Code) in 

manufacturing areas (such as mixing) where heat generation could occur.

2013-01-I-NJ R7 Revise the Capital Appropriations/Asset Request (CAR) form 

procedure for new installations and modifications to existing 

equipment to require at a minimum the following:

• Process hazard analysis (PHA)

• Management of change (MOC)

• Review of engineering drawings for permits

• Safety management of contractors 

• Training of plant operators based on applicable dust collection 

system guidelines and standards, including NFPA 91 and 

NFPA 654

2013-01-I-NJ R8 Develop and implement a management of organizational change 

protocol to allow for the transfer of knowledge and information to 

new personnel, at a minimum including initial and refresher training 

in the following:

• Safety and health procedures

• Lessons learned from previous incidents

• Technical information for equipment

• Routine plant operation

001329
CSB • US Ink Case Study 40

US Ink Case Study Case Study January 2015

CSB Investigation Reports are formal detailed reports on significant chemical accidents and include key findings, 

root causes, and safety recommendations. CSB Hazard Investigations are broader studies of significant chemical 

hazards. CSB Safety Bulletins are short general interest publications that provide new or noteworthy information 

on preventing chemical accidents. CSB Case Studies are short reports on specific accidents and include a discussion 

of relevant prevention practices. All reports may contain safety recommendations if appropriate. CSB Investigation 

Digests are plain-language summaries of Investigation Reports.

The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency whose mission is to ensure the safety 

of workers, the public, and the environment by investigating and preventing chemical incidents. The CSB is a scientific investigative 

organization; it is not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for 

determining the root and contributing causes of accidents, issuing safety recommendations, studying chemical safety issues, and evaluating 

the effectiveness of other government agencies involved in chemical safety.

No part of the conclusions, findings, or recommendations of the CSB relating to any chemical accident may be admitted as evidence or used 

in any action or suit for damages. See 42 U.S.C. § 7412(r)(6)(G). The CSB makes public its actions and decisions through investigation 

reports, summary reports, safety bulletins, safety recommendations, case studies, incident digests, special technical publications, and 

statistical reviews. More information about the CSB is available at www.csb.gov.

CSB publications can be downloaded at www.csb.gov or obtained by contacting:

U.S. Chemical Safety and Hazard Investigation Board

Office of Congressional, Public, and Board Affairs

2175 K Street NW, Suite 400

Washington, DC 20037-1848

(202) 261-7600

001330
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

FINAL

WEST FERTILIZER COMPANY FIRE AND EXPLOSION

(15 Fatalities, More Than 260 Injured) 

WEST FERTILIZER COMPANY

WEST, TX

KEY ISSUES: APRIL 17, 2013

• REGULATORY OVERSIGHT

• HAZARD AWARENESS

• EMERGENCY PLANNING AND RESPONSE

• FERTILIZER GRADE AMMONIUM NITRATE STORAGE PRACTICES

• LAND USE PLANNING AND ZONING

REPORT 2013-02-I-TX

001331
[This page intentionally left blank.]

001332
West Fertilizer Company Final Report January 2016

Dedication

This report is dedicated to the 12 emergency responders and 3 members 

of the public who lost their lives as a result of the explosion at the West 

Fertilizer Company on April 17, 2013. 

Morris Bridges

Perry Calvin

Jerry Dane Chapman

Cody Frank Dragoo

Kenneth Harris

Adolph Lander

James Matus

Judith Ann Monroe

Joseph Pustejovsky

Cyrus Adam Reed

Mariano C. Saldivar

Kevin William Sanders

Douglas Snokhous

Robert Snokhous

William Uptmor, Jr.

001333
West Fertilizer Company Final Report January 2016

1 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Contents

1.0 EXECUTIVE SUMMARY ........................................................................................................... 13

1.1 Overview........................................................................................................................................ 13

1.2 Federal and State Response ........................................................................................................... 14

1.2.1 Joint SFMO/ATF Investigation ........................................................................................ 14

1.2.2 CSB Response................................................................................................................... 15

2.0 BACKGROUND ........................................................................................................................... 16

2.1 West Fertilizer Company ............................................................................................................... 16

2.1.1 Facility Operations Description ........................................................................................ 18

2.1.2 Facility Layout and Materials of Construction ................................................................. 23

2.1.3 Unloading of Fertilizer...................................................................................................... 25

2.1.4 Housekeeping.................................................................................................................... 26

3.0 INCIDENT DESCRIPTION.......................................................................................................... 27

3.1 West Police Department ................................................................................................................ 27

3.2 West Volunteer Fire Department (WVFD).................................................................................... 28

3.3 Abbott, Bruceville-Eddy, Mertens, and Navarro Mills Volunteer Fire Departments.................... 29

3.4 Consequences................................................................................................................................. 30

3.4.1 Fatalities and Injuries........................................................................................................ 30

3.4.2 Property Damage .............................................................................................................. 32

3.4.3 West Independent School District .................................................................................... 39

3.4.4 West Rest Haven Nursing Home ...................................................................................... 49

3.4.5 West Terrace Apartment Complex ................................................................................... 53

3.4.6 Private Residences............................................................................................................ 54

3.4.7 Infrastructure Damage to the City of West....................................................................... 55

4.0 INCIDENT ANALYSIS................................................................................................................ 57

4.1 Fertilizer Grade Ammonium Nitrate (FGAN) ............................................................................... 57

4.1.1 The Fertilizer Industry ...................................................................................................... 57

4.1.2 FGAN Properties .............................................................................................................. 57

4.1.3 FGAN Hazards ................................................................................................................. 58

4.1.4 Previous Incidents Involving FGAN ................................................................................ 61

4.1.5 Historical Knowledge of FGAN Fire and Explosion Hazards.......................................... 62

001334
West Fertilizer Company Final Report January 2016

2 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.2 Factors Contributing to the Massive Fire and Explosion at the WFC ........................................... 64

4.2.1 Contamination of the FGAN Pile ..................................................................................... 64

4.2.2 Heating and Ventilation .................................................................................................... 66

4.3 Detonation Scenarios..................................................................................................................... 68

4.3.1 Scenario 1: Detonation from the Top of the FGAN Pile .................................................. 69

4.3.2 Scenario 2: Detonation in Heated FGAN Along Exterior Wall Exposed to Fire ............. 71

4.3.3 Scenario 3: Detonation in Elevator Pit That Spread to Main FGAN Bin ......................... 73

4.4 Forensic Testing of West Fertilizer Company Samples................................................................. 73

4.5 Blast and Impact Analysis ............................................................................................................. 78

4.5.1 Seismic Data ..................................................................................................................... 81

5.0 COMMERCIAL PROPERTY AND LIABILITY INSURANCE .................................................82

5.1 Triangle Insurance Coverage and Audits (2006–2010)................................................................. 83

5.1.1 Triangle Loss Control Surveys That Did Not Include FGAN Hazards............................ 86

5.2 U.S. Fire Insurance Coverage and Audits (2010–2013) ................................................................ 86

5.3 Insurance Claims and Other Aid after the Explosion .................................................................... 87

5.4 FGAN Facilities in Texas and the Potential for Offsite Consequences......................................... 88

5.5 Limits of Insurance Coverage in Texas ......................................................................................... 90

5.6 Insurance Services Office Rating................................................................................................... 94

5.6.1 Impact of the City of West Class 5 ISO Rating on the West Fertilizer Company............ 95

6.0 INHERENTLY SAFER TECHNOLOGY..................................................................................... 97

6.1 Alternative Formulations of FGAN............................................................................................... 99

6.2 Inherently Safe Building Design and Storage.............................................................................. 102

7.0 EMERGENCY RESPONSE........................................................................................................ 104

7.1 Firefighter Response .................................................................................................................... 105

7.2 Key Contributing Factors to Emergency Responders’ Fatality ................................................... 107

7.2.1 Lack of Incident Command System................................................................................ 107

7.2.2 Lack of Established Incident Management System........................................................ 108

7.2.3 Firefighter Training......................................................................................................... 110

7.2.4 Firefighter FGAN Knowledge and Lack of HAZMAT Training ................................... 112

7.2.5 Lack of Situational Awareness and Risk Assessment Knowledge ................................. 116

7.2.6 Lack of Pre-Incident Planning at Facility ....................................................................... 117

7.3 Limited and Conflicting Technical Guidance on FGAN............................................................. 119

001335
West Fertilizer Company Final Report January 2016

3 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.3.1 Emergency Response Guidebook ................................................................................... 120

7.3.2 Safety Data Sheets.......................................................................................................... 125

7.4 Lessons Not Learned and Lessons Learned................................................................................. 127

7.4.1 Pre-West-Incident FGAN-Related Fires and Explosions: Lessons Not Learned ........... 127

7.4.2 Post-West Incident FGAN-Related Fire: Lessons Learned ............................................ 131

7.5 Other Post-Incident Investigation Reports Related to Firefighting.............................................. 136

7.5.1 Texas State Fire Marshal’s Office (SFMO).................................................................... 136

7.5.2 NIOSH Findings and Recommendations........................................................................ 137

7.6 Summary of Incident Emergency Response ................................................................................ 138

7.7 Firefighter Training Grants and Programs................................................................................... 139

7.7.1 Need for Training............................................................................................................ 139

7.7.2 National Firefighter Training Funds and Programs........................................................ 142

7.7.3 National Membership Firefighter Associations.............................................................. 163

8.0 REGULATORY ANALYSIS...................................................................................................... 164

8.1 President Obama’s Executive Order 13650................................................................................. 164

8.2 OSHA Explosives and Blasting Agents Standard........................................................................ 165

8.2.1 OSHA Issuance of Guidance on Explosives and Blasting Agents Standard .................. 171

8.2.2 Need for an Emphasis Program ...................................................................................... 173

8.3 Chemical Facility Anti-Terrorism Standards (CFATS)............................................................... 173

8.3.1 AN Screening Thresholds............................................................................................... 174

8.4 Safety Management Programs..................................................................................................... 176

8.4.1 OSHA Process Safety Management Standard ................................................................ 176

8.4.2 EPA Risk Management Program Rule ........................................................................... 183

8.5 Emergency Planning .................................................................................................................... 195

8.5.1 Federal Emergency Planning .......................................................................................... 196

8.5.2 State Emergency Planning in the State of Texas ............................................................ 199

8.5.3 City Emergency Planning in the City of West................................................................ 200

8.5.4 Other Emergency Planning Requirements...................................................................... 204

8.6 Fire Protection Codes and Standards........................................................................................... 205

8.6.1 National Fire Protection Association .............................................................................. 206

8.6.2 International Code Council............................................................................................. 209

8.6.3 State Fire Codes.............................................................................................................. 210

001336
West Fertilizer Company Final Report January 2016

4 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.7 Post-Incident State and Local Regulatory Developments............................................................ 213

8.7.1 Texas Commercial Fertilizer Rules ................................................................................ 214

8.7.2 Texas House Bill 942...................................................................................................... 214

8.7.3 Athens City Ordinance.................................................................................................... 215

8.8 Industry Standards ....................................................................................................................... 216

8.8.1 The Fertilizer Institute (TFI)........................................................................................... 216

8.8.2 Agricultural Retailers Association (ARA)...................................................................... 218

8.8.3 Product Stewardship ....................................................................................................... 218

8.8.4 Efforts to Address FGAN Hazards Post-Incident........................................................... 220

9.0 LAND USE.................................................................................................................................. 223

9.1 Land Use Planning: An Introduction ........................................................................................... 223

9.2 The City That “Came to” the WFC Over the Years .................................................................... 224

9.3 Lack of Zoning Regulations......................................................................................................... 227

9.3.1 Importance of Land Use Planning in Siting Communities Near Facilities Storing FGAN 

and Other Hazardous Chemicals..................................................................................... 233

9.3.2 International Perspectives............................................................................................... 234

9.4 Efforts to Address Land Use Planning After the West Incident .................................................. 239

10.0 KEY FINDINGS.......................................................................................................................... 240

11.0 RECOMMENDATIONS............................................................................................................. 242

12.0 APPENDIX A: REBUILDING OF THE WEST INDEPENDENT SCHOOL DISTRICT ........250

13.0 APPENDIX B: FGAN INCIDENTS TABLES........................................................................... 252

14.0 APPENDIX C: TFI SAFETY AND SECURITY TOOLS .......................................................... 262

15.0 APPENDIX D: RESPONSIBLEAG............................................................................................ 264

001337
West Fertilizer Company Final Report January 2016

5 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figures

Figure 1. 2013 Overview of WFC Facility (Source: Bing Maps)............................................................... 18

Figure 2. Grain Silos (Source: WFC Insurer) ............................................................................................. 19

Figure 3. West View of Fertilizer Building (Source: Bing Maps).............................................................. 20

Figure 4. Fertilizer Building Overview (Source: Atlas Engineering)......................................................... 21

Figure 5. Southwest View from Northeast Corner of Fertilizer Building (Source: WFC Insurer)............. 21

Figure 6. Anhydrous Ammonia Storage (Source: WFC Insurer) ............................................................... 22

Figure 7. West View from East of Fertilizer Building (Source: WFC Insurer).......................................... 23

Figure 8. Plywood Bin Wall, Post-Explosion (Source: CSB)..................................................................... 24

Figure 9. Elevator System Recovered from Blast Debris (Source: CSB)................................................... 25

Figure 10. Video Stills of WFC Fire and Explosion (Source: Member of the Public)............................... 30

Figure 11. Number of Nonfatal Injuries, by Injury Type (Source: Waco-McLennan County Public Health 

District) ..................................................................................................................................... 31

Figure 12. Overview of Damage to WFC Facility (Source: Texas Civil Air Patrol).................................. 33

Figure 13. Damaged WVFD Water Tender (Source: ABS Consulting)..................................................... 34

Figure 14. Farm Truck South of Crater, Near the Scale House (Source: ABS Consulting)....................... 34

Figure 15. Railcar Loaded with FGAN, Destroyed and Overturned by Explosion (Source: CSB)............ 35

Figure 16. Liquid Fertilizer Tank Damage (Source: CSB)......................................................................... 35

Figure 17. Anhydrous Ammonia Pressure Vessels (Source: CSB) ............................................................ 36

Figure 18. Damaged Railroad Tracks Adjacent to WFC Facility (Source: CSB)....................................... 37

Figure 19. Damaged Playground Equipment (Source: ABS Consulting)................................................... 37

Figure 20. Damaged Basketball Goal Post at Park (Source: ABS Consulting).......................................... 38

Figure 21. Anhydrous Ammonia Tank PRV, Post-Incident (Source: CSB)............................................... 39

Figure 22. Proximity of WFC Facility to Schools and Other Public Structures (Source: Google Earth)... 40

Figure 23. WIS Room Layout in Evacuation Plan (Source: CSB) ............................................................. 42

Figure 24. WIS North Hallway, Looking Toward Northeast Exit Door (Source: ABS Consulting).......... 43

Figure 25. Glazing Hazard in WIS Room 12 (Source: ABS Consulting)................................................... 43

Figure 26. Embedded Glass in Assignment Poster in WIS Room 12 (Source: ABS Consulting)............. 44

Figure 27. Interior of Burned Northeast Section of WIS (Source: ABS Consulting)................................ 44

Figure 28. WIS Gymnasium (Source: ABS Consulting) ............................................................................ 45

Figure 29. WIS Classroom 20 (Source: ABS Consulting).......................................................................... 46

Figure 30. WHS Evacuation Map (Source: WISD).................................................................................... 47

001338
West Fertilizer Company Final Report January 2016

6 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. WMS Layout (Source: Bing Maps)........................................................................................... 48

Figure 32. Classroom Annex Interior Hallway and Ceiling Damage at WMS (Source: ABS Consulting) 49

Figure 33. Damage to Reagan Street Entry of West Rest Haven (Source: ABS Consulting)..................... 50

Figure 34. Emergency Exit Floor Plan for the West Rest Haven (Source: CSB)....................................... 52

Figure 35. Crater and Debris (left) from Fragment (right) of WFC Facility Foundation that Impacted West 

Rest Haven (Source: ABS Consulting)..................................................................................... 53

Figure 36. West Terrace Apartment Complex East Façade (Source: CSB)................................................ 54

Figure 37. Example of Damage to Single-Family Residential Structure (Source: ABS Consulting)......... 55

Figure 38. Initial Light Smoke (left) Followed by Dark Plume (right) (Source: Member of the Public).. 65

Figure 39. Dark and Heavy Smoke, Rich in Soot (Source: Member of the Public) .................................. 66

Figure 40. Photographs from 7:42 pm (left) and 7:45 pm (right), Showing Transition to Lighter Smoke 

and Larger Flame, Before Detonation at Approximately 7:51 pm (Source: Member of the 

Public)....................................................................................................................................... 67

Figure 41. Plume of Smoke from AN Fire in Bryan, Texas (Source: College Station Fire Department).. 68

Figure 42. Potential Explosive Train Layers on AN Pile Before Detonation (Source: CSB)..................... 70

Figure 43. North Side of Structure Approximately 3 Minutes Before Detonation, with Dark Foreground 

Objects Associated with the Bin Complex North of Fertilizer Building (Source: Member of the 

Public)....................................................................................................................................... 72

Figure 44. Solidified Fertilizer Collected from WFC Property (Approximate Location Unknown) (Source: 

Forensic Laboratory)................................................................................................................. 75

Figure 45. FGAN Prills Collected from a Railcar on WFC Property (Source: Forensic Laboratory)........ 75

Figure 46. Farmer’s Sample of FGAN and AS Blend (Source: Forensic Laboratory)............................... 75

Figure 47. Physical Comparison of Samples (20x) (Source: Forensic Laboratory) ................................... 77

Figure 48. Ground-Level View of WFC Explosion Crater (Source: CSB) ................................................ 79

Figure 49. WFC Explosion Crater Profile Measurements (Source: Army Corps of Engineers) ................ 80

Figure 50. Overhead View of WFC Bins, with Crater Underlay (Source: Atlas Engineering).................. 81

Figure 51. Elevation View of Fertilizer Building, with Crater Depth (Source: Atlas Engineering)........... 81

Figure 52. Data Recorded at Lake Whitney Station, WHTX, and Seismograph by the USGS National 

Earthquake Information Center (Source: USGS)...................................................................... 82

Figure 53. Exposed 440-Volt Electrical Wiring Identified in 2007 Survey (Source: Triangle Insurance 

Company).................................................................................................................................. 84

Figure 54. Damaged Electrical Cord Identified in 2008 Insurance Survey (Source: Triangle Insurance 

Company).................................................................................................................................. 85

Figure 55. Overhead View of a School Approximately 529 Feet from an FGAN Storage Facility (Source: 

Google Earth)............................................................................................................................ 89

001339
West Fertilizer Company Final Report January 2016

7 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 56. Breakdown of FGAN Storage Facilities (10,000 pounds or more) Within 1 Mile of a Texas 

School (Source: CSB)............................................................................................................... 89

Figure 57. Overhead View of a Texas FGAN Storage Facility near a Hospital, Residence, and School 

(Source: Google Earth) ............................................................................................................. 90

Figure 58. Distribution of ISO Class Ratings for Cities and Communities in Texas (Source: ISO) .......... 95

Figure 59. Distribution of ISO Class Ratings for All U.S. Cities and Communities (Source: ISO)........... 96

Figure 60. Risk Control Hierarchy (Source: CCPS)................................................................................... 98

Figure 61. Reconstructed EDC Facility in Bryan, Texas (Source: CSB) ................................................. 104

Figure 62. Timeline of Events for Emergency Response to WFC Facility (Source: CSB)....................... 106

Figure 63. Cover Page of 2012 Edition of ERG (Source: DOT PHMSA)................................................ 121

Figure 64. Cover Page of 2016 Edition of ERG (Source: DOT PHMSA)................................................ 124

Figure 65. Post-Incident Aerial View of EDC Facility Wooden Fertilizer Warehouse (Source: BryanCollege Station Eagle) ............................................................................................................ 130

Figure 66. Dark Grey Smoke Originating from East Texas Ag Supply Facility in Downtown Athens, 

Texas (Source: Athens Fire Department)................................................................................ 133

Figure 67. Dark Smoke Combined with Flames at East Texas Ag Supply Facility in Athens, Texas 

(Source: Athens Fire Department).......................................................................................... 134

Figure 68. East Texas Ag Supply Facility’s Masonry Brick Walls, Engulfed by Fire and Smoke (Source: 

Athens Fire Department)......................................................................................................... 135

Figure 69. Comparison of Volunteer and Career Firefighter Deaths (1977–2013) (Source: NFPA) ....... 141

Figure 70. Assistance to Firefighter Grant Program Recipients in Texas (Source: FEMA)..................... 147

Figure 71. SAFER Grant Award Recipients in Texas (Source: FEMA) .................................................. 148

Figure 72. FP&S Grant Recipients in Texas (Source: FEMA)................................................................. 148

Figure 73. Percentage of AN Storage Facilities by Industry (Source: DHS)............................................ 175

Figure 74. Progressive Development of West (Source: GeoSearch) ........................................................ 226

Figure 75. Aerial Photographs of the WFC Facility Before (left) and After (right) the Incident (Source: 

NBC News)............................................................................................................................. 227

Tables

Table 1. WFC Fertilizer Inventory in April 2013 ...................................................................................... 16

Table 2. Estimated Number of Students and Staff During School Hours.................................................. 41

Table 3. Infrastructure Repaired with FEMA Funding.............................................................................. 55

Table 4. Forensic Testing Results of Fertilizer Samples Collected from the WFC and the OTSC ............ 76

Table 5. Minimum Insurance Requirements in Texas................................................................................ 92

001340
West Fertilizer Company Final Report January 2016

8 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 6. Inherently Safer Approaches for Handling FGAN ....................................................................... 98

Table 7. Examples of AN Fertilizer Alternatives...................................................................................... 100

Table 8. Training and Experience Information of the Fatally Injured Firefighters................................... 112

Table 9. Comparison of Various AN-Related Firefighting Measures in April 2013................................ 126

Table 10. Funds Allocated to WVFD through the Rural VFD Assistance Program ................................ 158

Table 11. OSHA 29 CFR 1910.109(i) Citation History............................................................................ 169

Table 12. CSB Investigations Involving Reactive Chemicals Since 2002 ............................................... 192

Table 13. EPCRA Chemicals and Reporting Thresholds ......................................................................... 196

Table 14. Relevant Siting Regulations...................................................................................................... 228

Table 15. Investigations Involving Land Use Issues ................................................................................ 233

Table 16. Distribution of Grade Levels at the Old and New WISD Schools............................................ 251

Table 17. FGAN Incidents at Stationary Sites.......................................................................................... 254

Table 18. Non-Stationary FGAN Incidents .............................................................................................. 259

001341
West Fertilizer Company Final Report January 2016

9 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Acronyms and Abbreviations

°C degrees Celsius

°F degrees Fahrenheit

AC air conditioning 

AFG Assistance to Firefighters Grant

AHJ Authority Having Jurisdiction

AN ammonium nitrate

ANFO ammonium nitrate/fuel oil

ANSI American National Standards Institute

API American Petroleum Institute

ARA Agricultural Retailers Association

AS ammonium sulfate

ATF Bureau of Alcohol, Tobacco, Firearms and Explosives

CDC Centers for Disease Control and Prevention

CDP Center for Domestic Preparedness

CDT central daylight time

CEPP Chemical Emergency Preparedness Program

CERCLA Comprehensive Environmental Response, Compensation, and Liability Act

CFATS Chemical Facility Anti-Terrorism Standards

CFR Code of Federal Regulations

CMU concrete masonry unit

COI chemical of interest

CSAT Chemical Security Assessment Tool

CSB U.S. Chemical Safety and Hazard Investigation Board

CTG Continuing Training Grant

DHS U.S. Department of Homeland Security

DOL U.S. Department of Labor

DOT U.S. Department of Transportation

DWC Division of Workers’ Compensation

EDT eastern daylight time

EHS extremely hazardous substance

EMPG Emergency Management Performance Grant

EMS emergency medical services

EMT emergency medical technician 

001342
West Fertilizer Company Final Report January 2016

10 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

EO Executive Order

EPA U.S. Environmental Protection Agency

EPCRA Emergency Planning and Community Right-to-Know Act

ERDC Engineer Research and Development Center

ERG Emergency Response Guidebook

ERP Emergency Response Plan

EU European Union

FAST firefighter assist and search team

FEMA Federal Emergency Management Agency

FFFIPP Fire Fighter Fatality Investigation and Prevention Program

FGAN fertilizer grade ammonium nitrate

FP&S Fire Prevention and Safety

FR Federal Register

FRS Facility Registry Service

g/cm3 grams per cubic centimeter

GAO U.S. Government Accountability Office

GPD Grant Programs Directorate

HAZMAT hazardous material 

HAZWOPER Hazardous Waste Operations and Emergency Response

HCS Hazard Communication Standard

HUD U.S. Department of Housing and Urban Development 

HSE UK Health and Safety Executive

HSNTP Homeland Security National Training Program

HVAC heating, ventilation, and air conditioning 

IAFC International Association of Fire Chiefs

IAFF International Association of Fire Fighters

IAP Incident Action Plan

IBC International Building Code

IC incident commander

ICC International Code Council

ICS Incident Command System

ICT Insurance Council of Texas 

IFC International Fire Code

IME Institute of Makers of Explosives

ISO Insurance Services Office

001343
West Fertilizer Company Final Report January 2016

11 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

IST inherently safer technology

K-Mag potassium magnesium

LEPC Local Emergency Planning Committee 

LNG liquefied natural gas 

MOU memorandum of understanding

MSDS Material Safety Data Sheet

NAICS North American Industry Classification System

NEIC National Earthquake Information Center

NERRTC National Emergency Response and Rescue Training Center

NEW net explosive weight

NFA National Fire Academy

NFPA National Fire Protection Association

NIMS National Incident Management System

NIOSH National Institute for Occupational Safety and Health

NOX nitrogen oxide

NPD National Preparedness Directorate

NTED National Training and Education Division

NVFC National Volunteer Fire Council

NYC New York City 

OSHA Occupational Safety and Health Administration

OTSC Office of the Texas State Chemist

PHMSA Pipeline and Hazardous Materials Safety Administration

PPC Public Protection Classification 

PPE personal protective equipment

PRV pressure relief valve

PSI pounds per square inch

PSM Process Safety Management (standard)

PVC polyvinyl chloride

Q&A question and answer

RCRA Resource Conservation and Recovery Act

RDPC Rural Domestic Preparedness Consortium

RFI request for information

RMP Risk Management Plan

SAA State Administrative Agency

SAFER Staffing for Adequate Fire and Emergency Response

001344
West Fertilizer Company Final Report January 2016

12 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

SARA Superfund Amendments and Reauthorization Act

SBA Small Business Administration

SDS Safety Data Sheet

SERC State Emergency Response Commission

SFFMA State Firefighters’ and Fire Marshals’ Association

SFMO State Fire Marshal’s Office

SIC Standard Industrial Classification

SOP standard operating procedure

SPCC spill prevention, control, and countermeasures

TAC Texas Administrative Code

TCEQ Texas Commission on Environmental Quality

TCFP Texas Commission on Fire Protection

TDI Texas Department of Insurance

TEEX Texas A&M Engineering Extension Service

TFI The Fertilizer Institute

TGAN technical grade ammonium nitrate

TIESB Texas Industrial Emergency Services Board

TNT Trinitrotoluene

TR technical report

TRANSCAER Transportation Community Awareness and Emergency Response

TRI Toxics Release Inventory

TX Texas

U.K. United Kingdom

USFA U.S. Fire Administration

USGS U.S. Geological Survey 

VFD volunteer fire department

WFC West Fertilizer Company 

WFD West Fire Department

WIS West Intermediate School

WISD West Independent School District

WMS West Middle School

WVFD West Volunteer Fire Department

001345
West Fertilizer Company Final Report January 2016

13 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1.0 Executive Summary 

1.1 Overview

On April 17, 2013, a fire and explosion occurred at the West Fertilizer Company (WFC), a fertilizer 

blending, retail, and distribution facility in West, Texas. The violent detonation fatally injured 12

emergency responders and three members of the public. Local hospitals treated more than 260 injured 

victims, many of whom required hospital admission. The blast completely destroyed the WFC facility and 

caused widespread damage to more than 150 offsite buildings. The WFC explosion is one of the most 

destructive incidents ever investigated by the U.S. Chemical Safety and Hazard Investigation Board 

(CSB) as measured by the loss of life among emergency responders and civilians; the many injuries 

sustained by people both inside and outside the facility fenceline; and the extensive damage to residences, 

schools, and other structures. Following the explosion, WFC filed for bankruptcy.

The explosion happened at about 7:51 pm central daylight time (CDT), approximately 20 minutes after 

the first signs of a fire were reported to the local 911 emergency response dispatch center. Several local 

volunteer fire departments responded to the facility, which had a stockpile of between 40 and 60 tons 

(80,000 to 120,000 pounds) fertilizer grade ammonium nitrate (FGAN), not counting additional FGAN

not yet offloaded from a railcar. 

More than half of the structures damaged during the explosion were demolished to make way for 

reconstruction. The demolished buildings include an intermediate school (552 feet southwest of the 

facility), a high school (1,263 feet southeast), a two-story apartment complex with 22 units (450 feet 

west) where two members of the public were fatally injured, and a 145-bed nursing home (500 feet west) 

where many of the seriously injured civilians resided. A middle school (2,000 feet southwest) also 

sustained serious but reparable damage. Section 3 describes the incident and its consequences in detail.

The CSB investigated the factors that contributed to the detonation of FGAN. Section 4 describes the 

properties of FGAN and posits three scenarios that could lead to its detonation under the conditions 

present during the WFC fire. CSB concluded that the construction of the bins and other building materials 

as well as the lack of an automatic sprinkler system plausibly contributed to the detonation. Section 6 

describes inherently safer approaches to FGAN use and storage that reduce the risk of an FGAN 

detonation. 

The total insurance-related losses from the explosion are estimated to be around $230 million and federal 

disaster assistance is estimated to exceed $16 million. WFC was only insured for $1 million, which fell 

far short of the incident’s damage. Section 5 presents CSB’s analysis of the policies and regulations that 

led to this as well as to the failure of the insurer to identify the risks posed by FGAN. A few years prior to 

the incident, WFC was dropped by one insurer for failing to address safety concerns identified in loss 

control surveys. The company that insured WFC at the time of the incident did not appear to have 

conducted its own safety inspections of the facility.

001346
West Fertilizer Company Final Report January 2016

14 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB’s analysis of the emergency response, found in Section 7, concludes that the West Volunteer Fire 

Department did not conduct pre-incident planning or response training at WFC, was likely unaware of the 

potential for FGAN detonation, did not take recommended incident response actions at the fire scene, and 

did not have appropriate training in hazardous materials response. 

CSB found several shortcomings in federal and state regulations and standards that could reduce the risk 

of another incident of this type. These include the Occupational Safety and Health Administration’s 

Explosives and Blasting Agents and Process Safety Management standards, the Environmental Protection 

Agency’s Risk Management Program and Emergency Planning and Community Right-to-Know Act, and 

training provided or certified by the Texas Commission on Fire Protection and the State Firefighters’ and 

Fire Marshals’ Association of Texas. CSB’s complete analysis is presented in Section 8.

The location of the WFC relative to the surrounding community exacerbated the offsite consequences, 

leading CSB to assess whether other FGAN storage facilities could pose significant offsite risks. CSB’s 

analysis shows that the risk to the public from a catastrophic incident exists at least within the state of 

Texas, if not more broadly. For example, 19 other Texas facilities storing more than 10,000 pounds of 

FGAN are located within 0.5 miles of a school, hospital, or nursing home, raising concerns that an 

incident with offsite consequences of this magnitude could happen again. Section 9 explores the 

connection between land use planning and offsite consequences.

1.2 Federal and State Response

In response to this incident, President Barack Obama issued Executive Order (EO) 13650, “Improving 

Chemical Facility Safety and Security” to coordinate federal actions to reduce the risks of another 

incident of this type.1

 Details and updates on the status of the EO are included in Section 8.1. 

Early investigation activities focused on law enforcement efforts to determine if there was a criminal 

element to the incident. Responding governmental agencies included the U.S. Bureau of Alcohol, 

Tobacco, Firearms and Explosives (ATF) National Response Team, Texas State Fire Marshal’s Office 

(SFMO), U.S. Occupational Safety and Health Administration (OSHA), Texas Commission on 

Environmental Equality, U.S. Federal Emergency Management Agency (FEMA), and U.S. 

Environmental Protection Agency (EPA). In addition, multiple state and local law enforcement and 

emergency response organizations responded to the scene. 

1.2.1 Joint SFMO/ATF Investigation

Immediately following the incident, ATF deployed to West at the invitation of SFMO and assumed 

control of the WFC site to conduct a joint investigation of the immediate cause and origin of the fire and 

explosion and determine whether the initiating fire was intentionally set. The two agencies retained 

 

1 Executive Order 13650. “Improving Chemical Facility Safety and Security,” August 1, 2013. See: 

https://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facility-safety-andsecurity (accessed on December 8, 2015).

001347
West Fertilizer Company Final Report January 2016

15 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

control of the scene for about four weeks, interviewing witnesses, excavating the WFC site, and 

reconstructing the electrical system. To date, law enforcement has not made a final determination of the

cause of the fire and ensuing explosion. Three possible scenarios remain under consideration: (1) faulty 

electrical wiring, (2) short circuit in an electrical golf cart, and (3) intentional act of arson.2

1.2.2 CSB Response

CSB investigators from both the Washington, DC, and Denver, Colorado, offices deployed on April 18, 

2013, supported by a contingent of contractors that included blast modeling, structural, urban search and 

rescue, and fire and explosion experts. The joint ATF-SFMO control of the site as a crime scene limited 

CSB site access and delayed CSB investigator execution of evidence-gathering protocols, chemical 

testing, and witness interviews. Despite the limited access in the initial stages, driven by the criminal 

investigation, CSB continued with its investigation. 

The investigation of the WFC incident analyzed several root causes and considered multiple contributing 

causes. Investigative teams partnered with urban search and rescue experts and fire and explosion 

consultants to survey damage to residences, schools, the nursing home, and other structures. The teams 

also conducted interviews with eyewitnesses, WFC managers, and hourly workers and gathered physical 

evidence for further laboratory testing and analysis. 

Key Findings

The CSB’s analysis includes findings on the technical causes of the fire and explosion; regulatory 

changes that could have resulted in safety enhancements to the facility; the failure of the insurer to 

conduct safety inspections or provide an adequate level of coverage; shortcomings in emergency 

response, including pre-incident planning or response training of the volunteer fire fighters; and 

deficiencies in land use planning that permitted the City of West to encroach upon the WFC over the 

years. Section 10 presents the CSB’s key findings on the WFC incident. 

Recommendations

As a result of the investigation of the WFC fire and explosion, CSB developed recommendations and 

directed them to the following recipients:

• Environmental Protection Agency (EPA). 

• Occupational Safety and Health Administration (OSHA), U.S. Department of Labor. 

• Federal Emergency Management Agency (FEMA), U.S. Department of Homeland Security. 

• International Codes Council. 

• Texas Department of Insurance.

• Texas Commission on Fire Protection.

• State Firefighters’ and Fire Marshals’ Association of Texas.

• Texas A&M Engineering Extension Services (TEEX).

 

2 See: http://www.tdi.texas.gov/news/2013/news201320.html (accessed on December 22, 2015).

001348
West Fertilizer Company Final Report January 2016

16 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• El Dorado Chemical Company (EDC).

• West Volunteer Fire Department (WVFD).

Section 11 contains the complete set of recommendations.

2.0 Background 

2.1 West Fertilizer Company

The West Fertilizer Company (WFC) was located in the city of West, Texas. The city is approximately 

80 miles south of Dallas, Texas, and has a population of about 2,800.3

 The WFC stored and distributed 

fertilizers, chemicals, grains, and various other farming supplies. At the time of the incident, stockpiles of 

about 40 to 60 tons of FGAN were estimated to be onsite, and about 30 tons detonated. Table 1 shows 

the WFC inventory at the time of the explosion and fire.

Table 1. WFC Fertilizer Inventory in April 2013

Fertilizer Name Amount (in tons)

FGAN (fertilizer building) 40 to 60

FGAN (railcar) 100

Anhydrous ammonia 17

Potash4 45

Diammonium phosphate5 70

Diammonium phosphate and potash 25

Ammonium sulfate6 60 to 70

Zinc sulfate7 17.5

The fertilizer building was constructed in 1961, and business operations started in 1962. Photographs 

from 1972 show the closest residence about 265 feet from the WFC property. In addition, a baseball field 

 

3

 The 2010 U.S. Census data indicate that the population of West, Texas, is 2,807. See: 

http://www.census.gov/2010census/popmap/ (accessed on December 8, 2015). 4 Potash is an agricultural fertilizer and is a source of soluble potassium (K). 5 Diammonium phosphate (DAP), (NH4)2HPO4, is one of a series of water-soluble ammonium phosphate salts that can 

be produced when ammonia reacts with phosphoric acid.

6 Ammonium sulfate, (NH4)2SO4, is an inorganic salt with a number of commercial uses. The most common use is as 

a soil fertilizer.

7 Zinc sulfate, ZnSO4, is an inorganic compound and is a colorless solid that is a common source of soluble zinc ions.

001349
West Fertilizer Company Final Report January 2016

17 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was 58 feet from the property. In 1972, the town nursing home and the nearest group of homes were 

constructed about 500 feet away.8

 

Over the years, growth in the city of West led to the development of land closer to the WFC property line, 

including a park (less than 150 feet), an apartment complex, the nearest aggregation of homes (about 370 

feet), West Intermediate School (a little more than 200 feet), and West High School (about 500 feet). 

Sections 3.4.2 through 3.4.7 provide additional details on the property damage resulting from the 

explosion.9

 Figure 1 shows the WFC facility before the fire and explosion in relation to the nearby 

community, including details on the site and the location of various structures.

 

8 This information was determined using Image 272-37A provided by McLennan County and distances calculated 

using Google Earth (accessed on June 6, 2013). 9 Calculated using Google Earth (accessed on June 6, 2013). 

001350
West Fertilizer Company Final Report January 2016

18 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC Facility Legend Figures in Report

1 Grain Silos 2

2 Location of Overturned FGAN Railcar (post-explosion) 15

3 Corn Silo -

4 Office/Chemical Storage -

5 Fertilizer Building 3-5, 7

6 Liquid Fertilizer Tanks 16

7 Anhydrous Ammonia Pressure Vessels 6, 17, 21

8 Scale House -

9 Nearest Fire Hydrant -

City of West Legend Figures in Report Approximate Distance from Seat of 

Blast to Fenceline (Feet)

West Fertilizer Company 2-8, 12 0

West High School 30 1157

West Intermediate School 23-29 552

Basketball Court 20 249

Playground 19 366

West Terrace Apartment Complex 36 454

West Rest Haven Nursing Home 33-35 629

Figure 1. 2013 Overview of WFC Facility (Source: Bing Maps)

2.1.1 Facility Operations Description

The West, Texas, site consisted of two companies owned by the same family. Adair Grain, Inc., bought

and sold grain while the WFC sold fertilizer, farming chemicals (pesticides and herbicides), and basic 

farm equipment (such as barbed wire, baling twine, and fencing). The WFC also rented farming 

equipment (fertilizer spreading equipment, tillage equipment) and spread fertilizer on farmland when

needed, and its daily activities were largely based on season and weather.

001351
West Fertilizer Company Final Report January 2016

19 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Adair Grain bought grain (milo10 and corn) from farmers and stored it in four onsite silos (shown in 

Figure 1 and Figure 2). Adair Grain received grain from farmers’ trucks and deposited it into pits (Figure 

3). An auger then transferred the grain from these pits, depositing it into the grain bin. 

Figure 2. Grain Silos (Source: WFC Insurer)

 

10 Milo, also called grain sorghum, is a major feed grain for cattle.

001352
West Fertilizer Company Final Report January 2016

20 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Fertilizer Loading Pit and 

Conveyor Belt

Railcar of Fertilizer

Figure 3. West View of Fertilizer Building (Source: Bing Maps)

The WFC operated two buildings and a number of tanks (shown in Figures 1 and 3). One building served 

as a chemical warehouse, shop area, and office space. Most chemicals purchased by farmers were stored 

in that building. Such chemicals included Roundup®, Sevin®, and additives to make pesticides adhere to 

plants (such as Weedmaster® and Grazonnext®) and were stored in containers ranging in size from 2 to 

300 gallons. 

The WFC also owned the fertilizer building, constructed in the 1960s, where dry fertilizer was stored

(Figure 4). Fertilizers stored in that building included diammonium phosphate, ammonium sulfate, 

potash (potassium chloride), potassium magnesium sulfate (K-Mag), and FGAN. A seed room was 

located at the north end of this building (Figure 5). 

001353
West Fertilizer Company Final Report January 2016

21 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 4. Fertilizer Building Overview (Source: Atlas Engineering) 

Bagged 

Fertilizer

Abandoned 

Bin

Primary 

Ammonium 

Nitrate Bin

Palletized 

Zinc

Golf Cart Front End 

Loader

Hay Seed Hay Seed Hay Seed

Old Seed 

Storage

Top of 

Elevator

Twine

Figure 5. Southwest View from Northeast Corner of Fertilizer Building (Source: WFC Insurer)

The WFC facility had two 12,000-gallon anhydrous ammonia11 (NH3) storage vessels, located to the 

south of the fertilizer building, for distribution and sale of the product to farmers (Figure 6). The 

 

11 Anhydrous ammonia is a colorless and extremely water-soluble gas at room temperature, with a strong irritating 

odor. Ammonia gas is lighter than air, but under certain conditions, ammonia vapor can settle close to the ground 

during a leak, forming a white cloud. Ammonia can be compressed into a liquid under pressure, and within a 

concentration in air range of 15 to 28 percent, it is flammable. This is known as the lower explosive limit (LEL) and 

upper explosive limit (UEL), respectively. Ammonia exposure at lower concentrations can irritate the skin, eyes, 

and respiratory system, and at high concentrations, exposure can result in pulmonary edema and death.

001354
West Fertilizer Company Final Report January 2016

22 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

anhydrous ammonia was primarily trucked into the facility, but delivery by rail was also possible. 

Although anhydrous ammonia is used in the manufacture of AN, the WFC stored it onsite solely for sale 

to consumers as liquid fertilizer. Adjacent to the anhydrous ammonia tanks, liquid fertilizer was stored 

outside in several vertical tanks. This type of fertilizer included a urea ammonium nitrate (UAN) 

solution or liquid phosphate, and could be blended to meet specific farmer needs. One outside tank was 

normally full of water to mix with chemicals or liquid fertilizer. 

No products were manufactured onsite; the WFC was essentially a distribution center for suppliers such 

as Mosaic, BASF, Agri-Phos, El Dorado Chemical Company (EDC), and CF Industries. EDC and CF 

Industries are the only manufacturers of FGAN in the United States. The WFC mixed and sold bulk 

fertilizer components or unaltered products such as pure FGAN and ammonium sulfate. Farmers came to

the WFC and bought fertilizer that was weighed in a hopper, blended in a mixer, and distributed by 

conveyor belt (the mixer and conveyor belt can be seen in Figure 7). The WFC also delivered and applied

fertilizer or chemicals to a farmer’s fields if needed.

Figure 6. Anhydrous Ammonia Storage (Source: WFC Insurer)

001355
West Fertilizer Company Final Report January 2016

23 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 7. West View from East of Fertilizer Building (Source: WFC Insurer)

2.1.2 Facility Layout and Materials of Construction

The fertilizer building (Figure 4) was a wood-framed structure with a concrete floor, at an elevation about 

3 feet above grade. The building was constructed piecemeal over the years, starting with the original 

construction in 1961. The seed room was fabricated in the early 1980s, with a roof constructed of 

wooden rafters topped with plywood and covered with asphalt shingles. The only trench or drain in the 

building was in the cattle trough, which was used to collect fertilizer slurry when it became moist. A 

series of ladders were positioned adjacent to the elevator.

FGAN was stored in two plywood bins along the west wall of the building and in one primary FGAN bin 

at the north end of building. The primary FGAN bin was normally no more than half full while the 

fertilizer bins on the west wall could be filled to the top of the containment. In the northeast corner of the 

building, an abandoned bin had been used to store fertilizer in the past but was unused at the time of the 

incident. 

The primary FGAN bin was constructed differently than the bins on the west wall. The bins on the west 

wall were composed of three walls rising to a height of about 10 feet and an open front. The primary bin 

was constructed by attaching plywood sheets to the inside of the exterior beams of the structure. The 

interior walls were also constructed of 6-inch beams with plywood attached. The main bin was estimated 

to be 8 feet wide, 20 feet long, and 30 feet high. A large hinged door covered the south end of the bin, 

with a 3-foot opening at the bottom. Holes were cut in the bin to provide air circulation, and a set of holes 

on the west wall allowed the bin to overflow into a smaller adjacent bin. 

001356
West Fertilizer Company Final Report January 2016

24 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The door to the bin was normally closed when the bin was filled, and it could be opened to provide access 

after the inventory was reduced so that the fertilizer was not resting against the door. The bin was just 

wide enough (8 to 10 feet) to allow a front-end loader to drive in to access and gather the remaining 

FGAN. Like the west bins, the primary FGAN bin had plywood sheets (including some particle boards) 

and a wooden frame for support (shown post-explosion in Figure 8). The primary bin also had metal rods

connected at opposite sides of the bin, providing internal stiffening support.

About 2 years before the WFC explosion, the northeast corner of the north wall of the primary FGAN bin 

failed, and employees erected steel and concrete reinforcement around the bottom of the northeast corner 

to provide support and hold up the bin. As a result, the WFC never completely filled the primary bin to 

avoid another failure. 

A seed room,12 fabricated in 1980 and located at the north end of the fertilizer building served as the 

warehouse for seeds sold to consumers. Asphalt shingles covered the roof of the seed room of the 

fertilizer building. The seed room also stored more than 700 bags of zinc sulfate on the day of the fire 

and explosion. The zinc sulfate and seeds were stored in bags on pallets, with about 40 to 50 bags per 

pallet, stacked to a height of about 3 to 4 feet on each pallet. The seed room also contained two pallets of 

lawn and garden fertilizer (bagged at the WFC), twine, bailing wire, and fencing materials. At the west 

end of the seed room, 8 to 10 pallets of out-of-season seeds were segregated in an area cooled by an air 

 

12 The seed room was used for storage of seed, bagged fertilizer, equipment, and vehicles, including a riding 

lawnmower, a golf cart, and a fork lift. It was constructed as an addition to the main fertilizer building in the early 

1980s. 

. Figure 8. Plywood Bin Wall, Post-Explosion (Source: CSB)

001357
West Fertilizer Company Final Report January 2016

25 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

conditioner. The east end of the seed room stored twine and netting. At the time of the incident, the room 

held a relatively low inventory of seeds (approximately 30 percent of the room’s capacity, or 3,000 bags 

of out-of-season seeds).

2.1.3 Unloading of Fertilizer

Historically, suppliers delivered bulk fertilizer product by truck or rail, but immediately before the 

incident, most shipments arrived by truck. All bulk fertilizer was transferred into the bins (located as 

shown in Figure 4), using the same conveyor belt system described in the previous section. Delivered 

fertilizer was first deposited into a loading pit. An uncovered 20-inch-wide rubber conveyor belt then 

transported the product into the fertilizer building. The belt was cupped to hold the fertilizer, which was 

transferred from this conveyor belt to a bucket elevator (pictured post-explosion in Figure 9). 

Figure 9. Elevator System Recovered from Blast Debris (Source: CSB) 

The elevator lifted the fertilizer to the cupola (the highest structure) and deposited it into polyvinyl 

chloride (PVC) pipes, which in turn conveyed the fertilizer to either the main FGAN bin or a horizontal 

conveyor belt for distribution to the bins along the west wall. A valve was used to gravity-feed material 

to either the large FGAN bin by way of PVC piping (approximately 20 feet long by 1 foot in diameter) or 

through an approximately 40-foot downpipe toward the horizontal conveyor belt in the main portion of

the building. A piece of PVC piping could be added to the downpipe to direct product from the 

horizontal conveyor belt and to direct FGAN to the two FGAN overload bins on the west wall. The 

horizontal conveyor belt transported product to the bins in the southern portions of the building. A 6- to 

8-foot “kicker” conveyor belt transferred the fertilizer from the horizontal conveyor belt to its final 

destination in any of the west wall bins. Electric motors powered the conveyor belts. Every fertilizer 

product used the same conveyor system process for filling the respective bins.

001358
West Fertilizer Company Final Report January 2016

26 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Workers used a front-end loader to move the fertilizer within the fertilizer building. For a blended

fertilizer product, the operator would place a load of each product in a predetermined quantity into the 

weigh hopper. After all of the ingredients were weighed, the product was sent via a conveyor belt to a 

mixer, which had the appearance of a stationary concrete mixer. The mixed product was deposited on a 

conveyor belt and loaded into a truck or spreader. A yellow auger next to the conveyor mixed seed with 

fertilizer. Zinc sulfate could also be added to fertilizer.

2.1.4 Housekeeping

Because unloading operations in the fertilizer building created a dusty environment, the first task of the 

day in the fertilizer building was cleaning the floor after work during the previous day and evening. To 

address these conditions during operating hours, the WFC used fans to control the dust during unloading,

and on some occasions, workers added a vegetable oil coating to the ammonium phosphate to reduce the 

dust.13 An employee reported to CSB that some products were dustier than others and that floor sweeping 

compound was also applied to the fertilizer building floor on very wet days. When mixing fertilizer, 

operators usually added phosphate to the hopper and mixer first to eliminate any moisture. 

The employees reported that because FGAN tends to absorb moisture and dissolve, the WFC used air 

conditioning to cool and remove moisture from the primary FGAN bin. After the FGAN bin was 

emptied, it was swept to remove moisture. On damp or humid days, operators minimized handling 

FGAN unless necessary because it would “melt” and become lost product.

When the fertilizer became damp and began to “sweat” onto the floor, it was swept into a trench (cattle 

trough) on the east side of the fertilizer building. The liquid captured as slurry in the trough was then 

pumped into a liquid fertilizer tank for disposal. Employees reported that the plywood walls between the 

bins “stayed pretty clean” and did not require any housekeeping.

After a shipment of one type of fertilizer was unloaded, no cleaning process was used to clear the 

conveyor belt before the next load was transferred. During the unloading process, the fertilizer 

occasionally spilled because the conveyor belts got off track or ripped. In such cases, operators attempted

to separate the products as best they could, but intermixing and cross-contamination nonetheless would 

occur. The fertilizer in the west bins was occasionally changed out, and if the product became damp and 

moist, it might have been emptied out with a “drier” product such as K-Mag placed into that bin. The KMag would dry out the bin, and afterward, the bin could revert to storage space for another product. 

Occasionally, the bin walls developed holes or cracks, and when that occurred, either new wood walls 

were put in place to replace the old ones or caulk was used to fill the holes.

 

13 Ammonium phosphate was the only product at the WFC with an oil coating.

001359
West Fertilizer Company Final Report January 2016

27 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

3.0 Incident Description

On April 17, 2013, at approximately 7:29 pm, citizens reported signs of smoke and fire at the West 

Fertilizer Company (WFC) facility to the local 911 dispatch center. Within 20 minutes, a massive 

explosion occurred, killing 15 people and sending a blast wave through the town that damaged or 

destroyed many buildings and homes. The fire was witnessed from several vantage points by different 

individuals associated with the West Police Department, Dallas Fire-Rescue Department, and volunteer 

fire departments (VFDs) from West, Abbott, Bruceville-Eddy, Mertens, and Navarro Mills. These 

accounts assisted CSB in determining how the events of the day transpired.

3.1 West Police Department 

One of the first responders to the incident was a West Police Department officer who was on routine 

patrol that evening. The officer reported that he smelled smoke as he was driving through the city park14

but was not able to identify the exact location of the smoke until he encountered a concerned citizen who 

advised him that smoke was venting from the highest portion of the WFC building. The officer advised 

the dispatch center of the smoke and requested that the West Volunteer Fire Department (WVFD) be 

dispatched to the WFC facility. Once the officer arrived on scene, he witnessed flames that were visible 

through the wall, extending upward from the lower level to the upper level of the northeast corner of the 

two-story fertilizer storage building. Then he called dispatchers again and asked them to inform the 

WVFD that the smoke had escalated to a structure fire.

The WVFD contacted the officer via radio and requested that he establish traffic control to prevent 

citizens from driving over the fire hoses once the fire engines arrived and laid down fire hoses. The 

officer agreed but notified the WVFD that he needed to evacuate the city park first. As the officer 

proceeded to the city park, the responding West firefighters drove past him, heading toward the facility. 

Once the officer reached the city park, he used his public address system to order an evacuation of the 

park. After the park was evacuated, he left the area to establish traffic control on the north end of the 

fertilizer facility. There was no traffic control at the south end toward West High School (WHS), so the 

officer asked a nearby resident to assist by using his truck to block that intersection. At this time, the 

officer contacted the police chief and another officer who had called to determine whether he needed 

assistance. The officer asked the police chief to establish traffic control by the West Intermediate School 

(WIS) and requested that the other officer relieve the resident who was helping near the high school. 

Numerous citizens began parking their cars at WHS to watch the fire. The WVFD truck left the WFC

facility and headed toward the police officer. The manager of the WFC arrived on scene to assist the 

WVFD. Via radio traffic, the officer learned that the entire fertilizer storage building was engulfed in 

flames, and shortly thereafter he saw and felt the explosion. The officer was briefly disoriented and then 

unsuccessfully attempted via radio and cell phone to notify the dispatch center of the explosion. An 

 

14 The city park consisted of the basketball court and the playground.

001360
West Fertilizer Company Final Report January 2016

28 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

injured member of the public and an injured firefighter approached the officer, who assisted them. The 

possibility of further explosions or toxic releases was a concern because of the anhydrous ammonia 

pressure vessels on the south side of the WFC property. On the basis of this information, the officer 

decided to evacuate homes within a 1-mile radius. Because the officer’s patrol car would not start, he 

proceeded on foot along Jerry Mashek Drive and Main Street to alert people to evacuate (refer to Figure 1 

for a map of the area). By the time the officer made his way to Reagan Street, he had become aware that 

other emergency responders had initiated the evacuation of the northern portion of the city.

3.2 West Volunteer Fire Department (WVFD)

Emergency dispatchers paged the WVFD, and firefighters responded to the scene with two fire engines, 

two initial attack apparatus or brush trucks,

15 and a water tender truck16 at various times. Dispatchers also 

paged mutual aid personnel from neighboring counties, including Abbott, which responded. Many of the 

firefighters also responded by using their personally owned vehicles (POVs). According to eyewitness 

accounts, the fire intensified very quickly and was described as a rolling fire that moved from the 

northeast end of the fertilizer building (in the seed storage area north of the office) toward the southern 

end of the building. 

Five firefighters arrived on scene in two fire engines at different times. The first fire engine arrived on 

scene and staged east of the burning structure while one of the brush trucks staged to the north of the first 

fire engine. Four other firefighters directed water (using two 1.5-inch hoses) from the first fire engine’s 

internal tank onto the fire through the northeast doorway of the bagged fertilizer room, where fire was 

present. Once the second fire engine arrived on scene, the two firefighters from that fire engine began

laying 1,000 feet of 4-inch hose line from the fire hydrant near the high school (1,600 feet away) toward 

the fertilizer facility. After laying all of the hose lines from the second fire engine, they discovered that 

the hose was approximately 700 feet short of the length needed to effectively fight the fire. After 

assessing the situation, one firefighter arranged to take the first fire engine, which had a better pump with 

greater pressure capabilities and additional hose that would allow him to continue to reverse-lay the 

lines.17 However, rather than resuming where the first fire engine ran out of hose, the firefighter went 

back to the fire hydrant near the high school to connect the first engine to the hydrant without laying the 

additional length of hose needed to supplement the hose that had already been laid from the second 

 

15 Initial attack fire apparatus as defined in NFPA 1901 is fire apparatus with a permanently mounted fire pump of at 

least 250 gallons per minute (gpm) capacity, water tank, and hose body whose primary purpose is to initiate a fire 

suppression attack on structural, vehicular, or vegetation fires and to support associated fire department operations. 

Normally, most initial attack fire apparatus are constructed on commercial-style chassis. NFPA 190:1 Standard for 

Automotive Fire Apparatus, 2016 Edition. Quincy, MA: NFPA, 2016. 16 A water tender is the National Incident Management Systems (NIMS) approved term for a wheeled vehicle carrying 

water for fire suppression.

17 In firefighting, reverse lay refers to the nozzle end of the hose being laid from the fire to a water source. This 

method is used when the pumper must first go to the fire location to size it up before laying supply line, and it is the 

most expedient way to lay hose if the apparatus must stay close to the water source.

001361
West Fertilizer Company Final Report January 2016

29 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

engine. He saw flames (40 to 50 feet high) coming out of the cupola atop the fertilizer storage building 

and out of the door on the northeast corner of the building. Before the firefighter could make his way 

back to the end of the hose run, the explosion occurred. Before the explosion, the WVFD assistant chief 

arrived at the WFC facility, spoke with the police officer on scene, and advised him to begin evacuating

nearby homes. He also made a radio request to the dispatch center, asking for a ladder truck to set up at 

the West Terrace Apartments in case a fire started there, but a ladder truck was not available. The WVFD 

chief and assistant fire chief were assessing the situation just before the explosion and were considering a 

total evacuation, even though neither believed that the FGAN would explode.18

On the basis of interviews that CSB conducted after the incident, the WVFD came to understand that it 

did not have enough water to effectively fight the fire.19 Accordingly, the WVFD was considering the 

appropriate course of action—possibly standing down, letting the structure burn, and focusing on 

evacuation.

3.3 Abbott, Bruceville-Eddy, Mertens, and Navarro Mills Volunteer 

Fire Departments

On the evening of the incident, a group of volunteer firefighters from neighboring city fire departments 

(including Bruceville-Eddy, Mertens, and Navarro Mills), who were taking an Emergency Medical 

Technician (EMT)–Basic class at the West Emergency Medical Services (EMS) building, responded to 

the fire. The West EMS facility is located a few blocks west of the WFC facility.20 When these volunteer 

firefighters heard the sirens activated in the city, they immediately made their way to the site. In addition, 

an ambulance responded with two EMTs and a volunteer firefighter. According to interviews that CSB 

conducted with emergency responders, radio and cell phone capabilities at the scene were limited after the 

explosion. Following the explosion, officials established two different staging areas. The first staging 

area, at the high school football field about 0.25 miles from the blast site, was used as a triage area for 

injured residents. Injured personnel and residents were relocated from the football field to the second 

staging area, at the community center about 1 mile away.21 After the explosion at approximately 8:15 

pm, additional volunteer firefighters from the neighboring cities of Abbott, Bruceville-Eddy, Mertens, and 

Navarro Mills responded to the WFC facility. Figure 10 shows the WFC explosion as it unfolded. 

 

18 Section 7 of this report provides further details on how the evacuation occurred. 

19 Employees and emergency responders should not fight AN fires past the incipient stage. Further details on 

responding to AN fires is available in Section 7.5 and Section 7.6 of this report. 20 State Fire Marshal’s Office. “Firefighter Fatality Investigation,” Investigation FFF FY 13-06 (West, TX). 21 Clements, Bruce. Texas Department of State Health Services, “The Texas Public Health Response to the West 

Fertilizer Plant Explosion,” October 8, 2013.

001362
West Fertilizer Company Final Report January 2016

30 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 10. Video Stills of WFC Fire and Explosion (Source: Member of the Public) 

3.4 Consequences

3.4.1 Fatalities and Injuries

The violent explosion at the WFC facility fatally injured 12 emergency responders and 3 members of the 

public. All of the fatalities except one resulted from fractures, blunt force trauma, or blast force injuries 

sustained at the time of the explosion. Two fatally injured members of the public lived at a nearby 

apartment complex while the third resided at the nursing home and died from injuries brought on by the 

trauma of the explosion shortly after the incident. According to the Waco-McLennan County Public 

Health District’s report, 22 the incident resulted in more than 260 injured victims, including emergency 

responders and members of the public.23 Hill County (Hill Regional Hospital and Lake Whitney Medical 

Center) and McLennan County (Hillcrest Baptist Medical Center and Providence Health Center) hospitals 

received 81 percent of patient visits, with 104 injury visits at Hillcrest Baptist Medical Center, 82 visits at 

Providence Health Center, 41 injury visits to Hill Regional Hospital, and 1 injury visit at Lake Whitney 

Medical Center.24 The injuries ranged from relatively minor wounds (such as contusions, abrasions, and 

lacerations) to more serious injuries (such as fractures, closed head injuries, traumatic brain injuries, and 

skin burns). The majority of patients were treated and released after their initial visit to a hospital, 

medical center, or mobile medical unit. Figure 11 categorizes all injury types sustained by the 252 

patients injured directly by the explosion; many patients received multiple types of injuries. The WacoMcLennan County Public Health report also identified the location where 76 percent of the reported 252 

 

22 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) 

Fertilizer Plant Explosion,” June 24, 2014. 23 The number of injured victims includes patients who were treated after the explosion and sustained injuries during 

clean-up or by debris in the neighborhood. 24 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) 

Fertilizer Plant Explosion,” June 24, 2014: 7.

001363
West Fertilizer Company Final Report January 2016

31 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

injuries occurred, outside or inside of a structure. More than half of the injured patients reported being 

inside a structure (55 percent), and the rest said they were outside (13 percent) or inside of a vehicle (8

percent). The locations cited by the injured also reflected the most common types of injuries. Patients 

who were inside a structure were twice as likely to suffer abrasions, contusions, and lacerations. People 

who were outside or inside of a vehicle were eight times more likely to have hearing loss or tinnitus, 

tympanic membrane rupture, or inhalation injuries. The majority of the injured were within 1,500 feet of 

the blast, although some were more than 2,000 feet from the explosion; people who were hospitalized 

were closer to the center of the blast than those who were not admitted. Notably, eye injuries—and 

traumatic brain injuries and concussions—were equally distributed among the injured, regardless of 

location.25 Detailed information regarding the cause of nonfatal injuries was not collected and analyzed. 

Possible causes of injuries include being struck by primary fragment projectiles, by secondary fragments 

from remote structures and vehicles, or directly by the blast wave.

Figure 11. Number of Nonfatal Injuries, by Injury Type (Source: Waco-McLennan County Public Health 

District)26

During the investigation, CSB noted two potential scenarios that could have led to more severe 

consequences. First, if the fire had started during the middle of a normal school day instead of the 

 

25 Waco-McLennan County Public Health District. “A Public Health Report on Injuries Related to the West (Texas) 

Fertilizer Plant Explosion,” June 24, 2014.

26 Waco-McLennan County Public Health District. “Public Health Report: Injuries Related to the West (Texas) 

Fertilizer Plant Explosion,” April 2013 (issued on June 24, 2014).

141

134

53

34

31

30

29

21

12

12

6

0 20 40 60 80 100 120 140 160

Abrasions/contusions

Lacerations/penetrating trauma

Traumatic brain injuries/concussions

Tinnitus/hearing problems

Eye injuries

Inhalation injuries

Sprains/strains

Fractures/dislocations

Blast injuries

Tympanic membrane ruptures

Burns

Number of Injuries

001364
West Fertilizer Company Final Report January 2016

32 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

evening and if all other conditions remained unchanged (specifically, if onsite WFC employees were 

unable to extinguish the fire), students would have been present at the intermediate and high schools. 

Had the schools evacuated, students likely would have assembled in areas such as the gymnasium and 

multipurpose rooms within the schools (and in other pre-designated areas outside of the schools) before 

the evacuation to conduct a head count. Given the short time that elapsed before the explosion, many 

students and staff members might have been injured in the 20 minutes from the first discovery of a fire 

until the explosion. Second, a railcar loaded with more than 100 tons of FGAN toppled during the 

explosion but did not detonate. If the contents of the railcar had detonated, the damage, injuries, and 

fatalities would have been significantly worse. These scenarios are important to consider because 

throughout the United States, there are many facilities that, like WFC, are located near public structures 

such as schools.27

3.4.2 Property Damage

The West incident caused considerable property damage, including the complete destruction of the WFC 

facility (Figure 12). An initial estimate by the Texas Department of Insurance set total property damage 

resulting from the explosion and fire at $100 million. CSB hired a consulting firm28 to perform an 

assessment of the structural and property damage caused by the fire and explosion. The assessment 

involved a thorough examination of damage to the WFC facility and to the community structures and 

facilities.29 As of the publication of this report, neither the owners of the WFC nor the city of West has 

decided whether the WFC facility would be rebuilt. Currently, the local farmers are using fertilizer from 

another fertilizer facility in Leroy, Texas, seven miles east of the city of West.

 

27 Section 5.4 provides further details on the location of schools in relation to FGAN facilities throughout Texas. 28 ABSG Consulting Inc. See: http://www.absconsulting.com/ (accessed on June 26, 2015).

29 Sites examined included the West Intermediate School (WIS), West High School (WHS), West Middle School 

(WMS), West Rest Haven nursing home, and the park.

001365
West Fertilizer Company Final Report January 2016

33 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 12. Overview of Damage to WFC Facility (Source: Texas Civil Air Patrol)

The explosion, overpressure, and debris completely destroyed a WVFD brush truck, water tender, and fire 

engine (Figure 13). The water tender was located southeast of the crater and likely moved about 6 inches 

south as a result of the blast overpressure. The explosion propelled the door from the water tender to the 

east. A large farm truck south of the fertilizer storage building and toward the scale house moved about 6 

inches south of its original location because of the blast wave (Figure 14). All of the POVs belonging to 

responding volunteer firefighters who parked onsite were damaged or destroyed in the explosion. In 

addition, the explosion overturned and destroyed the railroad car loaded with FGAN, approximately 190 

feet to the north of the crater (Figure 15).

 

Overturned 

FGAN 

Railcar

Vertical

Liquid 

Fertilizer 

Tanks

Fire 

Department 

Water 

Tender

EMS 

Vehicle Damaged 

Railroad

Anhydrous 

Ammonia 

Pressure 

Vessels

Overturned 

FGAN 

Railcar

Vertical

Liquid 

Fertilizer 

Tanks

Fire 

Department 

Water 

Tender

EMS 

Vehicle

Anhydrous 

Ammonia 

Pressure 

Vessels

001366
West Fertilizer Company Final Report January 2016

34 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 13. Damaged WVFD Water Tender (Source: ABS Consulting) 

Figure 14. Farm Truck South of Crater, Near the Scale House (Source: ABS Consulting) 

001367
West Fertilizer Company Final Report January 2016

35 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 15. Railcar Loaded with FGAN, Destroyed and Overturned by Explosion (Source: CSB)

The explosion completely demolished the scale house; the roof and all four walls failed. The explosion 

flattened the chemical storage and office building east of the fertilizer storage building—all that remained 

was a stack of metal debris where the building once stood. The explosion also destroyed the corn silo 

north of the fertilizer storage building. In addition, the blast heavily damaged the above-ground vertical 

liquid fertilizer storage tanks. As shown in Figure 16, the liquid level during the explosion in the tank to 

the left is clearly visible by the crease at the top of the tank where the deformation begins. The tank on 

the right in Figure 16 clearly shows a large debris impact that folded and crushed the tank.

Figure 16. Liquid Fertilizer Tank Damage (Source: CSB)

001368
West Fertilizer Company Final Report January 2016

36 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The two 12,000-gallon anhydrous ammonia pressure vessels were approximately 30 percent full of 

ammonia at the time of the explosion. As shown in Figure 17, the anhydrous ammonia pressure vessels 

were south of the crater. The pressure relief valves (PRVs) on the northern anhydrous ammonia pressure 

vessel still had their weather caps on and consequently did not relieve the pressure. The weather caps 

were missing on the PRVs in the middle of the southern anhydrous ammonia pressure vessel.

30 Two 

additional liquid fertilizer storage tanks sat parallel to the railroad track southwest of the anhydrous 

ammonia pressure vessels. The blast of the explosion also damaged the tracks on the railroad between the 

WFC property and the park. The blast was sufficiently powerful to shift the tracks more than 2 feet to 

one side, creating a prominent curve in the tracks (Figure 18). 

Figure 17. Anhydrous Ammonia Pressure Vessels (Source: CSB) 

 

30 The condition of the anhydrous ammonia pressure vessels is discussed in further detail in Section 3.4.2.1 of this 

report. 

001369
West Fertilizer Company Final Report January 2016

37 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 18. Damaged Railroad Tracks Adjacent to WFC Facility (Source: CSB)

The explosion damaged a playground and basketball court in a park located a few hundred feet west of 

the WFC facility (Figure 19). The blast destroyed equipment on the playground, including damaging the 

basketball goal posts on the basketball court (Figure 20). In addition, the trees in the vicinity of the park 

showed evidence of scorching,

31 likely from the fireball when the explosion occurred. The trees were

directly downwind of the anhydrous ammonia pressure vessels and were not within the smoke plume 

from the fire. Pre-explosion video of the fire shows the smoke traveling with the wind but crossing the 

playground equipment to the north of the basketball courts.

Figure 19. Damaged Playground Equipment (Source: ABS Consulting)

 

31 The ABS damage assessment did not include making a determination about whether the trees were scorched by the 

fire or by another source.

001370
West Fertilizer Company Final Report January 2016

38 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 20. Damaged Basketball Goal Post at Park (Source: ABS Consulting)

3.4.2.1 WFC Anhydrous Ammonia Vessels

The two 12,000-gallon anhydrous ammonia vessels were located at the south end of the storage building, 

about 150 feet from the site where the initial fire and smoke were observed. Each vessel was more than 

46 feet long, with two affixed PRVs set to vent the tanks to the atmosphere if the pressure inside the tanks 

exceeded predetermined set points, estimated by one employee as between 250 and 300 pounds per 

square inch (psi). Both sets of PRVs were fitted with orange plastic caps intended to protect the devices 

from rain and dirt. The vessels shared a common pipeline that allowed switching between the tanks on 

occasion, but under normal operation, the connecting pipe was kept in a closed position.

CSB observed the intact PRVs on top of the vessels (Figure 21) on May 28, 2013, although the polyvinyl 

chloride (PVC) protective caps were no longer in place on the PRVs of the southernmost tank. The 

absence of detectable residue of this protective material on the PRV suggested that it was exposed to fire 

to the degree that it melted. The caps were not found during any post-incident salvage or recovery 

activities. During salvage operations, a crane with lift bucket reportedly struck the PRV for the 

northernmost tank, knocking it to the ground where it was found. 

001371
West Fertilizer Company Final Report January 2016

39 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 21. Anhydrous Ammonia Tank PRV, Post-Incident (Source: CSB) 

From interviews with employees who were knowledgeable about the frequency of deliveries and volumes 

in the tanks, CSB learned that the site received as many as four deliveries of anhydrous ammonia per day 

under normal operating conditions with good weather and that each vessel was at 30 percent capacity, or 

about 7,200 gallons, at the time of the fire and explosion. After the incident, technicians removed all 

remaining contents in both vessels. 

When hazardous materials technicians in fully encapsulated personal protection equipment initially 

entered the area of the anhydrous ammonia vessels after the site was secured, they observed a leaking 

valve at the east end of the tanks. In light of a buildup of ice around the valve, it is thought that the 

material leaking was liquid anhydrous ammonia. Notably, anhydrous ammonia stored under pressure 

contains latent heat. As the liquid is released, it cools rapidly and interacts with moisture in the 

atmosphere and can freeze on the pipe and adjacent vessel. However, the vessels did not catastrophically 

fail on the night of the incident. The CSB considers this to be a near-miss of potentially significant 

consequence.

3.4.3 West Independent School District

The WFC built its facility in 1962, before much of the surrounding community developed. In 1923, the 

West Independent School District (WISD) (Figure 22) built the West Middle School (WMS), which at the 

time served as the high school for the city of West. The WMS campus added a building in 1957 that 

served as supplementary classrooms and library space. The WISD also built West Elementary School 

(WES) in the early 1960s. WIS was built around 1985, and WHS was constructed in 2000, after the WFC 

facility was built. Four schools were in close proximity to the facility, including WIS (552 feet southwest

001372
West Fertilizer Company Final Report January 2016

40 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the facility), WHS (1,263 feet southeast of the facility), WMS (2,000 feet southwest of the facility), 

and WES (4,867 feet southwest of the facility).32

Figure 22. Proximity of WFC Facility to Schools and Other Public Structures (Source: Google Earth) 

 

32 The growth of the community around the WFC facility is discussed in further detail in Section 9 of this report.

West Fertilizer 

Company

West High 

School

West Playground Rest Haven

West 

Intermediate 

School

West Middle 

School

West Terrace 

Apartments

West Elementary 

School

001373
West Fertilizer Company Final Report January 2016

41 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The overpressure from the explosion’s blast wave caused most of the damage, although some fires started 

post-explosion, including those at WIS and many nearby homes. At the time of the incident, school was 

not in session, which limited the number of fatalities and injuries to members of the public (including 

students, teachers, and other staff members). However, if the explosion had occurred during normal 

school hours, the number of injuries and fatalities from the blast wave could have been much higher. 

Table 2 indicates the projected number of students and staff members who would have been affected and 

could potentially have been injured or killed by the blast if school had been in session. If all enrolled 

students had been in school that day, approximately 1,486 students would have been present and 

vulnerable. Of this total, 665 students would have been at WIS and WHS, which suffered the most severe 

damage. If the explosion had occurred during school hours and all staff members had been present that 

day, approximately 191 staff members would have been vulnerable. Of this total, 86 staff members 

would have been at WIS and WHS. Because of the breadth of damage at the schools, the WISD decided 

to demolish WIS, WHS, and all WMS facilities except for the gymnasium and the 1923 building. The 

WISD also demolished select portions of the 1967 annex and the entire cafeteria at WMS. Appendix A 

includes a discussion of the details of WISD plans to restore and rebuild the school system. For a more 

complete understanding of the magnitude of the injuries and fatalities that the WFC incident could have 

caused, this report considers in greater detail the extent of damage at the schools.

Table 2. Estimated Number of Students and Staff During School Hours

School Grades Estimated Number of 

Students Enrolled

Estimated Number of 

Staff Members

West Intermediate 

School 

4-5 246 22

West Middle School 6 320 40

West High School 7-12 419 64

West Elementary School K-3 501 45

Total Occupants 1,486 171

001374
West Fertilizer Company Final Report January 2016

42 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

3.4.3.1 Damage Assessment of the West Intermediate School

The original WIS was a pre-engineered metal building consisting of lightweight steel frames, cold-formed 

girts,

33 and purlins34 supporting lightweight metal decks. The gymnasium and cafeteria were also preengineered metal buildings. The remainder of the school was constructed of precast concrete tilt-up loadbearing walls that supported open webbed steel joists and a metal roof deck with a built-up roof. Figure 

23 shows the building room layout in the school evacuation plan and highlights in yellow some 

classrooms with extensive damage. A considerable amount of debris accumulated in the hallway outside 

of rooms 11 and 12 (Figure 24). An interior doorframe blocked the hallway; the acoustic ceiling had 

collapsed; and numerous obstacles would have made exiting the building difficult for students and staff. 

In addition, the original metal school building just south of this location was involved in a fire after the 

explosion at the WFC facility, so students and staff members also would have been exposed to smoke and 

heat. The acoustic ceiling, light fixtures, and other debris were thrown onto all of the desks in the interior 

of classroom 12 (Figure 25). Moreover, the window on the north facade failed violently, and a large 

shard of glass (approximately 3 inches long) was embedded in the assignment poster on the south wall of 

the classroom (Figure 26). 

Room 8

Room 7

Room 6

Room 5

Room 9

5th Grade Lab

Room 10

Girls 

RR

Book 

Room

Boys 

RR

Lounge 

Workroom

Storage

Ja

Nurse

Asst

Princ

Room 12 Room 11 PRR Room 13

4th Grade Lab Library

Room 4

Room 3

Room 2

Tech

Room 1

Tech

Room 18

Room 17

Room 16

Room 15

Comp Labs

Room 19

Cafeteria

Gym

Gym RRs

Room 21 Room 22 Room 23

Room 20

RRs

Princ Office 

Area

West Intermediate School 

Evacuation Route

N

REAGAN ST.

Figure 23. WIS Room Layout in Evacuation Plan (Source: CSB)

 

33 A horizontal structural member that spans columns or posts in framed construction and is used to support cladding. 

Dictionary of Construction, Surveying and Civil Engineering (2012). 34 A horizontal roof member that runs parallel to the ridge and spans the roof trusses and is used to support the roof 

covering. Dictionary of Construction, Surveying and Civil Engineering (2012).

001375
West Fertilizer Company Final Report January 2016

43 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 24. WIS North Hallway, Looking Toward Northeast Exit Door (Source: ABS Consulting)

Figure 25. Glazing Hazard in WIS Room 12 (Source: ABS Consulting)

001376
West Fertilizer Company Final Report January 2016

44 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 26. Embedded Glass in Assignment Poster in WIS Room 12

(Source: ABS Consulting)

The pre-engineered portion of the school in the northeast corner was heavily damaged by blast 

overpressure and was also fully engulfed in flames. At the time of the physical survey, blast damage to 

this portion of the building could not be evaluated because of the magnitude of the fire and associated 

heat; however, Figure 27 does provide a view looking east down the hallway of this part of the school 

after the fire.

Figure 27. Interior of Burned Northeast Section of WIS 

(Source: ABS Consulting)

001377
West Fertilizer Company Final Report January 2016

45 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The WFC explosion heavily damaged the WIS gymnasium (Figure 28). There was evidence that some of 

the built-up roof over the gymnasium burned; however, the level of heat damage to the roof was minor 

compared to the damage from blast overpressure. The north half of the gymnasium roof failed. Within 

the gymnasium, the blast heavily damaged the pre-engineered frames, which were unstable as a result. 

The roof purlins were moderately deformed, with the exception of the failure that occurred on the north 

half of the frame spans. Furthermore, the windows from the south facade of the gymnasium failed, and 

the overpressure propelled them over the south bleachers and onto the gym floor. The explosion also 

heavily damaged the roof in the cafeteria to the south of the gymnasium.

Figure 28. WIS Gymnasium (Source: ABS Consulting)

The interior of classroom 20 also sustained significant damage (Figure 29). The acoustic ceiling, light 

fixtures, and insulation were blown down onto the floor by a combination of the roof motion and the air 

blast entering through the heating, ventilation, and air conditioning (HVAC) duct after the explosion 

displaced the rooftop air conditioner. After the incident, the entire contents of the ceiling plenum were 

found on top of the desks. If the explosion had occurred during school hours, any students or staff 

members in the room would have been covered in this debris and would have had to climb over (or 

through) it to reach the exit. In addition, there was evidence that overpressure entered the room through 

the HVAC opening and was of sufficient magnitude to cause the door latch to fail. The damage to WIS 

decreased as the distance from the explosion source increased from the northeast to the southwest. WIS

also housed the technical department where all of the school servers were kept. The servers and the data 

stored on them were lost in the explosion and fire.

001378
West Fertilizer Company Final Report January 2016

46 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 29. WIS Classroom 20 (Source: ABS Consulting)

3.4.3.2 Damage Assessment of West High School

WHS was constructed of concrete masonry unit walls supporting open webbed steel joists and a metal 

deck with built-up roofing and gravel ballast.

35 The building room layout (on the basis of the school 

evacuation plan) shows that the school was organized into two wings (Figure 31). The north wing 

contained the activities area, including the two gymnasiums, two weight rooms, boy’s athletics locker 

room, girl’s athletics locker room, and band hall. The south wing included the classrooms as well as a 

large lecture hall. Between the two wings were the entry hall, administrative offices, common areas, 

kitchen, and (to the rear) auditorium. A pre-engineered maintenance building sat directly behind the 

school to the east.

 

35 Small gravel placed on a built-up roof to protect the roof from ultraviolet light, heat, and weather and to protect the 

roof membrane from degradation.

001379
West Fertilizer Company Final Report January 2016

47 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

N

Figure 30. WHS Evacuation Map (Source: WISD)

The WHS auditorium was a steel frame structure with masonry infill walls. After the WFC explosion, 

some of the masonry veneer on the exterior was loose near the northeast corner. Inside the auditorium, 

large areas of the hanging ceiling were unstable, and the supporting structure was compromised, 

especially one area of the ceiling (between the seating and the stage), which was near collapse because of

the failed hanger connections. Viewed from underneath, evidence of damage to the ceiling was 

observable at light fixtures, and evidence of cracking and separation was visible near the walls. However, 

the severity of the damage and compromise to the ceiling hangers became fully evident when they were 

inspected from the catwalks above the auditorium.

3.4.3.3 Damage Assessment of West Middle School

WMS was the school third farthest from the WFC site, and although it sustained less damage than WIS 

and WHS, it was nonetheless severely damaged in the explosion. WMS resided at the site of the original 

WHS, constructed in 1923. The athletic field east of WMS was the site employed for triage and 

evacuation of the wounded after the explosion (Figure 31). 

001380
West Fertilizer Company Final Report January 2016

48 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 31. WMS Layout (Source: Bing Maps)

The practice gymnasium was a lightweight pre-engineered metal building with a brick facade. The preengineered frames buckled after the explosion, resulting in a small permanent deformation of the roof 

purlins. In addition, the overpressure damaged the roof purlins and frames. An external assessment of 

the cafeteria and auditorium indicated damage to the ceiling components. Many of the windows on the 

west facade were unbroken. The original high school classroom building at WMS was constructed in 

1923. The windows facing north toward the WFC facility were broken, but only some of the remaining 

windows had failed. The building originally was not air conditioned and had a high tin ceiling, but at a 

later date, a new drop ceiling was installed to accommodate central air conditioning. After the explosion, 

the new drop ceiling failed, but the original tin ceiling was still in place, and some of the windows were 

broken. Window hazards thus were low to moderate, and the damage to the exterior appeared to be 

superficial. The classroom annex building roof structures were open web steel joists supporting a built-up 

roof on metal deck. The roof structure showed no observable damage; however, the suspended ceiling 

failed because of the motion of the roof (Figure 32). 

001381
West Fertilizer Company Final Report January 2016

49 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

3.4.3.4 Damage Assessment of West Elementary School

WES was the campus farthest from the WFC site and sustained very minimal damage. WES received 

minor renovations, such as removing and replacing damaged ceilings, replacing damaged windows, and 

performing general interior clean-up.36

3.4.4 West Rest Haven Nursing Home

The explosion also destroyed the West Rest Haven nursing home, located west and within 600 feet of the 

WFC facility, at the corner of North Reagan Street and West Haven Street (Figure 33). Since 1967, the

nursing home had provided residents with routine care and also treated patients with Alzheimer’s disease, 

diabetes, and hypertension, among many medical conditions. Approximately 20 of the 155 staff members 

and 130 patients37 were in the nursing home during the explosion. All were evacuated with the assistance 

of the nursing home staff and neighborhood volunteers, yet 72 patients sustained injuries. The level of 

severity of the injuries varied from cuts caused by broken glass and building materials to broken bones. 

An 87-year-old man succumbed to a stress-related heart attack; however, his death was not a direct result

of the explosion. 

Before the explosion, the nursing home’s medical director came to the Reagan Street entrance and 

directed the charge nurse to begin evacuating residents to the other side of the facility in response to the 

ongoing fire at the WFC facility. As the charge nurse began the evacuation process, the explosion 

occurred. During the post-blast evacuation, staff members and volunteers removed many bedridden 

 

36 See: http://www.restorewestisd.com/plans.html (accessed on December 22, 2015). 37 The nursing home had a capacity of 145 individual licenses.

Figure 32. Classroom Annex Interior Hallway and Ceiling Damage at WMS 

(Source: ABS Consulting)

001382
West Fertilizer Company Final Report January 2016

50 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

residents from the building through the windows instead of the hallways out of concern that the structure 

would collapse. The residents were moved from the back of the nursing home to the front during the fire, 

evacuated after the explosion to a helicopter pad and football field, and eventually moved to the 

community center. The 72 injured residents were transported to Providence Health Center and Hillcrest 

Baptist Medical Center to receive treatment. After the residents were treated and released, they were 

relocated to various nursing homes in the neighboring cities of Waco, Midway, Hewitt, Clifton, and

Hillsboro. Uninjured residents were also relocated to these nursing homes. 

Within 2 months of the incident, 14 of the West Rest Haven nursing home residents died, a figure cited as 

unusually high by the facility’s administrator,

38 and since the incident, approximately 50 patients have 

died. According to information the nursing home provided to CSB in May 2015, almost all of the 80 

living patients who formerly resided at West Rest Haven tentatively planned to return to the nursing home 

once the new construction was complete.

Figure 33. Damage to Reagan Street Entry of West Rest Haven (Source: ABS Consulting) 

 

38 See: http://www.dallasnews.com/news/west-explosion/human-toll/20130617-some-say-west-blast-rushed-nursinghome-patients-deaths.ece (accessed on December 22, 2015).

001383
West Fertilizer Company Final Report January 2016

51 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

3.4.4.1 West Rest Haven Nursing Home Disaster and Evacuation Plan

West Rest Haven followed a disaster and evacuation plan that include policies and procedures39 to meet 

all potential types of emergency and nonemergency situations, including fires, disasters, explosions, toxic 

fumes, train derailments, broken gas mains, auto and truck collisions, and fire drills. The plan included 

detailed evacuation procedures in the event of a fire as well as shelter-in-place procedures for events such 

as severe weather. Depending on the location of the fire, patients could be evacuated to another portion 

of the building rather than being completely removed from the premises. The disaster and evacuation 

plan also contained transportation and sheltering agreements if needed during an emergency evacuation of 

the facility. The plan also provided guidance to the facility’s operators on responses to a derailed train or 

ruptured tank cars containing potentially hazardous liquids and on steps to shelter in place if the facility 

were exposed to hazardous gas or vapors.40 West Rest Haven scheduled monthly fire drills to meet the 

requirement to conduct fire drills during each of the three work shifts. In addition, the nursing home held 

a mock disaster drill approximately 3 months before the explosion, employing a scenario that assumed a 

toxic gas release from the WFC facility.

3.4.4.2 Damage Assessment of West Rest Haven Nursing Home

The West Rest Haven nursing home was irreparably damaged (Figure 33), leading the city to completely 

demolish the structure 3 months after the incident.41 The nursing home was constructed of load-bearing 

wood stud walls (with brick veneer) and wood trusses that spanned the wings from exterior wall to 

exterior wall (east to west). The nursing home’s emergency exit plan (Figure 34) shows the floor plan 

and room layout. The explosion most heavily damaged the eastern-most corridor of the building. As a 

result of the explosion, the roof trusses collapsed, and the east wall failed. The eastern rooms were 

heavily damaged and subjected to flying wall debris and window fragments in addition to failing drywall, 

insulation, and light fixtures from the ceiling. Investigators observed high glazing hazards, including

glass shards that penetrated the wall opposite the windows. The ceilings, insulation, and interior contents 

of rooms were lying on beds and blocking doorways, posing hazards to any occupants of these rooms. In 

addition, the air blast would have infiltrated the rooms through the failed windows. Pieces of broken 

glass littered the inside of the nursing home, with the exception of hallway corridors that were shielded 

from windows by interior partitions. The great rooms, lobby, and patient rooms were also subjected to 

significant hazards from broken shards of glass.

 

39 The disaster and evacuation plan also includes policy and procedures for severe weather, bomb threats, water 

shortages, electrical power outages, loss of comfort heating, heat and humidity, and floods.

40 West Rest Haven Inc. “Disaster and Evacuation Plan.” 41 See: http://video.dallasnews.com/Damaged-West-nursing-home-razed-3-months-after-blast24951515?freewheel=90850&sitesection=dallasnews_nws_non_non&VID=24951515#.Uv58DMKYbIU (accessed 

on January 4, 2016).

001384
West Fertilizer Company Final Report January 2016

52 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 34. Emergency Exit Floor Plan for the West Rest Haven (Source: CSB)

The blast also inflicted significant damage to the western portion of the nursing home, and the great 

rooms, such as the lobby, were hit particularly hard because of the large spans of the overhead trusses that

failed and collapsed onto the furniture. In addition, hallways in this area presented many hazards, 

including hanging light fixtures, failed ceiling joists, and collapsed drywall and insulation on the floors. 

Moreover, the debris field of the nursing home contained secondary fragments from massive pieces of the 

WFC facility’s concrete foundation and also significant masses of earth. Observations indicated that a 

large piece of the WFC foundation, measuring 16 inches wide by 16 inches tall and 36 inches long 

(Figure 35, right) impacted room 79, traveling through the roof and the exterior wall (Figure 35, left). 

This debris fragment was calculated at a weight of approximately 800 pounds and had sufficient 

momentum after the impact to exit the nursing home, strike the ground, and then travel an additional 60 

feet before coming to rest just to the west of North Davis Street. 

001385
West Fertilizer Company Final Report January 2016

53 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

 

Figure 35. Crater and Debris (left) from Fragment (right) of WFC Facility Foundation that Impacted West 

Rest Haven (Source: ABS Consulting)

On April 4, 2014, the city of West broke ground at 503 Meadow Drive, a block away from the original 

site, on the new 120-bed West Rest Haven nursing home (with 75,000 square feet), which opened in 

summer 2015.42 The estimated construction cost is $11 million. West Rest Haven did not receive any 

grants or federal money to rebuild the facility.

3.4.5 West Terrace Apartment Complex

The West Terrace Apartment Complex, a 22-unit apartment complex built in 1979 and owned by J&B 

Realty Ltd., was 450 feet due west of the epicenter of the explosion. Two members of the public were 

fatally injured at the apartment complex. One of the victims was most likely standing on the east side of 

the complex and watching the fire shortly before the explosion occurred. The second victim was most 

likely inside her lower-level one-bedroom apartment. The apartment building had four vacant units that 

were being used for storage. At the time of the explosion, a member of the cleaning staff was just 

finishing servicing one of the recently vacant units; she was injured in the blast while exiting the 

apartment building and walking down the stairs to her car. This worker’s mother accompanied her on the 

job that day and was in the just-serviced unit, waiting for her daughter to return with the car, when the 

explosion occurred; however, the worker’s mother was not injured. Four residents of the apartment 

 

42 See: http://dfw.cbslocal.com/2014/04/04/groundbreaking-symbolizes-hope-in-west-one-year-later/ (accessed on 

April 4, 2014).

001386
West Fertilizer Company Final Report January 2016

54 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

complex were treated at Hillcrest Baptist Medical Hospital, and two residents were treated at Providence 

Health Center for injuries sustained. The explosion completely destroyed West Terrace. The roof and 

walls of the building completely failed (Figure 36). 

Figure 36. West Terrace Apartment Complex East Façade (Source: CSB)

3.4.6 Private Residences

According to the Texas Department of State Health Services, the fire and explosion affected many of the 

homes within a 2-mile radius of the WFC facility. West had a total of 700 homes, and 350 of those were 

impacted— with 142with homes damaged beyond repair,43 51 homes suffering major damage, 27 homes 

incurring minor damage, and 130 homes otherwise affected.44 CSB consultants examined damage to 190 

single-family residential buildings within a radius of 3,500 feet of the explosion crater45 and documented 

broken windows, facade damage, and nonstructural and structural component (e.g., wall and roof system) 

failures (Figure 37). The damage assessments were performed in the majority of the cases by inspecting

the perimeter of the property. Access to home interiors was limited because owners either were not 

present or were unwilling to grant access.

 

43 Not all homes that were damaged beyond repair have been rebuilt. 44 Clements, Bruce. Texas Department of State Health Services, “The Texas Public Health Response to the West 

Fertilizer Plant Explosion,” October 8, 2013. See: http://www.astho.org/Preparedness/DPHP-Materials2013/WestTexasExplosion/ (accessed on January 18, 2016). 45 CSB contractors assessed damage that was measured to 3,500 feet from the WFC site, but damage occurred beyond 

that distance.

001387
West Fertilizer Company Final Report January 2016

55 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 37. Example of Damage to Single-Family Residential Structure (Source: ABS Consulting)

According to the city of West, 259 building permits were issued as of October 2014. Of those, 79 were 

for building new homes, 117 for remodeling homes, and 63 for making miscellaneous repairs (such as 

fence, shed, and carport restoration).

3.4.7 Infrastructure Damage to the City of West

The explosion at the WFC facility damaged the West city infrastructure; it ruptured water lines, deformed 

sewer manholes, damaged water storage tanks, further rendered wells unusable, cracked walls of a pump 

house, and caused the loss of water supply to the community. Access to water was restored gradually as 

the affected infrastructure was repaired. As a result of the explosion, FEMA assisted the city in repairing 

some of the damaged infrastructure listed in Table 3, such as water facilities and water lines. 

Table 3. Infrastructure Repaired with FEMA Funding

Affected Infrastructure Cost to Repair Damage

Well 4, Ground Storage Tank $365,000

001388
West Fertilizer Company Final Report January 2016

56 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Well 4, Pump Station Door and Window $2,000

Davis Street Water Line $74,000

Walnut Street Sewer Manhole $9,200

Total $450,200

The West water system is fed by a 12-inch supply line from the city of Waco at a pump station 11 miles 

south of West. The pump station supplies 700 gallons per minute, with a storage capacity of 167,000 

gallons. Water pressure for homes is usually 48 to 50 psi; however, on the morning after the incident, 

water pressure was measured at less than 20 psi because of damaged water lines. In response to the 

abnormal water pressure, the city issued a boil water order. West used two water wells to supply water to 

the community. The first well had a capacity of 250,000 gallons; however, it had been out of service for 

about 7 years at the time of the explosion. The second well also had a capacity of 250,000 gallons and 

was removed from service in January 2013 for rehabilitation.46 This well also was damaged as a result of 

the explosion but has since been repaired and was back online as of September 1, 2014. The city also has 

an above-ground water tower with a storage capacity of 150,000 gallons; the tower was nearly drained by 

the post-explosion fire department response.47 According to CSB interviews conducted with the Abbott 

Fire Department, West had a history of improperly working water hydrants and consistently low water

pressure. Abbott firefighters had previously responded to fires in West and were unable to get hydrants to 

work adequately. The city had installed the above-ground water tower before the WFC incident to 

address the issue of low pressure. 

According to the Mayor of West, “The city generates its revenue in three ways—water and sewer rates,

property tax, and sales tax.” During the first 2 months after the explosion, West experienced a loss of 

income (65 percent of water and sewer revenue and 30 percent of property tax values).48 As of June 

2013, the city of West indicated that the fire and explosion at WFC had cost the city $17 million in actual 

damages; however, the total cost-to-date may be greater as additional demolition, renovation, and 

construction projects continue throughout the city. On April 15, 2014, the State of Texas provided 

additional disaster grant assistance49 to the city of West in the amount of $4,853,500 to fund the disaster 

recovery work on the water plants, water tank rehabilitation, wastewater outfall interceptor, and disaster 

zone infrastructure repairs.50 The first infrastructure project (costing $400,000) was completed in August 

2014 and involved installation of a new well and upgrading of a storage tank located by the new nursing 

home. 

 

46 State Fire Marshal’s Office. “Firefighter Fatality Investigation,” Investigation FFF FY 13-06 (West, TX). 47 Ibid. 48 See: http://www.cityofwest.com/wp-content/uploads/2012/12/June-2013.pdf (accessed on December 22, 2015).

49 The State of Texas provided an initial $3.2 million disaster grant in August 2013. 50 The State of Texas. Office of the Governor, “Letter to the City of West,” April 15, 2014.

001389
West Fertilizer Company Final Report January 2016

57 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.0 Incident Analysis

4.1 Fertilizer Grade Ammonium Nitrate (FGAN)

4.1.1 The Fertilizer Industry

The Fertilizer Institute defines fertilizer as a “collection of elements needed for plants to grow well.”51 

The application of fertilizer to soil provides nutrients for plants to enhance fertility and the production of 

crops. The primary nutrients for plant nutrition are nitrogen (N), phosphorous (P), and potassium (K). 

Nitrogen is considered the most important of the three nutrients because it is critical to the formation of 

protein, which composes the tissue of most living things. Although nitrogen exists in the composition of 

air, it does not exist in a form that plants can readily absorb. Accordingly, farmers apply fertilizers 

containing nitrogen compounds to their soils to enhance crop production. 

Nitrogen is most readily available for plants in its inorganic forms, such as ammonium (NH4

+

) or nitrate 

(NO3

-

) ions. It is applied to crops in different forms such as dry granules, liquid, or injection into the soil 

as a gas. The largest source of nitrogen by volume in commercial fertilizer is anhydrous ammonia, which 

is applied directly to crops.52 Other important nitrogen fertilizers include aqueous ammonia (NH3), 

ammonium sulfate ((NH4)2SO4)), ammonium thiosulfate (H8N2O3S2), calcium nitrate (Ca(NO3)2), sodium 

nitrate (NaNO3) and FGAN. FGAN, the substance in the fertilizer involved in the West Fertilizer 

Company (WFC) explosion, is primarily used on pastureland, hay, and fruit and vegetable crops. FGAN 

is most commonly used in the Southeast and Midwest in the United States, and the largest AN consumers 

are Missouri (20 percent), Tennessee (14 percent), Alabama (10 percent), and Texas (8 percent). 53 

4.1.2 AN Properties

AN (NH4NO3) is a salt compound produced by neutralizing nitric acid (HNO3) with anhydrous ammonia 

(NH3). The AN manufacturing process involves several steps, including solution formation and 

concentration; solids formation, finishing, screening, and coating; and product bagging, bulk shipping, or 

both. AN is marketed in different forms depending on its use, but it is primarily manufactured for use in 

fertilizers or as a precursor in the manufacture of explosives. Liquid FGAN can be sold as a fertilizer or 

may be concentrated to form a dry solid product. This solid product may be used for fertilizer or fertilizer 

blends or may be incorporated as part of an explosive. Pure solid AN is a white or grey odorless material 

that is marketed in several different forms, such as prills, grains, granules, or crystals. Prills are the most 

commonly produced form and take the shape of spherical pellets. High-density prills are used for FGAN; 

 

51 The Fertilizer Institute. Fertilizer 101, Nourish, Replenish, Grow. Washington, DC: The Fertilizer Institute, 2010: 

13. 

52 See: https://www.tfi.org/safety-and-security-tools/get-know-fertilizer-retailer/infographics/ammonium-nitrateinfographic (accessed on November 18, 2015). 53 Ibid.

001390
West Fertilizer Company Final Report January 2016

58 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

low-density porous prills are generally considered technical grade ammonium nitrate (TGAN) or 

explosive grade ammonium nitrate, both of which are used in the manufacturing of explosives. 

Chemically, however, these prills are identical; the difference is that small quantities of coatings and 

stabilizers are added to FGAN to prevent caking and degradation. 

4.1.3 AN Hazards

Under normal conditions, pure solid AN is a stable material; it usually is not sensitive to mild shock or 

other typical sources of detonation (such as sparks or friction). However, AN exhibits three main hazards

in fire situations:

1. Uncontrollable fire. 

2. Decomposition with the formation of toxic gases. 

3. Explosion.54 

These hazards arise in part because AN is an oxidizer. This classification is demonstrated both by the 

U.S. Department of Transportation (DOT), which categorizes AN as a Class 5.1 oxidizer,55 and by 

OSHA, which describes it as an oxidizer in its Explosives and Blasting Agents standard, 29 CFR 

1910.109. 56 Significantly, AN is classified as an “explosive” when the prills are produced with more 

than 0.2 percent carbonaceous material. Carbonaceous material is a substance rich in carbon, such as a 

hydrocarbon. OSHA defines “oxidizer” as a chemical that “initiates or promotes combustion in other 

materials, thereby causing fire either of itself or through the release of oxygen or other gases.”57 As an 

oxidizer, AN can increase the flammability or explosibility (or both) of other combustible substances 

when it decomposes after exposure to heat. As AN decomposes when in contact with heat or fire, the 

reactions can release gases such as nitric acid (HNO3), ammonia (NH3), nitrogen oxides (NO, NO2), 

nitrous oxide (N2O), nitrogen, oxygen, and water vapor, depending on the heat and pressure. Some byproducts can be toxic when emitted.

During fires, AN presents serious risks of explosion beyond those attributed to its oxidizing properties 

and ability to decompose and emit toxic gases. When AN is contaminated with organic carboncontaining materials or certain inorganic chemicals, its behavior can become dangerously unpredictable, 

 

54 Resources Safety, Division of Mines and Petroleum. Safe Practice: Safe Storage of Solid Ammonium Nitrate. East 

Perth, Western Australia: Government of Western Australia, 2013. See: 

http://www.dmp.wa.gov.au/documents/Code_of_Practice/DGS_COP_StorageSolidAmmoniumNitrate.pdf (accessed 

on August 4, 2015).

55 U.S. DOT. “Hazardous Material Table,” 49 CFR 172.101. See: 

http://www.phmsa.dot.gov/portal/site/PHMSA/menuitem.6f23687cf7b00b0f22e4c6962d9c8789/?vgnextoid=d84ddf

479bd7d110VgnVCM1000009ed07898RCRD&vgnextchannel=4f347fd9b896b110VgnVCM1000009ed07898RCR

D (accessed on August 4, 2015). 56 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9755 (accessed 

on January 13, 2016).

57 OSHA. See: https://www.osha.gov/dsg/hazcom/ghoshacomparison.html (accessed on August 4, 2015).

001391
West Fertilizer Company Final Report January 2016

59 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

especially when the AN is confined and in the presence of fire or high heat.58 Thus, when AN is 

combined with contaminants, its explosive sensitivity increases sharply, and the result can lead to 

detonation.59 Examples of contaminants include organic chemicals, acids, and flammable and 

combustible materials.60 

4.1.3.1 Decomposition of AN

AN has a melting point between 311°F and 337°F (155°C and 169°C). It begins to rapidly decompose at 

a significant rate soon thereafter.61 When it is exposed to high heat and pressure, AN experiences 

endothermic (heat-absorbing) and exothermic (heat-producing) reactions simultaneously, causing the 

compound to split into its constituent molecules and also transforming it from solid state to molten, or 

liquefied, state. When AN decomposes or breaks down under thermal conditions, at least seven unique 

reactions can occur at varying temperatures, with different heat outputs and rates of reaction.62 Some 

reactions can produce toxic and detonable by-products. All of the reaction pathways begin with the AN

splitting into gaseous ammonia (NH3) and nitric acid (HNO3), although that step is usually not explicit. 

In the following main exothermic reaction (Eq. 1), which can occur in conditions up to 482°F (250°C), 

AN yields nitrous oxide and water:

NH4NO3 (s)  N2O (g) + 2 H2O (g) (Eq. 1)

Above 482°F (250°C), a reversible endothermic reaction (Eq. 2) takes place at a significant rate, splitting 

the AN to form ammonia and nitric acid: 

NH4NO3 (s) ↔ NH3 (g) + HNO3 (g) (Eq. 2)

This endothermic reaction is accompanied by a number of exothermic reactions between gaseous 

ammonia (NH3) and nitric acid (HNO3) that vary by degree, depending on reaction conditions. As 

previously described, AN is in a liquid or molten state, which is aerated with off-gases such as nitrogen 

oxides (NO, NO2), water vapor, and nitrous oxide (N2O). This bubbly liquid is much more sensitive to 

detonation than solid prills or unaerated liquid. Depending on the rate of these endothermic and 

 

58 Greiner, Maurice. “Ammonium Nitrate: Hazards and Handling.” Fertilizer Progress January/February (1983): 26–

38. 

59 Sun, J. et al. “Catalytic effects of inorganic acids on decomposition of ammonium nitrate.” Journal of Hazardous 

Materials B127 (2005): 204–210. 60 The OSHA Explosives and Blasting Agents Standard, 29 CFR 1910.109)(i)(5)(i)(a), lists examples of combustible 

materials or other contaminating substances, including animal fats, baled cotton, baled rags, baled scrap paper, 

bleaching powder, burlap or cotton bags, caustic soda, coal, coke, charcoal, cork, camphor, excelsior, fibers of any 

kind, fish oils, fish meal, foam rubber, hay, lubricating oil, linseed oil, or other oxidizable or drying oils, 

naphthalene, oakum, oiled clothing, oiled paper, oiled textiles, paint, straw, sawdust, wood shavings, or vegetable 

oil.

61 CF Industries. “FGAN.” Material Safety Data Sheet Number 004. See: 

http://www.cfindustries.com/pdf/Amtrate_AN_Fertilizer_SDS_NA_FINAL.pdf (accessed on August 4, 2015). 62 U.S. Department of the Army. Department of the Army Technical Manual, Ammunition, General, TM 9-1300-214. 

Washington, DC: U.S. Department of Defense, September 1984. 

001392
West Fertilizer Company Final Report January 2016

60 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

exothermic reactions, detonation can occur. Conditions other than heat and pressure, such as pH levels 

and the presence of impurities, can also influence the rate of reaction.63

The decomposition of AN can be controlled to the extent that the main exothermic reaction (Eq. 1) can be 

used to produce hospital-grade nitrous oxide.

64 However, if the rate of reaction is uncontrolled (which 

happens, for example, when FGAN is exposed to fire), other reactions can occur as AN decomposes and 

melts. As the temperature rises over 482°F (250°C), liquid AN becomes less dense and contains many 

small bubbles of gaseous decomposition products and their reactants, primarily water vapor and nitrous 

oxide. At 500°F (260°C), liquid AN becomes much more sensitive to shock because these bubbles act as 

“hot spots” that focus the shock or magnify the energy input. Many tests have shown the direct 

correlation between temperature and sensitivity in molten AN.65 In other words, molten AN becomes 

more sensitive as the temperature under which it is kept rises. 

Although the exact sequence of chemical reactions is variable, the primary end products of the detonation 

process are consistently water, nitrogen (N2), and oxygen (O2). As reactions involving nitric acid (HNO3) 

and ammonia (NH3) (Eq. 2) produce these end products, heat is released, which adds energy to a 

detonation. The nitrous oxide (N2O) production process (Eq. 1) combines all of the internal fuel 

(hydrogen) with the oxygen from nitric acid to form water, so no additional oxidation can take place in 

the pure AN during the detonation reaction. The difference between the uncontrolled detonation reaction 

and the nitrous oxide reactions is the rate of the reaction and the formation of the triple bond in N2 and the 

double bond in O2, which are exothermic and therefore add to the energy yield during detonation. The 

following formula (Eq. 3) describes this overall decomposition reaction from the intermediate reactions 

where AN yields nitrogen, oxygen, and water: 

 NH4NO3 (s)  N2 (g) + 1⁄2 O2 (g) + 2H2O (g) (Eq. 3)

When mixed with AN, many combustible contaminants—including organic materials, fuels, and finely 

divided materials (e.g., flour, seed or grain dusts, asphalt or fuel oil, or very small metal flakes)—will 

provide additional fuel that can combine exothermically with the oxygen produced during detonation. 

Thus, for explosive uses, AN is nearly always combined with a fuel source. This approach increases the 

energy of the intended explosion and also reduces the toxicity of the end products by reducing nitrogen 

 

63 Lees, F.P., and M.L. Ang (eds.). Safety Cases Within Control of Industrial Major Accident Hazards (CIMAH) 

Regulations, Chapter 9. Butterworth-Heinemann, 1984; January 1, 1989: 160. 64 Asia Industrial Gases Association. Safe Practices for the Production of Nitrous Oxide from Ammonium Nitrate, 

AIGA 080/13. Singapore: Asia Industrial Gases Association, 2013. See: 

http://www.asiaiga.org/docs/AIGA%20080_13%20Safe%20practices%20for%20the%20production%20of%20nitro

us%20oxide%20from%20ammonium%20nitrate.pdf (accessed on November 19, 2015). 65 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. 

Department of the Interior, Bureau of Mines, 1966. See: 

http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateUnderFireExpos

ure.pdf (accessed on December 22, 2015).

001393
West Fertilizer Company Final Report January 2016

61 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

oxide (NOx) production. Nitrogen oxides are produced, for example, by the following reaction (Eq. 4), 

which shows AN yielding nitrogen, water vapor, and nitrogen oxides:

4NH4NO3 (s)  2NO2 (g) + 8H2O (g) + 3N2 (g) (Eq. 4)

An example of fueling AN to produce a blasting agent is the addition of fuel oil at around 6 percent by 

weight to produce ammonium nitrate/fuel oil (ANFO). ANFO may be used for mining and other 

purposes. Moreover, the military uses a mixture of fuel-rich trinitrotoluene (TNT), AN, and sometimes 

aluminum to produce a more effective explosive than TNT alone.66 

4.1.4 Previous Incidents Involving FGAN

AN-related explosions have occurred ever since large-scale AN production began in the late 19th

century.67 One of the earlier notable explosions involving FGAN took place in Oppau, Germany, in 

1921, when workers fired explosives into a caked mixture of fertilizer to loosen 4,500 tons of ammonium 

sulfate (AS) and FGAN. The explosion killed 500 to 600 people, injured an additional 2,000 more, and 

caused as much as $1.7 million (US) in property damage, destroying 80 percent of the city.68 Today, that 

property damage would equate to more than $22 million.69 

Since then, a number of other FGAN incidents have occurred that involved a major fire, explosion, or 

both. This report highlights the following four incidents involving FGAN because they provide important 

information about the behavior of FGAN when exposed to fire:

• Cherokee incident (1973). A fire in the storage building of FGAN producer Cherokee Nitrogen 

resulted in an FGAN detonation in Pryor Creek, OK. Of the 14,000 tons of FGAN in storage, 

only a few tons were involved. The detonation was believed to have been underneath a front-end 

loader parked in an area with FGAN on the floor and might have been initiated by one of the 

loader’s components exploding. It was theorized that contamination of the FGAN with 

flammable fluids in the loader occurred before the detonation. The detonation occurred 25 

minutes after the fire was discovered but did not propagate into the main pile.70 

• Cory’s Warehouse incident (1982). A fire in a warehouse storing wooden furniture, charcoal, and 

more than 3,000 tons of bagged FGAN and mixtures based on FGAN produced some deflagration 

of the FGAN but no detonation.71 Several small explosions occurred but were thought to be due 

 

66 Ibid. 67 Barbrauskas, Vytenis. “Explosions of Ammonium Nitrate Fertilizer in Storage or Transportation Are Preventable 

Accidents.” Journal of Hazardous Materials 304, 5 (2016): 134–149. 68See: http://www.aria.developpement-durable.gouv.fr/wp-content/files_mf/FD_14373_oppau_1921_ang.pdf

(accessed on December 19, 2015).

69 The CPI Inflation calculator. See: http://data.bls.gov/cgibin/cpicalc.pl?cost1=1%2C700%2C000&year1=1921&year2=2014 (accessed on December 30, 2014). 70 Freeman, R. “Cherokee Ammonia Plant Explosion.” Chemical Engineering Progress 71, 11 (1975). 71 A deflagration occurs when a combustion wave propagates at a velocity less than the speed of sound. A detonation 

is a combustion wave that propagates at a velocity greater than the speed of sound. Detonations create high-pressure 

shock waves that can cause damage at large distances from the source. 

001394
West Fertilizer Company Final Report January 2016

62 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to reactions between sodium nitrate and charcoal. More than 1,000 people were evacuated, and 

controlling the fire took 6 hours.

• EDC incident (2009). A fertilizer distribution facility in Bryan, Texas, caught fire and 

completely burned. Firefighters withdrew and evacuated the area. Unlike the West fire, the 

Bryan AN-related fire produced light-colored smoke as burning progressed, indicating that the 

fire was ventilated. No explosion occurred, and after the fire, much of the FGAN was still there. 

Some of the FGAN melted, spread away from the pile, and then re-solidified in a dark mass. The 

FGAN remaining in the pile had a black crust on it, but beneath that crust, the prills appeared to 

be unaffected.72

• East Texas Ag Supply incident (2014). A fertilizer warehouse in Athens, Texas, caught fire and 

burned. The warehouse was near the center of town, and the first responders evacuated the area 

as rapidly as possible. No explosion occurred. The walls of the structure were masonry, but the 

bins and roof structure were wood.73 

A more comprehensive list of FGAN incidents involving fires and explosions is provided in Appendix B. 

4.1.5 Historical Knowledge of AN Fire and Explosion Hazards

Over the years, the explosibility and fire hazards of AN have been the subject of a number of research 

papers. Some of those papers were first published through the U.S. Department of Agriculture (USDA),

74

U.S. Bureau of Mines,

75 and other sources abroad. In 1945, a USDA-archived publication discussed in 

detail the properties of pure AN, based on worldwide research conducted up to that date.76 The paper 

notes the following: 

• Under favorable conditions of pressure, rapid heating, and retention of heat, AN may be exploded 

partially from heat alone near 300°F. 

• AN can detonate if subjected to a very strong initial impulse.

• Six factors influence the sensitivity of AN toward an explosion: temperature, strength of initial 

impulse, density, packing, particle size, and moisture content of the material. 

Later, the Bureau of Mines (U.S. Department of the Interior) published reports on its investigation of the 

detonation of AN.

77 Some of the key findings of a 1966 Bureau of Mines report indicated the following: 

• No transition to detonation of AN occurred in numerous burning experiments.

 

72 CSB conducted an assessment of the Bryan, Texas, incident. 73 CSB collected information after the Athens, Texas, incident. 74 Davis, R.O.E. “Explosibility and Fire Hazard of Ammonium Nitrate Fertilizer,” no. 719. Washington, DC: U.S. 

Department of Agriculture, 1945. 

75 Van Dolah, R.W. et al. “Explosion Hazards of Ammonium Nitrate under Fire Exposure,” R. I. 6773. Pittsburgh: 

Bureau of Mines, 1966. 

76 See: https://ia601703.us.archive.org/1/items/explosibilityfir719davi/explosibilityfir719davi.pdf (accessed on 

January 6, 2016).

77 In 1961, the Manufacturing Chemists’ Association asked the Bureau of Mines to investigate the potential explosion 

hazards of AN under the conditions of fire exposure that could occur in storage and transportation incidents. 

001395
West Fertilizer Company Final Report January 2016

63 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• The critical diameter (minimum diameter to sustain detonation) of AN was quite small when just 

below the melting point.

• Initiation of prills by oxygen-acetylene gas detonation was shown to be unlikely.

• Detonations were achieved with fuel added in vessels with restricted vents.

• The initiation of detonation in AN from fire exposure in normal storage is quite improbable.

• The chance of modern AN detonating as the result of fire has been considered to be small or even 

nonexistent.

• The initial shock need not have an amplitude adequate for immediate initiation of detonation.

• Failure to detonate at a small scale should not be interpreted as meaning that the material is 

incapable of detonation.

• An acetylene-oxygen mixture in a 3-inch tube failed to detonate hot pulverized AN prills. No 

attempt was made to initiate detonation in foaming liquid AN by using a gas mixture.

• Large fire tests with bagged AN showed that heat penetrated less than 2 inches into the prills and 

that a crust formed, preventing liquid from penetrating the prills.78

The Bureau of Mines conducted a large-scale study (also in 1966) to determine distances for safe storage 

of AN. Cardboard tubes 1 meter in diameter were used as the donors and acceptors (the donor is 

detonated conventionally, and the acceptor, which is placed at a test-determined distance from the donor, 

either detonates or fails in each test). ANFO was the donor, and the acceptors were ANFO and straight 

AN. The tests were well documented and were of sufficient scale to produce reliable results. One of the 

findings was that sheet metal covering the donor increased the distance where sympathetic detonation (a 

follow-on detonation induced by the explosive effects of an initiating explosion) occurred. In a case with 

ANFO as the acceptor, a sympathetic detonation was produced over a 50-foot gap. With straight AN, the 

maximum gap was 19 feet. Without the metal, the gap was 12 feet for AN. The Bureau of Mines also 

conducted tests at smaller diameters, but no detonation was initiated in AN. 

One significant finding was that “strong evidence exists that the apparent insensitiveness of AN results 

largely from a manifestation of critical diameter effects,” highlighting the importance of scale. When 

evaluating test results, small-scale tests are not reliable indicators of large-scale behavior.

In December 1997, EPA published an alert, “Explosion Hazard from Ammonium Nitrate,” with the 

following recommendations:

79

• Avoid heating AN in a confined space (e.g., consider that processes involving AN should be 

designed to avoid this possibility). 

• Avoid localized heating of AN, which potentially leads to development of high-temperature 

areas. 

• Ensure that AN is not exposed to strong shock waves from explosives. 

 

78 Van Dolah, R.W. et al. “Explosion Hazards of Ammonium Nitrate under Fire Exposure,” R. I. 6773. Pittsburgh: 

Bureau of Mines, 1966.

79 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/P100BH59.PDF?Dockey=P100BH59.PDF (accessed on November 19, 

2015).

001396
West Fertilizer Company Final Report January 2016

64 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Avoid contamination of AN with combustible materials or organic substances, such as oils and 

waxes. 

• Avoid contamination of AN with inorganic materials that can contribute to its sensitivity to 

explosion, including chlorides and some metals, such as chromium, copper, cobalt, and nickel. 

• Maintain the pH of AN solutions within the safe operating range of the process, in particular 

avoiding low pH (acidic) conditions. 

This alert was later expanded in August 2013 as a joint EPA, OSHA, and ATF advisory, “Chemical 

Advisory: Safe Storage, Handling, and Management of Ammonium Nitrate.” A June 2015 revision refers 

explicitly to AN prills.80

4.2 Factors Contributing to the Massive Fire and Explosion at the 

WFC

Because of the unpredictable behavior of FGAN in fire situations, the scenario that contributed to the 

detonation at the WFC might never be precisely determined; however, several detonation scenarios are 

plausible. CSB identified two factors or conditions that likely contributed to the intensity of the fire and 

detonation: (1) the contamination of FGAN with materials that served as fuel and (2) the nature of the 

heat buildup and ventilation of the FGAN storage space. These factors and scenarios for how the FGAN 

behaved on the night of the incident are based on the physical evidence that remained, blast analysis 

commissioned by CSB, U.S. Army Corps of Engineers crater analysis of the WFC explosion, eyewitness 

accounts, and previous research on FGAN incidents and testing. 

4.2.1 Contamination of the FGAN Pile

In fire situations, the behavior of FGAN is unpredictable, in part because of the number of endothermic 

and exothermic decomposition reactions that take place with increasing temperature. FGAN 

decomposition reactions beyond the first step have yet to be uniquely defined, and subsequent 

decomposition reactions of FGAN can only be assumed.81 When contaminants are added to AN, the 

decomposition reactions become increasingly more complex.82 Possible sources of contamination in an 

FGAN storage area can include ignitable liquids, finely divided metals or organic materials, chloride 

salts, carbons, acids, fibers, and sulfides. These contaminants can increase the explosive sensitivity of 

FGAN.

 

80 EPA, OSHA, and ATF. “Chemical Advisory: Safe Storage, Handling and Management of Solid Ammonium 

Nitrate Prills.” See: http://www2.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf

(accessed on December 7, 2015).

81 Cagnina, Stefania; Rotureau, Patricia; and Carlo Adamo. “Study of Incompatibility of Ammonium Nitrate and its 

Mechanism of Decomposition by Theoretical Approach.” Chemical Engineering Transactions 31 (2013). See: 

http://www.aidic.it/lp2013/webpapers/141cagnina.pdf (accessed on December 7, 2015). 82 Ibid. 

001397
West Fertilizer Company Final Report January 2016

65 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The molten FGAN at the WFC likely came in contact with contaminants that were stored in the fertilizer 

warehouse or were produced during the fire that preceded the explosion. Seed materials, zinc, and other 

organic products, including the wood-constructed bins, were present near the FGAN storage area or could 

have come in contact with molten FGAN. During the fire, soot from the smoke and also collapsing wood 

and roofing material might have mixed with the FGAN pile. 

The presence of possible contamination in the FGAN pile can be evidenced by changes in the smoke 

observed in the WFC fire before the explosion. The earliest sign of the WFC fire was white smoke 

streaming from vents in the elevator cupola on top of the fertilizer warehouse that stored the FGAN. 

Light-colored smoke is evidence of a well-ventilated fire, which would be typical of the early phase of a 

structure fire before it depletes the oxygen in the room. The initial smoke observed at the WFC was from 

the incipient fire, now believed to have started in the seed room. Shortly after authorities were notified, 

the smoke darkened and became opaque, indicating large quantities of soot83 or hydrocarbons burning

(Figure 38). Such soot can be the result of a ventilation-limited fire or a soot-producing fuel such as 

plastic or asphalt, which produces large amounts of soot even in well-ventilated fires.84 The fact that

smoke was observed coming from the same room that held the FGAN bin suggests that the bin was 

burning at that time. It is likely that soot or molten asphalt began accumulating on the AN shortly after the 

fire spread to the roof and the FGAN bin. The soot provided a source of fuel as it contaminated the 

surface of the pile. Soot also greatly increases the absorption of radiant heat from a fire.85

Figure 38. Initial Light Smoke (left) Followed by Dark Plume (right) 

(Source: Member of the Public) 

 

83 Soot is finely divided carbon deposited from flames during the incomplete combustion of organic substances. 84 Fire Development and Behavior Indicators. See: http://cfbt-us.com/pdfs/FBIandFireDevelopment.pdf (accessed on 

November 19, 2015). 

85 Glassman, Irvin and Yetter, Richard. Combustion. Burlington, MA: Academic Press, 2009: 458. 

001398
West Fertilizer Company Final Report January 2016

66 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.2.2 Heating and Ventilation

As the fire progressed, the available oxygen in the building was depleted as it was consumed in the fire. 

Although the fertilizer warehouse structure had some ventilation louvers in the cupola at the top, 

ventilation at ground level was limited to only a few louvered vents and the normal infiltration that exists 

around doors. The limited ventilation increased the quantity of soot in the smoke and the potential 

contamination of the FGAN pile. The path of the fire from the seed room to the main structure is 

unknown, but an opening, perhaps resulting from an interior wall or the roof burning, seems to have 

allowed hot smoke and later flame to flow from the seed room into the main structure and out the cupola. 

Initially, no flames were visible at the cupola, but as the fire progressed, videos and photographs taken 

before the explosion show the fuel-rich smoke generated by the burning material inside the structure. 

Subsequently, asphalt roof shingles ignited and began burning vigorously. 

With limited ventilation inside the structure, a hot layer of smoke likely would have developed in the 

upper portion of the room containing the FGAN bin. Because cooler air settles below warmer air, the air 

temperatures would have remained relatively cooler inside the bin. The ground-hugging nature of the 

evolving smoke plume, as evidenced in Figure 39, is a characteristic of partially cooled smoke, perhaps 

cooling as it passed through the elevator structure before it exited the cupola. Because the elevator likely 

was filled with opaque black smoke, radiant heat from the fire on the FGAN pile would be reduced 

because the opaque black smoke shielded the pile from the heat. 

Figure 39. Dark and Heavy Smoke, Rich in Soot 

(Source: Member of the Public) 

At some point around 5 to 6 minutes before the detonation, the character of the fire changed, according to 

eyewitness accounts and photographic evidence (Figure 40). This change was most likely caused by 

increased ventilation through an opening low in the building, possibly when the fire burned through the 

seed room doors or the roof. The fire also might have been enhanced by oxidizing gases from the heated 

FGAN pile.

001399
West Fertilizer Company Final Report January 2016

67 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 40. Photographs from 7:42 pm (left) and 7:45 pm (right), Showing Transition to Lighter Smoke and 

Larger Flame, Before Detonation at Approximately 7:51 pm (Source: Member of the Public) 

The additional ventilation caused a marked decrease in dark smoke and probably was accompanied by a 

major increase in heat radiation inside the fertilizer building because of increased oxygen availability to 

the burning wood and other fuels. With the dark smoke inside of the structure reduced, radiant heat 

would reach the surface of the FGAN in the bin, and the increased airflow through the building would 

greatly increase the radiant heat flux by raising the temperature of the burning wood. The surface of the 

FGAN, covered with soot or molten asphalt, would absorb the heat flux and cause a very rapid heating of 

the surface of the FGAN pile. The very hot and contaminated surface of the pile was then sensitive to 

detonation.

If the building had been well ventilated, the ventilation-limited phase of the fire would not have been as 

prolonged, reducing the amount of soot and creosote on the pile. In this scenario, the increased intensity 

of the fire would heat the FGAN pile. The lighter color smoke would allow more heat to be reflected, and 

the liquid FGAN might have run off as it developed. CSB collected data on similar incidents at the 

facilities in Bryan, Texas, and Athens, Texas. These incidents demonstrate that an FGAN pile can 

experience a major structure fire without detonating. The plumes of smoke at the Bryan facility (Figure 

41) and Athens facility indicated cleaner-burning fires with less soot production. One source of the 

difference in the fire plumes might be the level of ventilation inside of the structure, as described to CSB 

investigators by the Athens fire chief. Some materials, such as asphalt and polyvinyl chloride (PVC), will 

001400
West Fertilizer Company Final Report January 2016

68 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

produce dark plumes even when burning in the open air, but if that smoke production is outside of the 

structure, no contamination of the FGAN will occur.

Figure 41. Plume of Smoke from AN Fire in Bryan, Texas 

(Source: College Station Fire Department)

4.3 Detonation Scenarios

CSB found that contamination (likely from the storage of nearby combustibles or the combustible 

materials used to construct the FGAN bins and building) and the lack of ventilation were contributing 

factors that ultimately led to the detonation. However, the exact behavior of the FGAN—specifically 

how the contaminants, decomposition by-products, ventilation issues, or a combination of those 

conditions led to the explosion—may never be known. 

Previous studies indicated that a detonation of modern FGAN prills under normal standard storage 

conditions when exposed to fire (unconfined storage without the potential for pressure buildup) was 

highly unlikely based on a number of factors. Therefore, the three scenarios in this section are considered 

plausible, but large-scale testing is needed to estimate their relative likelihood. One of the three scenarios

(or a combination) is considered plausible as an explanation of event sequences: 

• Scenario 1: Detonation from the top of the FGAN pile. 

• Scenario 2: Detonation in heated FGAN along exterior wall exposed to fire. 

• Scenario 3: Detonation in elevator pit that spread to main FGAN bin.

001401
West Fertilizer Company Final Report January 2016

69 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

4.3.1 Scenario 1: Detonation from the Top of the FGAN Pile

Based on the location of the pile and the properties of the bin along with the circumstances of other fireinduced incidents, one possible scenario is that a period of contamination with soot and other organics 

(possibly including molten asphalt and plastic dripping from the burning composite shingle roof and PVC 

drop pipe from the elevator mechanism) was followed by about 5 to 6 minutes of intense radiant heating 

from the flames above and adjacent to the main FGAN bin. During this time, a layer of very hot, 

contaminated, and sensitive liquid FGAN could have built up on the pile. The foaming FGAN likely 

produced oxidizing gases, and those mixed with flammable smoke to produce a detonable gas cloud over 

the FGAN pile in the main bin and possibly in an adjoining bin linked to the main bin through a series of 

holes cut in the partition between the bins. The cloud consisted of powerful oxidizers that would be 

expected when FGAN undergoes thermal decomposition—such as NO2, O2, and HNO3 as wells as fuelrich smoke and pyrolysis86 products off-gassing from the molten FGAN. The gas cloud then might have 

ignited from above, undergoing a gas-phase deflagration-to-detonation transition (DDT) in the 

confinement of the bin. This transition could have been enhanced by the passage of the burning front 

through the openings between the main and secondary bins, which possibly contained a few hundred 

pounds of FGAN, in a process known as hot gas injection.87 Given the powerful oxidizers and mixture of 

fuels possible in this environment, a direct gas-phase DDT in the partial containment of the main bin by 

itself might be another possible initiator. This gas detonation then initiated an explosive train on the 

surface of the pile (Figure 42), moving through the contaminated and sensitive low-density foam, into the 

mixture of high-density foam and prills beneath, and then into the ambient prills composing the bulk of 

the pile. 

 

86 Pyrolysis is the chemical decomposition of a substance by heat. 87 Byers, Kenneth J. “Pressure Piling and Other Issues Affecting Flameproof Enclosures.” Redbank, Australia: 

Testing and Certification Centre, SIMTARS, 1996. 

001402
West Fertilizer Company Final Report January 2016

70 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 42. Potential Explosive Train Layers on AN Pile Before Detonation (Source: CSB)

In tests using 1-meter (diameter) cardboard tubes, ambient temperature FGAN has been detonated by a 

10-centimeter layer of ANFO at the end of the tube, initiated by a flat shock wave.88 If a large portion of 

the surface of the AN pile was detonated by a gas explosion and if the sensitized layer detonated, then the 

minimum diameter for unconfined FGAN prills (around 1 meter) would be exceeded, and the detonation 

could potentially proceed through the pile in a complete detonation. In many historical accidents, only 

part of the AN detonates because of the inability of the detonation wave to spread from a small detonation 

source into the main pile.89 This type of incomplete or partial detonation does not seem to have occurred 

at the WFC; the crater and blast damage indicate a complete detonation of the main pile, however it is 

unknown how much of the FGAN burned prior to the explosion. 

Falling material from a roof collapse has been proposed as a possible initiator in previous accidents, but

subsequent testing of falling objects and high-speed projectiles entering solid and molten FGAN did not 

support this scenario. Although tests have shown that high-velocity impacts (such as those from high-

 

88 Winning, C.H. “Detonation Characteristics of Prilled Ammonium Nitrate.” Fire Technology 1, 1 (1965): 23.

89 Freeman, R. “Cherokee Nitrogen Co., Pryor OK.” Chemical Engineering Progress 71, 11 (1975). 

001403
West Fertilizer Company Final Report January 2016

71 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

caliber bullets) can detonate molten FGAN, the low velocities of falling objects do not appear to provide 

the energy density needed to detonate even sensitized FGAN.90

Fragments from a fire-induced explosion—such as the materials that might be produced in a hot steel 

roller with FGAN trapped inside—are another potential initiation source at the top of the pile but likely 

would not create the large flat shock wave required to fully detonate FGAN. No known vehicles or 

pressure tanks were close enough to the bin to produce high-speed fragments or a strong shock wave on 

the top of the FGAN pile. A golf cart was in the seed room, and fire extinguishers and an air conditioner 

could have failed from overpressure due to overheating, but they were separated from the FGAN bin by 

the substantial walls of the bin and are unlikely to have produced high-speed fragments. As other 

researchers have noted, the common element linking recent fire-induced FGAN detonations is some level 

of confinement.91 At the WFC building in West, the confinement was the wooden bin, whereas in the 

transportation accidents in Mexico and Romania cited in the reference, the confinement was the 

semitrailer. The confinement provided by a wooden bin or a trailer would not allow sufficient pressure to 

build up to support a solid-phase DDT92 but could allow the gases escaping the heated FGAN to 

accumulate over the pile. Additional field testing of this possibility would be useful.

4.3.2 Scenario 2: Detonation in Heated FGAN Along Exterior Wall Exposed to 

Fire

Another possible scenario is that the detonation at the WFC facility was initiated along one of the exterior 

walls of the bin. The north and east sides of the bin were exposed to the fire and could have been heated 

through the walls. No evidence indicates that the bin failed during the fire, although that cannot be ruled 

out, so the side of the FGAN pile likely would have no direct contact with flame, but some heat could 

have penetrated through the wall of the bin—more heat if the exterior wall adjacent to the seed room was 

penetrated and fire entered the space between the exterior sheathing and the plywood bin lining. Figure 

43 shows some of the features of the fire on the north side of the structure a few minutes before 

detonation. The structure above the bin had lost its siding and was burning with good air flow. Flames 

were appearing through the siding outside the bin, indicating that the wooden exterior sheathing and 

roofing were beginning to burn. The seed room was just a burning frame, and most of its roof had burned 

and collapsed.

 

90 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. 

Department of the Interior, Bureau of Mines, 1966. See: 

http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateUnderFireExpos

ure.pdf (accessed on November 19, 2015).

91 Nygaard, E.C. “Large Scale Testing of Ammonium Nitrate.” 4th EFEE World Conference of Explosives and 

Blasting 4(1), 2007. 

92 Van Dolah, R.W. et al. Explosion Hazards of Ammonium Nitrate Under Fire Exposure. Washington, DC: U.S. 

Department of the Interior, Bureau of Mines, 1966. See: 

http://www.osmre.gov/resources/blasting/docs/USBM/RI6773ExplosionHazardsAmmoniumNitrateunderFireExpos

ure.pdf.pdf (accessed on December 22, 2015).

001404
West Fertilizer Company Final Report January 2016

72 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 43. North Side of Structure Approximately 3 Minutes Before Detonation, with Dark Foreground 

Objects Associated with the Bin Complex North of Fertilizer Building (Source: Member of the Public)

Even with some heating of the pile through the bin wall, it is difficult to envision a potential detonation 

source; FGAN does not normally detonate when heated except under severe confinement.93 

Contamination also would be less likely in the FGAN exposed to heat along the exterior seed room wall, 

but some liquid AN, contaminated by soot and roofing components, on the pile surface might have 

penetrated along the heated wall of the bin if the temperature was high enough or the wall was partially 

breached. A small amount of wood from the bin also might be nitrated by nitric acid off-gassing from the 

heated FGAN to form nitrocellulose, but such a reaction has not been observed in testing, and no research 

papers supporting such a scenario were found. The WFC facility had a concrete floor that would have 

prevented heating of the pile from the bottom. Bin failure, preceded by leakage of the FGAN or FGAN 

liquid onto burning material such as seed or plastic cannot be ruled out. Because the bin floor was well 

above the floor of the seed room, the falling material would have some momentum and could produce 

 

93 Arthur D. Little, Inc. Study of Ammonium Nitrate Materials. Springfield, VA: National Technical Information 

Service, 1952: 1–49. See: http://www.dtic.mil/dtic/tr/fulltext/u2/786334.pdf (accessed on November 19, 2015).

001405
West Fertilizer Company Final Report January 2016

73 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

significant pressure under ideal conditions. Whether this situation could lead to a detonation is an open 

question.

4.3.3 Scenario 3: Detonation in Elevator Pit That Spread to Main FGAN Bin

Another possible detonation scenario focuses on the elevator pit near the FGAN bin. A fiberglass lid 

covered the pit, and the floor sloped away from the pit to prevent runoff from entering it, but the fire 

might have melted the cover, and FGAN remnants could have been in the pit. The typical elevator 

mechanism would not provide any areas for strong confinement leading to high pressures, nor does it 

seem plausible that a small detonation in the pit could have initiated the main FGAN pile. If the 

detonation began in the pit, then the most feasible mechanism would be a collapse of the west wall of the 

bin, spilling FGAN into a mixture of burning rubber from the melted elevator belt and residual FGAN in 

the bottom of the pit. The mass of the falling FGAN, combined with the strong confinement of the 

concrete pit walls, might have provided the conditions for a solid phase DDT beginning in the bottom of 

pit and spreading into the main pile. The likelihood of sufficient FGAN near the door, where the pit was 

located, seems quite low. Liquid FGAN, if it somehow leaked into the pit, would have been under 

confinement conditions similar to those for liquid in the bin, with no obvious areas where pressure could 

build. The elevator itself is a belt with cups protected by a sheet metal box open at the top and bottom. 

The belt that brought the material in from the unloading pit outside provides no obvious containment 

other than the rollers, which are often hollow metal. Unlike the rollers above the bin, these rollers would 

have been shielded from the heat of the main fire but could have been heated by a fire (if it existed) in the 

pit.

Molten and contaminated FGAN on the floor, initiated by an explosion from a burning loader, was 

suspected in the 1973 Cherokee FGAN storage explosion, but no known source of an initiating detonation 

existed at the WFC, and the detonation at Cherokee did not propagate into the main pile. The 

circumstances of the two accidents were too different to draw any firm conclusions about the role of 

molten AN in the detonations.

Other fires involving FGAN (such as the fires in Bryan, Texas, and Athens, Texas) did not result in 

detonation, even though the fires totally consumed the structures housing the FGAN bins and the roofs 

collapsed. This evidence demonstrates the unpredictable behavior of FGAN exposed to fire. Possible 

differences between the fire incidents and the WFC are ventilation of the fire, which determines the 

degree of contamination from smoke products; level of confinement in the bin; and degree of direct 

heating on the FGAN pile. 

4.4 Forensic Testing of West Fertilizer Company Samples

On the day before the explosion, the WFC sold 8,000 pounds of an FGAN/AS blend of fertilizer to a 

farmer in Abbot, Texas. The farmer told CSB investigators that the fertilizer he received, which he 

estimated was about 75 percent FGAN and 25 percent AS, was dustier than usual during spreading. After 

001406
West Fertilizer Company Final Report January 2016

74 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the incident, the Office of the Texas State Chemist (OTSC) retained a portion of the fertilizer and 

provided a sample to CSB for further testing. 

The OTSC is part of the Texas A&M University System and administers the requirements of the Texas 

Feed and Fertilizer Control Service. The OTSC regulates the sale of fertilizer and also conducts 

laboratory testing of FGAN to ensure that it meets quality guidelines for fertilizer. The OTSC conducted 

testing of the samples and shared the results with CSB. The OTSC spectral analysis found no activated 

carbon or any evidence of contamination of the FGAN sample. According to the report, the testing 

concluded that the sample was a mixture of FGAN and AS. The OTSC ran a nitrogen analysis in the 

state’s combustion laboratory; this is a routine test run by the OTSC to check the concentration of 

nitrogen in fertilizers. The OTSC determined that the amount of nitrogen contained in the FGAN/AS 

sample mixture had nitrogen percentages that ranged from 34.33 to 34.61 percent.94 

The laboratory also conducted tests to determine the particle size distribution of the prills in the farmer’s 

FGAN/AS sample. Results verified that the FGAN/AS samples had high concentrations of fines (smaller 

broken-down prills). Approximately half (50 to 55 percent) of the farmer’s sample consisted of particles 

smaller than 200 micrometers (0.2 millimeters). Operating under the assumption that the farmer’s sample 

was a blend of FGAN and AS prills, the laboratory obtained a control sample of FGAN and AS mixed in 

70:30 portions, respectively. The control sample contained 10 percent particles smaller than 200 

micrometers. Although the farmer’s sample included a larger than usual number of fines, the particle 

sizes in this sample are not necessarily representative of the FGAN in the main bin at the WFC because of 

the addition of AS to the farmer’s mixture. Mechanical action such as blending might have taken place 

when creating the FGAN/AS mixture, reducing the particle size, and further breakage might have 

occurred during transit. 

CSB investigators collected samples of the fertilizer remaining at the WFC facility and the OTSC and in 

March 2015 commissioned a forensics laboratory to characterize the composition of eight samples by 

semi-quantitative analysis. Samples 1 through 5 were categorized as solidified and pulverized fertilizer 

collected from various bins (Figure 44); sample 6 was collected from the FGAN railcar on the WFC 

property that was the least disturbed by the explosion and firefighting efforts (Figure 45); and samples 7 

and 8 were collected from the FGAN mixture purchased by the farmer on the day before the incident 

(Figure 46). According to shipment records, the railcar contained pure FGAN manufactured by CF 

Industries. The railcar arrived at the WFC site in early April 2013. At the time of the incident, the WFC 

had not yet unloaded the railcar. The WFC also received truckloads of EDC pure FGAN product in early 

April 2013. CSB is unable to conclude whether the CF Industries or EDC product, or a mixture of both, 

was present in the FGAN main bin at the WFC facility at the time of the explosion.

 

94 The percent of nitrogen (34 percent minimum) is typical for a high-density FGAN prill. 

001407
West Fertilizer Company Final Report January 2016

75 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 44. Solidified Fertilizer Collected from WFC Property (Approximate Location Unknown) (Source: 

Forensic Laboratory)

Figure 45. FGAN Prills Collected from a Railcar on WFC Property (Source: Forensic Laboratory)

Figure 46. Farmer’s Sample of FGAN and AS Blend (Source: Forensic Laboratory)

001408
West Fertilizer Company Final Report January 2016

76 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The laboratory used infrared spectroscopy and electron microscopy methods to determine the elemental 

compositions of each sample. Results of this testing confirmed the presence or absence of AN and other 

salts in some of the samples. Four of the eight samples (1, 2, 3, and 5) contained no FGAN (Table 4). 

The sample collected from the railcar (no. 6) was determined to contain wholly AN with 36 percent95

nitrogen and had a prill density of 1.59 grams per cubic centimeter (g/cm3

).96 The railcar sample 

consisted of prilled particles with a polyolefin coating, which is commonly applied to reduce caking.97 

Magnesium nitrate or magnesium oxide is also occasionally used as an additive to FGAN prills during the 

manufacturing process.98 The purpose of the additive is to act as a desiccant (absorbs moisture) and also 

to protect against the breakdown of prills at higher temperatures.99 CSB concluded that the chemical 

composition of the FGAN obtained from the rail car (no. 6) was typical of FGAN prills commonly used 

for fertilizer and for creation of fertilizer blends.

Table 4. Forensic Testing Results of Fertilizer Samples Collected from the WFC and the OTSC

 

95 FGAN prills typically contain about 34 percent nitrogen. The 36 percent nitrogen result in the sample is likely 

attributed to the percent error in the analytical method used. The laboratory conducted a linear regression analysis to 

determine the percentage error in the determination of elemental sulfur in the FGAN/AS samples compared to a 

control sample, and it estimated the error to be within +/- 0.3 percent of the sample. The laboratory concluded that 

the percentage error estimates would be similar for oxygen and nitrogen in the samples that underwent electron 

dispersive spectroscopy (EDS) methods.

96 FGAN is a higher-density prill in the range of 1.72 g/cm3

. 97 According to the FGAN Safety Data Sheet (SDS) from CF Industries, the FGAN prills contain a 0 to 0.2 percent 

proprietary polyolefin conditioning agent. 

98 Ammonium nitrate particulate fertilizer and method for producing the same. See: 

http://www.google.com/patents/US5720794 (accessed on November 25, 2015). 99 U.N. Industrial Development Organization. Fertilizer Manual, 3rd Edition. The Netherlands: Kluwer Academic 

Publishers, 1998: 227.

No. Sample Location 

(if known)

Sample Description Detected Compounds FGAN

Detected

1 Unknown White and pink encrusted 

and prilled layers

AS, magnesium phosphate (with 

iron), potassium sulfate No

2

Ammonium 

phosphate/potassium 

chloride bin

White prilled particles, 

pink fragmented particles, 

and grey encrusted 

particles

AS, ammonium phosphate, and 

possibly potassium chloride No

3

Space between 

FGAN and potassium 

chloride bins

Dark pink fragments Ammonium phosphate, sulfate, 

alkali salts of fluoride, trace iron No

4

Backside of 

diammonium 

phosphate bin

White powder with red 

streaks

AN, AS, chlorides, ammonium 

phosphate, and trace amounts of 

potassium chloride

Yes

001409
West Fertilizer Company Final Report January 2016

77 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The FGAN/AS mixture purchased by the farmer on the day before the incident was the only available 

sample representative of materials stored in the fertilizer building before the incident. In addition to the 

testing conducted by the OTSC to determine the percentage of nitrogen and quantity of fine in these

samples, CSB commissioned additional laboratory testing of the prills contained in the FGAN/AS 

mixture (samples 7 and 8 in Table 4) in October 2015. Because the FGAN sample from the railcar on the 

WFC property remained relatively undisturbed during the fire and explosion, the laboratory also selected 

a prill from that sample (no. 6 in Table 4) for comparison.

An image from a macroscopic examination of an individual prill from sample items 6, 7, and 8 is shown 

in Figure 47. Item 6, which was collected from the railcar, had a smooth and uniform coating-like 

texture, whereas evidence items 7 and 8, which were sampled from the farmer’s mixture, had an uneven 

surface made up of an agglomeration of amorphous (formless) and semicrystalline particles. 

Figure 47. Physical Comparison of Samples (20x) (Source: Forensic Laboratory)

5

Backside of 

ammonium sulfate 

bin

Sample containing gravel 

and pebbles (separated 

before analysis)

AS, sulfates, and chlorides No

6 Railcar White prilled particles Prilled AN coated with polyolefin Yes

7 Farmer AS/FGAN 

mixture 

White prilled particles 

(partially agglomerated 

from wetting)

AN, AS, sulfate, extractable 

polyolefin Yes

8 Farmer AS/FGAN 

mixture White prilled particles AN, AS, sulfate, extractable polyolefin Yes

001410
West Fertilizer Company Final Report January 2016

78 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Under a microscope, the polyolefin coating was visually apparent on the surface of the item 6 prill. 

Through infrared spectral analysis, the laboratory was able to chemically identify the external prill 

coating as a polyolefin. However, the external polyolefin coating on the surface of sample items 7 and 8

could not be identified through the same analysis. To determine whether a coating had been present, the 

laboratory quantitatively extracted residues from the prills in a solvent that could be analyzed through 

infrared spectra analysis. Although direct surface scans of items 7 and 8 did not reveal the presence of the 

coating, solvent extracts indicated the presence of a polyolefin. This coating could have been applied to 

the prills at some point in time but was no longer acting as a prill coating on the observed sample items 7 

and 8.

4.5 Blast and Impact Analysis

CSB commissioned a consultant firm to survey the property damage to the WFC and the surrounding 

community. On the basis of information obtained from the survey, the consultants characterized the force 

of the blast and estimated the energy produced during the explosion. Using indicators from the observed 

damage to residences and community structures, the consultants applied a guideline100 from the U.S. 

Army Corps of Engineers and created a three-dimensional model to predict the blast overpressure and 

determine the explosive weight that was best explained by the physical damage observed in West, Texas. 

The computational models and calculations expressed the AN explosive energy estimation normalized 

against the explosive power of TNT,101 a high-explosive compound commonly used to quantify blast 

loads. A TNT equivalence calculation provides an approximation of explosive energy in pounds of TNT. 

Several TNT equivalent equations are used in industry that employ actual and estimated explosion 

parameters such as heat capacity, weight of explosive charge, and explosion percent efficiency. Many of 

the parameters are specific to the material involved. TNT equivalent values are a rough approximation of 

explosive effects, and the variability of TNT equivalence (20 to 40 percent) might be a result of the ways 

that it is calculated based on pressure, impulse, crater size, or other damage measures.102

The blast modeling consultants estimated the range of potential explosive yields from the WFC explosion 

to be equivalent to a range of 20,000 to 40,000 pounds of TNT, based on the blast damage indicators 

recorded and analyzed from 20 lightweight metal buildings, the deformed basketball goalposts, and the 

condition of the apartment complex and nursing home. 

To further refine a specific explosive weight most consistent with all of the observed damage, the 

consultants used another modeling tool that incorporates a number of different blast prediction 

methodologies, including the development of a computational fluid dynamic simulation to characterize 

the shock wave as it wrapped around structures and other obstacles during the explosion. The CSB-

 

100 U.S. Army Corps of Engineers. “Estimating Damage to Structures from Terrorist Bombs Field Operations Guide,” 

ETL 1110-3-495. Washington, DC: U.S. Army Corps of Engineers, 1999. 101 One ton of TNT has an explosive energy of 4.184 gigajoules. 102 National Assessment Group. “Ammonium Nitrate Detonability Review and Assessment, Final Report.” Prepared 

for the Technical Support Working Groups, For Official Use Only. Kirtland AFB, NM: September 2, 2011: 7.

001411
West Fertilizer Company Final Report January 2016

79 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

commissioned blast experts determined that the explosive energy of the WFC explosion that is most 

consistent with the observed damage is 25,000 pounds (12.5 tons) of TNT. With an estimated 30 tons of 

FGAN in the main WFC bin at the time of the blast, the 12.5-ton TNT equivalent is based on a 42 percent

efficiency of the material that contributed to the explosive energy. Because the quantity of FGAN 

consumed in the fire before the explosion was not determined, the exact quantity of FGAN that 

contributed to the explosion remains unknown. 

The ATF National Response Team also requested that the U.S. Army Engineer Research and 

Development Center (ERDC) conduct an assessment of the WFC explosion damage and then estimate the 

equivalent explosive yield of the blast. The ERDC team arrived in West on April 29, 2013. As part of 

the site study, the ERDC team conducted a detailed survey of the crater left by the explosion (Figure 48), 

using survey and three-dimensional scanning equipment to verify critical dimensions. The shape of the 

crater was asymmetric, with an apparent diameter of 75 feet and a depth of nearly 8 feet (Figure 49). 

Figure 48. Ground-Level View of WFC Explosion Crater (Source: CSB)

001412
West Fertilizer Company Final Report January 2016

80 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 49. WFC Explosion Crater Profile Measurements (Source: Army Corps of Engineers) 

The ERDC team compared the field crater measurements with experimental data for blast craters and 

other sources to produce an estimate of the net explosive weight of the FGAN. The experimental data 

also took into consideration the near-surface geology (soil type and underlying rocks) surrounding the 

explosion, which has an effect on the crater depth and size. The ERDC team compared the crater 

dimensions and soil types from the WFC explosion with similar experimental data to estimate the 

explosive weight of FGAN. The final report on this analysis concluded that this method entails a degree 

of uncertainty because none of the experimental data included the type of soil with limestone found in 

Texas.103 In addition, the experimental charge was C-4, which might have a different explosive or 

cratering efficiency than FGAN. The ERDC team made assumptions to account for the lack of available 

data and, on the basis of the crater analysis, estimated the WFC explosion to be within the range of 10,000 

to 21,500 pounds of TNT.

The center of the crater was almost directly under the WFC facility’s main FGAN bin, which was likely 

the source of fuel for the explosion. This main bin contained an estimated 20 to 30 tons of FGAN at the 

time of the incident; however, the blast analyses from consultants hired by CSB and from the Army Corps 

of Engineers indicate that the quantity of FGAN that contributed to the explosion could have been 

smaller, based on the observed damage. To demonstrate the location of the crater in reference to the 

fertilizer storage building and the main FGAN bin, CSB commissioned a structural engineering firm to 

create a three-dimensional rendering of the fertilizer facility over the crater location (Figure 50).104 

Figure 51 shows an elevation view of the fertilizer building, with the underlying crater.

103 The soil at the WFC consists of limestone with varying amounts of chalk and clay. This soil type is consistent with 

what would be expected in West, Texas. 104 Crater and building location are estimated to be within +/- 2 feet, based on global positioning information.

001413
West Fertilizer Company Final Report January 2016

81 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 50. Overhead View of WFC Bins, with Crater Underlay (Source: Atlas Engineering)

Figure 51. Elevation View of Fertilizer Building, with Crater Depth (Source: Atlas Engineering)

4.5.1 Seismic Data

According to the United States Geological Survey (USGS), the WFC explosion registered as an 

earthquake of magnitude 2.1 on the Richter scale. The Lake Whitney seismic station in Meridian, Texas, 

about 25 miles west-northwest of the WFC site, recorded seismic signals from the April 17, 2013, 

explosion. ATF concluded that there were two separate explosions, “one smaller and one larger,” based 

001414
West Fertilizer Company Final Report January 2016

82 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

on eyewitness accounts and seismic evidence.105 After conversations with USGS seismologists, CSB 

later learned that a system error occurred, and only one event was recorded at the Lake Whitney station. 

According to USGS, seismic signals resulting from the WFC explosion were recorded on nine seismic 

stations within a range of 25 to 360 miles. Using the onset time of the seismic energy at these stations 

and the known location of the explosion, the USGS National Earthquake Information Center estimated 

that the time of the explosion was 7:50:38 pm local time. According to USGS, the seismic data recording 

shows both energy that propagated through the earth as well as later-arriving energy that propagated 

through the air (Figure 52). USGS concluded that the event was a single large explosion, but it could not

rule out the possibility of multiple closely timed explosions.

Figure 52. Data Recorded at Lake Whitney Station, WHTX, and Seismograph by the USGS National 

Earthquake Information Center (Source: USGS)

5.0 Commercial Property and Liability Insurance

The West Fertilizer Company (WFC) had commercial property insurance to cover losses (such as 

building damage, damage to product, or loss of income due to property damage) from certain loss events, 

such as fires. The company also held a commercial liability insurance policy to protect itself against 

claims for bodily injury while onsite or while operating company automobiles. CSB examined available 

documentation of the WFC’s insurance coverage and inspections from 2007 until the April 2013 

explosion. The WFC was insured by two different insurance companies, Triangle Insurance Company, 

 

105 ATF. “ATF Press Conference Video,” May 16, 2013, minute 12:45. See: 

http://www.youtube.com/watch?v=OpLjSvcRqzU (accessed on November 19, 2015).

001415
West Fertilizer Company Final Report January 2016

83 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Inc. (Triangle) and the United States Fire Insurance Company (U.S. Fire). Triangle issued policies that 

included coverage for property damage, business interruption, bodily injury, and automobile accidents 

from 2007 to the end of 2009. In late 2009, Triangle decided not to renew the insurance policy because of 

the WFC’s lack of compliance with loss control recommendations. The WFC insurance policy expired on 

December 31, 2009. Thereafter, the WFC obtained similar coverage from U.S. Fire in January 2010 and 

renewed it in 2011, 2012, and 2013. The U.S. Fire insurance policy was in effect at the time of the 2013 

explosion.

5.1 Triangle Insurance Coverage and Audits (2006–2010)

Triangle conducted an initial onsite survey of the WFC facility in 2006 and provided insurance coverage 

from 2007 until 2010. The WFC had a $1 million commercial general liability policy and $2 million in 

coverage to cover onsite property and business losses. In 2009, Triangle gave notice to the WFC that it 

was not renewing the policy because of the WFC’s lack of compliance with loss control recommendations 

issued by Triangle following several onsite audits. Triangle conducted annual loss control surveys at the 

WFC facility from 2006 through 2009, and it issued a number of recommendations for suggested 

improvements to WFC operations. The Triangle loss control surveys included an evaluation of WFC

automobiles and drivers, storage and application of dry and liquid fertilizers, grain and feed milling, and 

anhydrous ammonia.

CSB investigators requested and reviewed insurance documentation from Triangle, including risk 

profiles, insurance audit reports, and communications from Triangle to the WFC. In 2006, Triangle 

performed an initial survey of the WFC facility before issuing coverage. Triangle loss control specialists

made four recommendations to the WFC for safety improvements, including replacing missing guards on 

augers and conveyors and addressing visual damage to one of the grain bins. Triangle’s overall risk

assessment categorized the facility as average, with housekeeping, maintenance, and grounds in average 

to fair condition. During the anhydrous ammonia survey, Triangle noted the close proximity of the WFC

facility to schools, residences, and businesses and also documented concerns about the ammonia risk 

management plan (RMP) being out of date (discussed in Section 8.4.2.4). Triangle assigned a 

representative to work with the WFC to update and improve the RMP submission.

In 2007, Triangle conducted another loss control survey and submitted 10 recommendations to the WFC; 

4 of the 10 recommendations were restated from the 2006 survey because they remained unresolved. The 

loss control specialist identified several safety and compliance issues, including:

• A corroded 440-volt wire ran from the pole on the north side of the plant through the bulk 

fertilizer facility to the anhydrous ammonia tank area on the south side of the facility. 

• An aluminum ground wire showed noticeable signs of corrosion from the fertilizer. The loss 

control specialist noted that the wire could lose its ability to ground, potentially causing shock 

and fire hazards (Figure 53). 

• Several temporary lighting sockets needed to be wired in permanently to reduce the potential for 

electrical shocks and fire hazards. 

001416
West Fertilizer Company Final Report January 2016

84 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

About 2 months later, the WFC responded to some of the Triangle recommendations and reported that 3 

of the 10 recommendations were resolved, including replacing guards and repairing an electrical cord on 

an auger. The remaining seven recommendations, including the exposed 440-volt wire, remained 

outstanding. The Triangle loss control specialist’s overall opinion of risk, documented from this survey, 

was fair; housekeeping received a fair rating; and maintenance received a fair to poor rating.

Figure 53. Exposed 440-Volt Electrical Wiring Identified in 2007 Survey 

(Source: Triangle Insurance Company)

In September 2008, a loss control specialist from Triangle conducted another renewal survey and made 14 

recommendations, including several outstanding recommendations from the previous year. During this 

survey, Triangle identified additional damaged electrical wires at the facility in need of repair (Figure 54). 

The WFC submitted a completed recommendation form to Triangle later that month, stating that seven 

recommendations were addressed or in the process of being settled. 

001417
West Fertilizer Company Final Report January 2016

85 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 54. Damaged Electrical Cord Identified in 2008 Insurance Survey 

(Source: Triangle Insurance Company)

In August 2009, Triangle identified six additional recommendations during the annual loss control survey. 

One recommendation was restated and designated as “critical” for a lack of safety chains on towing 

equipment. The Triangle consultant also noted that the WFC “seems to be resistant” to implementing a 

training program to address the frequency of vehicle and mobile equipment accidents. Triangle 

documented a large quantity of temporary exposed wiring in the WFC facility that needed to be run in 

conduits. When evaluating WFC safety programs in 2009, Triangle noted that the company had no 

positive safety culture and that “written programs are incomplete and outdated, there is no structured 

safety program.” In addition, Triangle found no accident investigation program and no evidence that the 

WFC held regular safety meetings for employees. The following excerpt from the 2009 survey indicates 

Triangle concerns: 

They need a SCMP (Safety and Compliance Management Programs) person to help them 

with safety issues, permits, etc. To my knowledge they have not had a safety meeting since 

we started insuring them in 2006...I have a concern with the wiring at both grain operation & 

the dry fertilizer plant. Only about 10% is run in conduit. The rest consist of a heavy 

flexible 4-wire cable, the type you would normally use to put outside on poles but it is not 

protected from cuts & abrasion.106

In September 2009, the loss control specialist stated in an internal Triangle email that “because of losses 

and non-compliance of recommendations, Triangle should non-renew Adair Grain, Inc./West Fertilizer 

Co. in West, Texas.”107 In September 2009, Triangle sent notification to the WFC that all policies would 

not be renewed for the following year. In 2010, the WFC retained U.S. Fire for insurance coverage.

 

106 Triangle Insurance Company Documentation, Loss Control Survey at Adair Grain/WFC. August 2009. 107 Triangle Representative. “Adair Grain,” email message to manager, Underwriting Services Triangle, September 

14, 2009. 

001418
West Fertilizer Company Final Report January 2016

86 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.1.1 Triangle Loss Control Surveys That Did Not Include FGAN Hazards

CSB reviewed the WFC loss control survey documentation and the Triangle “Loss Control Best Practice 

Manual” for insurance inspectors and found no focus on FGAN fire and explosion hazards between 2006 

and 2009. In the 2006 survey and subsequent surveys, Triangle documented the presence of ammonium 

nitrate (AN) onsite for security concerns and answered, “Yes” to the question, “Does the account meet 

state regulations for the storage and transportation of product?” Although no state-specific regulations for 

AN storage existed at the time, the survey did not include federal regulations, such as the OSHA 

Explosives and Blasting Agents standard (29 CFR 1910.109, discussed in Section 8.2), or industry 

consensus standards, such as National Fire Protection Association (NFPA) 400, Hazardous Materials 

Code (addressed in Section 8.6.1). Triangle guidance included a description of combustible and 

noncombustible bulk fertilizer storage buildings for informational purposes, but Triangle did not provide

guidelines or requirements for specific storage practices, such as separation from potential contaminants, 

materials of construction, or mechanism for fire and explosion prevention. Other survey focus areas, such 

as grain milling and anhydrous ammonia, included a more detailed review of federal requirements, such 

as the OSHA Grain Handling Facilities Standard (29 CFR 1910.272) for the prevention of grain dust 

explosions and the EPA Risk Management Program rule for anhydrous ammonia storage. In November 

2013, Triangle updated the best practice manual to include compliance with federal regulations in 

addition to state regulations for fertilizer storage and transportation.

5.2 U.S. Fire Insurance Coverage and Audits (2010–2013)

U.S. Fire started providing insurance to the WFC in 2010 and renewed coverage for 2011, 2012, and 

2013. The WFC was insured by U.S. Fire at the time of the April 2013 incident. The WFC general 

liability policy had a maximum limit of $1 million, and the commercial property insurance policy had a 

limit of about $4.45 million, which included all buildings and equipment on the WFC property. In 2013, 

the WFC held U.S. Fire coverage for commercial property, general liability, inland marine,108 and 

commercial automobile.

According to the insurance policy documentation for the WFC, U.S. Fire offered policyholders a loss 

control service that included onsite surveys of the facility to provide:

• Safety information and educational material to minimize loss costs. 

• Initial survey and evaluation. 

• Specific suggestions for improving loss control practices. 

• Consultation and training to help management understand hazards associated with operations. 

• Follow-up surveys. 

 

108 Commercial inland marine insurance covers property in transit or property that is movable or portable and is not at 

a fixed location.

001419
West Fertilizer Company Final Report January 2016

87 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB requested additional information from U.S. Fire related to the WFC insurance policy, including 

claims, audits and inspections, and training requirements for U.S. Fire loss consultants. CSB also 

requested documentation of U.S. Fire’s onsite inspections at the WFC facility over the time period it was 

insured. To date, U.S. Fire has not provided CSB with the requested documentation. Outside counsel for 

U.S. Fire indicated to a CSB investigator that the $1 million policy amount did not necessitate much 

onsite activity, such as audits or inspections, during the time that the WFC was insured. 109

5.3 Insurance Claims and Other Aid after the Explosion

The Texas Department of Insurance (TDI) regulates the business of insurance in Texas and provides 

resources for people and businesses to obtain insurance in the state. In response to the WFC explosion, 

TDI assisted in securing the scene and mobilizing a disaster response program to assist consumers with 

filing insurance claims related to the incident. The Texas State Fire Marshal’s Office (SFMO) and the 

Division of Workers’ Compensation are units within TDI. The total insurance-related losses due to the 

explosion are estimated to be in the range of $230 million.110 Many of the residents in the area did not 

have home or rental insurance. Those individuals relied on aid from FEMA, Salvation Army, and 

American Red Cross operations. FEMA received a total of 1,108 applications for assistance as a result of 

the fire and explosion at the WFC facility.

111 Nearly 6 months after the incident, FEMA112 reported 

providing federal disaster assistance exceeding $16 million to eligible survivors. This sum included more 

than $9 million in federal disaster loans from the U.S. Small Business Administration (SBA), nearly 

$840,000 in individual assistance grants from FEMA, and more than $6.2 million in FEMA Public 

Assistance funding.113 Low-interest disaster assistance loans from the SBA114 were also available to 

homeowners, renters, businesses of all sizes, and private nonprofit organizations whose property was

damaged or destroyed by the incident. On the basis of data provided by FEMA, 580 applications were 

submitted for individuals or families that had homeowners, homeowners with small business loans, and 

mobile home insurance. FEMA verified losses totaled about $9,052,308. The real property FEMA 

verified losses amounted to about $8,145,750. The personal property FEMA verified losses totaled 

roughly $906,557. Although all losses related to the fire and explosion totaled nearly $250 million, the 

 

109 Outside Counsel for U.S. Fire, conversation with CSB Investigator, January 20, 2015. 110 Texas House of Representatives, 84th Texas Legislative Session. Testimony on House Bill 2470. See: 

http://www.house.state.tx.us/video-audio/committee-broadcasts/ (accessed on January 6, 2016). 111 Official data provided by FEMA. 112 FEMA—under the authority of Section 408 of the Robert T. Stafford Disaster Relief and Emergency Assistance 

Act, 42 U.S.C. § 5174, and Title 44 of the Code of Federal Regulations (CFR)—may provide financial assistance 

and, if necessary, direct services to eligible individuals and households that, as a direct result of a major disaster, 

have necessary expenses and serious needs and are unable to meet such expenses or needs through other means.

113 See: http://www.fema.gov/news-release/2013/10/07/federal-disaster-assistance-tops-16-million-west-texas

(accessed on January 6, 2016).

114 The SBA serves as the Federal government’s primary source of money for the long-term rebuilding of disasterdamaged private property. These disaster loans cover uninsured and uncompensated losses and do not duplicate 

benefits of other agencies or organizations.

001420
West Fertilizer Company Final Report January 2016

88 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC carried a policy from U.S. Fire at the time of the incident with a limit of only $1 million for bodily 

injury and offsite property damage.

5.4 FGAN Facilities in Texas and the Potential for Offsite 

Consequences 

Under the Texas Commercial Fertilizer Rule (described in Section 8.7.1), facilities that sell or offer to sell 

FGAN or FGAN-containing materials must obtain annual registrations from the Office of the Texas State 

Chemist (OTSC) to do business. The OTSC collects information on each facility storing more than 

10,000 pounds (5 tons) of AN in Texas. According to the OTSC list of facilities as of September 2014, 

80 facilities statewide stored AN in quantities exceeding 10,000 pounds. Of those 80 facilities, 43 stored 

FGAN, and 37 stored technical grade ammonium nitrate (TGAN). In October 2015, the OTSC reported 

40 FGAN facilities in Texas.115 Of those 40 facilities, only nine (23 percent) are located in jurisdictions 

with an adopted fire code.

CSB found that West, Texas, is not the only town in the state with FGAN storage in close proximity to 

residential areas, schools, and hospitals. In fact, some of these occupancies are directly adjacent to, or 

across the street from, FGAN storage. Because the WFC operated in close proximity to schools, 

residences, and a nursing home, CSB plotted the 40 FGAN storage facilities in Google EarthTM to 

determine whether FGAN storage facilities are also in close proximity to residential areas, schools, or 

other large population clusters. 

CSB found that 19 (48 percent) of the facilities storing more than 10,000 pounds of FGAN are located 

within 0.5 miles of a school, hospital, nursing home, or a combination of those occupancies. Of the 40 

FGAN facilities, 33 (83 percent) of the FGAN storage facilities are located within 0.25 miles of a 

residence or apartment building.

116 The WFC facility was about 550 feet (0.16 miles) from the closest 

school, which sustained catastrophic damage as a result of the explosion, which could have resulted in 

additional loss of life had the school been in session at the time of the incident. CSB identified one other 

school in Texas that is 529 feet (0.12 miles) from an FGAN storage facility, even closer than the school 

destroyed in West, Texas (Figure 55). Of the 40 FGAN storage facilities, 16 (40 percent) are within 0.5 

miles of an elementary school, secondary school, or high school (Figure 56). 

 

115 CSB noted that two new FGAN facilities registered with the OTSC between September 2014 and October 2015 

and that five facilities were listed in September 2014 that did not register to sell FGAN in October 2015. 116 The closest structures with obvious characteristics of a private residence were selected for this measurement using 

Google Earth and Google Street View.

001421
West Fertilizer Company Final Report January 2016

89 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

529 Feet

FGAN Facility

School

Figure 55. Overhead View of a School Approximately 529 Feet from an FGAN Storage Facility (Source: 

Google Earth)

Figure 56. Breakdown of FGAN Storage Facilities (10,000 pounds or more) 

Within 1 Mile of a Texas School (Source: CSB)

0 2 4 6 8 10 12 14 16 18

Less than 0.25 miles

 (< 0.4 km)

0.25 to 0.50 miles

(0.4 to 0.8 km)

0.50 to 1 mile

(0.8 to 1.6 km)

Greater than 1 mile

(> 1.6 km)

Number of Texas FGAN Facilities

Distance to Schools 

Fire Code No Fire Code

001422
West Fertilizer Company Final Report January 2016

90 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

The West Rest Haven nursing home was located about 600 feet from the WFC facility and sustained 

irreparable damage as a result of the blast. CSB measured distances between Texas FGAN storage 

facilities and nearby hospitals and nursing homes and found that 38 percent of the facilities are within 1 

mile of a nursing home or hospital. In one case, a fertilizer facility is adjacent to a 50-bed hospital and a 

residence, also a few blocks from a school (Figure 57). 

Hospital 278 Ft.

FGAN 

Facility

Residence 

220 Ft.

School

1432 Ft.

Figure 57. Overhead View of a Texas FGAN Storage Facility near a Hospital, Residence, and School

(Source: Google Earth)

Findings from the analysis of the proximity of FGAN storage facilities to various community structures 

show that the risk to the public from a catastrophic incident exists throughout the state of Texas. Injury 

data published by the Waco-McLennan County Health Department supported the conclusion that people 

within 1,500 feet (or 0.28 miles) from the blast epicenter were the majority of those injured in the WFC 

fire and explosion, particularly those who were inside a structure at the time of the blast.117 

5.5 Limits of Insurance Coverage in Texas

Property and liability insurance companies can complement government oversight of industry by 

identifying hazards and reducing losses through the insurance process. In some ways, insurance can 

 

117 Waco-McLennan County Public Health District. “Public Health Report: Injuries Related to the West (Texas) 

Fertilizer Plant Explosion,” April 2013 (issued on June 24, 2014). 

001423
West Fertilizer Company Final Report January 2016

91 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

augment government standards and safety monitoring.118 The insurance industry provides coverage for 

losses at established premiums but also has an incentive to reduce and manage risks. Insurers perform 

functions of risk reduction and risk management by using tools such as auditing and inspecting their 

clients, managing loss prevention efforts, analyzing loss histories, identifying causes of accidents, and 

teaching clients how to avoid premium increases (or how to secure premium reductions).119 Insurance 

reinforces existing government regulations by expecting that policyholders comply with existing 

requirements. This approach can be effective at reducing risk and preventing incidents because annual 

insurance audits can be more frequent than state or federal enforcement inspections, such as those by

SFMO or OSHA. Texas law does not require facilities that store FGAN to obtain commercial general 

liability or property insurance; however, the WFC voluntarily obtained insurance. The WFC’s $1 million 

general liability policy with U.S. Fire did not include excess or umbrella coverage for the consequences of 

serious incidents, such as bodily injury and property damage. If the WFC is found responsible for this 

incident in civil cases, its insurance would not be sufficient to pay the full amount of insurance claims for 

the catastrophic consequences caused by the blast. 

Texas law requires some businesses to have liability insurance for operations that potentially pose a lower 

level of public risk than the WFC incident (Table 5). Air conditioning and refrigeration contractors, mold 

assessors, and plumbers are some of the businesses or services subject to commercial general liability 

requirements in Texas. For amusement ride owners and operators, Texas set the minimum requirements 

for insurance at $1.5 million per occurrence and requires proof of insurance to operate an amusement ride. 

For an amusement park ride to operate in the state, the ride must be inspected at least annually by the 

insurer.120 The ride also must meet the standards for coverage and have an adequate amount of insurance 

coverage.121 Operators of amusement park rides annually must file copies of the inspection certificate and 

insurance policy with the TDI Commissioner. The Texas amusement ride regulation also requires 

operators of coin-operated rides and bounce houses to obtain liability insurance. However, FGAN storage 

facilities such as the WFC facility can operate next to schools, residential areas, and hospitals with little 

or no general liability insurance. Adequate levels of coverage would likely prompt rigorous onsite loss

control audits by insurers.

 

118 Ben-Shahar, Omri, and Kyle D. Logue. “Outsourcing Regulation: How Insurance Reduces Moral Hazard,” 

Michigan Law Review 111:2 (2012); University of Michigan Law and Economics Research Paper No. 12-004; 

University of Chicago Institute for Law and Economics Olin Research Paper No. 593. See: 

http://ssrn.com/abstract=2038105 (accessed on January 6, 2016). 

119 Ibid. 120 Texas Occupations Code, § 2151.101, “Regulations of Amusement Rides: Requirements for Operation.” See: 

http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.2151.htm (accessed on August 4, 2015). 121 Ibid.

001424
West Fertilizer Company Final Report January 2016

92 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 5. Minimum Insurance Requirements in Texas122

Business/Operation Minimum Amount

Amusement ride operators $1.5 million

Elevator/escalator contractors $1.5 million123

Mold assessors and remediators $1 million124

Electricians $600,000125

Residential appliance installers $600,000126

Plumbers $300,000127

Tow truck operators $300,000128

Structural pest control providers $300,000129

Used automotive parts recyclers $250,000130

Air conditioning service providers $200,000131

Previous incidents in Athens, Bryan, and West have demonstrated the risk imposed by FGAN facilities on 

Texas communities and the public. In the absence of a state fire code, there is limited state oversight to 

ensure that facilities are addressing conditions that could potentially lead to an incident similar to the 

WFC fire and explosion. 

 

122 See: http://www.dallasnews.com/news/west-explosion/headlines/20130508-texas-makes-bounce-house-operatorscarry-liability-coverage-but-not-plants-like-west-fertilizer.ece (accessed on January 6, 2016). 123 See: https://www.tdlr.texas.gov/elevator/Elevapp.pdf (accessed on January 6, 2016). 124 Texas Administrative Code Licensing Requirements. See: 

http://txrules.elaws.us/rule/title25_chapter295_sec.295.309 (accessed on January 6, 2016). 125 See: http://www.tdlr.texas.gov/electricians/forms/ElectricianCOI.pdf (accessed on January 6, 2016). 126 See: http://www.tdlr.texas.gov/electricians/forms/ELC012 Residential Appliance Installation Contractor License 

Application.pdf (accessed on January 6, 2016). 127 See: http://www.tsbpe.state.tx.us/common/CertificateofInsuranceForm-fillablefeb2012.pdf (accessed on January 6, 

2016).

128 Administrative Rules of the Texas Department of Licensing and Regulation, § 86.400, “Insurance Requirements—

Tow Truck Permits.” 33 TexReg 2940. New section adopted, effective April 15, 2008. 129 Texas Occupations Code, § 1951.312, “Liability Insurance.” See: 

http://www.statutes.legis.state.tx.us/Docs/OC/htm/OC.1951.htm (accessed on January 6, 2016). 130 See: https://www.tdlr.texas.gov/parts/aprrules.htm#8740 (accessed on January 6, 2016). 131 Proof of insurance is required only with an initial application for licensure, a change in license assignment (new 

company), or a request by the Department of Insurance. 

001425
West Fertilizer Company Final Report January 2016

93 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Triangle conducted annual inspections at the WFC facility and identified conditions that could result in 

potential losses, such as fires and worker injuries. Although Triangle did not focus specifically on 

hazards related to FGAN storage, it offered recommendations to the WFC to correct conditions, such as 

electrical hazards, that could result in a fire. CSB did not receive any documentation that U.S. Fire 

continued performing similar audits and inspections at the WFC facility after Triangle’s nonrenewal. 

It is not common for states to have prescriptive requirements for insuring specific industries. However, 

TDI does impose liability insurance and inspection requirements for amusement park rides and 

establishes minimum liability insurance coverage for certain operations and services, as listed in Table 5. 

CSB identified other FGAN storage facilities located in close proximity to community structures; 

however, the level of insurance carried by these facilities remains unknown. In response to the WFC 

incident, TDI conducted a voluntary survey of 95 Texas fertilizer facilities in June 2013 and requested the 

names of the companies that insure those facilities against general liability, property, and workers’ 

compensation losses. TDI received 12 responses to the 95 inquiries. Although the number of responses 

does not suggest that the remaining fertilizer facilities are uninsured, there is no way to determine whether

these facilities have insurance policies that incorporate audits and inspections to focus on safe FGAN 

storage and handling conditions.

On March 5, 2015, House Bill 2470 proposed amendments to the Texas Commercial Fertilizer Rules to 

require proof of liability insurance coverage for annual registration, similar to the requirements for 

amusement park rides. The bill proposed to amend the Texas Agriculture Code to require public liability 

insurance to produce, store, transfer, blend, or sell FGAN or FGAN-containing materials upon applying 

for a permit under the Texas Commercial Fertilizer Rules.132 However, this bill did not pass the state 

legislature. 

Without insurance and inspection requirements for FGAN facilities, operators can sell bulk quantities of 

fertilizer with little or no insurance coverage. The process of obtaining insurance could encourage both 

agricultural insurers and insured parties to assess current risks and to increase the awareness and rigor of 

insurance audits to ensure that companies are safely storing FGAN in accordance with guidance released 

as part of Executive Order 13650 (addressed in Section 8.1), OSHA standards, and industry consensus 

standards such as NFPA 400. Minimum coverage requirements will spur more realistic risk analysis by 

insurers that write coverage for FGAN bulk storage retail facilities. By providing agricultural businesses

the guidance to identify and address FGAN hazards when underwriting and conducting annual loss 

control inspections, insurers can play a role in ensuring that FGAN facilities mitigate hazardous 

conditions.

 

132 The required liability insurance policy proposed by HB 2470 afforded bodily injury and property damage 

protection in an amount determined by TDI to compensate a person who incurred damages as a result of FGAN 

operations. The bill also directed TDI to coordinate with the Texas State Fire Marshal, Department of Health 

Services, Office of the Texas State Chemist, and other agencies to study the risk exposure for FGAN activities to 

determine the appropriate requirements for a liability insurance policy.

001426
West Fertilizer Company Final Report January 2016

94 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.6 Insurance Services Office Rating

The Insurance Services Office (ISO)133 is an independent commercial enterprise and insurance industry 

advisory company that provides information, evaluation, and underwriting on safety and risk management

related to community fire protection and building code effectiveness, serving insurance companies and 

other fire safety organizations. ISO adopts a public protection classification (PPC) system to develop fire 

insurance premiums for residential and commercial properties.134 

ISO obtains information on municipal fire protection efforts in communities throughout the United States. 

Those data are then analyzed and evaluated for communities, using a standardized method and criteria 

known as the Fire Suppression Rating Schedule (FSRS). The FSRS assigns a PPC rating (from 1 to 10) 

to fire departments in each community. Class 1 represents exemplary public protection, and Class 10 

indicates that the area’s fire suppression program does not meet ISO minimum criteria. ISO develops a 

split classification; for example, 5/9. The first class (Class 5 in the example) applies to properties within 

5 road miles of a fire station and within 1,000 feet of a fire hydrant. The second class (Class 9 in the 

example) applies to properties within 5 road miles of a fire station but farther than 1,000 feet from a 

hydrant. ISO generally assigns Class 10 to properties farther than 5 road miles from a fire station. 

To determine a community’s PPC, ISO conducts a field survey, with ISO staff members visiting the 

community to observe and evaluate features of the fire protection systems. Using the FSRS, ISO 

objectively evaluates three major areas: fire department,

135 water supply,136 and fire alarm and 

communication systems.137 When ISO allocates a high class rating to a fire department, ISO works with 

the affected fire department and the city to make improvements to the fire department, water system, 

and/or fire and alarm communication systems. Once these improvements are completed, the city then 

requests a new ISO reclassification. ISO reevaluates the city and then notifies the fire department of the 

new PPC rating. If a lower rating is received, the city notifies all homeowners and business owners to 

inform their insurance carriers to adjust their policies based on the new classification.

 

133 See: http://www.isomitigation.com/index.php/about-iso (accessed on January 7, 2016). 134 Insurance companies often rely on information from ISO about a community’s fire protection services to evaluate 

claims and damages.

135 A review of the fire department accounts for 50 percent of the total classification. ISO focuses on a fire 

department’s first-alarm response and initial attack to minimize potential loss. Here, ISO reviews items such as 

engine companies, ladder or service companies, distribution of fire stations and fire companies, equipment carried 

on apparatus, pumping capacity, reserve apparatus, department personnel, and training.

136 A review of the water supply system accounts for 40 percent of the total classification. ISO reviews the water 

supply that a community uses to determine the adequacy for fire suppression purposes. It also considers hydrant 

size, type, and installation as well as the inspection frequency and condition of fire hydrants. 137 An ISO review of the fire alarm system accounts for 10 percent of the total classification. The review focuses on 

the community’s facilities and support for handling and dispatching fire alarms.

001427
West Fertilizer Company Final Report January 2016

95 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

5.6.1 Impact of the City of West Class 5 ISO Rating on the West Fertilizer 

Company

According to the West Fire Department, ISO rated the city of West at Class 5 before April 17, 2013. The 

pre-incident ISO classification and PPC rating of the West Volunteer Fire Department (WVFD) placed 

the city of West among the top 25 percent of all Texas communities (Figure 58). The average 

classification rating for communities and fire departments in Texas is Class 7. 

Figure 58. Distribution of ISO Class Ratings for Cities and Communities in Texas (Source: ISO)138

On the national scale, the average PPC for cities, fire departments, and communities in the United States

is Class 7 (the same as the average for Texas). The current ISO rating of the WVFD places the city of 

West among the top 30 percent of all communities nationwide (Figure 59). 

 

138 See: http://www.isomitigation.com/index.php/ppc-program/how-the-ppc-program-works/facts-and-figures

(accessed on December 20, 2015).

001428
West Fertilizer Company Final Report January 2016

96 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 59. Distribution of ISO Class Ratings for All U.S. Cities and Communities (Source: ISO)139

Firefighters who responded to the WFC fire reported difficulty in extending their 4-inch fire hoses to the 

nearest fire hydrant, which was located at West High School, more than 1,500 feet from the burning 

fertilizer plant. A surviving firefighter testified that the emergency responders had to use one of their fire 

trucks as a connector line to reach the nearest fire hydrant at the high school. After dropping all of the 

hose lines on the engine, they discovered that they were about 700 feet short of the length needed to 

effectively fight the fire. Some of the volunteer firefighters then arranged to take the engine with hose 

and continue to string lines. One of the firefighters subsequently returned to the hydrant near the high 

school to attempt to establish a connection from the hose line to the fire hydrant. The explosion occurred 

just as the firefighter arrived at the fire hydrant, and he survived the explosion, although with severe 

injuries. 

The WFC plant was not incorporated into the West city limits,

140 so an ISO assessment of the city of 

West did not capture the fertilizer plant as a high-risk facility. An ISO evaluation of the WFC plant 

would have increased the city’s ISO rating and would have compelled the insured residents141 and 

industrial facilities to carry higher homeowners and industrial hazard insurance premiums.142 The WFC

 

139 Ibid. 140 Section 9 discusses land use planning and zoning. 141 If the WFC plant had been included in the ISO rating, the city of West would have had a higher classification 

score, with an increased insurance premium for homeowners in West because of the proximity of the fertilizer plant 

to residential neighborhoods. 

142 The rating directly impacts the premiums that insurance companies charge for commercial and industrial facilities 

as well as homeowner’s coverage. A lower ISO rating means a lower price for insurance coverage.

001429
West Fertilizer Company Final Report January 2016

97 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

had insurance coverage of $1 million, without any prior evaluation from ISO. If ISO had evaluated the 

fertilizer plant, insurance underwriters would have charged a higher premium for the WFC plant based on 

the level of risks and hazards associated with the chemicals and operations at the WFC facility. Also, the 

ISO rating system would have revealed the distance from the nearest fire hydrant to the fertilizer plant, 

which would have increased the PPC rating. To obtain lower ISO PPC ratings, the city of West would 

have had to make adjustments by installing and regularly maintaining fire hydrants with ISO-minimum 

water flow rates closer to the fertilizer plant to enable ease of reach during emergencies.143

6.0 Inherently Safer Technology

FGAN has certain risk characteristics that can make it inherently dangerous under some conditions. 

Ammonium nitrate (AN) by itself is a powerful oxidizer; when mixed with fuel oil, it can be used as an 

industrial explosive when exposed to fire or shock. Traditional safety practices to control FGAN fire and 

explosion hazards through procedures, hazard awareness, and emergency response are important. 

However, applying the concept of inherently safer technology (IST) or inherently safer design (ISD) can 

substantially reduce risk. 

IST and ISD are recognized approaches for decreasing risk by permanently reducing or eliminating the 

hazards associated with materials and operations used in an industrial process.144 Trevor Kletz, an 

acknowledged expert on IST and chemical process safety, defined IST as the avoidance of hazards rather 

than the control of hazards by adding protective equipment.145 Inherently safer processes can be achieved 

by strategies such as:

• Substituting dangerous chemicals or processes with safer alternatives. 

• Simplifying processes. 

• Minimizing the quantity of a chemical on hand or in a process. 

• Moderating the operating conditions of a process.

Before the widespread adoption of IST, plant designs in the chemical industry tended to address reduction 

of risk by relying on layers of protective equipment, procedures, and alarms.146 IST is preferable to 

adding layers of protection because, while this approach might reduce the likelihood or impact of an 

event, the inherent hazards remain.

147 The concept of IST can be derived from a list of strategies for 

 

143 To qualify for rating credit, fire hydrants must be capable of delivering a minimum of 500 gpm for 30 minutes. 144 Center for Chemical Process Safety. Inherently Safer Chemical Processes—A Life Cycle Approach, Second

Edition. New York: John Wiley & Sons, 2009. 145 Kletz, Trevor A., and Paul Amyotte. Process Plants: A Handbook for Inherently Safer Design. Boca Raton, FL: 

CRC Press, 2009. 146 Kletz, Trevor, and Paul Amyotte. Process Plants: A Handbook for Inherently Safer Design, Second Edition. Boca 

Raton, FL: Taylor & Francis, 2010.

147 Ibid. 

001430
West Fertilizer Company Final Report January 2016

98 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

reducing risk (Figure 60). IST is most effective when implemented during the earliest stages of the 

process design, but it can be applied at all stages of a life cycle (design, operation, shutdown, and 

demolition).148 

Figure 60. Risk Control Hierarchy (Source: CCPS)149

Table 6 lists some IST approaches that can be applied to FGAN. 

Table 6. Inherently Safer Approaches for Handling FGAN150

Inherently 

Safer Strategy

Description Examples

Substitution Replacing a hazardous material 

with a safer option

Use a fertilizer with less explosive potential than 

FGAN

Minimization Reducing the quantity of a 

hazardous material used in a 

chemical process

Store FGAN in purpose-built buildings holding 

smaller quantities of materials, well separated from 

one another and from potential sources of 

contamination

Moderation Using a hazardous material 

under the least hazardous 

conditions

Store FGAN in bins constructed of materials 

impervious to the effects of AN and in areas where 

electric service is not required

Limitation of 

effects (a form 

of moderation)

Changing designs or reaction 

conditions rather than adding 

protective equipment

Construct FGAN storage bins to minimize the 

consequence of a possible explosion

Simplification Eliminating process complexity 

to provide fewer opportunities 

for error and equipment failure

Limit the types of FGAN blends sold to minimize 

the need for staff to handle FGAN.

 

148 National Research Council. The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience. Washington, 

DC: The National Academies Press, 2012. 149 Center for Chemical Process Safety. Inherently Safer Chemical Processes—A Life Cycle Approach, Second

Edition. New York: John Wiley & Sons, 2009: 3, 27. 150 Ibid. 

001431
West Fertilizer Company Final Report January 2016

99 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Once all hazards associated with a chemical process are identified and understood, IST can be applied in 

the design phase or to existing processes. According to Kletz, the concepts of IST are not sharply defined 

and can merge into each other, depending on how they are applied.151 Although not always feasible or 

cost-effective, substitution is often the most desired approach for reducing hazards because it involves 

replacing a hazardous material with a safer alternative. Minimization to reduce the quantity of a 

hazardous chemical stored or used within a process can often have a dramatic effect on risk, albeit usually 

only locally. The concept of moderation usually involves processing or storing chemicals under 

conditions that are less likely to add to or exacerbate risk—such as lower temperatures and pressures, 

removal of potential catalysts and sources of ignition, or use of materials of construction that minimize 

heat exposure near FGAN. In addition, the concept of simplification involves modifying procedures to 

reduce the likelihood of operator error and designing processes that require little or no operator actions to 

render the process safe in the event of a loss of control. The implementation of one or more of the 

inherently safer options, if feasible, can eliminate or minimize hazards instead of controlling them. 

IST might not eliminate all risks associated with a process, and some apparently inherently safer options 

might introduce new hazards that are of greater concern than those eliminated. For example, a reduced 

quantity of a hazardous chemical at a plant can lead to greater risk in transportation systems or at the 

originating plant. Elimination of large FGAN inventories at facilities similar to the West Fertilizer 

Company (WFC) is impractical because farmers rely on large quantities of fertilizer for their crops. 

Lower inventories could potentially introduce new hazards from the larger number of FGAN shipments 

needed to supply storage facilities. Accordingly, before implementation, IST options must be thoroughly 

analyzed and assessed, considering all risks and not only the interests of an individual facility. 

In terms of reducing the fire and explosion hazards associated with storage and handling of FGAN, two 

inherently safe measures are described in the rest of this section: (1) modify or substitute for the 

formulation of FGAN, making it less susceptible to fire or explosion, and (2) modify the conditions in 

which FGAN is stored to eliminate the possibility of a large fire and explosion.

6.1 Alternative Formulations of FGAN

An alternative formulation of FGAN could reduce the potential for a detonation under fire conditions. 

However, more testing is necessary to ensure that these formulations are safer in bulk quantities, 

agriculturally compatible, and environmentally acceptable. In response to the 1947 FGAN explosion in 

Texas City, Texas, and to subsequent AN-based bombings across the United States,152 researchers have 

 

151 Ibid. 152 Past AN-based bombings in the United States include the 1970 University of Wisconsin bombing, the 1990 

Internal Revenue Service building bombing and other attempted bombings in California, the 1995 Murrah Federal 

Building bombing in Oklahoma City, and the 1996 attempted bombing of the FBI fingerprint database complex in 

Clarksburg, West Virginia.

001432
West Fertilizer Company Final Report January 2016

100 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

explored several options for inerting or desensitizing FGAN to lower the detonation sensitivity of the 

material. One method introduced in 1968 claimed to render FGAN inert with the addition of 5 to 10 

percent monoammonium phosphate and diammonium phosphate.

153 However, in 1995, a test showed that 

the mixture was detonable with a larger charge diameter than the initially presented charge.154 

In 1997, the International Fertilizer Development Center conducted a study for ATF to study the 

feasibility, practicability, and impact of making nitrate-based fertilizer chemicals inert. The study 

concluded that it is not feasible to inert AN without adversely affecting its effectiveness and efficiency as 

a fertilizer.155 In 1998, the National Research Council (NRC) released a report that addressed existing 

studies for inerting AN. The NRC examination concluded that FGAN with altered prill porosity, dilutants,

or chemical additives could still be detonable156 and that no current technology would reduce the risk 

without seriously affecting the utility of AN as a fertilizer.157 The NRC recommends further examinations 

of the impacts of alternate formulations on agricultural suitability, costs to the end-user and 

environmental impacts of additives or inertants.158 Large quantities of inert materials mixed with AN 

might not be practical because of the cost and the reduction in fertilizer effectiveness. Adding a 

percentage of another chemical to AN can make it safer, but farmers might need to buy and transport 

more fertilizer to deliver the same quantity of nitrogen to their crops.159 CSB has reviewed documentation 

and publications that describe a few of those alternatives to AN based on the addition of inert chemicals 

(Table 7). 

Table 7. Examples of AN Fertilizer Alternatives

Name Method Claims

 

153 Porter, S.J. “Method of desensitizing fertilizer grade FGAN and the product contained,” U.S. Patent 3,366,468, 

1968.

154 National Research Council. Containing the Threat from Illegal Bombings: An Integrated National Strategy for 

Marking, Tagging, Rendering Inert, and Licensing Explosives and Their Precursors. Washington, DC: National 

Research Council, 1998: 106. See: http://www.nap.edu/openbook.php?record_id=5966&page=106 (accessed on 

June 26, 2014). 155 See: https://www.atf.gov/file/57516/download (accessed on January 20, 2016). 156 National Research Council. Containing the Threat from Illegal Bombings: An Integrated National Strategy for 

Marking, Tagging, Rendering Inert, and Licensing Explosives and Their Precursors. Washington, DC: National 

Research Council, 1998: 106. See: http://www.nap.edu/openbook.php?record_id=5966&page=106 (accessed on 

June 26, 2014). 157 Ibid. 158 Ibid.

159 Thompson, Steve. Dallas News. Quoting Bob Best, Pentagon scientist: “There are safer alternatives to FGAN

fertilizer. But a safer form?” See: http://watchdogblog.dallasnews.com/2013/10/there-are-safer-alternatives-toammonium-nitrate-fertilizer-but-a-safer-form.html/ (accessed on June 26, 2014). 

001433
West Fertilizer Company Final Report January 2016

101 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Sulf-N® 26160

(ASN 26)

FGAN fused with ammonium 

sulfate161

The addition of ammonium sulfate dampens 

the role of FGAN combustion.

162

Ferti-Safe163 Fly-ash-coated and gypsumcoated fertilizerDetonation potential can be reduced or 

eliminated. 

Calcium 

ammonium 

nitrate (CAN)

Mixture of FGAN and 

limestone (calcium carbonate) 

or dolomite (calcium 

magnesium carbonate)

Some tests revealed less oxidizing capability 

than FGAN. 

CAN is less prone to thermal decomposition 

than FGAN. 

Honeywell has developed a fertilizer called Sulf-N 26 (later marketed by J.R. Simplot Company as ASN 

26), claimed to be inherently safer than FGAN. Sulf-N 26 is made of nitrogen and sulfur164 by fusing 

FGAN with ammonium sulfate (AS), a fire retardant. For the patent, tests were conducted according to 

United Nations Recommendations on the Transport of Dangerous Goods.

165 The test method is designed 

to measure the potential for a solid substance to increase the burning rate or burning intensity of a 

combustible substance when the two are thoroughly mixed. The mixture of FGAN fused with AS did not 

burn in the test, and the mixture was not classified as an oxidizer. Sulf-N 26 contains significantly less 

nitrogen than FGAN (26 percent compared to 34 percent).166 This nitrogen level can be an issue for some 

farmers as the effective absorption rate of nitrogen is vitally important to plants. Sulf-N 26 also contains 

higher quantities of sulfur, which farmers can need for certain types of crops and soils but not for others. 

Further examination is necessary to fully assess the use of Sulf-N 26 as an inherently safer alternative to 

FGAN. Notably, a 50/50 mixture of AS and FGAN was involved in the 1921 Oppau, Germany, 

explosion.

Researchers from the University of Kentucky developed a technology called Ferti-Safe to desensitize 

FGAN by coating it with an ash-like coal combustion by-product.167 They developed the technology with 

the intention of preventing the malicious use of FGAN for explosive devices. The Ferti-Safe formulation

 

160 Sulf-N 26 was not commercially available at the time of the WFC incident. 161 Honeywell. “Honeywell Sulf-N 26.” See: http://sulfn26.com/ (accessed on June 26, 2014). 162 Ibid. 163 Ferti-Safe was not commercially available at the time of the WFC incident. 164 Honeywell. “Honeywell Sulf-N 26.” See: http://sulfn26.com/ (accessed on June 26, 2014). 165 United Nations. Recommendations on the Transport of Dangerous Goods, Manual of Tests and Criteria, 

ST/SG/AC.10/11/Rev2, Section 34, Classification Procedures, Test Methods and Criteria Relating To Oxidizing 

Substances of Division 5.1, Test O.1: Test for Oxidizing Solids, 1995. 166 Bomgardener, Melody M. “Safer Fertilizer,” Chemical and Engineering News, December 6 (2011). See: 

http://cen.acs.org/articles/89/web/2011/12/Safer-Fertilizer.html (accessed on May-June 2015). 167 Taulbee, D. et al. Reducing the Explosion Potential of Ammonium Nitrate Fertilizer, Final Report to the National 

Institute of Hometown Security, Lexington, KY (2012). 

001434
West Fertilizer Company Final Report January 2016

102 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

involves coating FGAN with gypsum (calcium sulfate) and fly ash.168 Both coating options are claimed 

to be effective in stopping an explosion of a blend of ammonium nitrate/fuel oil (ANFO).169 

Calcium ammonium nitrate (CAN) contains 26 percent nitrogen and about 25 percent inert calcium 

carbonate. Formulations of CAN have been used in Europe and other countries since the 1920s, but it is 

not manufactured in the United States. European safety data sheets state that CAN is not capable of selfsustaining progressive thermal decomposition.170

The scope of most existing studies on alternative forms of FGAN is focused on reducing or eliminating 

the security threats associated with using FGAN to construct improvised explosive devices with the 

addition of fuel oil, but such studies do not focus on FGAN used in agricultural operations. Although 

some of the available information on these options suggests that they might be inherently safer, only 

limited testing has been performed to characterize the behavior of the alternatives in fire situations similar 

to that at the WFC. 

FGAN is vital to the nourishment of crops across the country, and alternative formulations must also be 

capable of meeting agricultural fertilizer needs. Because of the lack of scientific literature to show that 

alternative formulations of bulk FGAN can resist detonation in fires, CSB concludes that FGAN 

detonations can currently best be avoided through better compliance with storage practices and the

application of inherently safe building design and storage.

6.2 Inherently Safe Building Design and Storage

In the United States, FGAN storage practices at facilities similar to the WFC have not significantly 

changed over time. Before the fires in Bryan, Athens, and West, these Texas FGAN facilities had similar 

construction, with combustible materials and construction and limited fire safety features. CSB visited 

another EDC facility in Itasca, Texas, in 2013 and also noted combustible construction for the storage 

facility and bins. Findings from the WFC incident demonstrate that inherently safer concepts can be 

applied to storage practices to significantly reduce the risk of a fire or explosion. Modifying existing 

facilities or constructing new storage facilities with inherently safe options—such as facility set-back 

distances and the use of noncombustible construction materials—can reduce such risks. 

Because FGAN behavior is unpredictable in fire conditions, the most immediately effective strategy for 

reducing risk in existing and future FGAN storage facilities is to use inherently safer building design 

options to avoid creating the hazardous conditions that can contribute to a large uncontrollable FGAN fire 

and detonation. CSB concluded that the storage of combustible materials near FGAN storage piles and 

the use of combustible bins likely facilitated the spread of the FGAN-related fire to other bins and nearby 

 

168 Fly ash is a fine particle residue of coal combustion.

169 Taulbee, D. et al. Reducing the Explosion Potential of Ammonium Nitrate Fertilizer, Final Report to the National 

Institute of Hometown Security, Lexington, KY (2012). 

170 See: http://www.eurochem.ru/wp-content/uploads/2012/08/SDB_27_KASweiss_0124_EU.pdf (accessed on 

January 7, 2016). 

001435
West Fertilizer Company Final Report January 2016

103 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

combustibles. The combustibles also likely acted as a fuel during the fire; the soot, creosote, and other 

contaminants from the burning wood materials mixed with the surface of the FGAN, potentially 

increasing its energy and sensitivity to detonation. 

By eliminating wood and other combustibles as construction materials for FGAN bins and storage 

facilities and also for the storage of nearby combustible materials, the possibility of contaminating FGAN 

during a fire or smoldering event is greatly reduced. However, organic materials (such as packing 

materials or seeds) that are commonly present with the storage of bulk fertilizer will increase the 

likelihood of an explosion and will make the FGAN explosion more energetic. Certain inorganic 

contaminants, including chlorides and some metals (such as aluminum powder, chromium, copper alloys, 

cobalt, and nickel), can also sensitize FGAN, increasing the likelihood of detonation.

171 Current OSHA 

requirements in the Explosives and Blasting Agents standard in 29 CFR 1910.109(i) do not prohibit the 

use of wooden FGAN storage bins; instead, OSHA requires bins that are protected against FGAN 

impregnation (as noted in Section 8.2). The installation and use of concrete or metal172 storage bins 

would reduce the potential for a fire to spread throughout the facility and to other piles of FGAN or 

nearby combustible materials. 

It is also inherently safer to store FGAN in places where sources of ignition are not present. For example, 

a storage building without electric service eliminates the one of the possible sources of ignition and is 

thus inherently safer. 

In July 2009, an FGAN-related fire at the EDC fertilizer storage facility in Bryan, Texas, burned the 

facility to the ground, but the FGAN did not explode. The fire forced an evacuation of more than 80,000 

residents in the Bryan area and students at the Texas A&M College Station campus. EDC rebuilt the 

facility, originally a wooden structure, with concrete bins surrounded by a concrete dome (Figure 61). 

EDC’s insurance company required the use of concrete construction materials instead of wood to 

minimize the fire risk. 

 

171 EPA. “EPA Chemical Advisory: Safe Storage, Handling, and Management of Solid Ammonium Nitrate Prills.” 

See: http://www2.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on 

November 30, 2015). 

172 Galvanized iron, copper or copper alloys, lead, and zinc are not recommended metals for AN storage.

001436
West Fertilizer Company Final Report January 2016

104 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 61. Reconstructed EDC Facility in Bryan, Texas (Source: CSB)

Use of concrete bins or external metal hoppers instead of wooden structures is considered an inherently 

safer option for FGAN storage. According to Kletz, the IST concept of moderation entails storing or 

transporting a hazardous material in a less hazardous manner.173 In this case, eliminating the presence of 

the combustibles removes an obvious and principal source of fuel and heat that contribute to detonation. 

Replacing bins with structures made of concrete instead of combustible materials also limits the quantity 

of FGAN available to support combustion by confining it to the bin and preventing the acceleration of a 

fire. It is well recognized that wood is not a preferred material of construction for buildings or bins 

storing FGAN, and untreated wooden bins should never be used to store FGAN because of the oxidizing 

properties of FGAN that will increase the burning temperature and rate of burn of the structure itself, 

facilitating the spread of a fire. Concrete or compatible metals should be used to avoid contamination 

during fires. The Health and Safety Executive in the United Kingdom states that FGAN storage “should 

be constructed of a material that does not burn, preferably concrete.”174 

In March 2014, CSB responded to OSHA’s request for information (RFI) (at 78 Federal Register 73756) 

on future possible revisions to OSHA safety standards, including the Explosives and Blasting Agents 

standard in 29 CFR 1910.109(i) and the Process Safety Management standard in 29 CFR 1910.119. In 

response to the RFI, CSB urged OSHA to consider revising existing standards to provide more explicit 

requirements for the storage and handling of FGAN, including prohibiting wooden or combustible FGAN 

storage bins. 175 In May 2015, the NFPA issued a new edition of NFPA 400-2016, Hazardous Materials 

Code (Chapter 11, “Ammonium Nitrate”), which prohibits combustible construction materials for new 

FGAN storage facilities and establishes requirements for automated fire detection, fire suppression, alarm 

activation, and evacuation plans for existing facilities with combustible construction. CSB recommends 

that OSHA revise its standards to include requirements similar to those in NFPA 400-2016 for FGAN 

storage facilities to reduce the likelihood of a detonation when FGAN is exposed to fire. 

7.0 Emergency Response 

The FGAN explosion at the West Fertilizer Company (WFC) facility killed 15 people and caused more 

than 260 injuries. Of the 15 fatalities, 12 were first responders (firefighters and emergency services) 

personnel who responded to the fire—eight volunteer firefighters, with five from the West Volunteer Fire 

Department (WVFD), two from the City of Abbott Fire Department, and one from the Mertens and 

 

173 Kletz, Trevor, and Paul Amyotte. “Attenuation.” Process Plants: A Handbook for Inherently Safer Design, 

Second Edition. Boca Raton, FL: CRC Press, 2010: 103. 174 Health and Safety Executive (HSE). Storing and Handling Ammonium Nitrate. United Kingdom: Health and 

Safety Executive, 2004. See: http://www.hse.gov.uk/pubns/indg230.pdf (accessed on January 6, 2016). 175 CSB. “CSB Comments on the OSHA Proposed Rule: Process Safety Management and Prevention of Major 

Chemical Accidents.” See: http://www.regulations.gov/#!documentDetail;D=OSHA-2013-0020-0074 (accessed on 

November 30, 2015).

001437
West Fertilizer Company Final Report January 2016

105 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Navarro Mills Fire Department; an off-duty career firefighter (captain) from the City of Dallas Fire 

Department; an emergency medical technician (EMT) from West; and two good Samaritans who 

supported the emergency response at the fertilizer plant.176 One of the deceased volunteer firefighters 

who responded to the fire was also an employee of the WFC. 

CSB developed this section of our report to provide information to fire departments across the country by 

evaluating the key factors that contributed to the firefighter fatalities and to share lessons learned so that 

similar events can be avoided in the future. Accordingly, to determine what went wrong, CSB used 

emergency response documents, interviews, and video footage to analyze in detail the actions that were 

taken before and during the approximately 20 minutes that elapsed from the first call for assistance until 

the explosion occurred. 

This analysis is not focused only on volunteer firefighters; it demonstrates the need for effective preincident planning and firefighter training. Firefighters are expected to make risk assessments and 

decisions under time pressure with limited visibility during an actual response to a fire, which is almost 

impossible without adequate training. 

Although this analysis indicates that the emergency responders involved in this incident accepted an 

extremely high level of risk that resulted in multiple deaths, CSB recognizes that they were attempting to 

develop a plan of action for a fire scenario that none of them had prior practical experience with.

7.1 Firefighter Response

The chain of events—from the time the volunteer firefighters and other emergency responders arrived at 

WFC until the time of the explosion—can never be precisely known. On the basis of interviews with 

surviving firefighters and the evaluation of the incident scene, CSB was able to assess the emergency 

response process on April 17, 2013. On the evening of the incident, the emergency responders who were 

initially dispatched to the fire arrived at the scene at different times. CSB obtained a street surveillance 

camera video recording and also camera footage from the inside of a neighboring hardware store in 

West.177 The surveillance recording indicated that four emergency response vehicles were en route 

between 7:37 pm and 7:51 pm, when the explosion occurred, as shown in the timeline of events in Figure 

62. 

 

176 One of these Good Samaritans was familiar with the equipment used by the WVFD and volunteered to assist the 

second, who was in the area tending to cattle and offered his help to the firefighters. These two deceased Good 

Samaritans were made honorary volunteer firefighters at the memorial for the fallen West, Texas, firefighters and 

other emergency responders held in Waco, Texas, on April 25, 2013.

177 The convenience store and street surveillance camera are located about a mile from the WFC facility at the 

intersection between East Pine Street and North Roberts Street.

001438
West Fertilizer Company Final Report January 2016

106 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 62. Timeline of Events for Emergency Response to WFC Facility (Source: CSB)

Emergency responders were notified and dispatched to the scene at about 7:29 pm on April 17. The 

firefighters arrived on scene over a span of about 14 minutes, as recorded on surveillance footage of 

emergency vehicles en route to the WFC site that night.

178 In the video footage, the WVFD fire chief can 

be observed driving the water tender toward the incident scene at about 7:41 pm. Firefighters were 

dispatched to the scene of the emergency without anyone’s knowledge of how long the fire had been 

 

178 Because the WVFD is a volunteer-based service, it should be noted that the volunteer firefighters were not at the 

station at the time of the incident. Several firefighters were at home, attending to other personal activities or 

participating in an EMT training class.

001439
West Fertilizer Company Final Report January 2016

107 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

burning or smoldering before being noticed.179 Upon arrival, they concentrated their efforts initially on 

the incident scene, preparing to suppress flames that were visible at the northeast portion of the storage 

structure. Without a robust incident pre-planning process in place, without adequate hazardous materials 

awareness training, and with no previous FGAN-related fire emergency training or drills, the firefighters 

had no expectation of a possible FGAN explosion. The firefighters were advised by the career fire 

captain that they did not have the resources to combat the growing fire and should concentrate on cooling 

the liquid anhydrous ammonia tanks located near the burning building to prevent the tank from rupturing

or venting. However, they had not established that stream of water when the explosion occurred because 

they had to shut off the attack lines while the pumpers were repositioned.180

7.2 Key Contributing Factors to Emergency Responders’ Fatality

CSB identified the following seven key factors that contributed to the fatalities of firefighters and other 

emergency responders in West:

1. Lack of incident command system. 

2. Lack of established incident management system. 

3. Lack of hazardous materials (HAZMAT) and dangerous goods training. 

4. Lack of knowledge and understanding of the detonation hazards of FGAN. 

5. Lack of situational awareness and risk assessment knowledge on the scene of an FGAN-related 

fire. 

6. Lack of pre-incident planning at the WFC facility. 

7. Limited and conflicting technical guidance on AN. 

7.2.1 Lack of Incident Command System

CSB found that none of the responding emergency response personnel trained and certified in the 

National Incident Management System (NIMS) process formally assumed the position of Incident 

Commander (IC) who would have been responsible for conducting and coordinating an incident 

command system (ICS). Senior emergency response personnel at the WVFD arrived at the scene of the 

WFC incident at different times and did not delegate an IC to be in charge of the incident. Also, there 

was no record that arriving firefighters conducted an initial incident size-up or risk assessment to 

determine initial actions (offensive or defensive) that would be most suitable in responding to the incident 

based on the situation and available resources without putting emergency personnel at risk. 

Despite multiple responders having ICS training, none of them reportedly established command or took 

control of the fire ground. On the basis of a review of radio communications and interviews with 

surviving firefighters, CSB found no clear messaging or discussion among the responding firefighters on 

who should assume the role of the designated IC. Without a delegated IC officially taking control of the 

 

179 CSB was unable to determine how long the fire had been burning before the firefighters were notified. 180 NIOSH Fire Fighter Fatality Investigation and Prevention Program. See: http://www.cdc.gov/niosh/fire/ (accessed 

on December 28, 2015).

001440
West Fertilizer Company Final Report January 2016

108 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

fire ground operations, no ICS was established. Consequently, no senior emergency response personnel 

or IC was responsible for coordinating the various response activities carried out by individual firefighters 

on the scene. The West fire chief arrived on scene at about 7:41 pm and did not critically assess the 

conditions on the ground before the explosion 10 minutes later, at about 7:51 pm. The fire chief and 

assistant chief provided support and advisory functions but did not actively engage in fire ground function 

or take control of the fire ground; no record indicated that the West fire chief took command of the 

incident upon his arrival.181 Without direction to the contrary, the firefighters immediately took offensive 

action against the flames coming from the doors on north end of the east side of the structure. CSB 

interviews with surviving firefighters indicated that before the arrival of the fire chief, the other senior 

firefighters who had reached the incident scene about six minutes earlier had not delegated senior 

personnel with the training and expertise needed to formally assume responsibility as the IC. The 

firefighters had not reached a conclusion about how to establish a best approach and how to respond to 

the fire when the explosion occurred. Despite being trained for the ICS and NIMS process, none of the 

certified firefighters had prior practical experience in establishing incident command or coordinating and 

maintaining control of any previous emergency that merited the same approach as an FGAN-related fire 

scene. 

7.2.2 Lack of Established Incident Management System

CSB found that the emergency response personnel who responded to the WFC incident did not take time 

to set up, implement, and coordinate an effective incident management system plan that would have 

ensured evacuation of the nearby residents. Because no formal IC was in charge of the incident, none of 

the firefighters took responsibility for formally establishing and coordinating an effective incident 

management system. 

Witness testimonies revealed that emergency alert systems for the public were not activated before the 

explosion, although McLennan County had such systems in place.182 Many of the injuries might have 

been avoided or might have been less severe if an immediate evacuation had occurred. When the fire was 

first detected by a police officer, he ordered people in the parks near the facility to evacuate, and he 

blocked off roads. In addition, employees from the nursing home took the initiative as part of their 

company emergency response policy to move occupants to the back of the building for fear of smoke or 

an ammonia release. However, without a formal evacuation order to the entire affected community, many 

of the residents were left unaware of the risk and chose to watch the fire from inside their homes or 

vehicles or from the street, placing them within range of the high-pressure blast wave and in the line of 

flight of debris. In a study conducted after the WFC incident of FGAN-related fires worldwide since 

 

181 NIMS requires that the ICS should be established by the first arriving NIMS qualified personnel. Best practices 

indicate that the fire chief does not need to be on the scene of a fire before the ICS can be established. 

182 See Section 8.5 of this report.

001441
West Fertilizer Company Final Report January 2016

109 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

1970, the majority of detonations occurred within 60 minutes of the initial fire report.183 Because this 

elapsed time to detonation might be shorter than the response times for emergency operations and 

potential firefighting, a ‘let-it-burn’ approach with a precautionary evacuation of the surrounding 

neighborhood is appropriate.184

An incident management system is intended to provide a standard approach to management of emergency 

incidents. The U.S. Department of Homeland Security (DHS) established NIMS in 2004.185 NFPA 1561 

(2014 Edition) indicates, “[T]he incident management system shall provide structure and coordination to 

the management of emergency incident operations to provide for the safety and health of emergency 

services organization responders and other persons involved in those activities.”186 DHS developed the 

NIMS program to standardize the incident management process by facilitating coordination of an

emergency among all responders (including all levels of government and public, private, and 

nongovernmental organizations) so that they work together seamlessly and manage incidents involving 

threats and hazards (regardless of cause, size, location, or complexity) to reduce loss of life, property 

damage, and harm to the environment. To achieve this objective, FEMA, an organization within DHS, 

developed a NIMS training program.187 All federal emergency responders, including firefighters, are 

required to receive NIMS training.

188 Presidential Policy Directive 5, which established the NIMS 

training program, applies to all federal agencies, and non-federal entities, although not required to 

participate, are encouraged to do so.189 

NFPA 1500 (Standard on Fire Department Occupational Safety and Health Program, 2013 Edition190) 

and NFPA 1561 (Standard on Emergency Services Incident Management System and Command Safety, 

2014 Edition191) emphasize the need to use effective incident management systems at all emergency 

 

183 Marlair, G., et al. Comments about the paper entitled “Lessons to be Learned from an analysis of ammonium 

nitrate disasters in the last 100 years,” by Pittman et al., Journal of Hazardous Materials 280 (2014). 184 Ibid. 185 See: https://www.fema.gov/national-incident-management-system (accessed on December 28, 2015). 186 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 

Edition. Quincy, MA: NFPA, 2014. 187 The NIMS training program specifies National Integration Center and stakeholder responsibilities and activities for 

developing, maintaining, and sustaining NIMS training. The NIMS training program outlines responsibilities and 

activities that are consistent with the National Training Program, as mandated by the Post-Katrina Emergency 

Management Reform Act of 2006. This program integrates with FEMA training offered through the Emergency 

Management Institute (EMI) and USFA. See: http://www.fema.gov/pdf/emergency/nims/nims_training_program.pdf

(accessed on December 28, 2015).

188 See: https://www.fema.gov/national-incident-management-system/training (accessed on December 28, 2015).

189 To compel non-Federal entities seeking grants, FEMA does require its grant recipients to verify that they are 

“NIMS-compliant.” However, there is no requirement for fire services not receiving federal grants to participate in 

NIMS. See: https://www.fema.gov/pdf/emergency/nims/nims_training_program.pdf (accessed on December 28, 

2015).

190 NFPA. NFPA 1500: Fire Department Occupational Safety and Health Program, 2013 Edition. Quincy, MA: 

NFPA, 2013.

191 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014 

Edition. Quincy, MA: NFPA, 2014.

001442
West Fertilizer Company Final Report January 2016

110 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

scenes. In most cases, this process is known as the ICS, with the primary objective of managing the 

incident. NFPA 1561 defines an incident management system as “a system that defines the roles and 

responsibilities to be assumed by responders and the standard operating procedures to be used in the 

management and direction of emergency incidents and other functions.” 

CSB concluded that despite multiple personnel in the WVFD being trained and certified to initiate and 

manage the NIMS process, none of the certified firefighters who responded to incident was designated to 

assume or assumed the role of IC to initiate and coordinate the ICS and incident management plan as 

stipulated in the NIMS process. If the West firefighters had executed a planned, tested, and practiced ICS 

and incident management plan, the number of injuries and casualties sustained by both responders and 

neighboring residents could have been reduced.

7.2.3 Firefighter Training

Firefighters must cope with extraordinary situations and circumstances that threaten their personal safety. 

To improve execution and reduce the threat of injury or loss of life, it is vital for both volunteer and 

career firefighters to receive thorough training and information supporting effective decision making. 

CSB’s investigation of the WFC incident revealed that no standardized training requirement applies to 

volunteer firefighters across the nation.

192 

The NFPA has found that, in general, career firefighters have more funding from their local 

municipalities and thus are often better trained and better equipped compared to volunteer or hybrid fire 

departments across the country.193 In some communities, volunteer firefighters receive training in formal 

or informal settings; however, this training hinges on the state and regulatory authority, and the level and 

type of this basic and specialty training are not standardized. Some VFDs provide training programs 

equal to those of paid departments, but most volunteer firefighters either pay out of pocket or raise funds 

to pay for any additional specialty training. Such specialty training can address wildland firefighting, 

technical rescue, swift water rescue, HAZMAT response, vehicle extrication, and firefighter assist and 

search teams.

CSB found that since there is no federal agency regulating municipal fire departments, some volunteer 

firefighters in less populated areas or rural communities rarely receive any major type of course training, 

and most of their initial training is usually on-the-job experience.194 In addition, some volunteer 

 

192 Career firefighters have a standardized basic minimum training requirement.

193 In its report A Third Needs Assessment of the U.S. Fire Service, the NFPA found that compared to their big city 

counterparts, fire departments in smaller communities were more likely to report that many firefighters had not had 

formal training in various activities and did not have sufficient PPE. See: 

http://www.nfpa.org/~/media/files/research/nfpa-reports/fire-service-statistics/2011needsassessment.pdf?la=en

(accessed on December 28, 2015).

194 Many volunteer firefighters near special or large manufacturing and storage facilities do receive training from the 

facility staff. This observation is particularly true when the volunteers include employees of the facility.

001443
West Fertilizer Company Final Report January 2016

111 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

firefighters receive EMT195 and fire academy training.196 After completing the EMT and fire academy 

training, most firefighters are required to earn state certification. To maintain additional professional 

competency, some volunteer firefighters become state certified, but they must meet the same levels of 

requirements as those that apply to career firefighters. 

For example, in Texas, the general requirements for volunteer fire protection personnel certification 

programs are the same as those for paid personnel. Certification for paid fire protection personnel in 

Texas is mandatory, but for volunteer fire protection personnel, participation in a certification program is 

voluntary and not enforced.197 Texas does not require volunteer firefighters to receive a minimum level 

of training on how to respond to fires involving hazardous materials. In some cases, volunteer firefighters 

receive first-level certification, which gives an overview of fire suppression and rescue techniques, 

including HAZMAT and jaws-of-life training. 

NFPA 1001 (Standard for Fire Fighter Professional Qualifications, 2013 Edition198) provides 

recommended basic and minimum training requirements that all firefighters are expected to complete to 

respond to fire emergency calls. Once the basic training requirement has been met, the subsequent level 

of training differs between paid career and volunteer firefighters. In Texas, paid career firefighters are 

required to complete about 500 hours of training certification over four levels—introduction, basic, 

immediate, and advanced—through an academy-type program. Training and certification for volunteer 

firefighters are provided through the State Firefighters’ and Fire Marshals’ Association of Texas 

(SFFMA).199 The SFFMA sets up standards for training and certification, but local jurisdictions are left 

to decide how many firefighters should be sent for particular training and the level of certification needed 

to protect their respective localities. For example, VFDs in rural areas and sparsely populated 

communities might require their firefighters to be certified only at the introductory level because few 

 

195 Some firefighters are mandated to receive certification as an EMT. The general EMT-Basic training requires about 

100 hours of classroom or field instruction, usually involving some hours of practice in a hospital or ambulance. At 

the end of the training, EMT-Basic students must take and pass an examination. Firefighters seeking additional 

training may enroll in the EMT-Intermediate class or the Advanced EMT class, which includes an additional 1,000 

hours of education in advanced medical emergency response and care. See: http://work.chron.com/certificationsneed-become-firefighter-17338.html (accessed on December 28, 2015).

196 The fire academy training program prepares firefighters for state firefighter certification. The fire academy 

program involves the completion of classes in the fire science program. Other courses administered in the fire 

academy program for entry-level firefighters address building codes, emergency medical procedures, and prevention 

techniques. In addition, the programs train students to fight fires with standard equipment, such as fire 

extinguishers, ladders, axes, and chainsaws. See: http://work.chron.com/certifications-need-become-firefighter17338.html (accessed on December 28, 2015).

197 See: http://www.tcfp.texas.gov/certification/certification_overview.asp (accessed on December 28, 2015).

198 NFPA. NFPA 1001: Standard for Fire Fighter Professional Qualifications, 2013 Edition. Quincy, MA: NFPA, 

2013.

199 According to its website, the SFFMA was established in 1876 to support fire and emergency service providers in 

Texas and beyond. The SFFMA offers support to more than 1,200 fire departments, 22,000 individual members, 80 

industrial fire brigades, and EMS and international departments. See: 

http://www.sffma.org/web/SFFMA/About_Us/SFFMA/About.aspx?hkey=84e079d0-75c2-47df-b9e9-

7ae03d5685dd (accessed on December 28, 2015).

001444
West Fertilizer Company Final Report January 2016

112 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

buildings are in the area. In contrast, other towns or communities (such as West) that are near a chemical 

plant might require their firefighters to receive HAZMAT training and certification.

7.2.4 Firefighter FGAN Knowledge and Lack of HAZMAT Training

CSB determined that lack of knowledge and understanding of FGAN detonation hazards at the WFC 

facility contributed to the emergency responder fatalities. Interviews with surviving firefighters indicated 

that they did not have sufficient time and information to properly assess the WFC facility and evaluate the 

behavior of the FGAN-related fire. Because the firefighters did not have adequate knowledge of the 

FGAN hazard, they focused their emergency response efforts on the anhydrous ammonia tanks. The lack 

of adequate HAZMAT training and the lack of FGAN firefighting guidance contributed to the deaths of 

the emergency responders. 

A joint NFPA-USFA survey revealed that an estimated 36 percent of U.S. fire departments involved in 

HAZMAT responses have not provided formal training in those duties to all involved personnel.200 CSB 

reviewed the training and experience of the firefighters who were fatality injured in the WFC incident and 

found that all of the responding firefighters had minimum training and certifications for responding to fire 

emergencies, especially training through FEMA courses.201 In addition, very few of the volunteer 

firefighters involved in this explosion, including surviving officers, had received HAZMAT training. 

Only two of the deceased volunteer firefighters had taken the HAZMAT awareness course, which is the 

introductory basic level for HAZMAT training and includes recognition and use of the Emergency 

Response Guidebook (ERG) as well as notification protocols.202 Table 8 shows the age, rank, function at 

the scene, and training and experience levels of the victims. 

Table 8. Training and Experience Information of the Fatally Injured Firefighters203

Victim Rank Age Years of 

Experience Training Function on Scene

1 Firefighter 48 15 years 

with WVFD

Landing zone safety, propane emergency 

response, fire and emergency 

management services emergency 

response, HAZMAT awareness, ladder 

practices, hose handling, live burns, basic 

self-contained breathing apparatus 

(SCBA), Introduction to Incident 

Dispatched 

to incident 

site by 

WVFD

 

200 NFPA, USFA. “Four Years Later: A Second Needs Assessment of the U.S. Fire Service.” See:

www.usfa.fema.gov/downloads/pdf/publications/fa-303-508.pdf (accessed on December 28, 2015). 201 See: https://training.fema.gov/is/crslist.aspx?all=true (accessed on December 28, 2015). 202 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate 

Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

11. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015). 203 Ibid. 

001445
West Fertilizer Company Final Report January 2016

113 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Victim Rank Age Years of 

Experience Training Function on Scene

Command System (ICS-100),204 ICS for 

Single Resources and Initial Action 

Incidents (ICS-200),205 National Incident 

Management System (NIMS): An 

Introduction (IS-700),206 National 

Response Framework: An Introduction 

(IS-800b)207

2 Career 

Fire 

Captain

(off duty)

52 31 years 

with career 

fire 

department

31 years as a career firefighter from 

Dallas (Training status unknown)

Responded 

voluntarily 

to assist 

WVFD

3 Firefighter 26 2 years at 

mutual aid 

VFD

ICS-100, ICS-200, IS-700a, NIMS

Multiagency Coordination System 

(MACS) Course (IS-701a),208 NIMS 

Public Information Systems (IS-702a),209

NIMS Resource Management (IS703a)210

Dispatched 

for mutual 

aid

4 Firefighter 37 17 years at 

mutual aid 

VFDs211

Emergency vehicle operations, basic auto 

extrication, compressed air foam 

systems,212 basic firefighting, ICS-100, 

ICS-200, IS-700a, IS-800.b, HAZMAT I 

& II,213 Various training classes offered 

by TEEX and other departments since 

1996.

214

Responded 

in privately 

owned 

vehicle 

(POV); 

dispatched 

for mutual 

aid

5 Volunteer 

Captain

29 10 years at 

mutual aid 

VFD

Training status unknown Attending 

EMT class 

nearby. 

Dispatched 

for mutual 

aid; 

responded 

in POV

 

204 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-100.b (accessed on December 28, 2015). 205 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-200.b (accessed on December 28, 2015). 206 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-700.a (accessed on December 28, 2015). 207 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-800.b (accessed on December 28, 2015). 208 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-701.a (accessed on December 28, 2015).

209 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-702.a (accessed on December 28, 2015). 210 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-703.a (accessed on December 28, 2015). 211 Training information provided to the CSB by victim’s family. 212 Ibid. 213 Ibid. 214 Ibid.

001446
West Fertilizer Company Final Report January 2016

114 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Victim Rank Age Years of 

Experience Training Function on Scene

6 EMT, 

Firefighter

33 1 year at 

mutual aid 

VFD

Training status unknown Attending 

EMT class 

nearby. 

Rode in city 

ambulance

7 On E-1 

Firefighter

41 2 years with 

WVFD

Basic auto extrication, emergency driving, 

landing zone safety, ICS-100, IS-700a

Responded 

on Engine 1

8 Firefighter 50 13 years 

with city 

VFD

Fire and EMS emergency vehicle 

response, landing zone safety, ground 

cover (basic and intermediate), EMS 

emergency vehicle response, vehicle 

extrication, propane ER, fire and EMS 

ER, Intro to IC, HAZMAT awareness, 

fire emergency vehicle response, ladder 

practices, hose handling, live burns, basic 

SCBA, ICS-100, ICS-700a, IS-800b

Drove the 

brush truck

9 Volunteer 

Captain

50 18 years 

with WVFD

Basic firefighting, propane emergency 

response, ICS-100, IS-700a

Responded 

in POV

10 Firefighter 29 3 years with 

WVFD

Firefighting phase 1, emergency driving, 

basic auto extrication, landing zone 

safety, SCBA and smokehouse training, 

ICS-100, ICS-200b, Intermediate ICS for 

Expanding Incidents (ICS-300),215

Advanced ICS (ICS-400),216 IS-700a, IS701a, IS-702a, IS-703a, NIMS 

Communication and Information 

Management (IS-704), NIMS Intrastate 

Mutual Aid: An Introduction (IS-706),217

IS-800b

Drove in 

Engine 1

Texas provides voluntary certification for HAZMAT technicians and HAZMAT ICs through the Texas 

Commission on Fire Protection (TCFP).218 The TCFP was established under Texas Government Code, 

Chapter 419, to develop and enforce recognized professional standards for individuals and the fire 

service.219 In addition, the TCFP provides education and assistance to the fire service and enforces 

 

215 Intermediate ICS for Expanding Incidents (ICS-300) provides training and resources for personnel who require 

advanced knowledge and application of the ICS. This course expands on information covered in the ICS-100 and 

ICS-200 courses. See: http://training.fema.gov/emiweb/is/icsresource/trainingmaterials.htm (accessed on December 

28, 2015).

216 The Advanced ICS (ICS-400) course provides training and resources for personnel who require advanced 

application of ICS. This course expands on information covered in ICS-100 through ICS-300. See: 

http://training.fema.gov/emiweb/is/icsresource/trainingmaterials.htm (accessed on December 28, 2015). 217 See: https://training.fema.gov/is/courseoverview.aspx?code=IS-706 (accessed on December 28, 2015). 218 See: http://www.tcfp.texas.gov/certification/certification_requirements.asp (accessed on December 28, 2015).

219 See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm (accessed on December 28, 2015).

001447
West Fertilizer Company Final Report January 2016

115 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

statewide fire service standards. The TCFP is responsible for certification, training approval, and testing 

and compliance.220

CSB evaluated the curriculum manual used for HAZMAT certification for firefighters in Texas and found 

that FGAN explosion hazards were not covered at all. In fact, the manual mentioned FGAN twice under 

United Nations (UN)/DOT hazard classes and divisions of hazardous materials and weapons of mass 

destruction (WMD)—as a Class 1, Division 1.5 insensitive explosive221 and as a Class 5, Division 5.1 

oxidizing substance222—in the 349-page document.223 

Nationally, CSB found that the curriculum used for HAZMAT training does not fully address the hazards 

and severity of FGAN-related fires and explosions. A review of the U.S. Fire Administration (USFA)

National Fire Academy HAZMAT field course outlines confirmed that they place little emphasis on 

emergency response to storage sites containing dangerous reactive chemicals and oxidizers such as 

FGAN. Conversely, HAZMAT shipping and transportation are covered in detail in the courses. A 

review of one firefighter training reference manual, Fundamentals of Firefighter Skills, compiled by the 

International Association of Fire Chiefs (IAFC) and the NFPA, indicated that very little guidance is 

provided to firefighters regarding responses to HAZMAT incidents involving reactive chemicals. 

Chapter 29 (“Hazardous Materials: Recognizing and Identifying the Hazards”) of the second edition of 

the Fundamentals of Firefighter Skills reference manual includes in-depth information on various 

HAZMAT transportation methods and containers but does not consider storage and warehousing for these 

materials. FGAN is not mentioned in the entire chapter.224 

CSB concludes that the current training resources at the local, state, and federal levels do not provide 

sufficient information for firefighters to understand the hazards of FGAN. It is therefore essential for 

firefighter and emergency response training institutions to collaborate with fire departments to develop 

and implement a realistic process for ensuring that hazard response knowledge, once attained, does not 

become unused and obsolete.225 

 

220 TCFP. See: http://www.tcfp.texas.gov/about/mission_and_goals.asp (accessed on December 28, 2015). 221 AN is mentioned as FGAN fertilizer and fuel oil mixtures (ANFO), an example of a very insensitive explosive with 

a mass explosion hazard (blasting agent) under Division 1.5 (Explosives). Chapter 6, “Hazardous Materials 

Awareness.” United Nations/Department of Transportation (UN/DOT) Hazard Class and Division of Hazardous 

Materials and Weapons of Mass Destruction (WMD), Class 1. Section 601: 3. See: 

http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 222 AN is mentioned as an example of a Division 5.1 oxidizing substance under U.N./DOT Hazard Class 5. Chapter 6, 

“Hazardous Materials Awareness,” Section 601: 4. See: 

http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 223 TCFP. Chapter Six, “Hazardous Materials.” Certification Curriculum Manual, effective on June 1, 2010. Based

on NFPA 472 (2008 Edition). See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed 

on December 28, 2015).

224 NFPA, IAFC. Fundamentals of Fire Fighter Skills, 2nd Edition. Burlington, MA: Jones & Bartlett Publishers, 

2008.

225 Hazard response knowledge must be retained, and an effective retraining process must be put in place to prevent 

the loss of its organizational value. 

001448
West Fertilizer Company Final Report January 2016

116 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.2.5 Lack of Situational Awareness and Risk Assessment Knowledge

Although many firefighter training courses provide overviews of initial fire scene size-up, assessment, 

incident planning, and execution, CSB found that none of the firefighter HAZMAT field training courses 

provide sufficient information on firefighter situational awareness and risk assessment that could help 

them make informed decisions while at the fire scene.226,227 The firefighters who initially responded to 

WFC did not have the tools to effectively perform the situational awareness and risk assessment that 

would have enabled them to make an informed decision to not fight the fire. Situational awareness in 

firefighting involves the capability to “read” the scene of a fire or emergency, including changes in the 

behavior of a fire. Effective situational awareness supports prompt decision making to either evacuate the 

scene of a fire or continue fighting the fire by taking a defensive or offensive stance. Chapter 4 of NFPA 

472 (Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction 

Incidents, 2013 Edition) provides guidance on situational awareness competencies for responder-level 

personnel.228

In fires involving HAZMAT, it is not always possible for firefighters to obtain needed information before 

acting, but they might be able to characterize a HAZMAT incident based on initial information acquired 

from the emergency call center and dispatcher; emergency response manuals and guides; knowledge base 

on the response area; and visual, auditory, and olfactory (odorous) clues. In some cases, the fire 

department’s standard operating procedures (SOPs) and the level of training of the emergency response 

crew might be insufficient to respond at the incident scene to changing events and scenarios that were not 

planned for or anticipated—hence, the need for effective training on situational awareness and risk 

assessment.

Clearly written SOPs would afford fire department trainees the opportunity to read and understand the 

operational procedures of their fire department. The NIOSH Alert, “Preventing Injuries and Deaths of 

Fire Fighters,” emphasizes the need for departments to establish and adhere to the firefighting policies 

and procedures stipulated in the SOPs.229 NFPA 1500 (Fire Department Occupational Safety and Health 

Program, 2013 Edition230) emphasizes the need for development of a risk management plan, including 

risk identification of actual and potential hazards. In addition, it states that “fire departments shall prepare 

and maintain policies and standard operating procedures that document the organizational structure, 

membership, roles and responsibilities, expected functions, and training requirements.” NFPA 1500 also 

 

226 NFPA, IAFC. Fundamentals of Fire Fighter Skills, 2nd Edition. Burlington, MA: Jones & Bartlett Publishers, 

2008.

227 Texas Commission on Fire Protection. Chapter Six, “Hazardous Materials.” Certification Curriculum Manual, 

effective on June 1, 2010. Based on NFPA 472 (2008 Edition). See: 

http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on December 28, 2015). 228 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass 

Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013.

229 See: http://www.cdc.gov/niosh/docs/2005-132/pdfs/2005-132.pdf (accessed on December 28, 2015). 230 NFPA. NFPA 1500: Fire Department Occupational Safety and Health Program, 2013 Edition. Quincy, MA: 

NFPA, 2013.

001449
West Fertilizer Company Final Report January 2016

117 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

provides guidance on the procedures to initiate and manage operations at the scene of an emergency 

incident. Moreover, NFPA 1561 (Standard on Emergency Services Incident Management System and 

Command Safety, 2014 Edition) states that “SOPs shall include the requirements for implementation of 

the incident management system and shall describe the options available for application according to the 

needs of each particular situation.”231 

Firefighting environments are inherently unpredictable, volatile, and fraught with risk.232 It is therefore 

important for decisions to be made in a context of changing priorities, uncertain information, and limited 

resources. Firefighters must be able to rapidly size up233 any situation and create scenarios (or what-ifs) 

to make quick and informed decisions and predict the nature and behavior of a fire. NFPA 472 (Standard 

for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2013 

Edition) offers guidance on competencies for ICs. Scene size-up is essential in any emergency situation, 

especially for HAZMAT incidents.234 This approach includes a thorough overall assessment of the scene 

and the identification of all possible hazards to ensure the safety of the emergency response crew. CSB 

concluded that training references and guides on emergency response do not address how to effectively 

respond to AN-related fires. 

7.2.6 Lack of Pre-Incident Planning at Facility

The fire department did not have a formal pre-incident planning program for FGAN at WFC. Firefighters 

responding to the incident were aware of the risks associated with anhydrous ammonia leaking from the 

tanks and that it could form a toxic flammable cloud that could leave the facility, drift into nearby homes, 

and potentially explode. Although some responding firefighters knew that FGAN was onsite, they did not 

anticipate a possible FGAN explosion. Some of the West fire department officials reported that they were 

aware of the chemicals routinely stored at the WFC, but there was never any formal training to prepare 

for a fire or chemical emergency. Effective site-specific pre-incident planning for emergency responders 

is essential to guide initial and subsequent actions while responders are at an emergency. Onsite preincident planning might have identified the possible FGAN explosion hazard. CSB did not find evidence 

of regularly scheduled training exercises to ensure that the WVFD conducted incident pre-planning and 

facility tours to address fire safety and chemicals onsite. 

A pre-incident plan must provide clear information on the magnitude of hazards in a chemical plant or 

business. A competent incident commander (IC) or designated authority must be capable of executing the 

pre-incident plan, including analyzing the incident, planning the response, implementing the planned 

 

231 NFPA. NFPA 1561: Standard on Emergency Services Incident Management System and Command Safety, 2014

Edition. Quincy, MA: NFPA, 2014. 232 Flin, R. Sitting in the Hot Seat: Leaders and Teams for Critical Incident Management. Chichester: Wiley, 1996. 233 Incident size-up uses ongoing processes of information gathering and analysis that will help the firefighters make 

quick and informed decisions concerning how better to respond to the incident.

234 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass 

Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013.

001450
West Fertilizer Company Final Report January 2016

118 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

response, evaluating progress, retreating from the incident, and terminating the response. The NFPA 235

provides guidance on developing an effective incident response plan methodology for emergency 

responders.236 NFPA 472 (Standard for Competence of Responders to Hazardous Materials/Weapons of 

Mass Destruction Incidents, 2013 Edition237) provides guidance on the competencies required for 

hazardous materials responders (including the IC) involved in pre-incident planning and execution of the 

plan.

The pre-incident plan also must be effectively communicated to other external emergency units in the 

surrounding areas for times when these agencies are called on for mutual aid. In addition, a pre-incident 

plan must be systemic and must include a realistic exit and evacuation strategy, especially when a 

decision is made to not take offensive action at a hazardous materials incident. 

Pre-incident planning must include all of the HAZMAT onsite. Plans must be put in place to address how 

to effectively respond to an emergency. NFPA 1620 (Standard for Pre-Incident Planning, 2015 Edition) 

states that the pre-incident plan “shall identify and document any special hazards recognized by the 

authority having jurisdiction that present extraordinary life safety challenges, operations challenges, or 

other challenges to emergency responders.”238 NFPA 1620 further states that the “pre-incident plan 

should be the foundation for decision making during an emergency situation and provides important data 

that will assist the IC in developing appropriate strategies and tactics for managing the incident.” This 

standard also states that the “primary purpose of a pre-incident plan is to help responding personnel 

effectively manage emergencies with available resources.” Pre-incident planning involves evaluating the 

protection systems, building construction, building contents, and operating procedures that can affect 

emergency operations. 

NFPA 1620 outlines the steps involved in developing, maintaining, and using a pre-incident plan by 

isolating the incident into pre-incident, incident, and post-incident phases. In the pre-incident phase, for 

example, the guidance covers factors such as physical elements and site or occupant considerations, 

protection systems, water supplies, hydrant locations, and special hazard considerations. Building 

characteristics—including type of construction, materials used, occupancy, fuel load, roof and floor 

design, and unusual or distinguishing characteristics—should be recorded, shared with other departments 

that provide mutual aid, and entered into the dispatcher’s computer if possible so that the information is 

readily available if an incident is reported at the noted address. 

 

235 The NFPA, a nonprofit standards organization, has been developing standards since 1896 that directly affect fire 

services at the department level. The NFPA produces more than 300 consensus codes and standards intended to 

minimize the possibility and effects of fire and other risks. The codes are voluntary standards that industry can 

adopt and that regulatory agencies can enforce once the codes are signed into law. Standards are an attempt by an 

industry or profession to self-regulate by establishing minimal operating, performance, or safety criteria. See:

http://www.nfpa.org/about-nfpa (accessed on December 28, 2015). 236 CSB referred to the most current edition of the NFPA codes and standards throughout this report. 237 NFPA. NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass 

Destruction Incidents, 2013 Edition. Quincy, MA: NFPA, 2013. 238 NFPA. NFPA 1620: Standard for Pre-Incident Planning, 2015 Edition. Quincy, MA: NFPA, 2015.

001451
West Fertilizer Company Final Report January 2016

119 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An adequate pre-incident plan must include, at a minimum, specific tested and practiced procedures for 

responding to an emergency at a given facility; a list of potential HAZMAT such as FGAN, including the 

quantity of each chemical that may be onsite; details on HAZMAT handling and storage; chemical 

locations at a particular site; the likely behavior of chemicals in a fire, flood, or other emergency; worst 

case scenario regarding how these chemicals might behave or interact in an emergency; the Safety Data 

Sheet (SDS)239 for each of the HAZMAT; and specific recommendations on how to respond to a fire 

when these chemicals are involved.

Before the incident, the WVFD did not conduct a pre-inspection for an FGAN-related fire emergency. In 

most cases, a site-specific pre-incident plan would be developed in partnership with each chemical plant 

or chemical business in the response jurisdiction. Although WFC reported the quantity and location of 

each of its hazardous chemicals, including FGAN, to the WVFD, no mechanism ensured that pre-incident 

drills or inspections were conducted. Although the firefighters in West conducted some onsite anhydrous 

ammonia drills, none of the drills or training focused on the potential of an FGAN-related fire emergency.

A fire pre-plan would enable firefighters to determine various situations where conditions could 

dramatically change in a burning structure. This information would enable them to consider the hazards 

associated with each site. Also, the pre-incident plan could provide this advanced information, which 

might have aided the WVFD in developing a response strategy or might have facilitated a decision to 

stand down and allow the structure to burn to the ground if no lives were endangered by doing so. 

Whether a volunteer fire department (VFD) has pre-incident plans in place often depends on the 

individual fire department. Currently, no federal agency regulates municipal fire departments in the 

United States. Although the U.S. Congress funded the National Institute for Occupational Safety and 

Health (NIOSH) in 1998 to establish the Fire Fighter Fatality Investigation and Prevention Program, 

NIOSH only investigates on-the-job firefighter fatalities and makes recommendations for improvements 

to the profession. NIOSH lacks authority to enforce regulations or mandate firefighter training 

requirements.240 

7.3 Limited and Conflicting Technical Guidance on FGAN

Firefighters might not have at their fingertips all of the hazard information regarding the chemicals that 

can be found in their communities. Regardless of the instant availability of information on the hazards of 

a specific chemical, firefighters are required to respond immediately upon dispatch and are expected to 

 

239 An SDS is a document developed by the manufacturer of a hazardous chemical product that communicates the 

hazards of the product. It is required under OSHA’s Hazard Communication Standard. Under this standard, all 

chemical manufacturers, distributors, or importers must provide to downstream users an SDS for each hazardous 

chemical. Previously, SDSs were known as Material Safety Data Sheets (MSDS); however, in 2012, the name 

underwent a change when OSHA decided to modify the Hazard Communication Standard to adopt the U.N. 

Globally Harmonized System.

240 NIOSH Fire Fighter Fatality Investigation and Prevention Program. See: http://www.cdc.gov/niosh/fire/ (accessed 

on December 28, 2015).

001452
West Fertilizer Company Final Report January 2016

120 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

make prompt decisions. To make effective decisions in fire emergencies, some fire prevention and 

emergency response stakeholders have developed technical manuals and guidebooks. These guidebooks 

help emergency responders and firefighters to better understand chemical hazards. References include the 

Emergency Response Guidebook (ERG), SDSs, and NFPA standards.241 Although firefighting manuals 

support the prevention of injuries and fatalities, CSB found conflicting information and inconsistencies in 

various emergency response guidelines. 

7.3.1 Emergency Response Guidebook

The ERG is a readily available and widely used guidebook among the emergency response community. 

Formerly known as the DOT ERG, this document is now jointly produced by DOT, Transport Canada, 

and the Secretariat of Communications and Transportation (Mexico). The current ERG is designed as a 

resource for first responders to consult during the initial phase of a dangerous goods or HAZMAT 

transportation incident. Emergency response personnel (such as firefighters, EMTs, and police officers) 

in the United States, Canada, Mexico, and other countries use the ERG when responding to transportation 

emergencies involving HAZMAT. In most cases, firefighters who complete HAZMAT courses, the most 

basic of which is Awareness Level training, are expected to be familiar with the ERG. Figure 63 shows 

the 2012 edition of the ERG. 

 

241 Annex E of NFPA 400 (2013 Edition) also provides AN firefighting guidance. NFPA. NFPA 400: Hazardous 

Materials Code, 2013 Edition. Quincy, MA: NFPA, 2013.

001453
West Fertilizer Company Final Report January 2016

121 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 63. Cover Page of 2012 Edition of ERG (Source: DOT PHMSA)242

Most firefighting apparatuses have a copy of the ERG.243 After the WFC incident, NIOSH investigators 

found copies of the 2012 ERG in the glove boxes of some of the damaged fire equipment and 

apparatuses.244 However, CSB does not have any evidence that indicates whether the West firefighters 

consulted the ERG on the night of the explosion. The ERG is especially useful in situations when the 

relevant SDS is not readily available to firefighters.

The ERG gives direction (based on DOT Hazard Classification Criteria) on response to HAZMAT and 

dangerous goods emergencies during transportation. It does not provide any specific guidance on the 

 

242 DOT Pipeline and Hazardous Materials Safety Administration (PHMSA). See:

http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_7410989F4294AE44A2EBF6A80ADB640BCA8E4200/filename/ER

G2012.pdf (accessed on December 28, 2015). 243 DOT. The Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a 

Dangerous Goods/Hazardous Materials Transportation Incident (ERG), 2012 Edition. See: 

http://phmsa.dot.gov/staticfiles//PHMSA/DownloadableFiles/Files/Hazmat/ERG2012.pdf (accessed on December 

28, 2015).

244 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate 

Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

11. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

001454
West Fertilizer Company Final Report January 2016

122 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

handling of ammonium fertilizer.245 In fact, the ERG includes the following commentary under the 

heading of its 2012 Edition: 

This guidebook will assist responders in making initial decisions upon arriving at the 

scene of a dangerous goods incident. It should not be considered as a substitute for 

emergency response training, knowledge or sound judgment. ERG2012 does not address 

all possible circumstances that may be associated with a dangerous goods incident. It is 

primarily designed for use at a dangerous goods incident occurring on a highway or 

railroad. Be mindful that there may be limited value in its application at fixed facility 

locations.246 

The current edition of the ERG lists 15 variations of FGAN. Next to each FGAN variant is a guide 

number that leads to information on the potential hazard and the appropriate emergency response, but the 

suggested measures are broad and subject to varying interpretations. 

On October 1, 2014, CSB provided comments on a DOT request for information (RFI), “Hazardous 

Materials: Revision of Emergency Response Guidebook” (FR Doc. 2014-20683), which was published on 

August 29, 2014.247 CSB commented as follows: 

The ERG is intended for incidents involving the transport of hazardous materials and is 

limited to the size of the transportation containers involved.248 However, the CSB has 

found in several investigations249 that the ERG manual was used by emergency 

responders for incidents involving chemical fires, explosions and releases of hazardous 

materials at fixed facilities. Incidents at fixed facilities may involve larger quantities of 

hazardous materials as well as additional hazards involving process conditions or other 

hazardous chemicals stored nearby, resulting in higher risk to emergency responders. 

The directions regarding response to a chemical release or fire incident intended for 

transportation may be different when applied to an incident at a fixed chemical or 

manufacturing facility. For this reason, the CSB suggests that the DOT consider 

additional language to clarify ERG’s use limitations at fixed facilities.

CSB also urged DOT to highlight in bold text on the front cover page of the next edition of the ERG: 

“Only Intended for Use When Responding to Transportation Incidents.” Realizing that emergency 

 

245 The ERG provides some information and guidance on handling Division 5.1 oxidizers. 246 DOT. The Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a 

Dangerous Goods/Hazardous Materials Transportation Incident (ERG), 2012 Edition: 356. See: 

http://phmsa.dot.gov/staticfiles//PHMSA/DownloadableFiles/Files/Hazmat/ERG2012.pdf (accessed on December 

28, 2015).

247 See: http://www.csb.gov/csb-recommends-safety-improvements-to-us-department-of-transportation-emergencyresponse-guidebook-widely-used-by-firefighters/ (accessed on December 28, 2015). 248 See: http://www.csb.gov/assets/1/7/DOT_ERG__RFI10_1_14.pdf (accessed on December 28, 2015).

249 Technics, Inc., 2003. See: http://www.csb.gov/technic-inc-ventilation-system-explosion/ (accessed on December 

28, 2015); 

DuPont Belle, 2010. See: http://www.csb.gov/dupont-corporation-toxic-chemical-releases/ (accessed on December 

28, 2015); 

Millard Refrigerated Services, 2010. See: http://www.csb.gov/millard-refrigerated-services-ammonia-release/

(accessed on December 28, 2015); 

AL Solutions, 2010. See: http://www.csb.gov/al-solutions-fatal-dust-explosion/ (accessed on December 28, 2015).

001455
West Fertilizer Company Final Report January 2016

123 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

responders will continue to reference the ERG for incidents involving HAZMAT releases at fixed 

facilities, CSB suggested that DOT consider adding guidance such as the information that first responders 

should obtain and reference when responding to an incident at a fixed facility, such as the company SDSs 

and submitted Tier II information.250 CSB advised that such guidance also should be in the front section 

of the ERG (for example, on pages 1 and 2). In addition, CSB suggested that DOT move the user’s guide 

from page 356 to page 1 or 2 of the next ERG edition to provide users with earlier guidance. 

CSB also urged DOT to take the following actions: 

• Review and revise the ERG to remove generic and vague information in the emergency response 

section of Guide 140 and other ERG sections. 

• Include a statement that urges emergency responders to reference other sources in addition to the 

ERG to obtain more detailed instructions when responding to emergency incidents at fixed 

facilities. First responders should obtain and refer to the company SDSs or submitted Tier II 

information when responding to an incident at a fixed facility. This information should also be in 

the introduction of the ERG (for example, on pages 1 and 2).

• Revise the ERG to address the unpredictable behavior of fires involving FGAN and the potential 

for detonation within a very short time frame. DOT should consider recommending a more 

conservative response to fires involving FGAN by emphasizing firefighter and resident 

evacuation when the threat is to human lives rather than property. 

• Revise Guide 140 to include a separate discussion of the properties and behaviors unique to 

FGAN (such as the potential for detonation within a very short time frame) that might differ from 

those of other oxidizers covered by Guide 140.

On its website, DOT provided a preview of updates for the 2016 Edition of the ERG.251 The link to the 

ERG updates provided by DOT showed that the review working group on the ERG had made the 

following changes:

• Replaced written instructions on page 1 with a flow chart to show how to use the new ERG 

(2016). 

• Expanded the Table of Placards and updated the title to Table of Markings, Labels, and Placards 

and Initial Response Guide to Use on Scene. 

• Expanded the Railcar Identification Chart and the Road Trailer Identification Chart to two pages 

each. 

• Updated Table 1 and Table 3 based on new toxic inhalation hazard (TIH)252 data and reactivity 

research.

 

250 Additional information on Tier II information is noted in Section 8.5 of this report. 251 DOT. “Preview of Updates for the ERG 2016.” See:

http://www.phmsa.dot.gov/pv_obj_cache/pv_obj_id_CDF7F93A3E0C2F808D9EA09C262749DAEF400200/filena

me/ERG2016_Preview.pdf (accessed on December 28, 2015). 252 TIH is the abbreviation for toxic inhalation hazard. Under the Hazardous Materials Regulations (HMR), 49 CFR 

Parts 171–180, TIH materials are gases or liquids that are known (or presumed on the basis of tests) to be so toxic to 

humans as to pose a hazard to health in the event of a release during transportation. See: 

001456
West Fertilizer Company Final Report January 2016

124 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Updated pipeline emergency response information. 

• Added information about Globally Harmonized System of Classification and Labeling of 

Chemicals (GHS) markings. 

• Added all new dangerous goods and HAZMAT listed in the U.N. Recommendations on the 

Transport of Dangerous Goods, 19th Revised Edition. 

• Added information on emergency response assistance plans applicable in Canada.

Also, DOT provided a snapshot of the cover page of the 2016 edition of the ERG (Figure 64) on its 

website. 

Figure 64. Cover Page of 2016 Edition of ERG (Source: DOT PHMSA)253

CSB noticed (from the preview of the 2016 edition of the ERG), that DOT and other authors of the ERG 

moved the warning statement, “A Guidebook for First Responders During the Initial Phase of a 

Dangerous Goods/Hazardous Materials Transportation Incident” from the left side of the cover page of 

the 2012 edition to the top of the cover page, as recommended by CSB. However, DOT and other authors 

 

https://www.federalregister.gov/articles/2004/08/16/04-18705/hazardous-materials-enhancing-rail-transportationsecurity-for-toxic-inhalation-hazard-materials (accessed on January 20, 2016). 253 See: http://www.phmsa.dot.gov/staticfiles/PHMSA/ImageCollections/Images/ERG2016_Cover.png (accessed on 

December 28, 2015).

001457
West Fertilizer Company Final Report January 2016

125 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

of the ERG did not include the statement “Only Intended for Use When Responding to Transportation 

Incidents” in bold on the front cover page of the 2016 edition of the ERG, as suggested by CSB in its 

response to the DOT RFI for the ERG revision.254 Instead, DOT and other ERG authors modified the 

statement “A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous 

Materials Transportation Incident” to “A guidebook intended for use by first responders during the initial 

phase of a transportation incident involving dangerous goods/hazardous materials.”255 Note that 

“transportation incident involving dangerous goods/hazardous materials” is in bold on the cover page of 

the 2016 edition of the ERG.

7.3.2 Safety Data Sheets 

CSB did not find any record that the WVFD consulted the SDS for FGAN and other chemicals present at 

the WFC facility during the incident. After the incident, CSB reviewed the SDS (that was current at the 

time of the WFC incident) provided by CF Industries and EDC, the manufacturers of the FGAN used at 

the WFC. The CF Industries SDS for FGAN (SDS Number 004) provided guidance on FGAN hazards in 

the December 11, 2012, revision of the SDS.256 Under the Hazards Identification, Emergency Overview 

heading (item three, page 1), CF Industries described FGAN:

Strong oxidizer. Contact with combustible material will increase fire hazard. May undergo 

detonation if heated under confinement causing pressure buildup or if subjected to strong shocks. 

Solid AN when sensitized or during decomposition may become unstable and/or explosive. 

When AN is heated to decomposition it may produce vapor which contains nitrogen oxides 

(NOX). AN is an oxidizer and as such may increase the flammability and/or explosiveness of 

other substances. Use water to control fires involving AN, if water is compatible with burning 

material. AN itself is non-flammable. AN can cause irritation to eyes and skin and may be an 

inhalation discomfort in confined locations.257 

Under the Firefighting Measures heading (item five, page 3), CF Industries noted:

Flood burning ammonium nitrate fertilizer with large volumes of low pressure water. Do not use 

salt water, carbon dioxide, dry chemicals or foam extinguishers. Never attempt to smother fire, 

such as by sealing off, closing a compartment or building doors when fire occurs. Do not add 

steam. Ammonium nitrate fertilizer does not have the property of spontaneous combustion. Fire 

fighters should wear approved self-contained breathing apparatus to protect themselves from the 

 

254 See: http://www.csb.gov/csb-recommends-safety-improvements-to-us-department-of-transportation-emergencyresponse-guidebook-widely-used-by-firefighters/ (accessed on December 28, 2015). 255 See: http://www.phmsa.dot.gov/staticfiles/PHMSA/ImageCollections/Images/ERG2016_Cover.png (accessed on 

December 28, 2015).

256 CF Industries has since removed its December 11, 2012, SDS for FGAN from its website. CF industries replaced 

the December 11, 2012, SDS for FGAN with a revised and updated SDS for FGAN (April 23, 2013). See: 

http://www.cfindustries.com/pdf/Ammonium-Nitrate-Amtrate-MSDS.pdf (accessed on January 20, 2016). On May 

15, 2015, CF Industries published its current SDS for Amtrate FGAN fertilizer, which supersedes every other SDS. 

See: http://www.cfindustries.com/pdf/Amtrate_AN_Fertilizer_SDS_NA_FINAL.pdf (accessed on December 28, 

2015).

257 CF Industries LLC. “Safety Data Sheet, FGAN.” SDS Number 004, revised December 11, 2012.

001458
West Fertilizer Company Final Report January 2016

126 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

toxic fumes of decomposing ammonium nitrate, and protective clothing to guard against molten 

nitrate splashes should also be worn.258

This SDS for FGAN referred to NFPA 400 (Hazardous Materials Code, 2013 Edition) under its section 

on handling and storage but not in its section on firefighting measures. Although Chapter 11 of NFPA 

400 provided some recommendations for safe storage, handling, and use of AN, it did not include any 

specific guidelines on FGAN firefighting measures. Annex E of NFPA 400 outlined some general 

procedures and suggestions on firefighting for FGAN incidents. Section E.2.1 of Annex E of the 2013 

edition of NFPA 400 states: 

[S]hould a fire break out in an area where FGAN is stored, it is important that the mass be kept 

cool and the burning be promptly extinguished. Apply large volumes of water as quickly as 

possible. If fires reach massive and uncontrollable proportions, fire-fighting personnel should 

evacuate the area and withdraw to a safe location.259 

Also, Section E.2.2 of NFPA 400 suggested the provision of as much ventilation as possible to the fire 

area.260 Although the FGAN SDS provided by CF Industries contained some useful insights and 

guidance on how to respond to FGAN-related fires, it did not clearly define “a distance” from which a fire 

could be “flooded” (one of the special firefighting procedures) and did not specify what “volumes of low 

pressure water” would be needed. 

CSB compared the firefighting measures in the CF Industries and EDC SDS with those in the SDS 

provided by a similar large technical grade AN (TGAN) manufacturer (Orica)261 and with those in the 

current edition of the DOT ERG (Table 9).

Table 9. Comparison of Various AN-Related Firefighting Measures in April 2013

EDC SDS

(FGAN)

CF Industries SDS

(FGAN)

Orica AN SDS 

(TGAN)

DOT ERG 

(2012 Edition)

If confined when an 

ignition occurs, an 

explosion may occur.

FGAN may undergo 

detonation if heated 

under confinement. 

FGAN may explode 

under confinement and 

high temperature. 

FGAN may explode from 

heat or contamination. 

Flood with water. Flood fire area from a 

distance. 

Fires should be fought 

from a protected location. 

Flood large fire with 

water from a distance. 

 

258 Ibid. 259 NFPA. NFPA 400: Hazardous Materials Code, 2013 Edition. Quincy, MA: NFPA, 2013. 260 Ibid. 261 According to its website, Orica is the largest provider of commercial explosives and blasting systems to the mining 

and infrastructure markets, a global leader in the provision of ground support in mining and tunneling, and a leading 

supplier of sodium cyanide for gold extraction. See: http://www.orica.com/About-Us#.VlXviHarSUk (accessed on 

December 28, 2015).

001459
West Fertilizer Company Final Report January 2016

127 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Firefighters should wear 

proper protective 

equipment and selfcontained breathing 

apparatus.

For massive fires, use 

unmanned fire nozzles; if 

this is impossible, 

withdraw from area, and 

let burn. 

A major fire may involve 

a risk of explosion. 

For massive fire, use 

unmanned hose holders 

or monitor nozzles; if this 

is impossible, withdraw 

from area and let fire 

burn.

These examples of guidance for fighting fires involving FGAN illustrate hazards that were broadly 

defined and were not clearly communicated to emergency responders. The use of vague and broad 

terminologies in some of the guidelines compared in Table 9 indicates that the behavior of FGAN under 

heat and confinement is not clearly understood because no standardized methods are used to communicate 

the hazards of FGAN and possible firefighting procedures to emergency responders. Also, terms such as 

“massive,” “major,” “large,” “protected location,” and “distance” were not clearly defined in the 

guidelines. The CF Industries SDS and the ERG suggested “flooding” a fire involving FGAN from a 

distance, and the Orica SDS suggested fighting such fires from a “protected location.” The EDC SDS 

instructed firefighting personnel to flood with water but did not address the need to extinguish fires from 

a distance or to evacuate under massive fire situations. In these guidelines, the safe distance or protected 

location is not clearly defined. Hence, a firefighter must make a judgment to determine which location or 

area is protected, which distance is safe enough to fight a fire involving FGAN, how much water is 

needed for flooding, and which fire is massive or major. Unfortunately, firefighters are often forced to 

make these decisions without adequate training, information, preparation, and pre-planning. The WFC 

incident highlighted the need for greater awareness of FGAN hazards. In response to the 2013 explosion, 

EDC updated its SDS to include more information about the explosive hazards of AN and information for 

firefighters. The revised EDC SDS now advises firefighters to fight AN fires remotely because of the risk 

of explosion. If an AN-containing structure is fully engulfed in flames, firefighters are instructed not to 

fight the fire and to evacuate the surrounding area to at least a one-half-mile radius.262 

7.4 Lessons Not Learned and Lessons Learned 

7.4.1 Pre-West-Incident FGAN-Related Fires and Explosions: Lessons Not 

Learned

CSB found that lessons learned from previous firefighter fatalities and emergency responses to FGANrelated incidents were not effectively disseminated to firefighters and emergency responders in other 

communities where FGAN is stored or used. Had those lessons been applied to the very similar situation 

 

262 See: 

www.eldoradochemical.com/MSDS_Sheets/EDC/EDC_Products/EDCC_AN_Prill_SDS_Information_Bulletin_No

v_2014.pdf (accessed on December 28, 2015).

001460
West Fertilizer Company Final Report January 2016

128 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in West, the firefighters and emergency responders might have better understood the risks associated with 

FGAN-related fires. 

Although the firefighters in West knew of the hazards associated with the tanks of anhydrous ammonia as 

a result of previous releases, they were not alert to the explosion hazard from the FGAN inside the 

warehouse. Although FGAN itself does not burn, the conditions under which AN might detonate when 

exposed to fire are unpredictable and not clearly understood, and current guidance does not offer 

consistent advice on how to attempt to guarantee firefighter safety. The deaths of the volunteer 

firefighters and emergency responders in West was not the first time that firefighters have been killed 

when responding to FGAN-related explosion incidents. 

On April 16, 1947, a ship containing 7,000 tons of wax-coated FGAN263 exploded in the port of Texas 

City, Texas, killing 581 people, including all 26 Texas City firefighters who responded to the incident.264 

The November 29, 1988, Kansas City, Missouri, ammonium nitrate/fuel oil (ANFO) incident, although 

not directly related to an FGAN fire, is worth mentioning because of its severity, the important lessons 

learned from the incident, and its implication for emergency response. Six firefighters from the Kansas 

City, Missouri, fire department were killed in an explosion while they were extinguishing a fire at a 

construction site.265 About 40 minutes later, a second explosion occurred, followed by several minor 

explosions. Investigators later learned that after the first explosion, the battalion chief immediately pulled 

back and prevented other firefighters from entering the area. A command post was set up at a safe 

distance, which ultimately prevented more firefighter casualties. The initial fire involved a 

trailer/magazine containing blasting mixtures of FGAN, fuel oil, and aluminum pellets. One end of the 

trailer contained approximately 3,500 pounds of ANFO mixture while the remainder of the load was 

approximately 17,000 pounds of ANFO mixed with 5 percent aluminum pellets. In addition, a second 

explosion rocked another trailer/magazine loaded with approximately 1,000 30-pound sacks of ANFO 

mixture with 5 percent aluminum pellets.266 

Both explosions in Kansas City created large craters where the two trailers had been parked, similar to the 

impact of the explosion in West. The first trailer explosion produced a swimming-pool-like crater that 

 

263 Although the Texas City incident involved a form of wax-coated FGAN that is no longer manufactured for 

fertilizer purposes and a form of strong confinement (the locked hull of a ship), the lessons of confinement were 

developed and incorporated into industry guidance after the Texas City incident.

264 See: https://www.txdps.state.tx.us/dem/temo/archives/2013/Vol60No4/Articles/article2.htm (accessed on 

December 28, 2015).

265 The Texas City incident is discussed in this section to indicate that firefighters have lost their lives in the past 

because of a lack of pre-incident planning, inadequate training and information, and erroneous knowledge of the 

hazards with which they were dealing. The same observation applied to Kansas City, even though it was an ANFO 

incident; firefighters were not equipped with the right information and had inadequate knowledge of the hazards of 

the explosive material (ANFO) that they dealt with that evening, and they lost their lives as a result.

266 USFA. “Six Firefighter Fatalities in Construction Site Explosion; Kansas City, Missouri.” Technical Report

Series,” USFA-TR-024, November 1988. See: http://www.usfa.fema.gov/downloads/pdf/publications/tr024.pdf

(accessed on January 20, 2016).

001461
West Fertilizer Company Final Report January 2016

129 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

was 80 feet in diameter with a depth of 8 feet, connected to a smaller crater that was 20 feet in diameter 

and 6 feet deep. The second trailer explosion gouged a crater approximately 100 feet in diameter and 8 

feet deep, similar in dimensions to the crater resulting from the explosion in West, Texas. The Kansas 

City incident investigation determined that the firefighters were not told specifically about the contents of 

the trailer/magazine, although the dispatcher did caution them about explosives on the site. The 

firefighters did not report any indication of the presence of warning placards on the trailers because there 

was no requirement by firefighters to report the presence or absence of warning placards over the radio 

upon their arrival at a scene of a fire. Also, it was not clear whether the firefighters realized that the 

trailers housed an explosive magazine.267 

No record of communication among the dispatch official, fire chief, and firefighters indicated that the 

firefighters knew the contents of the magazine, and the firefighters did not seem alarmed when they 

arrived at the site. In addition, the fire department was not aware of the presence of the trailers/magazines 

or their contents before the incident because of a lack of jurisdictional authority. The Kansas City Fire 

Prevention and Protection Code did not require the city engineer to notify the fire department that blasting 

permits had been issued, although this provision was changed immediately after the incident. The Kansas 

City Fire Department had no authority or responsibility to inspect the construction site because it was a 

state enclave.268 

Shortly after the Kansas City explosions, the USFA produced a technical report (USFA-TR024/November 1988)269 with findings of its investigation and lessons learned. Although the fertilizerrelated incidents in Texas City and West did not involve explosives per se, the Kansas City incident 

further illustrated that the lack of knowledge about the stored HAZMAT and the lack of pre-incident 

planning by firefighters before their response led to the fatalities. Most of the recommendations based on 

lessons learned emphasized the need to be properly prepared through pre-incident planning and through 

the provision of clear information to firefighters and emergency responders dealing with fires involving 

HAZMAT.

CSB observed that within the last 6 years, three notable FGAN-related incidents in Texas involved 

emergency responders. Subsequently, CSB reviewed the emergency response activities associated with 

the FGAN-related fires that occurred in 2009 at the EDC facility in Bryan, Texas, and in 2014 at the East 

Texas Ag Supply facility in Athens, Texas.

On Thursday, July 30, 2009, at about 11:40 am CDT, a fire broke out at the EDC facility in Bryan. The 

EDC facility stores FGAN and blends it with other materials to create fertilizer. The fire at the EDC 

fertilizer plant led to the evacuation of more than 80,000 residents in the Bryan and College Station area. 

 

267 An explosive magazine is an enclosed storage structure for holding explosives. 268 A state enclave is any portion of a state that is completely surrounded by the territory of another state.

269 USFA. “Six Firefighter Fatalities in Construction Site Explosion; Kansas City, Missouri.” Technical Report 

Series,” USFA-TR-024, November 1988. See: http://www.usfa.fema.gov/downloads/pdf/publications/tr024.pdf

(accessed on January 20, 2016).

001462
West Fertilizer Company Final Report January 2016

130 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Although the storage structure burned to the ground, unlike the incident at the WFC facility, no explosion, 

loss of life, or major injuries were recorded. 

At Bryan, the firefighters were informed that a welder had accidentally heated an FGAN bin and that the 

chemical was smoldering. The firefighters decided not to fight the fire, evacuated the area, and let the 

facility burn to the ground, without any explosion. Their knowledge of FGAN and the risks associated 

with a probable explosion most likely led the Bryan firefighters to decide to evacuate. Figure 65 shows 

the post-incident aerial view of the EDC facility wooden fertilizer warehouse.

Figure 65. Post-Incident Aerial View of EDC Facility Wooden Fertilizer Warehouse (Source: Bryan-College 

Station Eagle)

After the incident, the Bryan Fire Department—in conjunction with the emergency management divisions 

for Brazos County, the city of Bryan, the city of College Station, and Texas A&M University—performed 

an emergency review and analysis and released an after-action report and improvement plan. These 

documents were shared with fire departments and emergency response agencies that were involved in the 

incident response and investigation, including local and regional emergency response agencies—mostly 

001463
West Fertilizer Company Final Report January 2016

131 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

in the Brazos Valley area, where Brazos County, the cities of Bryan and College State, and Texas A&M 

University are located—and other state agencies that responded to the incident.270 

The 2009 EDC fire after-action report for Brazos Valley highlighted the need for emergency response 

departments to reflect on protection, response, and recovery activities that occurred during the EDC 

incident, despite the fact that the community-wide response to the incident resulted in no loss of life or 

serious injuries. In addition, the after-action report identified potential strengths to be maintained and 

built on, noted potential areas for further improvement, and suggested recommendations for corrective 

and preventive actions based on the incident. The after-action report indicated:

The Texas Division of Emergency Management provides the National Emergency Response and 

Rescue Training Center (NERRTC) funding to develop regional plans that will enable local 

emergency management to rapidly respond to disasters using the region’s resources before 

requesting assistance from State and Federal partners. Within that scope, NERRTC also develops 

after-action reports on behalf of local, regional and state governments that have been affected by 

major disasters. As in the case of the EDC fire, lessons learned help recognize needs for plans, 

policies and procedures revisions to enhance the effectiveness of response (personnel, teams 

and/or equipment).271

Unfortunately, CSB did not find any record that the WVFD requested or received a copy of the Brazos 

Valley after-action report and improvement plan. In addition, no record suggested that lessons learned 

from the EDC incident were discussed or shared with firefighters at West.272 Although circumstances in 

West might have differed from those in Bryan, if lessons learned had been effectively relayed among the 

firefighters at West, the volunteer firefighters who responded to the WFC incident possibly could have 

drawn on the experience of Bryan firefighters to inform response strategies, both in the pre-planning 

stages and in the response to the incident on the night of April 17, 2013.

7.4.2 Post-West Incident FGAN-Related Fire: Lessons Learned

On May 29, 2014, at around 5:45 pm, a fire involving FGAN occurred at the East Texas Ag Supply 

facility in downtown Athens, Texas. Emergency dispatchers and the Athens Police Department promptly 

notified firefighters from the Athens Fire Department (AFD).273 Emergency response units from the AFD 

arrived on the scene of the fire at 5:50 pm and found fire and smoke coming from the northwest end of 

the 3,500-square-foot East Texas Ag Supply facility. This facility was built with masonry bricks and 

combustible wooden structures, similar to construction at the WFC facility.274 The AFD chief arrived 

 

270 EDC. “2009 El Dorado Chemical Fire After-Action Report for Brazos Valley,” August 11, 2009. 271 Ibid. 272 CSB found that several surviving West firefighters interviewed after the WFC incident did not have adequate 

information about the EDC incident at Bryan (approximately 100 miles south of West, Texas).

273 The AFD was organized as a volunteer department in 1911. Currently, the AFD is a fully paid fire department 

with two stations and 27 firefighters. See: http://athenstexas.us/fire.cfm (accessed on December 28, 2015). 274 Shortly after the April 17, 2013, incident at the WFC facility in West, Texas, an investigative reporter from the 

Dallas news station (WFAA) entered the Athens facility with a camera crew and revealed that East Texas Ag Supply 

001464
West Fertilizer Company Final Report January 2016

132 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

about 2 minutes after the first responding units were dispatched to the site of the incident, and he found 

that the fire had self-ventilated at the northwest end. On the basis of his observation of the enormous 

scope of the fire and the possibility of detonation of FGAN in the engulfed building, the fire chief 

promptly decided to let the East Texas Ag Supply facility burn to the ground instead of attempting to 

fight the fire.275 He ordered his firefighters to retreat from the scene and began an extensive evacuation of 

the downtown Athens, Texas, area. The Athens Police Department coordinated the evacuation of the 

nearby residential areas, setting up an initial three-block evacuation perimeter, which was later expanded 

to five blocks.276 Fortunately, no injuries were associated with this incident. On June 2, 2014, the State 

Fire Marshal’s Office (SFMO) completed its investigation of the East Texas Ag Supply facility incident

and released its findings, ruling and classifying the source of the fire as undetermined.277 

The East Texas Ag Supply facility was a privately owned business with annual revenues estimated 

between $10 million to $20 million and a work force of approximately nine employees. The East Texas 

Ag Supply facility was an FGAN and potash fertilizer storage facility, and it was registered under 

Standard Industrial Classification Code 5191 (Farm Supplies) and North American Industry Classification 

System (NAICS) Code 424910 (Farm Supplies Merchant Wholesalers).278 On the day of this incident, 

the East Texas Ag Supply facility received approximately 70 tons of FGAN (total) and 100,000 pounds of 

potash, which were stored inside the building when the fire occurred. 

CSB gathered information concerning the East Texas Ag Supply incident from the emergency responders 

and the facility and also conducted an interview with the AFD fire chief. According to the incident 

statement provided to CSB, the Athens, Texas, fire chief stated: 

We allowed the fire to mitigate itself, with research showing that some such facilities had 

burned out with no explosions. We had learned a lot from West and had already removed 

other products that could cause contamination and had made the owner remove his diesel 

tractor from within the building and to keep it off site when not in use. We feel this was 

a major deterrent from having a detonation.279

Figure 66 and Figure 67 show photographs of the East Texas Ag Supply facility during the fire incident.

 

was receiving and storing the same substance thought to have been involved in the explosion in West. See: 

http://www.wfaa.com/story/news/local/investigates/2014/08/18/14029198/ (accessed on December 28, 2015). 275 According to the Athens, Texas, fire chief, the initial plan of action was to engage the fire at the incipient stage, but 

by the time he arrived on scene, the chief knew that the fire was well past the incipient stage and that the quantity of 

water needed to squelch the fire at that stage was beyond the capabilities of the equipment on hand. He gave the 

order for his men to cease firefighting based on his early observations and to begin evacuation activities. 276 The City of Athens police chief was in charge of the evacuation and the control of traffic. The police chief set the 

initial evacuation perimeter at three blocks from the facility based on the immediate resources available to the police 

chief at that time; the perimeter subsequently was expanded to five blocks. Police and fire personnel conducted the 

evacuation notification by using their public address systems and going door to door. 277 See: http://www.tdi.texas.gov/news/2014/news201443.html (accessed on December 28, 2015). 278 After the WFC incident in West, the city of Athens, Texas, received a lot of attention because of the presence of a 

fertilizer storage facility downtown that was similar to and older than the WFC facility. Wooden bins were used for 

storage of AN at the East Texas Ag Supply facility.

279 The fire incident statement was provided to CSB via email on October 3, 2014, by the Athens, Texas, fire chief.

001465
West Fertilizer Company Final Report January 2016

133 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 66. Dark Grey Smoke280 Originating from East Texas Ag Supply Facility in Downtown Athens, Texas 

(Source: Athens Fire Department)

 

280 However, this smoke was not as black as the smoke from the WFC fire (see Section 4 of this report).

001466
West Fertilizer Company Final Report January 2016

134 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 67. Dark Smoke Combined with Flames at East Texas Ag Supply Facility in Athens, Texas281 

(Source: Athens Fire Department) 

In an interview, the fire chief reported that the AFD conducted extensive pre-planning, visited the East 

Texas Ag Supply fertilizer storage facility on multiple occasions, and instructed the owner of the facility 

to repair anything that seemed to be hazardous or noncompliant with the International Fire Code, which 

the city of Athens adopted in 2009. SFMO officials had also visited the facility previously on at least two 

occasions and compelled the owner of the East Texas Ag Supply facility to fix old broken machinery that 

was onsite.282 In addition to these visits from SFMO, AFD officials often toured the facility to randomly 

inspect loading and unloading operations and to take note of other fire safety issues, including the 

location and spacing of exits within the facility. Pre-incident assessment of the facility indicated that the 

fertilizer storage bins were old and constructed of double layer plywood, each about 10 feet from the 

ceiling of the 35- to 40-foot-tall building, with three of the bins used to store FGAN. Similar to the WFC 

facility in West, the East Texas Ag Supply facility had no sprinkler systems, and the building was 

 

281 At the East Texas Ag Supply facility incident in Athens, Texas, the flame appeared to be the normal yellow color 

of many wood and other combustibles burning in normal air. Unlike the WFC incident, there was no detonation of 

FGAN; hence, no evidence of brighter (higher-temperature) white flame was observed before the detonation at West 

(see Section 4 of this report).

282 In addition to the actions taken by the city of Athens before the East Texas Ag Supply fire on May 29, 2014, the 

SFMO—as part of its endeavors to share the lessons learned from the West, Texas, AN explosion—went to all 66 

counties with businesses that had 10,000 pounds or more of AN. The statewide tour started on December 12, 2013, 

and was completed on December 17, 2014. Local first responders, LEPC members, local officials, business staff, 

and citizens were invited to the public meetings organized by the SFMO. On April 3, 2014, the SFMO visited 

Athens, Texas (Henderson County) to enlighten the public on the hazards of FGAN. See:

http://www.tdi.texas.gov/fire/fman.html (accessed on December 28, 2015).

001467
West Fertilizer Company Final Report January 2016

135 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

constructed with masonry brick walls on three sides, covered with an asphalt shingle roof. Figure 68

shows the East Texas Ag Supply facility, including its masonry brick walls completely burned to the 

ground.

Figure 68. East Texas Ag Supply Facility’s Masonry Brick Walls, Engulfed by Fire and Smoke 

(Source: Athens Fire Department)

The Athens community has two community alert systems, CodeRED and FIRST Alert. The CodeRED 

community alert system was developed to notify residents of any emergency. The FIRST Alert system is 

directed from the Henderson County 911 dispatch center.283 The protocol for use of the CodeRED system 

indicates that during any emergency situation or a fire incident, the fire chief or a designee (usually the 

police chief) would give the order for the CodeRED notification. Once a CodeRED order is given, the 

designee or authorized emergency staff member is expected to make a recorded speech, which is then 

broadcast over the Internet and to all landline telephones in the city. The process also notifies mobile 

phone subscribers. The CodeRED system was not deployed during the East Texas Ag Supply incident to 

notify Athens residents. 284 However, the CodeRED alert system was used the following day (May 30, 

2014) to notify the community about the post-incident status of the East Texas Ag Supply facility and the

conditions surrounding that facility. 

The Athens, Texas, fire chief compared the city’s situation to that in West and stated that the AFD 

conducted additional research and identified how best to respond to any emergency situation that could 

 

283 Athens, Texas, is located in Henderson County, about 70 miles southeast of Dallas, Texas. 284 On the day of the incident, there was no clear communication on the designation of the appropriate party to make 

the outgoing emergency notification message. The fire chief maintained that because he was occupied with 

command firefighting operations, the task of making the announcement should have been transferred to the Athens 

Police Department (police chief); unfortunately, this was not the case. Moving forward with the post-incident 

critique, the fire chief indicated that standardizing the designation of who makes the announcement would be better 

defined for future community notifications. 

001468
West Fertilizer Company Final Report January 2016

136 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

arise because of the East Texas Ag Supply facility. In West, the WFC plant was primarily a fertilizer 

facility, with anhydrous ammonia tanks, carts, loaders, insecticides, and other potential contaminants for 

FGAN. On the basis of the aftermath of the WFC explosion in West, Henderson County reviewed its 

existing local emergency planning committee (LEPC) process. About a year before the Athens fire 

incident, the natural disaster planning LEPC was expanded, with the fire chief as its chair, to address 

emergencies arising from human activities or industrial facilities. 

Although the cause of the Athens fire incident has not been determined, the city of Athens initiated 

reforms aimed at protecting the city from another incident in the future. On May 29, 2015, a year after 

the fire at the East Texas Ag Supply facility, the city passed an ordinance that banned the bulk storage of 

FGAN in Athens. The ordinance included a mandatory reporting process for facilities with limited 

quantities of hazardous chemicals such as FGAN so that they would report the quantities of the hazardous 

chemicals in their facilities, thereby enabling VFDs to conduct inspections at such facilities.285 CSB 

investigators conducted a teleconference with the city of Athens fire chief on June 24, 2015. The fire 

chief stated that the East Texas Ag Supply facility had been torn down and will not be rebuilt within the 

Athens city limits. In addition, Athens is now considering efforts aimed at monitoring other hazardous 

chemicals (similar to FGAN) that are currently stored by facilities within the city limits.286

7.5 Other Post-Incident Investigation Reports Related to Firefighting 

After the fire and explosion at the WFC facility, several other agencies conducted investigations of the 

incident. EPA and OSHA conducted their investigations for violations of environmental and workplace 

safety and health laws, while the Texas SFMO and NIOSH conducted their investigations on the 

firefighters and the emergency response at the WFC facility. The ATF investigation of the WFC incident 

is ongoing.

7.5.1 Texas State Fire Marshal’s Office (SFMO)

The SFMO 287 served as the lead Texas investigatory agency for the WFC incident, working in 

collaboration with ATF.288 On May 15, 2014, the SFMO released its line-of-duty deaths investigation of

the West, Texas, incident, “Firefighter Fatality Investigation” (Investigation FFF FY 13-06).289 

The SFMO report described the incident and issued recommendations focused on the emergency response 

to the WFC incident, including the conditions that led to the fire and explosion. The report indicated that 

the firefighters at West were not prepared for what they faced on the night of April 17, 2013. Also, the 

 

285 Section 8.7.3 of this report discusses the Athens City ordinance in detail. 286 Section 8.7 of this report addresses state and local regulatory developments (post-West, Texas, and Athens, Texas, 

incidents).

287 See: http://www.tdi.texas.gov/fire/documents/fmohistory.pdf (accessed on December 28, 2015). 288 Section 1.2.1 of this report addresses the ATF investigation.

289 See: http://www.tdi.texas.gov/reports/fire/documents/fmloddwest.pdf (accessed on December 28, 2015).

001469
West Fertilizer Company Final Report January 2016

137 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

SFMO highlighted that the emergency responders were victims of a “systemic deficiency in the training 

and preparation” of the WVFD, attempting to put out a fire that was beyond its incipient stage290 and 

could no longer be extinguished. The report also included findings related to training and operational best 

practices for firefighters. On page 47, the SFMO report identified training deficiency as a key finding: 

The State of Texas has not adopted minimum training standards for volunteer fire departments; 

however, all fire department members must be properly trained and qualified to perform their 

assigned duties. Members who are authorized to work in high-level assignments (rank) must be 

trained and evaluated in performing those duties. All members must be periodically re-evaluated 

to ensure that they are capable of performing their assigned duties safely and effectively.291 

The SFMO firefighter fatality report on the WFC incident further proposed several recommendations 

based on training of firefighters, including establishment of “realistic training and educational 

requirements for all positions and ranks and a promotional process that ensures that ranking members 

demonstrate a progressive knowledge, skill, and ability to perform their assigned duties and 

responsibilities according to their position in the organization.” The SFMO report concludes by 

recommending that “fire departments should develop standard operating guidelines and appropriate 

training involving those critical findings specific to incident command, strategy and tactics, and 

firefighter safety.”292

The SFMO report findings and recommendations are similar to those of CSB in this report with regard to 

the emergency response in West. Section 7.2 of this report describes in detail pre-incident planning, fire 

scene risk assessment, and development of a clearly defined incident command structure for emergency 

situations.293

7.5.2 NIOSH Findings and Recommendations

In 1998, the U.S. Congress funded NIOSH to establish the Fire Fighter Fatality Investigation and 

Prevention Program, which investigates on-the-job fatalities of firefighters and provides improvement 

recommendations to the profession.294 On November 12, 2014, NIOSH released its report on the 

emergency responder fatalities caused by the WFC explosion.295 The report, “9 Volunteer Fire Fighters 

and 1 Off-Duty Career Fire Captain Killed by an FGAN Explosion at a Fertilizer Plant Fire–Texas,” 

identified contributing factors to the firefighter fatalities, specifically failure to recognize hazards 

associated with FGAN, limited pre-incident planning of the commercial facility, quick spread of the fire 

 

290 The term “incipient” has been widely used in the firefighting community and in various fire codes, including 

NFPA codes. However, CSB believes that it could be easily misinterpreted and imposes on firefighters a 

responsibility to make a subjective determination regarding the seriousness of a fire. 

291 See: http://www.tdi.texas.gov/reports/fire/documents/fmloddwest.pdf (accessed on December 28, 2015).

292 Ibid. 293 Section 7.1 of this report considers the firefighter response and Section 7.2 discussed details of factors contributing 

to the firefighter and other emergency responder fatalities in West, Texas. 

294 See: www.cdc.gov/niosh/fire (accessed on December 28, 2015).

295 See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

001470
West Fertilizer Company Final Report January 2016

138 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

to uncontrollable size, unexpected detonation of approximately 40 to 60 tons of solid FGAN, emergency 

responders working within the blast radius at the time of the explosion, and large non-sprinklered wood 

construction in the commercial structure.296 

In addition, NIOSH issued recommendations to prevent a similar incident from recurring. 

Recommendations included pre-incident planning inspections of facilities within the jurisdiction of a fire 

department; development of a written risk management plan; fire department use of risk management 

principles at all structure fires, especially for incidents involving high-risk hazards; development, 

implementation, and enforcement of a written incident management system to be applied during all 

emergency incident operations; standards for firefighters to wear a full array of turnout clothing and 

personal protective equipment (PPE) appropriate for the assigned tasks; and firefighter training that meets 

or exceeds NFPA 1001 (Standard for Fire Fighter Professional Qualifications). 

CSB concluded that most of the key contributing factors and recommendations cited by NIOSH in its 

WFC incident investigation report are similar to those of CSB.297

7.6 Summary of Incident Emergency Response 

CSB found no evidence of pre-incident planning addressing the likelihood of a fire involving FGAN at 

the WFC facility. As a result, the firefighters who responded to the WFC fire did not take the time to 

critically assess the situation on the ground before the explosion occurred. Senior emergency response

personnel from the WVFD arrived at the scene of the incident at different times, and firefighters who 

were ICS trained and certified in the NIMS process did not assume the role of IC to establish, implement, 

and coordinate an incident command structure and incident management system for the fire emergency. 

The firefighters did not fully understand the hazards of FGAN detonation and consequently shifted their 

firefighting tactics to strategies to ensure that the anhydrous ammonia tanks onsite did not rupture. Also, 

the emergency response personnel at West did not take the time to implement an incident management 

system plan, which would have facilitated the prompt and proper evacuation of the nearby residents. 

The volunteers who responded to the WFC facility fire did not have sufficient HAZMAT training to make 

an informed decision on how best to respond to the fire at the fertilizer facility. Furthermore, lessons 

learned from previous firefighter fatalities and emergency responses to FGAN-related incidents were not 

effectively disseminated to firefighters and emergency responders in other communities, such as West, 

where FGAN is stored or used. 

A review of firefighter training courses, information in emergency response guides, manufacturers’ 

manuals, and other information available to emergency responders concerning AN-related fires at 

incident sites confirms that such materials place little emphasis on how to effectively respond to fire 

 

296 NIOSH. “9 Volunteer Fire Fighters and 1 Off-Duty Career Fire Captain Killed by an Ammonium Nitrate 

Explosion at a Fertilizer Plant Fire–Texas.” NIOSH Report on Death in the Line of Duty. Report Number F2013-

11. See: http://www.cdc.gov/niosh/fire/pdfs/face201311.pdf (accessed on December 28, 2015).

297 Ibid. 

001471
West Fertilizer Company Final Report January 2016

139 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incidents involving the handling and storage of FGAN and might altogether be insufficient to enable 

firefighters to recognize the potential magnitude of an FGAN explosion. The commonly used emergency 

response guides and manuals contain inconsistent information regarding the best response to FGANrelated fires. In a fire situation, an FGAN explosion could occur at any time, and without knowing how 

long an AN-related fire has been burning, firefighters might not be aware of how much time they have to 

make informed emergency response decisions before an explosion occurs. That is why in the DECIDE 

model widely used by HAZMAT responders, after it is determined that HAZMAT is present, the next 

step is to estimate likely harm, without intervention.298 Above all, the conditions under which FGAN 

might detonate when exposed to a fire are unpredictable and not clearly understood, and current guidance 

does not offer best practices to protect firefighters from FGAN fire and detonation hazards.

7.7 Firefighter Training Grants and Programs

7.7.1 Need for Training 

CSB found that currently no federal requirements compel municipal fire departments to develop sitespecific pre-incident plans with businesses and chemical plants that process and store HAZMAT such as 

FGAN. To implement any reform in nationwide inspection of businesses and facilities storing hazardous 

chemicals, determining the number of fire departments and firefighters in the United States (especially in 

rural communities such as West, Texas) is important. In addition, it is important to understand how 

prepared fire departments and firefighters should respond to fires involving FGAN. Part of being 

prepared is being properly trained on the hazards surrounding a community.

7.7.1.1 U.S. Firefighter Statistics

CSB conducted a review of firefighter statistics across the country at the time of the WFC fire and 

explosion. The review indicated that the majority of the nation’s firefighters are volunteers and that 85 

percent of fire departments are composed of volunteer firefighters. In addition, the NFPA estimated the 

number of firefighters in the United States in 2013 at more than a million, including 345,600 career 

firefighters (31 percent of the total) and 786,150 volunteer firefighters (69 percent of the total).299 

Approximately 95 percent of all volunteer firefighters serve in local fire departments that protect fewer 

than 25,000 people.300 More than half of these volunteer firefighters support small rural departments that 

protect fewer than 2,500 residents, such as the WVFD in West, Texas.301 At the end of 2012, an 

estimated 30,100 fire departments operated in the United States. Of these, 2,610 (9 percent of all 

departments) were composed of only career firefighters; 1,995 (7 percent) relied on mostly career 

 

298 Ludwig Benner. “D.E.C.I.D.E in Hazardous Materials Emergencies.” See: 

http://www.henrycoema.org/EMA/HazMat_Training_Materials_files/DECIDE.pdf (accessed on January 8, 2016).

299 See: http://www.nfpa.org/research/reports-and-statistics/the-fire-service (accessed on December 28, 2015). 300 Ibid. 301 Ibid. 

001472
West Fertilizer Company Final Report January 2016

140 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

firefighters; 5,445 (18 percent) were supported by a mostly volunteer firefighting force; and 20,050 (67 

percent) depended entirely on volunteer firefighters.302 Despite the fact that the majority of the nation’s 

firefighters are volunteers and that 85 percent of fire departments are composed of volunteers, no federal 

requirements mandate that VFDs work with businesses and chemical plants that process and store 

HAZMAT (such as FGAN) to develop site-specific pre-incident plans.

7.7.1.2 U.S. On-Duty Firefighter Fatalities

Over the last few decades, the fire service industry has made notable advancements, including building 

code improvements, incorporation of sprinkler systems in commercial and industrial buildings, and 

development of improved personal protective gear and technologically advanced apparatus. In addition, 

several laws and programs have been implemented to improve firefighter health and safety in the United 

States.303,304,305 Despite these laws and improvements, many firefighters are injured or killed while on 

duty each year. The USFA has recorded the number of firefighter fatalities and conducted an annual 

analysis since 1977, noting almost 4,500 on-duty firefighter fatalities in the United States in the last 35 

years.306 By the end of 2013, 101 firefighter fatalities were reported for the year nationally, including 

those in West, Texas; four Houston Fire Department firefighters who died while responding to a hotel fire 

on May 31, 2013; and 19 firefighters from the Prescott Fire Department who lost their lives while 

responding to a wildland fire in Arizona on June 30, 2013. The NFPA also publishes its own annual 

study detailing on-duty firefighter fatalities in the United States.307 The annual number of fatalities for 

volunteer firefighters is substantially higher than the annual number of fatalities for career firefighters 

(Figure 69). 

 

302 NFPA, Fire Analysis and Research Division. “US Fire Department Profile 2012.” See: 

http://www.kolb.net/FireReports/2013/US_DeptProfile2012.pdf (accessed on December 28, 2015). 303 Fabio, A. et al. “Incident-level risk factors for firefighter injuries at structural fires.” Journal of Occupational and 

Environmental Medicine, 44(11) (2002): 1059–63. 304 NFPA. NFPA 1500: Standard on Fire Department Occupational Safety and Health Program. Quincy, MA: 

NFPA, 2013. 

305 Moore-Merrell, L. et al. Contributing Factors to Firefighter Line-of-Duty Injury In Metropolitan Fire 

Departments in the United States. Emmitsburg, MD: USFA, 2008. 306 USFA. See: http://www.usfa.fema.gov (accessed on December 28, 2015). 307 NFPA. “U.S. Fire Service.” See: http://www.nfpa.org/research/fire-statistics/the-us-fire-service (accessed on 

December 28, 2015).

001473
West Fertilizer Company Final Report January 2016

141 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 69. Comparison of Volunteer and Career Firefighter Deaths (1977–2013) (Source: NFPA)308

This discrepancy could be due to a number of factors, such as the larger population of volunteer 

firefighters (more than 67 percent of all firefighters nationwide) or the lack of standardized training 

requirements for volunteers. Of the 82 firefighter fatalities in 2012, 39 were volunteer firefighters (47.6 

percent of the total), and 32 were career firefighters (39 percent of the total); in addition, four part-time 

wildland firefighters, three contract wildland firefighters, two paid on-call firefighters, one part-time 

(paid) firefighter, and one industrial firefighter lost their lives (1.2 percent of the total). CSB believes that 

adequate training is essential to reduce on-the-job firefighter fatalities, especially among volunteer 

firefighters who are not required to complete the same level of training as career firefighters. 

7.8.1.3 U.S. Volunteer Firefighter Statistics 

A VFD is a fire department composed of volunteers, usually residents or nearby citizens, who perform 

fire suppression and other related emergency services for a local jurisdiction or community. The U.S. 

Department of Labor (DOL) classifies volunteer firefighters as firefighters who receive either no 

compensation or nominal fees (up to 20 percent of the compensation that a full-time firefighter would 

receive in the same capacity).309 DOL allows volunteer firefighters to receive benefits such as worker’s 

compensation, health insurance, life insurance, disability insurance, pension plans, length-of-service 

 

308 See: http://nysfma.org/diyFiles/FirefighterFatalitiesinttheUS2013.pdf (accessed on December 28, 2015).

309 Dodge, G., and M. Mullarkey. Managing Volunteer Firefighters for FLSA Compliance: A Guide for Fire Chiefs 

and Community Leaders. Fairfax, VA: International Association of Fire Chiefs, 2006. 

001474
West Fertilizer Company Final Report January 2016

142 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

awards, and property tax relief. DOL also states that volunteer firefighters may be paid nominal fees on a 

per-call or per-shift basis or on the basis of various service requirements, but they may not be 

compensated based on productivity (such as receiving an hourly wage).

Career firefighters are fully compensated for their services. Some volunteer firefighters might serve in a 

hybrid fire department that relies on both full-time and volunteer firefighters. In this approach, career 

firefighters can regularly staff a station for rapid response with needed apparatuses, and the volunteers can 

provide supplementary staffing and staff apparatuses before, during, and after an incident or while fulltime career personnel are out of service for training. Moreover, volunteer firefighters can sometimes 

compose a group of part-time or on-call firefighters who have other occupations when not engaged in 

occasional firefighting.

The West volunteer firefighters held other (full-time) jobs and were not financially compensated for their 

time. Some VFDs compensate their firefighters as employees during the time that they are responding to 

or attending to an emergency scene and possibly during training. An on-call firefighter can also volunteer 

time for other nonemergency duties, such as training, fundraising, and equipment maintenance. In 

addition to fundraising, fire departments and emergency response services often seek alternative sources 

to support and fund their daily operations and long-term plans. Federal and state funding is available 

through grants from DHS and FEMA to assist emergency responders and fire departments in addressing 

EMS and firefighter-related needs such as training and equipment procurement and maintenance. 

National programs that support the need for emergency preparedness, including firefighter training, are 

discussed in the next section of this report.

7.7.2 National Firefighter Training Funds and Programs

7.7.2.1 U.S. Department of Homeland Security (DHS)

DHS was formed after the terrorist attacks of September 11, 2001, as part of a national effort to safeguard 

the United States against terrorism. The mission of DHS includes preventing terrorism and enhancing 

security, managing U.S. borders, administering immigration laws, securing cyberspace, and ensuring 

disaster resilience. DHS also provides the coordinated comprehensive federal response in the event of a 

terrorist attack, natural disaster, or other large-scale emergency while working with federal, state, local, 

and private sector partners to ensure a swift and effective recovery effort. DHS builds a ready and 

resilient nation through efforts to accomplish the following:

• Bolstering information sharing and collaboration. 

• Providing grants, plans, and training to homeland security and law enforcement partners. 

• Facilitating rebuilding and recovery.310

Although the scope of DHS is expansive, it contains many components, including FEMA, where much of 

the federal funding flows to various FEMA programs that assist in elements of national resiliency, such as 

 

310 See: http://www.dhs.gov/building-resilient-nation (accessed on December 28, 2015).

001475
West Fertilizer Company Final Report January 2016

143 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

rebuilding and recovering after a disaster (such as the West, Texas, incident) or encouraging emergency 

response preparedness training. 

Federal Emergency Management Agency (FEMA)

FEMA was created in 1979 in an effort to coordinate the federal government’s role in preparing for, 

preventing, mitigating the effects of, responding to, and recovering from all domestic disasters, whether 

natural or man-made, including acts of terror.311 On March 1, 2003, FEMA became part of DHS, and 

FEMA’s Office of National Preparedness was given responsibility for helping to ensure that the nation’s 

first responders were trained and equipped to deal with WMD along with other types of disasters. FEMA 

supports preparedness by developing policies; ensuring that adequate plans are in place and are validated; 

defining the necessary capabilities required to address threats; providing resources and technical 

assistance to state, local, tribal, and territorial partners; and integrating and synchronizing preparedness 

efforts throughout the nation.

DHS and FEMA achieve their mission of ensuring disaster resiliency partly by providing funding and 

support to various federal programs that are tasked with preparing the nation to respond to various 

hazards, such as community exposure to chemicals and hazardous materials. Fire departments use the 

programs to assist in developing a well-organized, equipped, and trained function for the communities 

they serve. CSB reviewed the nationwide funding mechanisms available to career and VFDs through 

DHS and FEMA. Volunteer firefighters similar to those who responded at West have access to these 

firefighting resource funds if they can demonstrate that they have a need for it. CSB examined whether 

federal and state funds could be allocated to fire departments to assist them in obtaining the training that 

firefighters need to address fires and explosions involving HAZMAT such as FGAN.

Grants 

It is important to understand the process for allocating grants to emergency responders such as fire 

departments. First, this section discusses the application process for a DHS FEMA grant. Second, the 

FEMA Grant Programs Directorate (GPD), the program that administers these grants once they receive 

proposals from applicants for funding is discussed. Third, the DHS FEMA preparedness (non-disaster) 

grants are described. Fourth, the Assistance to Firefighter Grants (AFG) Program is discussed in detail 

and in relation to funding in Texas. Specifically, the AFG, Staffing for Adequate Fire and Emergency 

Response (SAFER) grants, and the Fire Prevention and Safety (FP&S) grants are examined.

DHS FEMA Grants Application Process 

Often federal grant funding flows to the local level through the states. However, some states provide 

direct funding for emergency medical services (EMS), especially in rural areas. On the other hand, some 

states have no funding for local programs. Most SFMOs and EMS bureaus offer technical assistance to 

 

311 See: http://www.fema.gov/about-agency (accessed on December 28, 2015).

001476
West Fertilizer Company Final Report January 2016

144 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

local agencies and subsidized training programs to first responders.312 A large portion of the federal grant 

budget is passed to the states through formula or block313 grants. The states then decide how to use the 

grant money. However, some direct federal grant programs are for fire departments and EMS agencies 

such as the AFG.

314 Direct grants are given specifically to the applying agency, but pass-through 

grants315 require the state to apply to the federal government and then distribute grant money to agencies 

that request it. Project grants are the most common form of federal grant. Depending on the program 

requirements, EMS organizations gain access to the funds through a competitive bidding process. 

Application for a project grant does not guarantee an award, and the amount received by grantees is not 

predetermined by a formula.316 Although most DHS components possess some programs that support 

grants,

317 FEMA has the majority of programs and funding.318 

FEMA Grant Programs Directorate (GPD)

The purpose of FEMA GPD is to strategically and effectively administer and manage FEMA grants to 

ensure critical and measurable results for customers and stakeholders. The mission is to manage federal 

assistance to measurably improve capability and reduce the risks that the nation faces in times of manmade and natural disasters. The focus of GPD is to provide customer service to all grantees as well as 

internal and external partners; establish and promote consistent outreach and communication with state, 

local, and tribal stakeholders; ensure transparency in the grant process; and enhance the nation’s level of 

preparedness and the public’s capability to prevent, protect, mitigate against, respond to, and recover from 

all hazards. GPD also holds program management responsibility for the suite of preparedness grants that 

included, and continue to include, the following goals and objectives:

• Review, negotiate, award, and manage the FEMA preparedness grant portfolio.

• Provide subject matter expertise in response to regional office and stakeholder inquiries. 

• Develop grant guidance. 

• Formulate risk methodology to support grant allocations. 

• Analyze investments. 

• Manage budget execution and formulation. 

 

312 FEMA and USFA. “Funding Alternatives for Emergency Medical and Fire Services.” FA-331, April 2012.

313 A block grant does not involve competition. The federal government distributes funds to the states based on an 

established formula.

314 The AFG Program is discussed in further detail in the Assistance to Firefighters Grant Program Section of this 

report.

315 Funds issued by a federal agency to a state agency or institution that are then transferred to other state agencies, 

units of local government, or other eligible groups, per the award eligibility terms.

316 FEMA and USFA. “Funding Alternatives for Emergency Medical and Fire Services.” FA-331, April 2012.

317 DHS supports a wide variety of financial assistance, including post-disaster relief and resilience, preparedness, 

boating safety, cybersecurity, research, university centers of excellence, and assistance to firefighters.

318 See: http://www.dhs.gov/dhs-financial-assistance (accessed on December 28, 2015).

001477
West Fertilizer Company Final Report January 2016

145 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Provide the driving force for grant management initiatives through the strategic delivery of 

policy, training, systems, and data analysis.319

The GPD carries out its mission through three divisions, including the GPD Front Office, Grant 

Operations Division, and Preparedness Grant Division.320 The FEMA grants that pertain to firefighter 

training and emergency response are discussed in the Preparedness (Non-Disaster) Grants and Assistance 

to Firefighters Grant Program Sections of this report.

Preparedness (Non-Disaster) Grants

FEMA provides state and local governments with preparedness program funding in the form of NonDisaster Grants to enhance the capacity of state and local emergency responders to prevent, respond to, 

and recover from a WMD terrorism incident involving chemical, biological, radiological, nuclear, and 

explosive (CBRNE) devices and cyber attacks.321 The Emergency Management Performance Grant 

(EMPG) Program is a preparedness grant that provides more than $350 million to assist local, tribal, 

territorial, and state governments in enhancing and sustaining all-hazards emergency management 

capabilities.322 Either the State Administrative Agency (SAA) or the state’s Emergency Management 

Agency (EMA) is eligible to apply directly to FEMA for EMPG Program funds on behalf of state and 

local EMAs.323 The fiscal year (FY 2015) EMPG Program will focus on planning, operations, equipment 

acquisitions, training, exercises, construction, and renovation to enhance and sustain the all-hazards core 

capabilities of state, local, tribal, and territorial governments.324 The period of performance for the 

EMPG Program is 24 months. In FY 2015, the EMPG Program allocated $20,163,325 to the state of 

Texas.325

Assistance to Firefighters Grant Program 

Within FEMA, the AFG Program consists of three types of grants326 that support improvements in 

training, staffing, and safety within fire departments. These grants include the AFG, FP&S grants, and 

SAFER grants:

 

319 See: https://www.fema.gov/grant-programs-directorate (accessed on October, 23, 2015). 320 The Preparedness Grant Division includes the Preparedness (Non-Disaster) Grants. 321 See: https://www.fema.gov/preparedness-non-disaster-grants (accessed on October, 22, 2015). 322 See: http://www.dhs.gov/news/2015/07/28/dhs-announces-grant-allocations-fiscal-year-fy-2015-preparednessgrants (accessed on October 22, 2015). 323 See: http://www.fema.gov/media-library-data/1427284579730-

8faafd19a62444a974429c3e12d803fa/FY2015EMPG_FAQ.pdf (accessed on December 28, 2015). 324 See: http://www.fema.gov/media-library-data/1438020444107-

4db58a4f1c24b3bd0962b8327652df5b/FY_2015_EMPG_Fact_Sheet_Allocations.pdf (accessed on October 22, 

2015). 325 See: http://www.fema.gov/media-library-data/1438020444107-

4db58a4f1c24b3bd0962b8327652df5b/FY_2015_EMPG_Fact_Sheet_Allocations.pdf (accessed on November 25, 

2015) 

326 The AFG Program also includes Assistance to Firefighters Fire Station Construction Grants.

001478
West Fertilizer Company Final Report January 2016

146 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• AFG. The primary goal of the AFG Program is to meet the firefighting and emergency response 

needs of fire departments and nonaffiliated EMS organizations. Since 2001, the AFG Program 

has helped firefighters and other first responders to obtain critically needed equipment, protective 

gear, emergency vehicles, training, and other resources needed to protect the public and 

emergency personnel from fire and related hazards.327 AFGs are awarded to fire departments, 

state fire training academies, and EMS organizations.

• SAFER Grants. The SAFER Grants were created to provide funding directly to fire departments 

and volunteer firefighter interest organizations to help them increase the number of trained 

frontline firefighters available in their communities. The goal of SAFER is to enhance the local 

fire departments’ capabilities to comply with staffing, response, and operational standards 

established by the NFPA (NFPA 1710, NFPA 1720, or both).328

• FP&S Grants. The FP&S Grants are part of the AFG Program and support projects that enhance 

the safety of the public and firefighters from fire and related hazards.329 The primary goal is to 

reduce injury and prevent death among high-risk populations. In 2005, Congress reauthorized 

funding for FP&S Grants and expanded the eligible uses of funds to include firefighter safety 

research and development.330

In FY 2014, the AFG provided more than $300 million in grant money nationwide; of this $300 million, 

Texas received approximately $6.5 million. The AFG Program issued 2,243 individual grants 

nationwide, and of those, only 90 grants were to fire departments for the purpose of training 

firefighters.331 Moreover, in FY 2014, the AFG Program awarded grant money to 40 firefighting and 

EMS organizations in Texas to provide aid for much needed resources (Figure 70). Of those 40 Texas 

organizations, 20 career fire departments, but only 14 VFDs, were awarded funding through the AFG 

Program. The remaining six organizations include emergency service organizations and one state fire 

training academy. Notably, an interesting finding is that of the grants awarded in Texas, only one award 

was specific to training personnel while the majority of the awards were used to fund equipment, PPE, 

facility modifications, vehicle acquisitions, and wellness and fitness programs.

 

327 See: http://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 328 See: http://www.fema.gov/staffing-adequate-fire-emergency-response-grants (accessed on December 28, 2015).

329 See: http://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015). 330 See: http://www.fema.gov/fire-prevention-safety-grants (accessed on December 28, 2015). 331 See: http://www.fema.gov/assistance-firefighters-grants-award-year-2014 (accessed on October 21, 2015).

001479
West Fertilizer Company Final Report January 2016

147 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Organization City State Program Award Amount Activity Breakdown Award Date

Martindale Volunteer Fire Dept. Co. Martindale TX Operations and Safety $46,196.00 Personal Protective Equipment ($48,005) 4/24/2015

Northwest Rural Emergency Medical 

Services Association, Inc. Tomball TX Operations and Safety $160,572.00 EMS Equipment ($168,600) 4/24/2015

Sulphur Springs Fire Rescue Sulphur Springs TX Operations and Safety $57,143.00 Modify Facilities ($60,000) 4/24/2015

Devine Volunteer Fire and Rescue 

Department Devine TX Operations and Safety $23,982.00 Equipment ($24,056) 5/8/2015

Farmers Branch Fire Department Farmers Branch TX Operations and Safety $223,773.00 Personal Protective Equipment ($246,150) 5/22/2015

Frankston Volunteer Fire Department Frankston TX Operations and Safety $80,000.00

Equipment ($45,900) || Personal Protective 

Equipment ($38,100) 5/22/2015

City of Paris Fire Department Paris TX Operations and Safety $11,632.00 Equipment ($12,795) 5/29/2015

Commerce Fire Department Commerce TX Operations and Safety $153,048.00 Personal Protective Equipment ($160,075) 5/29/2015

Texas Engineering Extension Service 

(TEEX) College Station TX State Fire Training Academy $265,243.00 Equipment ($265,600) 6/19/2015

Hitchcock Volunteer Fire Department Hitchcock TX Operations and Safety $160,667.00 Personal Protective Equipment ($167,500) 7/3/2015

Leander Fire Department Leander TX Operations and Safety $22,719.00 Wellness and Fitness Programs ($6,540) 7/10/2015

San Marcos Fire Department San Marcos TX Regional Request $707,546.00 Equipment ($778,300) 7/10/2015

Troup Volunteer Fire Dept Troup TX Vehicle Acquisition $238,096.00 Vehicle Acquisition ($250,000) 7/10/2015

Bonham Fire Department Bonham TX Vehicle Acquisition $663,713.00 Vehicle Acquisition ($696,898) 7/24/2015

Glenn Heights Fire Department Glenn Heights TX Operations and Safety $78,858.00 Personal Protective Equipment ($82,800) 7/24/2015

Houston Fire Department Houston TX Operations and Safety $915,120.00 Training ($1,008,732) 7/24/2015

Itasca Fire Department Itasca TX Vehicle Acquisition $103,621.00 Vehicle Acquisition ($108,802) 7/24/2015

Burnet County Emergency Services 

District No. 9 Spicewood TX Operations and Safety $72,000.00 Personal Protective Equipment ($75,600) 7/31/2015

Apple Springs Volunteer Fire Dept Apple Springs TX Operations and Safety $53,143.00 Personal Protective Equipment ($55,800) 8/14/2015

Mic-County Volunteer Fire 

Department Lockhart TX Regional Request $399,637.00 Equipment ($423,600) 8/14/2015

Orange County Emergency Services 

District #1 Vidor TX Operations and Safety $173,993.00 Personal Protective Equipment ($191,392) 8/14/2015

Anna Fire Department Anna TX Operations and Safety $28,572.00 Modify Facilities ($30,000) 8/21/2015

Cash Fire Department Assoc. Inc. Greenville TX Operations and Safety $71,760.00 Equipment ($74,355) 8/21/2015

City of Palestine Fire Department Palestine TX Operations and Safety $170,667.00 Personal Protective Equipment ($179,200) 8/21/2015

City of Terrell Fire Department Terrell TX Operations and Safety $246,215.00

Modify Facilities ($65,700) || Personal 

Protective Equipment ($139,500) || Wellness 

and Fitness Programs ($53,325) 8/21/2015

eastex freeway volunteer fire 

department humble TX Operations and Safety $73,119.00 Equipment ($80,430) 8/21/2015

Elm Mott Volunteer Fire and Rescue Elm Mott TX Operations and Safety $31,429.00 Equipment ($33,000) 8/21/2015

Kilgore Fire Department Kilgore TX Operations and Safety $158,364.00 Personal Protective Equipment ($174,200) 8/21/2015

Comanche Volunteer Fire 

Department Comanche TX Operations and Safety $116,071.00 Personal Protective Equipment ($121,374) 8/28/2015

Sanger Volunteer Fire Department Sanger TX Operations and Safety $36,364.00 Equipment ($40,000) 8/28/2015

Tarkington Volunteer Fire 

Department Cleveland TX Operations and Safety $62,858.00 Personal Protective Equipment ($66,000) 8/28/2015

Kingsville Fire Department Kingsville TX Vehicle Acquisition $362,728.00 Vehicle Acquisition ($399,000) 9/4/2015

Muenster Volunteer Fire Department Muenster TX Operations and Safety $78,572.00 Personal Protective Equipment ($82,500) 9/4/2015

Richland Hills Fire Rescue Richland Hills TX Operations and Safety $41,214.00 Equipment ($43,274) 9/4/2015

Stafford, City of Stafford TX Operations and Safety $152,728.00 Personal Protective Equipment ($168,000) 9/4/2015

Quitman Fire & Rescue Quitman TX Operations and Safety $111,429.00 Personal Protective Equipment ($117,000) 9/11/2015

CITY OF WEBSTER WEBSTER TX Operations and Safety $23,620.00 Equipment ($24,800) 9/18/2015

Garland Fire Department Garland TX Operations and Safety $18,730.00 Equipment ($20,400) 9/18/2015

Van Alstyne Fire Department Van Alstyne TX Operations and Safety $33,387.00

Modify Facilities ($23,500) || Equipment 

($10,056) 9/18/2015

Centerville Volunteer Fire Dept., Inc Centerville TX Operations and Safety $97,381.00 Personal Protective Equipment ($102,250) 9/25/2015

$6,525,910.00

Assistance to Firefighters Grant Program (AFG)

FY 2014 Award Recipients

Last Updated: 9/25/2015 - www.fema.gov/firegrants/

TOTAL

Figure 70. Assistance to Firefighter Grant Program Recipients in Texas (Source: FEMA)

In FY 2014, the awarded SAFER Grants totaled approximately $11.7 million to five fire departments in 

Texas to increase the number of trained firefighters; of these five departments, only one was a VFD 

(Figure 71). Similarly, the awarded FP&S Grants totaled approximately $1.5 million to two organizations 

in Texas, neither of which were fire departments, to support projects that enhance the safety of the public 

and firefighters from fire and related hazards (Figure 72). 

001480
West Fertilizer Company Final Report January 2016

148 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 71. SAFER Grant Award Recipients in Texas (Source: FEMA)

Figure 72. FP&S Grant Recipients in Texas (Source: FEMA)

On the basis of the analysis of the FEMA FY 2014 funding allocation to fire departments throughout the 

nation, it can be concluded that much of the grant monies went toward non training-related support. 

Given the constraints that many VFDs experience regarding funds to support training, fire departments 

should express a greater interest in also applying for federal grants for training purposes and not solely for 

supporting other firefighting-related needs such as equipment. For this reason, FEMA should develop a 

grant that specifically supports firefighter training needs and cannot be used toward funding other 

resource needs such as equipment or PPE. 

DHS FEMA Programs 

A general understanding of the intricate landscape of federal grant programs also enables a better 

understanding of many of the DHS and FEMA programs specific to training. This section describes the 

various components and programs that promote preparedness at a national level. First, the FEMA 

National Preparedness Directorate (NPD) serves as a mechanism for fostering programs and resources. 

Second, training programs reside within the National Training and Education Division (NTED). Third, 

the Homeland Security National Training Program (HSNTP) is positioned to create accessible training 

and specifically addresses national preparedness gaps. Fourth and fifth, the Center for Domestic 

Preparedness (CDP) and the Rural Domestic Preparedness Consortium (RDPC) are NTED training 

001481
West Fertilizer Company Final Report January 2016

149 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

partners. Sixth, the USFA role as a leader in firefighter training is reviewed. Each is discussed in detail 

in the rest of this section.

National Preparedness Directorate (NPD)

The NPD is an organizational component of FEMA that provides the doctrine, programs, and resources to 

prepare the nation to prevent, protect, mitigate, respond to, and recover from disasters while minimizing 

the loss of lives, infrastructure, and property.332 A variety of courses in all-hazards emergency planning 

and response constitutes a key aspect of building a culture of preparedness and involves training at many 

levels, including:

• State, local, tribal, and territorial elected officials. 

• Emergency managers. 

• First responders. 

• Appropriate whole community members, such as volunteer organizations, Community 

Emergency Response Teams, Citizen Corps, and bystanders. 

• Other emergency responders. 

Through the NPD, FEMA has established and delivered effective training and professional education 

programs and developed a national certification system for overall emergency management competency 

and expertise. This work is accomplished by the National Emergency Training Center (NETC), CDP, and 

other training partners.333

National Training and Education Division (NTED)

NTED serves the nation’s first responder community, offering more than 150 courses to help build critical 

skills that responders need to function effectively in mass consequence events. NTED primarily serves 

state, local, and tribal entities in 10 professional disciplines, but has expanded to serve the private sector 

and citizens as well. Instruction is offered at the awareness, performance, and management and planning 

levels. Emergency responders attend NTED courses to learn how to apply the basic skills of their 

profession in the context of preparing, preventing, deterring, responding to, and recovering from acts of 

terrorism and catastrophic events. Training partners or providers that develop and deliver NTED 

approved training courses include: 

• CDP. 

• Counterterrorism Operations Support. 

• Louisiana State University. 

• New Mexico Institute of Mining and Technology. 

 

332 See: http://www.fema.gov/national-preparedness-directorate (accessed on December 28, 2015). 333 See: http://www.dhs.gov/topic/plan-and-prepare-disasters (accessed on December 28, 2015).

001482
West Fertilizer Company Final Report January 2016

150 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Texas Engineering Extension Service.

334

• Transportation Technology Center, Inc.

• University of Hawaii, National Disaster Preparedness Training Center. 

Other training partners, such as the following, have developed or are developing training courses for 

NTED:

• BCFS Health and Human Services. 

• Frederick Community College. 

• International Association of Fire Fighters.

335

• Naval Postgraduate School. 

• RDPC.336

NTED training partners deliver training at no cost to the individual or to the individual’s jurisdiction or 

agency. In some circumstances, with approval from the SAA state/territory training point of contact, 

Homeland Security Grant Program (HSGP) funds 337 may be used for overtime and backfill costs for 

those individuals attending NTED courses.

Training providers have a limited supply of training for each state. Occasionally, a state exhausts the 

available free training. In these cases, NTED has an Excess Delivery Acquisition Program that allows 

NTED training partners to charge for course delivery when more sessions of a requested class are needed 

than the grant funds can accommodate. Select training partners potentially could support training 

firefighters on the hazards associated with FGAN fires, as discussed in further detail.

NTED courses include multiple delivery methods, specifically instructor-led (direct), train-the-trainers 

(indirect), customized (conferences and seminars), and web-based deliveries. Instructor-led courses are 

offered in residence (i.e., at a training facility) or through mobile programs that deliver courses to state 

and local jurisdictions that request the training. While the GPD, Grant Operations Division manages, 

administers, and conducts application budget review, creates the award package, approves, amends and 

closes out awards, the NPD NTED holds programmatic responsibility for the HSNTP Continuing 

Training Grants (CTG) Program and also maintains the program management function and 

responsibilities throughout the life cycle of the awarded grant.338 

 

334 TEEX currently has an 8-hour course delivered in any participating jurisdiction that focuses on training responders 

to meet the requirements established in NFPA 472, Chapter 4, “Competencies for Awareness Level Personnel,” and 

the OSHA 29 CFR 1910.120 (q)(6)(i) (a–f) First Responder Awareness Level competencies. This course takes an 

all-hazards approach to HAZMAT incidents. It provides participants with the knowledge to recognize the 

HAZMAT, protect themselves, notify others, and secure the scene. As part of a DHS FEMA funded HSNTP 

Cooperative Agreement, this course is available at no direct cost to state, county, and local government agencies.

335 Section 7.7.3.1 of this report provides additional information about the IAFF. 336 RDPC is discussed in further details in the Rural Domestic Preparedness Consortium Section of this report. 337 HSGP funds can be used to reimburse the state agency or local jurisdiction for delivery of, and attendance to, the 

course.

338 DHS, HSNTP, CTG Program. “Notice of Funding Opportunity.” DHS-15-NPD-005-000-01.

001483
West Fertilizer Company Final Report January 2016

151 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Homeland Security National Training Program, Continuing Training Grants 

The FY 2015 HSNTP CTG program339 provides funding via cooperative agreements340 to training 

partners to develop and deliver training to prepare whole communities to prevent, protect against, 

mitigate, respond to, and recover from acts of terrorism and from natural, man-made, and technological 

hazards. An objective of the program is to create accessible training solutions to address specific national 

preparedness gaps across the country.

For FY 2015, the total HSNTP funds available under the CTG Program is $11.521 million, to be used for 

training in the following focus areas: 

• Cybersecurity. 

• HAZMAT. 

• Countering violent extremism. 

• Rural training. 

The FY 2015 HSNTP CTG Program is an open and competitive funding opportunity, available to entities 

with existing programs or demonstrable expertise relevant to the focus areas in the funding opportunity 

announcement—including state, local, tribal, and territorial entities; nonprofit national associations and 

organizations; nonprofit higher education institutions; and nonprofits such as community and faith-based 

organizations.

HAZMAT and rural training are two focus areas of interest to this investigation because fire departments 

with HAZMAT or FGAN facilities in their jurisdiction (or those in rural341 locations) can apply for this 

grant since they fall under these focus areas. Within the HAZMAT focus area, departments are required 

to identify current and emerging national gaps in HAZMAT incident planning, response, and recovery as 

well as the training solutions to address these gaps. The FY 2015 HSNTP CTG Program prescribed the 

following standards related to HAZMAT training: NFPA standards, including NFPA 472 (Standard for 

Competence of Responders to Hazardous Materials /Weapons of Mass Destruction Incidents), NFPA 473 

(Standard for Competencies for EMS Personnel Responding to Hazardous Materials/Weapons of Mass 

Destruction Incidents), and 29 CFR 1910.120 (Hazardous Waste Operations and Emergency Response). 

In addition, Executive Order 13650, “Improving Chemical Facility Safety and Security,” and published 

reports from the Chemical Facility Safety and Security Working Group have been incorporated. The 

proposed training should address the following issues:

 

339 As appropriated by the Department of Homeland Security Appropriations Act, 2015 (Pub. L. 114-4) and authorized 

by the Implementing Recommendations of the 9/11 Commission Act of 2007 (Pub. L. 110-53) (hereafter the 9/11 

Act), and the Homeland Security Act of 2002 (6 U.S.C. § 101 et seq.). 340 A legal instrument of financial assistance between a federal awarding agency or pass-through entity and a nonfederal entity that is consistent with 31 U.S.C. 6302–6305. 341 The U.S. Census Bureau defines rural areas as all areas not meeting the following definition of a metropolitan area: 

Metropolitan statistical area (MSA) must include at least one city with 50,000 or more inhabitants or an urbanized 

area with at least 50,000 inhabitants and a total MSA population of at least 100,000.

001484
West Fertilizer Company Final Report January 2016

152 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Planning, response and mitigation strategies, defensible critical decision making to save lives and 

property, and actions for fixed-facility spills and releases. 

• Increasing knowledge, skills, and abilities to achieve core capabilities of interdiction and 

disruption, on-scene security and protection, and operational communications and coordination to 

enhance a jurisdiction’s capability to mitigate and respond to HAZMAT incidents. 

• Responder health and safety to prepare for, respond to, and recover from HAZMAT incidents by 

including on-scene health risk assessments and hazard risk analysis, incident safety and health 

plans, air monitoring plans, PPE selection and use, and safe work practices.

Many VFDs similar to the WVFD are situated in rural environments where the funding to support 

training is limited. The required training objectives for the rural training focus area include HAZMAT, 

mass fatality planning and response, crisis management for school-based incidents, development of 

emergency operations plans, railcar safety, agroterrorism and food and animal safety, and media 

engagement strategies for first responders.342

Center for Domestic Preparedness

CDP opened in June 1998 as a training center for the nation’s emergency responders. The CDP mission 

is to train emergency response providers from state, local, and tribal governments as well as the Federal 

government, foreign governments, and private entities, as available. CDP training is also available for 

international, federal, and private sector responders who may participate if space is available on a fee-forservice basis. The scope of training includes preparedness, protection, and response. CDP provides 

onsite and mobile training at the performance, management, and planning levels while also facilitating the 

delivery of training by DHS training partners. DHS fully funds CDP training for state, local, and tribal 

responders. CDP has three distinct facilities that support training, specifically the Chemical, Ordnance, 

Biological, and Radiological Training Facility (COBRATF), Advanced Responder Training Complex 

(ARTC), and Noble Training Facility. The CDP COBRATF offers the only program in the nation 

featuring civilian training exercises in a toxic chemical agent environment, including biological materials. 

The advanced hands-on training enables responders to effectively respond to real-world incidents 

involving chemical, biological, explosive, or radiological materials or other HAZMAT. The ARTC 

provides responders with a realistic training environment to exercise the skills acquired during training. 

The CDP Noble Training Facility is the nation’s only hospital dedicated solely to preparing the health 

care, public health, and environmental health communities for mass casualty events related to terrorism or 

natural disasters.

CDP’s federal training partners include agencies such as:

• Emergency Management Institute (EMI). 

• National Fire Academy (NFA). 

• Federal Law Enforcement Training Centers. 

 

342 DHS HSNTP CTP Program. “Notice of Funding Opportunity (NOFO),” DHS-15-NPD-005-000-01.

001485
West Fertilizer Company Final Report January 2016

153 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Center for Disease Control and Prevention. 

• Veterans Administration. 

• DHS Office for Bombing Prevention. 

• Radiological Emergency Preparedness Program. 

• Department of Agriculture. 

• DHS Domestic Nuclear Detection Office. 

• Health and Human Services Division of Strategic National Stockpile. 

Rural Domestic Preparedness Consortium (RDPC) 

Rural emergency responders face unique challenges compared to their urban counterparts, such as limited 

access to funding for fundamental training. These challenges in providing consistent and high-quality 

training for first responders were recognized by Congress and DHS, which then established RDPC. Led 

by the Center for Rural Development, RDPC is a DHS-funded program providing training and resources 

to rural first responders. RDPC develops and delivers relevant all-hazards training specific to rural 

environments, and courses are offered both in person and online at no cost. To ensure that training 

directly reflects the needs of rural emergency responders, RDPC convenes a national rural preparedness 

summit and completes a biannual national survey of rural stakeholders. Data gathered from these 

activities are used to determine the type of training needs, level of need, and best delivery methods.343

U.S. Fire Administration (USFA)

The USFA is currently an entity within FEMA. The USFA was established by the Federal Fire 

Prevention and Control Act of 1974. 344 The mission of the USFA is to provide leadership, coordination, 

and support for the nation’s fire prevention and control, fire training and education, and EMS activities 

and to prepare first responders and health care leaders to react to all-hazard and terrorism emergencies. 

One of USFA’s key objectives is to reduce the nation’s loss of life from fire while also reducing property 

loss and nonfatal injury due to fire.345

The USFA develops and delivers fire prevention and safety education programs in partnership with other 

federal agencies, the fire and emergency response community, media, and safety interest groups.346 The 

USFA collaborates with public and private groups to promote and improve fire prevention and life safety 

through research, testing, and evaluation. The USFA manages many of the federal programs related to 

firefighting, including the National Fire Incident Reporting System, a dataset and collection of statistical 

 

343 See: https://www.ruraltraining.org/about/overview/ (accessed on October 21, 2015). 344 The U.S. Congress passed P.L. 93-498, the Federal Fire Prevention and Control Act, in 1974, which led to 

establishment of the USFA and the NFA. See: http://legcounsel.house.gov/Comps/FIREPREV.PDF (accessed on 

December 28, 2015).

345 See: https://www.fas.org/sgp/crs/homesec/RS20071.pdf (accessed on December 28, 2015). 346 See: http://www.usfa.fema.gov/about/index.html (accessed on December 28, 2015).

001486
West Fertilizer Company Final Report January 2016

154 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

information relating to fire incidents, public fire education campaign materials, and information on grants 

and funding. 

The USFA oversees the NFA at the NETC in Emmitsburg, Maryland. The NFA works to enhance the 

capability of fire and emergency services and allied professionals to deal more effectively with firerelated emergencies. The NFA offers free training courses and programs on campus, online, and 

throughout the nation.347 

The USFA offers federal funding and grants directly to local career fire departments and VFDs and 

unaffiliated EMS organizations to help address a variety of equipment, training, and other firefighter and 

EMS-related needs. The grants are provided through the Fire Act Grants under the FEMA AFG Program, 

FP&S Grants, and SAFER Grants, which provide grants for hiring, recruiting, and retaining 

firefighters.348 349 Firefighters often dedicate personal time for training, public education, fundraising, 

and other nonemergency department-related activities. In addition, they are often members of their local 

or national firefighter associations.

7.8.2 Texas Firefighting Training Organizations and Programs

CSB reviewed the availability of national firefighter training grants and programs. The review revealed 

that career and volunteer firefighters and fire departments have access to many federally funded training 

grants and programs throughout the nation. Moreover, CSB reviewed state-level funding and programs 

available to Texas firefighters and fire departments in an effort to determine how access to HAZMAT and 

FGAN-specific training can be increased while also improving training standards for FGAN. Select state 

resources—such as the Texas Commission on Fire Protection (TCFP), Texas Rural Volunteer Fire 

Department Assistance Program, SFFMA, and Texas A&M Engineering & Extension Services (TEEX) 

are discussed further. As a result, CSB issues recommendations to some of these state resources, which 

are identified in Section 11. 

7.7.2.2 Texas Commission on Fire Protection (TCFP)

The TCFP, a state government agency, is one of many state and local agencies that compose the Texas 

fire protection community. The commission’s statutory authority and role within this community is to 

serve Texas fire departments as follows:

• Provide training guidelines and assistance to the fire service. 

• Establish and enforce statewide fire service standards.350

 

347 See: http://www.usfa.fema.gov/training/nfa/ (accessed on December 28, 2015). 348 See: https://www.fema.gov/welcome-assistance-firefighters-grant-program (accessed on December 28, 2015).

349 The AFG, FP&S Grants, and SAFER Grants are discussed in the Assistance to Firefighters Grant Program Section 

of this report.

350 See: http://www.tcfp.texas.gov/about/compact.asp (accessed on November 13, 2015).

001487
West Fertilizer Company Final Report January 2016

155 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

An important TCFP characteristic is its service to regulated organizations, including paid fire departments 

and those volunteer departments that choose to be voluntarily regulated. The policymaking body of the 

TCFP is a 13-member board appointed by the governor and confirmed by the Texas Senate. The 

commissioners adopt policies in accordance with Chapter 419 of the Texas Government Code. Upon 

adoption by the TCFP, these policies become state administrative laws collected under Part 13 of Title 37

of the Texas Administrative Code (TAC). The TCFP may propose or adopt changes to the TAC. The 

firefighter advisory committee351 is responsible for reviewing and commenting on the administrative rules 

that govern the state’s fire service and also assists the TCFP in matters relating to fire protection 

personnel, volunteer firefighters, fire departments, and VFDs.

352 The advisory committee may submit 

new curricula (or changes to curricula) for study and review before approval by the TCFP. The 

commission often creates ad hoc advisory committees to assist in creating and updating curricula, 

validating test questions, and addressing other related matters. Members of the Texas fire service serve 

voluntarily on these committees.353

The goal of the TCFP compliance program is to ensure the safety of the state’s fire protection personnel 

by inspecting fire departments and other regulated entities to confirm that they are in compliance with 

state laws and rules. The compliance inspectors also inspect training records to ensure that fire protection 

personnel are in compliance with the appropriate certification rules for their disciplines. The 

commission’s compliance officers travel to every regulated entity at least once every 2 years to inspect 

fire protection personnel certifications, training records, breathing air test records, protective clothing, and 

self-contained breathing apparatus. If a fire department is found to be in violation of a state law or TCFP 

rule, the Compliance Section compels the department to correct the violation immediately or works with 

it to develop a plan that will lead to compliance.354 

The TCFP certification program certifies approximately 32,000 fire protection personnel in Texas. State 

law requires paid fire protection personnel to be certified by this commission; volunteers and individuals 

not affiliated with a paid or volunteer department can voluntarily choose to be certified by TCFP. The 

commission certifies fire protection personnel to multiple levels (basic, intermediate, advanced, and 

master) in several different disciplines.355 In addition, TCFP certifies training facilities. When fire 

departments have unmet training needs, TCFP may take a number of actions:

• Authorize reimbursement for a local government agency for training program expenses. 

• Provide staff or educational materials on request to training programs or fire departments. 

 

351 The firefighter advisory committee is created by the TCFP enabling statute, Chapter 419 of the Government Code. 

The TCFP appoints members. See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm#419.023

(accessed on December 28, 2015).

352 See: http://www.tcfp.texas.gov/directory/commission_and_committees.asp (accessed on November 3, 2015). 353 See: http://www.tcfp.texas.gov/directory/commission_and_committees.asp (accessed on November 13, 2015). 354 See: http://www.tcfp.texas.gov/about/compact.asp (accessed on October 27, 2015). 355 Including structure fire protection, aircraft rescue fire protection, marine fire protection, fire inspector, fire and 

arson investigation, HAZMAT technician, pumper driver and operator, fire instructor, fire officer, and head of 

department.

001488
West Fertilizer Company Final Report January 2016

156 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Establish minimum curriculum requirements for courses in schools operated by state or local 

governments. 

• Provide training assistance to fire departments through the following methods:

 Purchase and provide training aids to fire departments, temporarily or permanently. 

 Finance training seminars for fire departments. 

 Pay instructor fees to teach specialized courses for fire departments that employ fully paid 

fire protection personnel.356

Although these four elements are cited in the TCFP statute (Section 419.028), the commission is no 

longer funded for the type of assistance provided by authorizing reimbursements or delivering training. 

The TCFP funding program that offers this type of training assistance to fire departments was transferred 

to the Texas A&M Forest Service in 2009.357 TCFP’s Certification Curriculum Manual supplies the 

curriculum for the training of structural fire suppression personnel, aircraft rescue fire protection 

personnel, and marine fire protection personnel as well as fire inspectors, fire investigators, HAZMAT 

technicians, pumper drivers and operators, fire instructors, fire officers, and wildland firefighters. 358 The 

Certification Curriculum Manual’s Hazardous Materials Awareness chapter was updated in June 2015. 

This chapter of the manual includes course material on Class 5 oxidizing substances and organic 

peroxides; this class includes AN.359 The curriculum sets the minimum standards for materials covered in 

the course; however, instructors decide whether to go into further detail within specific topic areas such as 

AN.

The TCFP may consult and cooperate with a local governmental agency, other governmental agency, 

university, college, junior college, or other relevant institutions concerning the development of training 

schools and associated programs of courses of instruction for fire protection personnel, including the 

preparation or implementation of continuing education or training programs.360 The TCFP has entered 

into a memorandum of understanding (MOU) with TEEX361 to coordinate each organization’s training 

responsibilities. In addition, the TCFP has an MOU with the Texas A&M Forest Service to coordinate 

the provision of training assistance and other assistance to firefighting entities. The Texas A&M Forest 

Service consists of many programs directed to VFDs to enhance the ability of firefighters to protect 

themselves and the public from fire-related hazards. One such program within the Texas A&M Forest 

Service that supports volunteer firefighter training is discussed in more detail in the next section.

 

356 See: http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.419.htm (accessed on October 28, 2015), Section 

419.028 through Section 419.031.

357 The Rural VFD Assistance Program in the Texas A&M Forest Service is discussed further in Section 7.7.4 of this 

report.

358 See: http://www.tcfp.texas.gov/manuals/curriculum_manual.asp (accessed on October 28, 2015).

359 See: http://www.tcfp.texas.gov/manuals/curriculum_manual/chapter_6.pdf (accessed on October 28, 2015). 360 Section 419.030. 361 Section 7.7.2.5 discusses TEEX in further detail.

001489
West Fertilizer Company Final Report January 2016

157 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

7.7.2.3 Texas Rural Volunteer Fire Department Assistance Program (HB 2604)

In a January 2015 interim report by the Texas Committee on Homeland Security and Public Safety, 

Chairman Joe Pickett (D-El Paso) submitted recommendations to, and drafted legislation for 

consideration by, the House of Representatives, 84th Texas Legislature.362 The committee’s report 

indicates that of the 40 fire departments that represent the authority with jurisdiction for the 43 FGAN 

facilities across the state, 27 are VFDs; 7 are a combination of paid and volunteer firefighters; and 6 

consist only of paid firefighters. A recommendation that stemmed from this finding encouraged the 

legislature to approve a rider in the Appropriations Bill for Texas A&M Forest Service that addresses 

funding in the Rural Volunteer Fire Department (Rural VFD) Assistance Program. The purpose of this 

funding is to provide training for VFDs across the state that are in a jurisdiction with an FGAN facility.363 

The 77th Texas Legislature passed House Bill 2604 in 2001, establishing the Rural VFD Assistance 

Program.364 The primary goal of the VFD Assistance Programs is to enhance the emergency response 

capabilities of volunteer and combination fire departments with 20 or fewer paid members.365 The Texas 

Rural VFD Assistance Program provides funding to rural VFDs for the acquisition of firefighting 

vehicles, fire and rescue equipment, protective clothing, dry hydrants, computer systems, and firefighter 

training. This cost-share program is funded by the Texas State Legislature. Beginning on September 1, 

2015, the annual grant budget for the program increased to $24.3 million from the previous annual budget 

of $12.8 million. Cost share assistance for training tuition has increased after changes to the Rural VFD 

Assistance Program that also took effect on September 1, 2015. The new reimbursement rate is 100 

percent of the actual cost of tuition, not to exceed $125 per day up to a maximum of $625 per trainee per 

school. The annual maximum for training tuition grant assistance per fire department is $12,500.366 The 

Texas A&M Forest Service conducted a funding meeting for FY 2015 on March 11, 2015, to determine 

how grants would be awarded. During this meeting, approximately $1.4 million in grants was awarded to 

Texas VFDs. Two VFDs in McLennan County, Texas, were approved for funding, and one is the 

WVFD, approved for $8,000 for a training library (Table 10).

367 All VFDs that apply for state grants, 

 

362 See: http://www.house.state.tx.us/_media/pdf/committees/reports/83interim/House-Committee-on-HomelandSecurity-and-Public-Safety-interim-report.pdf (accessed on October 28, 2015). 363 See: http://www.house.state.tx.us/_media/pdf/committees/reports/83interim/House-Committee-on-HomelandSecurity-and-Public-Safety-interim-report.pdf (accessed on October 28, 2015): 22–24. 364 See: http://texasforestservice.tamu.edu/uploadedFiles/FRP/New_-

_Local_Capacity_Building/TFS_Assistance_Programs/Historical_Funding_Summaries/2604/HB%202604%20Fund

ing%20Meeting%20Approvals%2003_11_15.pdf (accessed on November 13, 2015). 365 See: http://texasforestservice.tamu.edu/content/article.aspx?id=19857 (accessed on October 28, 2015).

366 See: 

http://texasforestservice.tamu.edu/uploadedFiles/TFSMain/Preparing_for_Wildfires/Fire_Department_Programs/Lo

cal_Volunteer_Fire_Department_Programs/Rural_VFD_Assistance_Program/Special%20Announcement%20--

%20Program%20Changes%20FY16(1).pdf (accessed on October 27, 2015)

367 See: http://texasforestservice.tamu.edu/uploadedFiles/FRP/New_-

_Local_Capacity_Building/TFS_Assistance_Programs/Historical_Funding_Summaries/2604/HB%202604%20Fund

ing%20Meeting%20Approvals%2003_11_15.pdf (accessed on November 16, 2015).

001490
West Fertilizer Company Final Report January 2016

158 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

including matching federal funds, must certify that they have adopted NIMS. Before the WFC incident in 

December 2012, the WVFD had requested funds through the Rural VFD Assistance Program for a large 

brush truck, but the request was not approved. The WVFD requested this funding every year thereafter, 

although it did not meet the NIMS certification requirement.368 

Table 10. Funds Allocated to WVFD through the Rural VFD Assistance Program

Date Approved Equipment/Training 

Category

Approved 

Amount

January 2003 Truck Chassis Large $40,000

May 2004 C/S Structural Gear $6,000

September 2008 Wildland Gear $5,700

March 2015 Training Library $8,000

The SFFMA of Texas was instrumental in the creation of House Bill 2604, which annually distributes 

grant funding through the Texas Forest Service to fire departments in need. Similar to the TCFP, the 

SFFMA assists many volunteer firefighters and fire departments in obtaining training. 

7.7.2.4 State Firefighters’ and Fire Marshals’ Association of Texas (SFFMA)

Organized in 1876, the SFFMA is Texas’s oldest and largest fire association serving the fire and 

emergency service responders of Texas. The SFFMA has the support of more than 1,200 fire 

departments, 22,000 individual members, 80 industrial fire brigades, and EMS and international 

departments. The association is active in legislative efforts that affect the fire service in Texas.369 The 

SFFMA is a fee-based membership organization that offers individual and fire department 

memberships,370 and has partnered with the National Volunteer Fire Council (NVFC)371 to provide 

joint benefits to their members. 

The SFFMA consists of a volunteer firefighter certification program that encourages VFDs to initiate 

the program in an effort to upgrade training standards. A VFD must be a member of the SFFMA to 

participate in the certification programs. Through the program, the fire department’s selected 

 

368 See: http://tfsweb.tamu.edu/HistoricalFunding/ (accessed on November 17, 2015).

369 See: http://www.sffma.org/web/SFFMA/About_Us/SFFMA/About.aspx?hkey=84e079d0-75c2-47df-b9e9-

7ae03d5685dd (accessed on October 29, 2015). 370 The fire department membership dues are based on the Federal Census population of the cities and towns that they 

serve.

371 NVFC is discussed in further detail in Section 7.7.3 of this report.

001491
West Fertilizer Company Final Report January 2016

159 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

certification coordinator is required to attend a free certification workshop at least once every 2 years. 

The certification workshop is a requirement to maintain the departments’ participation status. The 

certification coordinator validates that all training and certifications meet state criteria; it is the 

coordinator’s responsibility to document the training and ensure that a qualified instructor has 

conducted the training. To verify that a department holds continual training and correctly maintains its 

records, the coordinator must submit an annual training summary or progress report.372 The SFFMA 

Certification Board sets the criteria for the training curriculum; however, it does not develop topicspecific training modules for firefighters and departments. The SFFMA relies on firefighter training 

schools, approved training providers, or certified training instructors to administer the training. The 

SFFMA Program allows individual departments and their members to decide how far they will go in 

the process. The process levels include NFPA 1403, Introductory; NFPA 1001, Firefighter I; NFPA 

1001, Firefighter II; and Master certifications.373 Currently, the SFFMA does not have an exclusive 

program that certifies firefighters on HAZMAT or AN; however, part of the certification for the 

Firefighter I program includes a section on HAZMAT.374 As part of the minimum standards for 

firefighter certification, the section designates that trainees recognize the hazard classes and divisions 

of HAZMAT and WMD375 and identify common examples of materials and primary hazards in each 

hazard class or division, such as Class 5 oxidizers.376 

The SFFMA Texas Industrial Emergency Services Board (TIESB) provides guidance for the Texas 

Industrial Fire Protection Program. The TIESB works with the Texas Chemical Council and the National 

Petroleum Refiners Association in reviewing differences among various industries in training needs for 

all emergencies and loss prevention programs. The TIESB has many objectives, including promoting the 

development of fire training and loss prevention programs for industrial firefighters or members of the 

SFFMA and also recommending for each member industry-minimum criteria for maintaining effective 

fire training, loss prevention, and educational programs.377 Currently, the TIESB has a certification 

program for industrial HAZMAT teams and emergency response personnel378 that establishes minimum 

criteria for certification but also provides flexibility so that each facility can structure its training 

programs to address individual needs. The TIESB has formally adopted NIMS, designating it as the 

incident management system for all members seeking certification of their training programs.379

 

372 See: http://www.sffma.org/web/SFFMAPages/Certification/2015/Navigating_Cert_2015_Apr.pdf (accessed on 

November 2, 2015).

373 See: 

http://www.sffma.org/WEB/SFFMAPages/Certification/Resources/Certification_FAQ.pdf?WebsiteKey=65a2a6d5-

cf92-4d26-8251-b69cdeecaa68&hkey=1509bff9-ad5b-411d-904d-9de79e384a6d (accessed on October 30, 2015). 374 Of the 22 sections in the program, Section 18 covers HAZMAT. 375 NFPA 472, Section 4.2.1: 2, 3. 376 See: http://www.sffma.org/web/SFFMAPages/Certification/2015/Full_Program_2015_02.pdf (accessed on October 

29, 2015): 61.

377 See: http://www.sffma.org/web/SFFMA/Divisions/Industrial/SFFMA/TIESB.aspx?hkey=60a9d6ce-7f4f-4d91-

b642-d41585bf3597 (accessed on October 30, 2015). 378 Training program certification is for HAZMAT Technician, Specialist, and Incident Command levels.

379 See: http://www.sffma.org/web/SFFMAPages/TIESB/Policy_Docs/TIESB010.pdf (accessed on October 30, 2015).

001492
West Fertilizer Company Final Report January 2016

160 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Within Texas, multiple organizations support firefighter standards for training curricula and certification. 

These organizations work with training partners such as TEEX in the development of course curricula and 

the implementation of training programs that suit the diverse needs of fire departments.

7.7.2.5 Texas A&M Engineering Extension Services (TEEX)

In 1929, the State Firemen’s and Fire Marshals' Association of Texas (SFFMA) selected Texas A&M 

College as the site for a permanent firefighter training school. In 1931, the Texas Legislature authorized 

the creation of a Firemen’s training school by passing House Bill No. 921. This bill authorized Texas 

A&M to create, conduct and maintain a Firemen’s training school.

A member of The Texas A&M University System, the Texas A&M Engineering Extension Service 

(TEEX) has more than 80 years of experience in providing professional services with expertise in national 

and industrial security, emergency preparedness and response, public infrastructure, occupational safety, 

economic development, and technology assessment and validation. TEEX employees nearly 1,000 experts 

in various fields and is able to develop training solutions for emergency responders across the state and 

nationwide. Funding for Texas agencies and fire departments is available from several sources to support 

TEEX tuition, fees, and other related expenses. 

TEEX encourages fire departments to take advantage of federal funding programs such as those in DHS 

FEMA as well as no-cost training in Texas through the fire extension services, NFA, area schools, and 

other assistance programs and associations.380 TEEX tailors need-specific services and training at a 

number of its facilities and also at customer-specified locations worldwide. TEEX has the ability to offer 

a full-range of services and delivery methods, including: 

• Course design and development. 

• Online course delivery. 

• Hosting services for eLearning courses. 

• Classroom-based instruction. 

• Hands-on skills-based instruction. 

• National certification testing. 

• Technical assistance and technology validation.

• Bilingual training and translation services. 

TEEX collaborates with resources within The Texas A&M University System to provide a unique blend 

of research and technical expertise. The TEEX Emergency Services Training Institute’s (ESTI) main 

training facility is the Brayton Firemen’s Training Field. Adjacent to this facility is Disaster City®, which 

is comprised of 296 acres in College Station, Texas, making it the world’s largest, most comprehensive 

campus for first responders. Each year thousands of students participate in ESTI’s hands-on training in 

firefighting, emergency medical services, hazardous materials, rescue, Incident Command, and 

 

380 See: https://teex.org/Pages/about-us/funding-grants.aspx (accessed on November 6, 2015).

001493
West Fertilizer Company Final Report January 2016

161 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

specialized programs. ESTI offers over 200 different courses in more than 130 specialty areas to students 

from across Texas, the United States and around the world.381

In FY15 TEEX/ESTI provided training for some 96,364 students in 3,670 separate classes which 

accounted for 1.625 million man contact hours. During the course of FY15 training, all 254 Texas 

Counties were served including 92% of all Texas Communities. TEEX/ESTI also trained students from 

81 foreign countries during FY15. TEEX receives General Revenue from the State of Texas to provide 

outreach or extension training to the States Emergency Responders. In FY15, more than 20,000 

responders of the State trained through this program at no cost to them or their department. 

Through its accreditation with the National Professional Qualification System (NPQS), or ProBoard, 

TEEX/ESTI is authorized to offer certification training in compliance with National Fire Protection 

Association (NFPA) standards.382ESTI is currently accredited to provide certifications in 46 individual 

disciplines. TEEX/ESTI currently leads the nation in the number of ProBoard certifications issued on an 

annual basis. The certification levels TEEX/ESTI offers include:

• NFPA 1001 Fire fighter I & II. 

• NFPA 1002 Driver/Operator Pumper, Aerial, ARFF, Mobile Water Supply. 

• NFPA 1003 Airport Firefighter. 

• NFPA 1006 Rescue Technician - Rope Rescue I, II; Trench Rescue I, II; Confined Space Rescue 

I, II; Wilderness Rescue I, II; Vehicle & Machinery I, II; Structural Collapse I, II. 

• NFPA 1021 Fire Office I – IV. 

• NFPA 1031 Fire Inspector I & II, Plans Examiner I.

• NFPA 1041 Fire Instructor I & II. 

• NFPA 1061 Public Safety Telecommunicator I & II. 

• NFPA 1081 Fire Brigade - Incipient, Advanced Exterior, Interior Structural, Leader. 

• NFPA 472 Hazardous Materials - Awareness; Operations Core; Operations Mission Specific: 

PPE, Product Control, Air Monitoring & Sampling, Response to Illicit Laboratory Incidents; 

Technician; Technician w/ Tank Car Specialty; Technician w/ Cargo Tank Specialty; Technician 

w/ Intermodal Tank Specialty; Technician with Flammable Liquids Bulk Storage Specialty; 

Incident Commander. 

ESTI supports FEMA’s HSNTP with the delivery of over twenty different courses across the nation with 

topics that range from tactical level, Wide Area Search and WMD Defensive Operations to simulationdriven incident management courses to executive-level workshops and seminars. In addition, ESTI 

provides technical assistance, exercise planning expertise and event review and After-Action Report 

support to organizations across the nation. Throughout the year, TEEX hosts full-scale operational 

readiness exercises (OREs) that test a team’s entire response capabilities. 

 

381 See: https://teex.org/Pages/about-us/disaster-city.aspx (accessed on December 31, 2015). 382 See: https://teex.org/Pages/Program.aspx?catID=613&courseTitle=Pro%20Board (NPQS) (accessed on December 

31, 2015).

001494
West Fertilizer Company Final Report January 2016

162 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

TEEX/ESTI provides many DHS FEMA funded training programs that can be delivered online, face to 

face, or in a combination format. One such training program funded by DHS FEMA involves HAZMAT 

response; this training is geared toward emergency responders and focuses on the special challenges of 

dealing with WMDs or a terrorist incident, including knowledge of CBRNE events and responses to 

incidents involving CBRNE materials. The Standardized Awareness Training course focuses on training 

responders to meet competency requirements established in NFPA 472, Chapter 4, and in OSHA 29 CFR 

1910.120. The course takes an all-hazards approach to HAZMAT incidents and gives participants the 

knowledge needed to recognize the hazardous material, protect themselves, notify others, and secure the 

scene. Another training program funded by DHS FEMA addresses incident management and response. 

These courses facilitate the implementation of the all-hazards multidisciplinary team-based approach 

outlined in the DHS National Response Framework, which is designed to respond to large-scale or 

expanding incidents, including those involving HAZMAT.383 In addition to the in-person training, ESTI 

offers a variety of web-based training, such as awareness-level courses and those within the innovative 

Online Recruit Academy. These interactive courses provide emergency responders with a convenient way 

to complete knowledge-based training at their own pace. 

There is an increasing need to provide training to responders who have the potential and will be expected 

to respond to Industrial Facilities/Industrial Emergencies in their area. There are multitudes of newlyintroduced specialized hazards across the United States that First Responder communities have the 

potential to respond to. The increased potential for incidents to occur in these areas further highlights the 

need for all response and emergency management personnel be trained on how to properly preplan for, 

respond to, and mitigate these specialized incidents. Components of this training should address the 

preplanning, command, safety, operational, logistical, and local resource coordination and public 

information areas and should focus on assisting local responders in addressing key priorities and a safe 

outcome for their personnel. 

These hazards include emergencies that result from drilling and fracking operations, flammable liquid 

bulk storage facilities, transportation emergencies (pipelines, rail384, trucking, maritime, and air), and 

warehousing or storage of hazardous chemicals and materials such as FGAN. In light of these potential 

exposures to the response community, TEEX has developed a course entitled, “Industrial Emergencies for 

Municipal Based Responders” (IEMBR). This is a two-phased course with the awareness-level 

information contained in Phase I and the hands-on (firefighting and Hazardous Materials Response) 

contained in Phase II. TEEX is currently reaching out across the State of Texas and providing Phase I 

IEMBR training to first responders. Due to the complexity of the Phase II response scenarios and the 

 

383 See: https://teex.org/Pages/Program.aspx?catID=469&courseTitle=ResponseHazardous%20Materials%20and%20Search%20and%20Rescue (accessed on November 6, 2015). 384 TEEX has also developed and is currently delivering a 24-hour Crude by Rail course. TEEX worked in 

corporation with rail service providers, owning companies and the response community to develop this course. It 

provides a detailed look at rail car construction, hazards associated with rail car emergencies, response plans, 

resource management and responder safety. 

001495
West Fertilizer Company Final Report January 2016

163 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

need for realistic training props, all Phase II training is conducted at the TEEX/ESTI Brayton Firemen’s 

Training Field. Phase II of the IEMBR course is more costly than Phase I due to the flammable liquid 

fuels, LPG and firefighting foams that are used as part of the training.385 There is a critical need to 

establish a funding mechanism for First Responders to attend IEMBR Phase II training.

7.7.3 National Membership Firefighter Associations

Although several bodies represent the interests of firefighters and emergency responders, the three most 

prominent labor unions and associations for firefighters in the United States are the International 

Association of Fire Fighters (IAFF), NVFC, and IAFC. Combined, these three associations have more 

than a million members across the United States.386 An important aspect of the mission of each 

association entails providing training information and resources to members.

7.7.3.1 International Association of Fire Fighters (IAFF)

The IAFF387 is a labor union that represents career firefighters in the United States and Canada. 

Established in 1918, the IAFF currently represents a membership of more than 300,000 professional 

firefighters in more than 3,200 fire departments. The IAFF acts to ensure that adequate resources and 

tools, including the development and implementation of new training and equipment, are provided to 

career firefighters and paramedics in all member fire departments. 

7.7.3.2 National Volunteer Fire Council (NVFC)

The NVFC is a nonprofit association that represents the interests of fire and emergency services at the 

national level by providing advocacy, information, resources, and programs to support volunteer first 

responders. The NVFC serves as the voice of the volunteer firefighter in the national arena and supplies 

tools, resources, programs, and advocacy for first responders nationwide. The NVFC also conducts 

national advocacy for first responders, including promoting legislation that benefits the fire and 

emergency medical services. The NVFC offers information, education, and training for volunteer fire and 

EMS organizations throughout their respective states.

388 

7.7.3.3 International Association of Fire Chiefs (IAFC)

The IAFC represents the leadership of firefighters and emergency responders worldwide.389 With a 

network of more than 10,000 fire chiefs and emergency personnel, IAFC members include experts in 

firefighting, EMS, terrorism responses, HAZMAT spills, natural disasters, search and rescue operations, 

and public safety policy. The IAFC was established in 1873 to provide a forum for fire and emergency 

 

385 See: https://teex.org/Documents/2014-04-firetalk.pdf (accessed December 31, 2015). 386 See: http://www.nfpa.org/research/reports-and-statistics/the-fire-service (accessed on December 28, 2015). 387 See: http://client.prod.iaff.org/#page=AboutUs (accessed on December 28, 2015). 388 NVFC. See: http://www.nvfc.org/ (accessed on December 28, 2015).

389 IAFC. See: http://www.iafc.org/About/?navItemNumber=537 (accessed on December 28, 2015).

001496
West Fertilizer Company Final Report January 2016

164 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

service leaders to exchange ideas, develop professionally, and identify the latest products and services 

available to first responders, including career and VFD chiefs.390

8.0 Regulatory Analysis

Multiple federal, state, and local agencies regulate FGAN storage and handling, depending on statutory 

requirements, which can address worker safety, environmental protection, public safety, national security, 

and transportation. Requirements for reporting bulk quantities of FGAN also vary. CSB reviewed FGAN 

safety-related requirements in the United States and found differences in how FGAN facilities are 

identified and regulated. This section includes a discussion of the requirements for FGAN safety and 

security as well as voluntary efforts by industry, including: 

• President Obama’s Executive Order (EO) 13650 (Section 8.1). 

• OSHA Explosives and Blasting Agents standard (Section 8.2). 

• DHS Chemical Facility Anti-Terrorism Standards (CFATS) (Section 8.3). 

• OSHA Process Safety Management (PSM) standard (Section 8.4.1). 

• EPA Risk Management Program rule (Section 8.4.2). 

• EPA Emergency Planning and Community Right-to-Know Act (EPCRA) regulations (Section 

8.5). 

• National fire protection standards and Texas fire codes (Section 8.6). 

• Post incident state and local regulatory developments (Section 8.7). 

• Voluntary industry initiatives (Section 8.8). 

Each of these sections includes background and analysis. The sections provide supporting information 

for the CSB recommendations in Section 11, which includes recommendations to regulatory agencies to 

revise existing standards so that they include FGAN-specific requirements. 

8.1 President Obama’s Executive Order 13650

In the aftermath of the West Fertilizer Company (WFC) incident, President Barack Obama issued EO 

13650, “Improving Chemical Facility Safety and Security,” on August 1, 2013.391 The EO states that 

“...measures can be taken by executive departments and agencies with the regulatory authority to further 

improve chemical facility safety and security in coordination with owners and operators.”392 The EO 

established the Chemical Facility Safety and Security Working Group, which is co-chaired by the 

 

390 According to its website, the mission of the IAFC is to provide leadership to current and future career, volunteer, 

fire rescue, and EMS chiefs; chief fire officers; and company officers and managers of emergency service 

organizations throughout the international community, using vision, information, education, services, and 

representation to enhance their professionalism and capabilities. See:

http://www.iafc.org/About/index.cfm?navItemNumber=537 (accessed on December 28, 2015).

391 Executive Order 13650. “Improving Chemical Facility Safety and Security.” August 1, 2013.

392 Ibid. 

001497
West Fertilizer Company Final Report January 2016

165 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Secretary of Homeland Security, the EPA Administrator, and the Secretary of Labor.393 Working with 

multiple governmental agencies, the EO Working Group was tasked with improving operational 

coordination with state, local, and tribal partners; enhancing federal coordination regarding chemical 

facility safety and security; improving information collection and sharing; modernizing key policies, 

regulations, and standards; and identifying best practices.394 

One of the group’s first deliverables, issued in August 2013, was the document, “Chemical Advisory: 

Safe Storage, Handling, and Management of FGAN.”395 The advisory summarized best practices for AN 

storage, lessons learned from past AN incidents, hazard information, hazard reduction options, emergency 

planning activities, emergency response operations, and information resources.396 In June 2015, the 

advisory was reissued as “Chemical Advisory: Safe Storage, Handling, and Management of Solid 

Ammonium Nitrate Prills.”397 This advisory includes a more detailed and reorganized regulatory 

information section.398 It has been distributed by government agencies such as EPA and OSHA and by 

the two U.S. manufacturers of FGAN, CF Industries and EDC. 

In addition, in June 2014, the EO Working Group published “Actions to Improve Chemical Facility 

Safety and Security—A Shared Commitment: Report for the President.”399 That report summarized the 

EO Working Group’s progress, focusing on actions to date, findings and lessons learned, challenges, and 

high-priority next steps.400 The report includes an aggressive action plan that details specifically how the 

EO Working Group has begun to, or will, tackle each of its aforementioned tasks.401 

8.2 OSHA Explosives and Blasting Agents Standard 

The 1971 OSHA Explosives and Blasting Agents standard (29 CFR 1910.109) regulates, in part, the 

storage, use, and transportation of explosives and blasting agents and specifies safety requirements for 

various grades of AN. The standard was based on two national consensus standards—NFPA402 495 

(Code for the Manufacture, Transportation, Storage, and Use of Explosives and Blasting Agents, 1970 

 

393 Ibid. 394 Ibid. 395 See: http://www.ctif.org/sites/default/files/news/files/fed_an_advisory-083013.pdf (accessed on December 28, 

2015). 

396 Ibid. 397 See: http://www.epa.gov/sites/production/files/2015-06/documents/an_advisory_6-5-15.pdf (accessed on 

December 28, 2015). 

398 Ibid. 399 See: https://www.osha.gov/chemicalexecutiveorder/final_chemical_eo_status_report.pdf (accessed on December 

28, 2015). 400 Ibid. 401 See: https://www.osha.gov/chemicalexecutiveorder/ (accessed on December 28, 2015). 402 NFPA codes, standards, and guides are voluntary consensus products that are not enforceable unless adopted into 

law.

001498
West Fertilizer Company Final Report January 2016

166 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Edition), and NFPA 490 (Code for the Storage of Ammonium Nitrate, 1970 Edition).

403 The first nine 

sections of OSHA’s Explosives and Blasting Agents standard, (a) through (h), cover the storage and 

transportation of explosives and blasting agents. The last two sections, (j) and (k), address small arms 

ammunition and the manufacture of explosives and pyrotechnics. 

AN is covered in the middle of the standard, under section (g) when it is used as a blasting agent404 and 

under section (i) when it is stored in the form of crystals, flakes, grains, or prills, including fertilizer 

grade, dynamite grade, nitrous oxide grade, technical grade, and other mixtures containing 60 percent or 

more AN by weight.405 Included in 29 CFR 1910.109(i) are requirements for storage, building 

construction, ventilation, and fire protection associated with bulk and bagged AN. These requirements 

cover facilities that store more than 1,000 pounds of AN.406 At the time of the incident, the WFC facility 

stored FGAN well in excess of 1,000 pounds. 

The standard includes various requirements for the bulk storage of AN.407 For example, the standard 

mandates that warehouses have “adequate ventilation or be capable of adequate ventilation in case of 

fire.”408 Also, storage bins must “be clean and free of materials which may contaminate AN.”409 Bins 

storing bulk quantities of AN may not be constructed with galvanized iron, copper, lead, or zinc “unless 

suitably protected,” and wooden bins “protected against impregnation by AN” are permitted.410 The 

partitions dividing AN storage from other products that would contaminate the AN must be of “tight 

construction.”411 To avoid potentially dangerous contamination, AN must be in a separate building or 

must be separated by “approved type firewalls of not less than 1 hour fire-resistance rating from storage 

of organic chemicals, acids, or other corrosive materials, materials that may require blasting during 

processing or handling, compressed flammable gases, flammable and combustible materials or other 

contaminating substances.”412 

While CSB found no evidence to suggest that any detonation of AN in the United States has occurred at a 

facility compliant with OSHA’s 1910.109(i) standard, CSB does find that these requirements do not offer 

sufficient safeguards concerning the bulk storage of FGAN. This conclusion is evidenced best by the 

 

403 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=19509

(accessed on December 28, 2015). The NFPA 490 standard went through several updates. The most recent edition 

was issued in 2002. In 2010, NFPA incorporated NFPA 490 into a more recently developed standard, NFPA 400 

(Hazardous Materials Code) (discussed in detail in Section 8.6.1). OSHA, however, has not updated its Explosives 

and Blasting Agents standard to incorporate the provisions of NFPA 400 because OSHA’s legal authority to adopt

consensus standards expired in the mid-1970s. 404 Because it was not pertinent to this investigation, 29 CFR 1910.109(g) is not discussed. 405 29 CFR 1910.109(i)(1)(i)(a). 406 29 CFR 1910.109(i)(2)(i). 407 Because bulk storage of FGAN was primarily at issue at the WFC facility, bagged storage is discussed only briefly 

for the sake of comparison. 408 29 CFR 1910.109(i)(4)(i)(a).

409 29 CFR 1910.109(i)(4)(ii)(a). 410 Ibid. 411 Ibid. 412 29 CFR 1910.109(i)(5)(i)(a).

001499
West Fertilizer Company Final Report January 2016

167 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

WFC incident, in which the use of wooden bins (albeit not untreated wooden bins) to store FGAN was 

allowed under the 1910.109(i) standard. The CSB found that such construction likely facilitated the fire’s 

spread between storage bins.413 Moreover, the CSB found that even if the wooden bins had been treated 

(e.g., with coated or clad materials), the incident may have still occurred. This is because, as discussed 

previously, although coated or clad materials may protect wood against AN impregnation, they are not 

fire resistant and will still burn. Accordingly, CSB issued public comments on March 31, 2014 when 

OSHA released a Request for Information (RFI) to CSB and other stakeholders on its Explosives and 

Blasting Agents standard.414 

The comments made by CSB pertained in part to the weakness of the provisions in 29 CFR 1910.109(i), 

particularly with respect to the bulk storage of FGAN.415 Specifically, CSB expressed concern that, 

because of certain gaps in 1910.109(i), users are left to decide appropriate safety measures without proper

instruction.

416 For example, 1910.109(i) permits the use of wooden bins “protected against impregnation 

of AN” without defining the word “impregnation.”417 Furthermore, even if the word had been defined, 

CSB noted that the use of wooden bins is not recommended in other countries, such as the United 

Kingdom (U.K.), which recommend the use of concrete for bulk AN storage.418 Moreover, CSB noted in 

its RFI comments that 1910.109(i) does not provide sufficient fire protection measures with respect to the 

storage of bulk quantities of FGAN because it requires sprinklers only for bagged AN in amounts 

exceeding 2,500 tons.419 CSB concluded that the requirement for sprinklers (or other fire suppression 

methods) as well as fire detection equipment likely would have helped minimize the severity of the 

impact of the WFC fire and explosion on the facility and on the surrounding community.420 

In addition, CSB commented that the title of the standard, “Explosives and Blasting Agents,” should be 

revised so that it is clear that FGAN not used as a blasting agent or explosive is also covered under the 

standard.421 As currently titled, the name of the standard might mislead readers to believe that the 

standard applies only to the explosives industry. Accordingly, CSB recommended that the title be revised 

to clearly indicate that the standard also applies to the fertilizer industry. Similarly, CSB noted that no 

scope describing the purpose and application of the standard is listed at the beginning of the standard.422 

Rather, the scope of 29 CFR 1910.109(i) that applies to FGAN appears in the middle of the standard. 

 

413 It should be noted, however, that 29 CFR 1910.109(i) did prohibit the configuration and contents of the seed room 

adjacent to the AN bin. 

414 On December 9, 2013, OSHA issued an RFI on 17 issues regarding revision to the agency’s regulatory standards. 

CSB commented on 15 of the 17 issues in a public comment dated March 31, 2014. The CSB comments are posted 

on the OSHA website; see: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 

2015). 415 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 416 Ibid. 417 Ibid. 418 Ibid. 419 Ibid. See: 29 CFR 1910.109(i)(7)(i). 420 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 421 Ibid. 422 Ibid. 

001500
West Fertilizer Company Final Report January 2016

168 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB recommended changing this organization so that the scope is specified early in the document and is 

easy to locate. CSB concluded that the implementation of such recommendations regarding the 

standard’s title and scope would likely make the standard easier to understand. 

In addition to providing comments in response to the OSHA RFI, CSB reviewed guidance documents on 

FGAN from government and industry sources, finding that the only pre-WFC incident reference to the 

OSHA standard was in an EPA Chemical Safety Alert, “Explosion Hazard from AN,” from December 

1997.423 In a letter to EPA, The Fertilizer Institute (TFI), a major trade association composed of fertilizer 

industry representatives, contended that the reference was inaccurate and that EPA therefore should 

remove it from its alert.424 Specifically, TFI said that the standard “was not applicable to facilities 

handling AN, unless the facility also handles an explosive or blasting agent.”425 This assertion, however, 

is incorrect; no part of the standard supports such a reading. As previously mentioned, 29 CFR 

1910.109(i) clearly states that it applies to “. . . the storage of AN in the form of . . . prills including 

fertilizer grade . . .”426 Nonetheless, CSB finds that additional and well publicized guidance is needed to 

explain the applicability and provisions of the standard. 

Fertilizer industry representatives reported to the Government Accountability Office (GAO) that it was 

not well known that 1910.109(i) applies to FGAN.427 While conducting interviews with WFC 

management and employees, CSB found that WFC personnel knew little about the pertinent section. 

During these interviews, CSB learned that OSHA conducted its last inspection of the WFC plant428 in 

1985, when the facility was cited for various violations concerning anhydrous ammonia, respiratory 

protection, and recordkeeping. CSB found no evidence that OSHA cited the WFC for violating any 

requirement of 1910.109(i) before the April 2013 fire and explosion. It is unknown whether OSHA 

inspected the facility against this section of the standard. 

CSB found that, in addition to WFC personnel, others who would reasonably be expected to know about 

29 CFR 1910.109(i) might not have had such knowledge. After the current owners acquired the facility 

in 2004, third-party safety consultants who visited the facility never referenced 1910.109(i) in their final 

inspection reports. In fact, in reviewing documentation provided by the WFC, CSB identified only one 

mention of 1910.109(i)—in a Safety Data Sheet (SDS) provided by one of the WFC’s FGAN suppliers, 

CF Industries, which the WFC received in 2012. The GAO confirmed this observation, noting in its May 

 

423 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/P100BH59.PDF?Dockey=P100BH59.PDF (accessed on December 28, 

2015). 

424 The Fertilizer Institute. “Fertilizer Grade Ammonium Nitrate: Properties and Recommended Methods for 

Packaging, Handling, Transportation, Storage and Use.”

425 Leason, Chris S., counsel to TFI. Letter to Tawai-David Chung, EPA OSWER, CEPPO, June 27, 1997. At the 

request of CSB, EPA conducted a search to find its final signed response to TFI’s letter. Because of the age of the 

document, it would only exist in paper form; however, EPA no longer has paper files from that time frame. Thus, 

EPA’s response to this letter is unknown. 

426 29 CFR 1910.109(i)(1)(i)(a). 427 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” 

Washington, DC: GAO, May 2014. 428 Certain structures of the WFC plant had not yet been built at the time of the 1985 OSHA inspection. 

001501
West Fertilizer Company Final Report January 2016

169 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2014 report that it reviewed four SDSs from producers of solid FGAN fertilizer and only one mentioned 

the pertinent section of the OSHA standard.429 CSB notes as a concern the fact that the fertilizer industry, 

as recently as 2014, reported that personnel exhibited little recognition of the applicability of 1910.109(i)

to FGAN.

430

With respect to enforcement, CSB found very little history of OSHA using 29 CFR 1910.109(i) to cite 

fertilizer facilities. Table 11 shows OSHA’s record of 1910.109(i) citations and also the citation that 

OSHA issued against the WFC by Standard Industrial Classification (SIC)431 code. 

Table 11. OSHA 29 CFR 1910.109(i) Citation History

No. Facility Inspection

Year

Standard Industrial 

Classification

1. Coshocton Farm Bureau

(Coshocton, OH)

1974 5083: Farm and Garden Machinery

2. Smith-Douglass Chemical Div. Bo. 

(Clayton, DE)

1975 5191: Farm Supplies

3. Jr. Simplot Co. 

(Bartley, NE)

1975 2875: Fertilizers, Mixing Only

4. Farmers Union Cooperative Oil

(Flandreau, SD)

1975 5541: Gasoline Service Stations

5. Old Fox Chemical Co, Inc.

(East Providence, RI)

1976 2875: Fertilizers, Mixing Only

6. Drake Chemical Inc. 

(Lock Haven, PA)

1976 2865: Cyclic Crudes and 

Intermediates

7. IMC Chemical Group Inc. Trojan

(New Tripoli, PA)

1976 2892: Explosives

8. Atlas Powder Co. Kinepak

(Alvarado, TX)

1977 2892: Explosives

9. Jacklin-Plant Food Center

(Post Falls, ID)

1977 5191: Farm Supplies

10. Genstar Chemical Inc.

(Presque Isle, ME)

1978 2873: Nitrogenous Fertilizers 

11. Nipak Energy Corp.

(Krum, TX)

1979 2892: Explosives

12. Iuka Coop Exchange

(Iuka, KS)

1979 5153: Grain and Field Beans

13. Beaver Explosives Inc.

(New Castle, PA)

1980 2892: Explosives

14. Independent Explosives Co. of 

Pennsylvania

(Pittston Township, PA)

1987 2892: Explosives

 

429 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” 

Washington, DC: GAO, May 2014. 430 Ibid. 431 SIC is a system for classifying industries according to industry-specific four-digit codes.

001502
West Fertilizer Company Final Report January 2016

170 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

15. Thermex Energy Corp.

(Parrish, AL)

1990 2892: Explosives

16. Kesco, Inc. 

(Kittanning, PA)

1994 2892: Explosives

17. Howard Fertilizer Company, Inc.

(Orlando, FL)

1997 2875: Fertilizers, Mixing Only

18. Hall Explosives Inc. 

(Good Springs-Tremont, PA)

1998 1629: Heavy Construction, Nec.

19. American East Explosives

(Mount Carmel, PA)

1999 2892: Explosives

20. West Fertilizer Co.

(West, TX)

2013 5191: Farm Supplies

As shown in Table 11, 19 inspections resulted in citations, excluding the citation against the WFC. The 

SIC code for 10 of these citations are clearly nonfarm, addressing mostly explosives; the nine remaining 

citations are related to farm supplies. It is important to note, however, that these data reflect citations 

only, not inspections. That is, although the facilities in Table 11 were inspected against, and cited for 

violations of, 1910.109(i), they do not represent all inspections conducted by OSHA against that section 

of the standard. It is impossible to determine whether OSHA inspected any other facilities for 

compliance, but did not cite them. CSB found no evidence of citations from 1999 to 2013. 

The OSHA 29 CFR 1910.109(i) citation history in Table 11 is also similar to that of more recent OSHA 

enforcement data from 2005 to 2013. These data show that no other facility with the same North 

American Industry Classification System (NAICS)432 code as the WFC (NAICS Code 424910) received a 

citation for violating 1910.109(i). The GAO May 2014 report similarly concluded that OSHA rarely 

issued citations for violations of the standard’s requirements for FGAN storage at fertilizer facilities.433 

GAO found that “a citation for a violation of [OSHA’s] AN storage regulations was issued as a result of 

an inspection of a fertilizer facility only once before the explosion in West, Texas.”434 

After the WFC explosion, OSHA issued 24 citations to the WFC on October 9, 2013, including nine 

citations for serious violations of 29 CFR 1910.109(i).435 These violations included lack of adequate 

ventilation, absence of fire-resistive construction, and improper storage and bin pile heights.436 The 

agency also cited the WFC for not ensuring that the wooden bins it used to store FGAN were treated to 

prevent FGAN impregnation.437 OSHA and the WFC ultimately settled, with the WFC agreeing to pay

 

432 NAICS is the standard used by Federal statistical agencies in classifying business establishments for the purpose of 

collecting, analyzing, and publishing statistical data related to the U.S. business economy. 433 GAO. “Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with Ammonium Nitrate.” 

Washington, DC: GAO, May 2014. 434 Ibid. 435 OSHA. “Citation and Notification of Penalty to Adair Grain,” October 9, 2013. 436 Ibid. 437 Ibid. 

001503
West Fertilizer Company Final Report January 2016

171 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

penalties without admitting guilt about violating the standards under which it was cited, including 

1910.109(i). 

There is evidence that the WFC owners made efforts to comply with regulations when notified of 

noncompliance. When the WFC owners acquired the facility in 2004, state and federal regulators found 

them to be noncompliant with environmental, product quality, and transportation regulations—issues that 

the owners promptly corrected. For example, Federal EPA inspectors cited the WFC for not refiling its 

Risk Management Plan (RMP) registration in 2004.438 This citation prompted the WFC to hire an 

insurance company to develop a comprehensive RMP for the safe storage of its anhydrous ammonia.439 

Also, Texas Commission on Environmental Quality (TCEQ) inspectors issued a citation to the facility in 

2006 for not having an air permit for anhydrous ammonia.440 The WFC subsequently developed 

maintenance and inspection programs to prevent anhydrous ammonia releases. As a result of these 

inspections and citations, the WFC took appropriate corrective actions. The importance of regulatory 

awareness and notification, therefore, cannot be overemphasized. 

8.2.1 OSHA Issuance of Guidance on Explosives and Blasting Agents Standard

In December 2014, the OSHA Directorate of Enforcement Programs issued investigatory and citation 

guidance to OSHA enforcement personnel on elements of 29 CFR 1910.109. The nine-page guidance 

document provides additional clarification of the scope of 1910.109(i) and its application to facilities that 

store FGAN. This document includes specific compliance guidance for the majority of standard 

provisions and describes conditions that would be considered in or out of compliance. This guidance 

further clarifies the application of the standard to facilities storing FGAN and provides a list of NAICS 

industry codes for facilities most likely to manufacture, use, store, handle, or possess FGAN. The list of 

NAICS codes includes facilities such as the WFC plant and states that particular attention to AN hazards 

is needed when inspecting these facilities. The guidance also clarifies the standard’s definition of 

“adequate ventilation” and includes the types of ventilation likely to be unacceptable under the 

regulations as well as a ventilation rate calculation to assess compliance. 

Furthermore, the guidance document provides additional clarification on the subject of wood protection 

against FGAN impregnation. As discussed previously, 1910.109(i) does not specifically define compliant 

approaches for the treatment of wood to protect against FGAN impregnation. The standard prohibits 

untreated wood bin construction for FGAN storage. Although OSHA does not recommend the use of 

treated wood bins, wood with impermeable coating and claddings (such as two-part epoxy coatings, steel 

sheet cladding, or sodium silicate) are considered acceptable means for protecting wood against FGAN 

impregnation. OSHA provides additional guidance for varying types of wood construction that might be 

encountered during field inspections, including citable conditions such as improperly treated wood and 

 

438 EPA. “Enforcement Case Report to West Chemical & Fertilizer Company,” August 14, 2006. 

439 Triangle Insurance Company. Anhydrous Ammonia Supplement for WFC, 2006. 440 TCEQ. “TCEQ Enforcement Referral to West Chemical & Fertilizer,” June 21, 2006. 

001504
West Fertilizer Company Final Report January 2016

172 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

treated wood that has not been maintained to protect the coating integrity. The guidance also addresses 

pile heights for clumping and caking conditions and fire prevention. 

The 2014 guidance document for 1910.109(i) addressed some of the issues with vague wording that CSB 

raised in the RFI comments. Some of the requirements listed under the standard, however, do not provide 

sufficient safeguards to a facility owner storing bulk quantities of FGAN. In the case of the WFC 

incident, the wood-constructed bins were made of combustible materials and likely facilitated the spread 

of a fire between storage bins. According to OSHA, AN impregnation of porous combustible materials, 

such as wood, can accelerate combustion in the event of a structural fire and increase the explosion 

risk.441 OSHA permits the use of wood bins and wood construction only if the wood is protected against 

impregnation. Although coated or clad materials can protect against AN impregnation, they are not fire 

resistant and will still burn, contributing to the generation of heat during a fire. CSB determined that the 

wood-constructed bins likely contaminated the AN, ultimately leading to the detonation by increasing AN 

energy and sensitivity (discussed in Section 4.2.1). Completely eliminating wood and other combustibles 

as materials for constructing FGAN bins and storage facilities greatly reduces the possibility of 

contaminating FGAN during a fire or smoldering event.

Although OSHA enforcement guidance and other efforts have provided greater clarity on how 

1910.109(i) applies to FGAN facilities, OSHA still needs to revise and update the standard to incorporate 

the most recent provisions in NFPA 400 (2016 Edition) that address the safe storage of FGAN. 

OSHA cannot enforce some of the regulations in the current 1910.109(i) because they contain 

requirements reserved for the authority having jurisdiction, such as the municipal or state code official for 

occupancy permits. Moreover, OSHA cannot cite the following requirements in the standard:

• 29 CFR 1910.109(i)(2)(ii): Approval of large quantity storage shall be subject to due 

consideration of the fire and explosion hazards, including exposure to toxic vapors from burning 

or decomposing ammonium nitrate. 

• 29 CFR 1910.109(i)(2)(iii)(e): The continued use of an existing storage building or structure not 

in strict conformity with this paragraph may be approved in cases where such continued use will 

not constitute a hazard to life.

Because the current version of 1910.109(i) has limited enforcement in some areas—and because NFPA 

400 (2016 Edition) (discussed in Section 8.6.1.1) includes updated provisions, some in response to the 

WFC incident, for increasing the safety of AN storage facilities—OSHA should update 1910.109(i) to 

include requirements similar to the provisions in NFPA 400 (2016 Edition). It also should revise the rules 

that currently are enforceable only by municipal or state officials.

 

441 OSHA enforcement directive on 1910.109(i). 

001505
West Fertilizer Company Final Report January 2016

173 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.2.2 Need for an Emphasis Program

Unfortunately, only after the WFC incident was more attention focused on the hazards of FGAN and the 

role of applicable regulations. Since the explosion and issuance of the EO, OSHA has worked to increase 

awareness of FGAN and the scope of 29 CFR 1910.109(i) through the joint agency advisory on safe 

storage of FGAN, the letter to the fertilizer industry, and the guidance document for compliance officers 

to assist in enforcing the 1910.109 standard for FGAN facilities. However, enforcement guidance does 

not provide the resources needed by OSHA to increase the frequency of inspections, although such 

guidance may help ensure that 1910.109(i) is applied appropriately when OSHA compliance officers 

happen to inspect facilities that fall under the rule. 

A more realistic and immediate approach to confirm that FGAN facilities are complying with the standard 

would be for OSHA to launch a regional emphasis program (e.g., in Regions IV, VI, and VII442) where 

these types of facilities are more common. A regional emphasis program would include a certain number 

of annual inspections per year, which would facilitate bringing FGAN facility operators into compliance 

with both regulatory and industry standards and would reduce the potential for a future event similar to 

the WFC incident. 

Imposing stricter requirements on AN storage and handling could take several years before enactment 

into federal regulations. OSHA has initiated several national, regional, and local emphasis programs 

targeted at specific industries or located in specific geographical areas to help prevent hazards. Such 

emphasis programs have successfully focused inspection and enforcement efforts on specific industries. 

A 1910.109(i) emphasis program can include NFPA 400 (2016 Edition) as a guidance document for 

compliance officers to support recognition of hazardous conditions or issuance of violations when found. 

It would also prompt improvement of safe FGAN storage and handling practices through increased 

awareness and would allow OSHA to collect information and data that could support future revisions to 

current regulations on FGAN.

8.3 Chemical Facility Anti-Terrorism Standards (CFATS)

DHS promulgated the CFATS in 2007 to address security issues at high-risk chemical facilities, including 

those that store certain quantities of FGAN. The rule establishes risk-based performance standards for 

chemical facility security and requires facilities to prepare vulnerability assessments and security plans to 

protect the public from a breach of security or an intentional release. 

Under CFATS, DHS collects information from facilities that possess designated quantities of chemicals 

of interest (COIs).

443 In creating the COI list, DHS referenced other established lists that regulate 

 

442 These regions include the following states: Alabama, Florida, Georgia, North Carolina, South Carolina, Tennessee, 

Mississippi, Kentucky, Nebraska, Kansas, Missouri, Iowa, Texas, Oklahoma, Arkansas, Louisiana, and New 

Mexico. 443 CFATS § 27.210(a)(1)(i). 

001506
West Fertilizer Company Final Report January 2016

174 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

chemicals—including the list of chemicals covered under the EPA Risk Management Program, the 

Chemical Weapons Convention, and DOT—and a list of chemicals with known inhalation hazards. The 

COI list includes 322 chemicals and also screening threshold quantities for each chemical as it relates to 

each of the three defined security hazards (release, theft, and sabotage). 

Chemical facilities that meet the COI criteria listed in Appendix A of the CFATS rule must complete and 

electronically submit a Chemical Security Assessment Tool (CSAT) Top-Screen form to DHS. Using the 

information collected from facility Top-Screen information, DHS assigns a preliminary risk-based tier—

from the highest (tier 1) to the lowest “high-risk” level (tier 4) and the “not high-risk” level (tiered out)—

based on a basic assessment of the potential consequences in association with the chemical holdings at 

each facility.444 Once a preliminary tier is assigned, each facility in tiers 1 through 4 must submit a CSAT 

Security Vulnerability Assessment to DHS, and DHS uses that assessment to make a final determination 

of the facility’s assessed level of risk. If DHS retains the facility in one of the four high-risk tiers, the 

facility must submit a site security plan. DHS reviews the plan, conducts an onsite inspection of the 

facility, and approves the plan if it is deemed adequate relative to the risks inherent in the facility, its 

chemical holdings, and potential consequences of a security breach. 

Since publication of the CFATS rule, DHS has received more than 50,000 Top-Screen forms submitted 

by chemical facilities. As of September 2015, DHS covers 3,182 high-risk facilities nationwide, and 

2,607 of those sites have undergone onsite authorization inspections. 

8.3.1 AN Screening Thresholds

FGAN is listed in CFATS Appendix A as a DHS COI. A facility reports to DHS based on possession of 

AN under three conditions: 

1. If a facility possesses 5,000 pounds or more of FGAN with more than 0.2 percent combustible 

substances, including any organic substance calculated as carbon, to the exclusion of any other 

added substance in bulk storage, the facility must report. Facilities meeting this threshold must 

also submit information to DHS on quantity and on method of storage or packaging. 

2. If a facility possesses 400 pounds or more of FGAN with more than 0.2 percent combustible 

substances, including any organic substance calculated as carbon, to the exclusion of any other 

added substance in transportation packaging, the facility must report. 

3. If a facility possesses 2,000 pounds or more of solid FGAN with a nitrogen concentration of 23

percent or higher in transportation packaging, the facility must report. 

CSB requested and reviewed CFATS data from all facilities in the United States that submitted 

information to DHS for storage of FGAN as of March 2014. According to the DHS data, 1,351 facilities 

in the United States store AN in quantities that exceed the screening thresholds. The majority of those 

 

444 When determining whether a facility is high risk, DHS primarily focuses on the potential consequences associated 

with a successful terrorist attack on the facility (including the use of stolen or diverted materials in a separate attack 

offsite). A threat factor also is incorporated into the risk assessment for facilities with release hazards.

001507
West Fertilizer Company Final Report January 2016

175 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

facilities store FGAN for agricultural uses (Figure 73). Based on the NAICS codes submitted with TopScreen information, 46 percent of the facilities that report to DHS stock FGAN for agricultural purposes 

such as farm merchandising and wholesale or crop preparation. An additional 6 percent store FGAN for 

fertilizer mixing. 

Figure 73. Percentage of AN Storage Facilities by Industry (Source: DHS)

In 2008, DHS filed a reporting extension to agricultural facilities meeting screening thresholds of FGAN 

for farmers and agricultural end users of FGAN, such as the preparation and application of crops, feed, 

land, or livestock.445 However, this extension does not apply to chemical distribution facilities or to 

commercial chemical application services, such as the WFC. At the time of the April 2013 explosion, the 

WFC possessed an estimated maximum of 120,000 pounds of FGAN, about 60 times the screening 

threshold of 2,000 pounds, but did not submit Top-Screen information to DHS as required under the 

CFATS. Consequently, DHS was unaware that the WFC possessed FGAN until the 2013 explosion. 

After the incident, the WFC retroactively submitted a Top Screen to DHS upon notification that it was not 

compliant with the rule, and DHS did not issue a citation to the WFC for originally failing to submit the 

form. If the WFC had complied with the CFATS, a CFATS inspection or assistance visit might have 

noted the storage conditions at the WFC facility and prompted change. In addition, DHS engagement 

 

445 73 Federal Register 1640. 

001508
West Fertilizer Company Final Report January 2016

176 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

with facility management might have prompted greater engagement by local law enforcement, which in 

turn might have supported greater involvement by other community emergency services. 

8.4 Safety Management Programs

Following a number of major chemical accidents in the United States and abroad in the 1970s and 1980s, 

Congress amended the Clean Air Act (CAA) in 1990 to require both OSHA and EPA to publish new 

regulations to help prevent similar accidents. Through Section 304 of the CAA Amendments, Congress 

directed the Secretary of Labor, in coordination with the EPA Administrator, to promulgate, pursuant to 

the Occupational Safety and Health Act of 1970, a chemical process safety standard to prevent accidental 

releases of chemicals that could pose a threat to employees.446 Also, through CAA Amendments Section 

112(r), Congress required EPA to publish regulations and guidance for chemical accident prevention at 

facilities using substances that posed the greatest risk of harm from accidental releases.447 The following 

sections focus on the intertwined regulations that OSHA and EPA developed – the OSHA Process Safety 

Management of Highly Hazardous Chemicals standard and the EPA Risk Management Program rule. 

8.4.1 OSHA Process Safety Management Standard

OSHA’s Process Safety Management of Highly Hazardous Chemicals standard (29 CFR 1910.119) 

(known as the PSM standard) became effective in May 1992.448 The standard contains requirements for 

preventing or minimizing the consequences of catastrophic releases of toxic, reactive, flammable, or 

explosive chemicals.449 It includes the following 14 elements: 

1. Employee participation. 

2. Process safety information. 

3. Process hazard analysis. 

4. Operating procedures. 

5. Training. 

6. Contractors. 

7. Pre-startup safety review. 

8. Mechanical integrity. 

9. Hot work permits. 

10. Management of change. 

11. Incident investigation. 

12. Emergency planning and response. 

13. Compliance audits. 

 

446 See: https://www.osha.gov/Publications/osha3132.html (accessed December 28, 2013). 447 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed December 

28, 2015). 

448 OSHA. “Process Safety Management.” OSHA 3132, 2000.

449 29 CFR 1910.119. 

001509
West Fertilizer Company Final Report January 2016

177 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

14. Trade secrets.450 

The PSM standard states that it applies, in part, to “a process which involves a chemical at or above the 

specified threshold quantities listed in Appendix A [List of Highly Hazardous Chemicals, Toxics and 

Reactives] to this section.”451 Notably, FGAN is not on this list.

In deciding which chemicals to regulate under the PSM standard, OSHA reviewed potential “highly 

reactive and explosive substances,” as required by Section 304(b) of the CAA Amendments.452 OSHA 

considered information drawn from multiple sources, including EPA, DOT, World Bank, NFPA, the 

Health and Safety Commission of the U.K., and the states of Delaware and New Jersey.453 With respect 

to reactives, OSHA chose to include only those chemicals with the two highest (i.e., most dangerous) 

reactivity ratings under NFPA 490 because of the significant risk that they posed to workers.454 These 

chemicals had reactivity ratings of 3 or 4.455 FGAN, however, was left off the PSM list, despite having a 

reactivity rating of 3.456 Although the agency did consider adding FGAN to the PSM list in the late 

1990s, this effort failed due to “resource constraints and other priorities.”457 Thus, FGAN has yet to be 

regulated under the PSM standard. 

Anhydrous ammonia, on the other hand, is on the List of Highly Hazardous Chemicals, Toxics and 

Reactives, with a threshold quantity of 10,000 pounds. CSB found that, at the time of the incident, the 

WFC was storing the equivalent of 34,000 pounds of anhydrous ammonia, more than three times the 

threshold quantity that triggers PSM coverage. CSB also discovered that the WFC had previously stored 

54,000 pounds of anhydrous ammonia in 2006 and 2011. Given these facts, the WFC should have 

complied with the PSM standard because the company stored anhydrous ammonia, at least in 2006, 2011, 

and 2013, in quantities that exceeded its threshold quantity. However, CSB learned that the PSM 

standard did not apply to the WFC at the time of the incident because the facility qualified under OSHA’s 

interpretation of the standard’s retail facilities exemption. 

At the time of the incident, a facility qualified under the retail facilities exemption if the following 

conditions were met: (1) the facility contained a highly hazardous chemical in a quantity that met or 

exceeded the threshold quantity for the chemical; (2) the facility used a process458 covered by the PSM 

 

450 Ibid. 451 29 CFR 1910.119(a)(1)(i). 452 CONSAD OSHA Report, 1988. 453 55 Federal Register 29150. 454 CONSAD OSHA Report, 1988. 455 Ibid. 456 Federal OSHA in discussion with CSB, May 14, 2015. 457 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946

(accessed December 28, 2015). 

458 The PSM standard defines “process” as any activity involving a highly hazardous chemical, including any use, 

storage, manufacturing, handling, or onsite movement of such chemicals (or any combination of these activities). It 

also states that, for purposes of this definition, any group of vessels that are interconnected—and separate vessels 

001510
West Fertilizer Company Final Report January 2016

178 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

standard; and (3) more than 50 percent of the facility’s income was derived from direct end users.459 The 

WFC facility met all three conditions for its storage of anhydrous ammonia. It stored anhydrous 

ammonia, a highly hazardous chemical, in quantities that exceeded its threshold quantity. Also, the 

facility used a process because it stored the anhydrous ammonia, and storage meets the PSM standard 

definition of a “process.” Because the WFC primarily sold its products, including anhydrous ammonia, to 

farmers (i.e., direct end users), the company met the third condition as well. Thus, the WFC qualified 

under the PSM standard’s retail facilities exemption and was not required to comply with the standard. 

If the PSM standard had applied to the WFC for its storage of anhydrous ammonia however, the WFC 

would have been required to conduct a process hazard analysis (PHA). A PHA must address the 

following:

• Hazards of the process. 

• Identification of any previous incident that had a potential for catastrophic consequences in the 

workplace. 

• Engineering and administrative controls applicable to the hazards and their interrelationships, 

such as appropriate application of detection methodologies to provide early warning of releases, 

with acceptable detection methods that might include process monitoring and control 

instrumentation with alarms and also detection hardware such as hydrocarbon sensors. 

• Consequences of a failure of engineering and administrative controls. 

• Facility siting. 

• Human factors. 

• Qualitative evaluation of a range of the possible safety and health effects on employees in the 

workplace if a failure of controls occurs.

460

The WFC would have had to address facility siting as part of its PHA. Facility siting refers to the 

location of the covered process and its proximity to various other components within the facility’s 

property.

461 It does not refer to the site of the facility in relation to the surrounding community.462 A 

facility siting analysis at the WFC likely would have identified the close proximity of the facility’s FGAN 

storage warehouse and its anhydrous ammonia storage tanks, thus triggering implementation of necessary 

safeguards to mitigate the possibility of potentially catastrophic successive incidents involving the two 

hazardous chemicals. This observation was a critical element of CSB’s investigation because evidence 

indicated that the FGAN explosion damaged the facility’s anhydrous ammonia tanks. If more force had 

been applied to the tanks, their contents could have been released into the neighboring community and 

 

that are located so that a highly hazardous chemical could be involved in a potential release— must be considered a 

single process.

459 OSHA interpretation letter. See: 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=23885

(accessed December 28, 2015). 460 See: https://www.osha.gov/Publications/osha3132.html (accessed on December 28, 2015). 461 See: https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=1558 (accessed 

on December 28, 2015). 462 Ibid. 

001511
West Fertilizer Company Final Report January 2016

179 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

caused even more fatalities and injuries. However, the WFC was not required to conduct facility siting 

because it qualified for the PSM standard’s retail facilities exemption. 

CSB communicated its concern about the retail facilities exemption in its March 31, 2014, comments to 

OSHA’s December 9, 2013 RFI.463 CSB asked OSHA to consider whether the retail facilities exemption 

should be revised in order to cover facilities such as WFC, which stored bulk quantities of chemicals 

covered by the PSM standard.464 

8.4.1.1 Revised Interpretation of the PSM Retail Facilities Exemption

On July 22, 2015, OSHA issued a memorandum, “Process Safety Management of Highly Hazardous 

Chemicals and Application of the Retail Exemption” (Retail Exemption Memorandum).465 OSHA noted 

in the memorandum that the PSM exemption for retail facilities does not define the term “retail 

facility.”466 However, the agency also said that the preamble to the PSM standard does explain that 

chemicals in retail facilities are generally sold in “small volume packages, containers, and allotments.”467 

OSHA pointed out that the preamble gives an example of a gasoline station as a type of facility that 

would fit within the definition of a retail facility and thus qualify for the exemption.468 OSHA also 

mentioned in the Retail Exemption Memorandum that other federal agencies define the term similarly.469 

In particular, it states that the U.S. Department of Commerce, which develops NAICS codes, 

characterizes retail trade as follows (emphasis added):

The Retail Trade sector comprises establishments engaged in retailing merchandise, generally 

without transformation, and rendering services incidental to the sale of merchandise. The 

retailing process is the final step in the distribution of merchandise; retailers are, therefore, 

organized to sell merchandise in small quantities to the general public. 470

However, this is not how OSHA had always interpreted its PSM retail exemption. 

After promulgation of the PSM standard, OSHA issued a series of letters of interpretation471 and a PSM 

compliance directive472 that interpreted the retail exemption more broadly than originally intended.473 

Under these interpretations, a facility was considered exempt from the PSM standard if it derived “more 

 

463 See: http://www.csb.gov/assets/1/16/CSB_RFIcomments.pdf (accessed on December 28, 2015). 464 Ibid. 465 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption 

(29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. 466 Ibid. 467 57 Federal Register 6356, 6369. 468 Ibid. 469 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption 

(29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. 470 U.S. Department of Commerce. NAICS Manual, Sector 44–45: Retail Trade. 471 OSHA letters of interpretation explain OSHA requirements, which are set by statute, standards, and regulations. 472 OSHA. Compliance Directive (CPL) 02-03-045. 473 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption 

(29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015.

001512
West Fertilizer Company Final Report January 2016

180 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

than 50 percent of its income from direct sales of highly hazardous chemicals to the end user” (the 50 

percent test).474 This rationale is how the WFC claimed the retail exemption for its storage of anhydrous 

ammonia. If FGAN had been covered under the PSM standard before the WFC incident, the retail 

exemption, as it had been interpreted, would have precluded PSM coverage at the WFC and similar 

facilities. In addition, this 50 percent test allowed employers that sold or distributed large bulk quantities 

of highly hazardous chemicals directly to end users to claim the exemption, even if the end users were 

themselves commercial establishments.475 This reasoning led to confusion about the definition of the 

term “end user.” In its Retail Exemption Memorandum, OSHA said that it did not intend either of these 

outcomes.

OSHA’s Retail Exemption Memorandum rescinded all previous documents, letters of interpretation, and 

memoranda related to the retail exemption and the 50 percent test.476 OSHA states that its interpretation 

of the exemption is now more consistent with the standard’s original intent.477 In reference to the NAICS 

Manual, OSHA states that:

Only facilities, or the portions of facilities, engaged in retail trade as defined by the current and 

any future updates to sectors 44 and 45 of the NAICS Manual may be afforded the retail 

exemption at 29 CFR 1910.119(a)(2)(i).478

Facilities that fall within Sectors 44–45: Retail Trade, consist of a number of subsectors. These facilities 

are now (or are still) considered retail facilities eligible for the retail exemption. Notably, NAICS codes 

typically used for FGAN bulk storage and sales do not fit into one of these classifications. As such, 

facilities that store or sell bulk FGAN do not qualify for the retail exemption. If OSHA’s new 

interpretation were in effect before the incident, the WFC could not have claimed the retail exemption for 

its storage of anhydrous ammonia. Furthermore, it could not have claimed the exemption for its storage 

of FGAN had FGAN been included on the PSM list pre-incident.

If this new interpretation had been in effect before the incident, the WFC might have recognized that its 

storage of anhydrous ammonia was covered by the PSM standard. Although compliance efforts would 

have focused on this potential hazard, the WFC might have learned about FGAN-related hazards as well. 

As previously discussed, if the WFC had conducted a facility siting analysis, it could have identified the 

close proximity of its FGAN storage warehouse to its anhydrous ammonia pressure tanks. This may have 

 

474 Ibid. 475 Ibid. 476 Ibid. 477 Ibid. According to a December 23, 2015, OSHA memorandum, through September 30, 2016, OSHA will not cite 

employers for violations of the PSM standard at facilities that it would not have cited applying the interpretation of 

the term “retail” that was in place prior to July 22, 2015. 

478 OSHA. “Process Safety Management of Highly Hazardous Chemicals and Application of the Retail Exemption 

(29 CFR 1910.119(a)(2)(i)).” OSHA Memorandum, July 22, 2015. Facilities that fall under Sectors 44–45: Retail 

Trade consist of a number of subsectors, including Motor Vehicle and Parts Dealers (NAICS 441), Building 

Material and Garden Equipment and Supplies Dealers (NAICS 444), Gasoline Stations (NAICS 447), and General 

Merchandise Store (NAICS 452). 

001513
West Fertilizer Company Final Report January 2016

181 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

led the WFC to explore the potential for FGAN to catch fire and detonate under certain conditions. It also 

may have caused the WFC to implement safeguards to prevent hazards associated with the two different 

chemicals. 

OSHA’s revised interpretation of the retail exemption would mean that facilities such as the WFC would 

be covered for their use of anhydrous ammonia. According to the fertilizer industry, more than 3,800 

U.S. retail facilities previously exempted by the older interpretation of the retail exemption would be 

covered under the requirements of the PSM standard because of anhydrous ammonia storage. 479 WFC 

use of FGAN could also be regulated directly in the future, but only if FGAN were added to PSM’s List 

of Highly Hazardous Chemicals, Toxics and Reactives. CSB recommends that OSHA consider including 

FGAN for coverage under the PSM standard.480 CSB supports OSHA’s revised interpretation of the retail 

exemption to guarantee that potential changes to the PSM standard will apply to facilities like the WFC 

that store anhydrous ammonia as well as FGAN, which would provide the basis for the CSB’s proposed 

recommendation to add FGAN to the PSM list. 

8.4.1.2 Guidance on Recognized and Generally Accepted Good Engineering Practices 

Under the PSM Standard

OSHA also recently addressed its reference to the common industry term, “recognized and generally 

accepted good engineering practices” (RAGAGEP), under its PSM standard. This term is often used in 

performance-based standards like PSM. Generally, standards can be either prescriptive or performance 

based. As its name suggests, a prescriptive standard sets rigid compliance specifications. A performancebased standard, on the other hand, simply delineates the expected performance outcome or end result, 

without specifying how the outcome or result is to be achieved. In other words, a prescriptive standard 

describes how something is to be achieved, but a performance-based standard only specifies what is to be 

accomplished. For example, OSHA’s Explosives and Blasting Agents standard (Section 8.2) is a 

prescriptive standard that contains FGAN-specific provisions. That part of the standard is prescriptive 

because its provisions set out how to handle FGAN; the provisions are inflexible. 

In contrast, OSHA’s PSM standard is performance-based. It employs a broad approach to materials and 

applications and enables incorporation of current industry practices. As a performance-based standard, it 

allows employers to select the RAGAGEP that they choose to apply to their facilities.481 These chosen 

RAGAGEP are the ones that employers must follow at their facilities so that they are deemed compliant. 

Although the PSM standard does not define RAGAGEP, OSHA’s Petroleum Refinery PSM National 

 

479 TFI/ARA Hearing Statement: “Examining the Use of Agency Regulatory Guidance.” See: http://www.moag.com/uploaded/Senate%20HSGAC%20RFAM%20Hearing%209-23-15.pdf (accessed December 1, 2015). 480 OSHA has initiated a Small Business Regulatory Enforcement Fairness Act panel on its PSM standard, after 

issuing an RFI in November 2013 seeking public comment on ways to improve the standard. ATF/OSHA/EPA. 

“Actions to Improve Chemical Facility Safety and Security.” ATF/OSHA/EPA Fact Sheet, June 2015. 

481 OSHA. “RAGAGEP in Process Safety Management Enforcement.” OSHA Memorandum, June 8, 2015.

001514
West Fertilizer Company Final Report January 2016

182 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Emphasis Program references the definition established in the Center for Chemical Process Safety’s 

Guidelines for Mechanical Integrity Systems: 

Recognized and Generally Accepted Good Engineering Practices (RAGAGEP) are engineering, 

operation, or maintenance activities based on established codes, standards, published technical 

reports or recommended practices or a similar document. RAGAGEP detail generally approved 

ways to perform specific engineering, inspection or mechanical integrity activities, such as 

fabricating a vessel, inspecting a storage tank, or servicing a relief valve.482 

This is the definition OSHA references in addressing its use of the term under the PSM standard. 

Following the WFC incident, OSHA provided guidance on its use of the term RAGAGEP under its PSM 

standard in a June 8, 2015, memorandum, “RAGAGEP in Process Safety Management Enforcement” 

(PSM RAGAGEP Memorandum). As noted by OSHA in its PSM RAGAGEP Memorandum, the PSM 

standard directly references or implies the use of RAGAGEP in three provisions:

1. 29 CFR 1910.119(d)(3)(ii): Employers must document that all equipment in PSM-covered 

processes complies with RAGAGEP. 

2. 29 CFR 1910.119(j)(4)(ii): Inspections and tests are performed on process equipment subject to 

the standard’s mechanical integrity requirements in accordance with RAGAGEP. 

3. 29 CFR 1910.119(j)(4)(iii): Inspection and test frequency follows manufacturer’s 

recommendations and good engineering practice, and more frequently if indicated by operating 

experience.483

Accordingly, RAGAGEP under the PSM standard apply to process equipment design, installation, 

operation, and maintenance; inspection and test practices; and inspection and test frequencies.484 

The PSM RAGAGEP Memorandum notes the following primary sources of RAGAGEP: (1) published 

and widely adopted codes, (2) published consensus documents, and (3) published nonconsensus 

documents.485 Published and widely adopted codes are those consensus standards that have been widely 

adopted by federal, state, or municipal jurisdictions.486 Published consensus documents are identified as 

those published by certain organizations which must follow the American National Standards Institute 

(ANSI) “Essential Requirements: Due process requirements for American National Standards” (ANSI 

Essential Requirements).487 Published nonconsensus documents include publications that do not conform 

to the ANSI Essential Requirements and peer-reviewed technical articles.488 It is important to note that 

 

482 OSHA. Compliance Directive (CPL) 03-00-010. 483 OSHA. “RAGAGEP in Process Safety Management Enforcement.” OSHA Memorandum, June 8, 2015. 484 Ibid. 485 Ibid. 486 Ibid. Examples of published and widely adopted codes include NFPA 101 (Life Safety Code) and NFPA 70

(National Electric Code). 487 Ibid. Examples of published consensus documents include the ASME B31.3, “Process Piping Code,” and the 

International Institute of Ammonia Refrigeration (IIAR) ANSI/IIAR 2-2008, “Equipment, Design, and Installation 

of Closed-Circuit Ammonia Mechanical Refrigerating Systems.” 488 Ibid. Examples of published nonconsensus documents include the Chlorine Institute “pamphlets” focusing on 

chlorine and sodium hypochlorite safety and the Design Institute for Emergency Relief Systems guideline book 

addressing technology for reactive and multiphase relief systems design. 

001515
West Fertilizer Company Final Report January 2016

183 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

while OSHA generally accepts published and widely adopted codes and published consensus documents 

as RAGAGEP, published nonconsensus documents are not necessarily generally accepted. However, 

OSHA may choose to accept them if they are applicable and appropriate.489 

The PSM RAGAGEP Memorandum also explains the difference between “shall” and “should” language. 

In particular, OSHA notes that positive and negative uses of “shall,” “must,” or similar language in 

published RAGAGEP reflect the developer’s view that the practice is a mandatory minimum to control a 

hazard.490 Thus, if an employer deviates from such RAGAGEP, OSHA will presume a violation.491 

Where “should” language applies in RAGAGEP, OSHA presumes that employer compliance with the 

recommended approach is acceptable.492 If an employer chooses to deviate from the recommended 

approach, however, OSHA will evaluate whether the employer has determined and documented that its 

alternative approach is at least as protective as the recommended approach or whether the recommended 

approach does not apply to the employer’s operation.493 OSHA presumes a violation if employers act in a 

way that RAGAGEP deem they “should not.”494 

These enforcement considerations emphasize that RAGAGEP are more than optional recommendations. 

Many RAGAGEP are mandatory standards based on scientific data and previous incidents and it is 

crucial that employers comply with them. If FGAN is added to the PSM list, the use of RAGAGEP will 

allow facilities to select and comply with FGAN-specific standards, such as NFPA 400, that have been 

recently updated to address and help prevent the conditions that led to the WFC explosion. 

8.4.2 EPA Risk Management Program Rule 

The EPA Risk Management Program rule (40 CFR Part 68, Subparts A through H) is intended to prevent 

and minimize the consequences of accidental releases of toxic or flammable substances.

495 Enacted in 

1996, the regulation required facilities to be compliant by 1999.496 In general, covered facilities are those 

with a substance on one of the Risk Management Program rule’s two lists, one for toxic substances and 

one for flammable substances, in a quantity that meets or exceeds the threshold quantity for the 

substance.497 These facilities must perform a hazard assessment, consisting of worst case and alternative 

release scenarios as well as a five-year accident history; implement an accident prevention program 

(which is required for most facilities); establish an emergency response program; and develop an RMP 

 

489 Ibid. 490 Ibid. 491 Ibid. 492 Ibid. 493 Ibid. 494 Ibid. 495 EPA. “Accidental Release Prevention Requirements: Risk Management Program Under the Clean Air Act.” RFI, 

July 31, 2014. 

496 See: http://nepis.epa.gov/Exe/ZyPDF.cgi/100038BD.PDF?Dockey=100038BD.PDF (accessed on December 28, 

2015). 

497 See: http://www.epa.gov/rmp/risk-management-plan-rmp-rule-overview (accessed on December 28, 2015). 

001516
West Fertilizer Company Final Report January 2016

184 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

and submit it to EPA.498 Facility management must revise and resubmit its RMP to EPA at least every 

five years.499 

EPA has developed three program levels for process classification to ensure that individual processes are 

subject to requirements that appropriately match their size and risks they pose.500 Program Level 1 

applies to processes with lower risks that would not significantly affect the public in a worst case release 

scenario and that have had no accidents with specific offsite consequences in the last five years.501 These 

facilities have limited and/or minimal accident prevention requirements.502 Program Levels 2 and 3 cover 

higher-risk facilities that must meet more stringent accident prevention requirements.503 A Program Level 

3 facility is not eligible for classification under Program Level 1 and is either (1) subject to OSHA’s PSM 

standard or (2) classified in one of 10 specified NAICS codes.504 Program Level 3 requires 

implementation of an accident prevention program that is virtually equivalent to the one required under 

the PSM standard.505 Program Level 2 applies to facilities that are not eligible for classification in 

Program Level 1 or Program Level 3.506 Program Level 2 requires implementation of a streamlined 

accident prevention program.507 

The WFC was a Program Level 2 facility under the Risk Management Program rule for its storage of 

anhydrous ammonia, a regulated substance, which the WFC kept in amounts that exceeded the 

substance’s threshold quantity. Program Level 2 facilities must conduct hazard reviews.

508 For this 

requirement to be satisfied, facilities must conduct a review and identify the following: 

• Hazards associated with the Program 2 process and regulated substances. 

• Opportunities for equipment malfunction or human error that could cause a release. 

• Safeguards that will control the hazards or prevent the malfunction or error. 

• Steps to detect or monitor releases.509 

 

498 Ibid. 499 Ibid. 500 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed on 

December 28, 2015). 

501 Ibid. 502 Ibid. 503 Ibid. 504 Ibid. These 10 manufacturing NAICS codes are (1) 32211 pulp mills; (2) 32411 petroleum refineries; (3) 32511 

petrochemical manufacturing; (4) 325181 alkalis and chlorine manufacturing; (5) 325188 all other basic inorganic 

chemical manufacturing; (6) 325192 cyclic crude and intermediate manufacturing; (7) all other basic organic 

chemical manufacturing; (8) plastics material and resin manufacturing; (9) nitrogenous fertilizer manufacturing; and 

(10) pesticide and other agricultural chemical manufacturing. See: http://www2.epa.gov/sites/production/files/2013-

11/documents/cd-chap-02.pdf (accessed on December 28, 2015). 505 See: http://www.epa.gov/sites/production/files/2013-10/documents/caa112_rmp_factsheet.pdf (accessed on 

December 28, 2015). 

506 Ibid. 507 Ibid. 508 See: http://www.epa.gov/sites/production/files/2013-11/documents/chap-06-final.pdf (accessed on December 28, 

2015). 

509 Ibid. 

001517
West Fertilizer Company Final Report January 2016

185 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

CSB discovered that the WFC implemented a prevention program that included a hazard review. In its 

most recent RMP from 2011, the WFC identified major hazards, which included toxic releases, 

equipment failure, and earthquakes, but did not include fire or explosion.510 The facility also indicated 

that it did not use mitigation systems, such as sprinklers, for its storage of anhydrous ammonia.511 

Clearly, this hazard review did not provide the type of protection needed to address the fire and explosion 

that occurred on the day of the WFC incident. Because FGAN is not a regulated substance, the WFC was 

not required to conduct such a hazard review for its storage of FGAN. Accordingly, CSB recommends 

that FGAN be added to the Risk Management Program list.512 

CSB contends that EPA should consider adding FGAN to the list of regulated substances, taking into 

account the more recent recognition of the unpredictable explosive hazards of FGAN, better awareness of 

the location of FGAN facilities across the United States, greater knowledge of the quantity of FGAN 

normally stored at these facilities, and continuance of FGAN-related incidents since the issuance of the 

final Risk Management Program list. As demonstrated in Appendix B, FGAN-related incidents continue 

to occur, domestically and abroad. Despite tremendous property damage and economic cost, the most 

devastating result of these incidents is the immeasurable loss of human life. CSB found that a likely 

cause of such loss of life is the alarming number of FGAN facilities located in communities—next to 

schools, hospitals, residences, and businesses (discussed in Section 9). Another cause, as determined by 

CSB, is the tendency of these facilities to store FGAN in large quantities. Coupling these factors with the 

more recent recognition that FGAN is susceptible to unstable detonation under certain conditions, CSB 

recommends that FGAN be listed under the Risk Management Program rule. Moreover, CSB reviewed 

original listing criteria and found that inclusion of FGAN on the Risk Management Program list is 

warranted.

8.4.2.1 Risk Management Program Rule Listing Criteria Background

Under CAA Section 112(r)(4), the factors to be considered in listing substances for Risk Management 

Program rule coverage are (1) the severity of acute adverse health effects associated with accidental 

releases of the substance, (2) the likelihood of accidental releases of the substance, and (3) the potential 

magnitude of human exposure to accidental releases of the substance.513 When EPA first promulgated its 

Risk Management Program list of chemicals and threshold quantities in 1994, it reviewed 11 different 

lists, including three EPA lists.514 The criteria used for development of these lists were reviewed to 

determine whether the criteria were related to the factors mandated by Congress for list development 

 

510 WFC 2011 RMP submission to EPA. 511 Ibid. 512 EPA has issued a RFI and worked on a Notice of Proposed Rulemaking for its Risk Management Program rule. 

ATF/OSHA/EPA. “Actions to Improve Chemical Facility Safety and Security.” ATF/OSHA/EPA Fact Sheet, June 

2015. 

513 58 Federal Register 5102 (January 19, 1993). 514 Ibid. 

001518
West Fertilizer Company Final Report January 2016

186 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

under CAA Section 112(r).515 Acute toxicity was generally considered in developing these lists of 

chemicals, but some also used flammability and explosivity as criteria for regulating chemicals.516

As part of its review of the first factor to be considered for listing substances under the Risk Management 

Program rule, EPA reviewed chemicals that could cause severe acute adverse health effects. EPA found 

that the severity of acute adverse health effects can be related to the inherent hazards (i.e., hazardous 

material properties that cannot be changed) of the substances of interest, such as the toxicity of a 

substance resulting in lethal effects.517 EPA noted that acute adverse health effects also could result from 

other inherent hazards, such as the flammability or high reactivity of the substance.518 Importantly, it 

stated that the phenomena associated with these hazards could be, for example, radiant heat from a 

chemical fire or blast waves from an explosion of a chemical.519 

In reviewing the second Risk Management Program listing criteria factor, EPA stated that the likelihood 

of an accidental release of a chemical can be related to typical usage and handling scenarios, such as 

equipment commonly used in typical facility operations.520 EPA stated that ubiquitous substances, 

because of greater handling and use, might have a greater potential for an accidental release.521 The 

agency observed that a history of a large number of accidents in the past, for example, might be an 

indicator of an existing hazard related to a particular substance and its potential to be involved in 

accidental releases in the future.522 Notably, EPA stated that chemicals that are found in large volumes at 

many locations and chemicals that are particularly prevalent (e.g., commodity chemicals, like chlorine 

and ammonia) might be more likely to be involved in accidental releases than small-volume, less 

commonly used chemicals.523 

With respect to the last factor to be considered for Risk Management Program listing, EPA found the 

magnitude of human exposure associated with accidental releases to be related to the severity of the 

health effects (hazards) and the likelihood of a release (the chance that a release will have an effect on the 

population of environment beyond the facility fenceline).524 The agency noted that this definition was 

somewhat different from the traditional risk assessment definition of human exposure, which relates 

magnitude of exposure to the population and sensitive environments that might be affected by a release 

from a specific site.525 It recognized that factors that might affect the magnitude of human exposure could 

be site specific or accident specific and could vary widely by location and incident.526 Significantly, EPA 

 

515 Ibid. 516 Ibid. 517 Ibid. 518 Ibid. 519 Ibid. 520 Ibid. 521 Ibid. 522 Ibid. 523 Ibid. 524 Ibid. 525 Ibid. 526 Ibid. 

001519
West Fertilizer Company Final Report January 2016

187 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

also contended that proximity to population centers, for example, might play a role in the magnitude of 

accidental releases.527 

8.4.2.2 Risk Management Program Rule Listing Criteria and Coverage for FGAN

CSB reviewed the original listing criteria to determine their application to FGAN and found support for 

inclusion of FGAN on the Risk Management Program list. First, CSB found a high severity of acute 

adverse health effects related to accidental releases of FGAN because one of the phenomena associated 

with the hazards of FGAN as a reactive and as an explosive is blast waves from an FGAN explosion. 

Acute adverse health effects from blast waves can include not only major injuries (such as fractures and 

injuries to the head, ears, and eyes), but also death. All of these were reported after the WFC incident. 

As stated previously, EPA specifically deemed blast waves to be considered in assessing the severity of 

acute adverse health effects related to accidental releases of the substance. 

CSB concluded that FGAN meets the second criteria for listing under the Risk Management Program rule 

because the likelihood of accidental releases of FGAN is high. Before assessing the merits of this listing 

factor, CSB sought to define such accidental releases and ultimately found that they can be described as 

emissions of blast waves and thermal energy from FGAN explosions. An accidental release is defined by 

the CAA Amendments of 1990 as “an unanticipated emission of a regulated substance or other extremely 

hazardous substance into the ambient air from a stationary source.”528 In general, this definition has been 

interpreted to apply only to gases and liquids, not to solids such as FGAN.529 However, in its original 

Risk Management Program rule listing notice, EPA determined the proposed threshold quantity for high 

explosives530 based on the quantity that could produce potentially lethal blast waves from an explosion at 

a distance of 100 meters.531 This determination is significant because it supports the conclusion that EPA 

envisioned blast waves as qualifying as unanticipated emissions when it considered explosives for 

addition to the Risk Management Program list. 

CSB also conducted its own research on explosions and emissions. An explosion involves a sudden 

release of large amounts of energy. This energy release can be dissipated as blast waves, propulsion of 

 

527 Ibid. 528 40 CFR 68.3

529 ARA. “Re: Accidental Release Prevention Requirements: Risk Management Programs under the Clean Air Act, 

Section 112(r)(7); Request for Information; Docket # EPA-HQ-OEM-2014-0328; FRL-9911-61-OSWER.” October 

29, 2014. 

530 High explosives represent the category of explosives that might most easily detonate. 59 Federal Register 4487 

(January 31, 1994). They are likely to cause severe impacts in detonation scenarios. These explosives were 

subsequently deleted from coverage in 1998 due to settlement of litigation with the Institute for Manufacturers of 

Explosives. 63 Federal Register 640 (January 6, 1998). It is important to note, however, that this was not due to 

any potential misinterpretation of the term “accidental release” (as discussed in the Explosive Substances Section). 531 58 Federal Register 5102 (January 19, 1993). 

001520
West Fertilizer Company Final Report January 2016

188 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

debris, or the emission of thermal and ionizing radiation.532 Furthermore, the term “emissions” is not 

strictly limited to the release of toxic or flammable liquids and vapors. It can refer to the generation of 

hot gases and overpressures that result from explosions. This interpretation aligns with EPA’s reasoning 

that explosives can produce accidental releases, as demonstrated by EPA’s original inclusion of high 

explosives on the Risk Management Program list and by its associated determination of the appropriate 

threshold quantity for such explosives. CSB supports EPA’s original reasoning that blast waves are 

emissions for purposes of listing substances under the Risk Management Program rule. In particular, 

CSB supports that this reasoning should apply to FGAN. 

CSB concluded that there is a reasonable likelihood of an accidental release of FGAN because FGAN is a 

ubiquitous commodity chemical that is stored in large volumes at many locations. CSB found that this 

was true not only at the WFC facility (where the WFC stored 80,000 to 120,000 pounds of FGAN), but 

also at domestic fertilizer facilities throughout the South and the Midwest where Alabama, Missouri, 

Tennessee and Texas make up more than 50 percent of FGAN consumption in the United States.533 

FGAN also has been involved in a large number of accidents in the past (described in Appendix B). It 

has been at the center of major disasters such as the Oppau, Germany, incident in 1921 and the Texas 

City, Texas, incident in 1947; each caused more than 500 fatalities. EPA considered these exact factors 

(i.e., ubiquity, commodity, volume, and past accident history) to be indicative of whether an accidental 

release of a substance is likely. 

Finally, CSB determined the magnitude of human exposure associated with accidental FGAN releases is 

significant because FGAN storage is commonly located close to many population centers. This was 

clearly the case in West, Texas, where a playground, four public school buildings, a nursing home, and an 

apartment complex all surrounded the WFC facility. It is also the case throughout Texas, where many 

fertilizer facilities are in communities and downtown neighborhoods (noted in Section 5.4). Because of 

the WFC investigation and other CSB investigations that identified offsite consequences from chemical 

releases, land use planning and siting of chemical facilities remain important issues for CSB. As 

discussed previously, EPA considered the proximity of facilities to population centers as a significant 

determinant of potential impact. The WFC incident demonstrates the validity of this conclusion. After 

finding that all three listing criteria were satisfied, CSB concludes that FGAN warrants listing under the 

Risk Management Program rule. 

 

532 Akhavan, Chemistry of Explosives (3rd Edition). London: Royal Society of Chemistry, 2011. See: 

http://app.knovel.com/hotlink/toc/id:kpCEE0001C/chemistry-explosives/chemistry-explosives (accessed on 

November 14, 2015).

533 See: https://www.tfi.org/sites/default/files/documents/ammoniumnitrateinfographic.pdf (accessed November 17, 

2015). Akhavan, Chemistry of Explosives (3rd Edition). London: Royal Society of Chemistry, 2011. See: 

http://app.knovel.com/hotlink/toc/id:kpCEE0001C/chemistry-explosives/chemistry-explosives (accessed on 

November 14, 2015).

533 See: https://www.tfi.org/sites/default/files/documents/ammoniumnitrateinfographic.pdf (accessed November 17, 

2015).

001521
West Fertilizer Company Final Report January 2016

189 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.4.2.3 Additional Support for Risk Management Program Rule Coverage for FGAN

Besides considering the three listing criteria factors mandated under the CAA, EPA identified other 

substances based on similarities with the mandated substances and selection criteria.534 EPA considered 

options that accounted for the inherent hazards of the substances to be listed and for the potential of these 

hazards to affect the community if an accidental release occurred.535 In particular, EPA analyzed hazards 

such as toxicity, flammability, reactivity, explosivity, and radioactivity, stating that all of them can result 

in acute effects after short-term exposure.536 EPA identified substances associated with each of these 

hazards, but also considered the potential impact that the identified substances would have on the 

community if a release took place.537 It evaluated each hazard independently, as well as each hazard’s 

potential to pose a threat to the community.538 Ultimately, a group of toxic substances, a group of 

flammable substances, and a group of explosive substances were proposed in the January 19, 1993, rule 

for addition to the 16 mandated substances in the CAA.539 Because they pertain to FGAN, CSB 

conducted further research on explosives and on reactive substances. 

Explosive Substances

With respect to the group of explosive substances, EPA proposed to focus on physical hazards because of 

their ability to impact communities beyond the fenceline in the event of an accidental release.540 EPA 

viewed commercial high explosives, which have the potential to detonate, as the explosive substances 

with the greatest potential to affect such communities and therefore proposed commercial high explosives 

as a category for listing.541 In determining the threshold methodology, EPA indicated that a blast wave 

overpressure of 3.0 psi from a detonation could have potentially lethal effects in communities beyond the 

fenceline.542 The agency noted that this overpressure level could cause serious structural damage to 

buildings, lead to serious wounds from flying glass, and potentially cause eardrum rupture.543 The agency 

also considered reactive substances that have explosive properties, including oxidizers (e.g., pure AN), for 

listing.544 In its final decision however, EPA deferred listing these types of substances for lack of an 

adequate technical basis upon which to evaluate offsite consequences from unstable and reactive 

substances.

545 Nonetheless, EPA concluded in its response that “this decision does not preclude the 

 

534 58 Federal Register 5102 (January 19, 1993). 535 Ibid. 536 Ibid. 537 Ibid. 538 Ibid. 539 Ibid. 540 Ibid. 541 Ibid. 542 Ibid. 543 Ibid. 544 Ibid. 545 EPA. “Proposed List of Substances and Thresholds for Accidental Release Prevention: Summary and Response to 

Comments,” January 14, 1994: 146. 

001522
West Fertilizer Company Final Report January 2016

190 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Agency from revisiting this issue in the future, in response to a petition to list, or when the list is reviewed 

and the listing criteria modified.”546 

For several decades, a number of agencies and organizations have regulated materials with explosive 

potential. ATF regulates the manufacture, processing, use, distribution, and storage of explosive 

materials; ATF regulations include requirements for licensing, permitting, and recordkeeping and for 

storage of explosives.547 DOT regulates the transportation of explosives, and other agencies, such as 

OSHA, Mine Safety and Health Administration (MSHA), Department of Defense (DOD), and 

International Maritime Organization, regulate certain aspects of the explosive industry.548 In its 1993 

Federal Register notice, however, EPA stated that although explosives are regulated by federal, state, and 

local governments, these regulations do not uniformly address the issue of using appropriate hazard 

assessment techniques to identify hazards, designing and maintaining a safe facility, and minimizing the 

consequences of accidental releases when they do occur.549 EPA noted that all of these elements were to 

be addressed in the Risk Management Program regulations, which it described as “intended to help focus 

on accident prevention.”550 The agency therefore asserted that these substances should be considered for 

purposes of list development and accidental release prevention regulations, and for some time, high 

explosives (classified as Class 1, Division 1.1 on DOT’s Hazardous Materials Table) were included on 

the final 1994 Risk Management Program list.551 However, DOT Division 1.1 explosives were delisted 

four years later.552 

After promulgation of the Risk Management Program list, the Institute of Makers of Explosives (IME) 

petitioned against EPA for judicial review, challenging the listing of high explosives.553 IME objections 

included the contention that existing ATF, DOT, MSHA, and OSHA regulations already adequately 

controlled DOT Division 1.1 explosives.554 EPA and IME ultimately settled, with EPA agreeing to delist 

the explosives in exchange for IME’s promise to undertake specific measures to enhance local emergency 

response.555 CSB found this information important with respect to its investigation because FGAN has 

explosive properties under certain conditions. Accordingly, CSB conducted research to determine 

whether FGAN was listed and then delisted along with these DOT Division 1.1 explosives. 

CSB found that DOT Division 1.1 explosives include one less common form of AN (classified by the 

United Nations as UN0222) containing more than 0.2 percent carbonaceous material. However, this form 

of AN is not commercially used or manufactured. Importantly, CSB discovered that FGAN has never 

 

546 Ibid. 547 58 Federal Register 5201 (January 19, 1993). 548 Ibid. 549 Ibid. 550 Ibid. 551 Ibid. 552 79 Federal Register 44607 (July 31, 2014). 553 61 Federal Register 16598 (April 15, 1996). 554 Ibid. 555 Ibid. See also: 63 Federal Register 640 (January 6, 1998). 

001523
West Fertilizer Company Final Report January 2016

191 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

been explicitly regulated under the Risk Management Program rule because it is not a DOT Division 1.1 

explosive. Furthermore, even if FGAN were a DOT Division 1.1 explosive, the DOT Division 1.1 

explosives were never specifically identified by name on the Risk Management Program list. Therefore, 

AN has never explicitly been listed under the Risk Management Program rule. Nonetheless, CSB found 

it significant that EPA evaluated explosives, and the effects they can have upon communities in 

detonation scenarios, when determining the substances to include on the Risk Management Program 

list.556 Because FGAN can detonate under certain conditions, CSB recommends that FGAN be included 

for coverage under the Risk Management Program rule. Further support for including FGAN on the Risk 

Management Program list can be found in EPA’s original inquiry into reactive substances and in CSB’s

past work on reactives. 

Reactive Substances

At the time of its 1993 Federal Register notice, EPA was attempting to evaluate the hazards of reactive 

and unstable chemicals and to develop an adequate technical basis for determining the potential effects on 

the community.557 For example, EPA investigated computer models that estimate heats of reaction and 

also the possible use of heats of reaction to compare the effects of an explosion of an unstable substance 

to the effects of an explosion of TNT.558 EPA stated that this method would only be appropriate for 

substances that detonate, an outcome that appeared to be unlikely for many unstable substances.559 

Ultimately, EPA contended that unstable and reactive substances would be considered for listing for 

accidental release prevention if the evaluation indicated potential community consequences.560 On the 

basis of the WFC investigation and on the CSB’s “Improving Reactive Hazard Management” study, CSB 

recommends that FGAN be added to the Risk Management Program list.

In the early 1990s, EPA considered listing reactive substances, such as AN, on the Risk Management 

Program list.561 Specifically, EPA assessed whether to include chemicals whose reactive properties could 

cause impacts on nearby communities in the event of an accident.562 In December 2002, CSB issued the 

study, “Improving Reactive Hazard Management,” which examined reactive hazard management across 

the United States.563 The study found regulatory coverage of reactive hazards to be a key issue.564 As a 

result of the study, CSB issued several regulatory recommendations, including the following 

recommendation to EPA: 

Revise the Accidental Release Prevention Requirements, 40 CFR 68, to explicitly cover 

catastrophic reactive hazards that have the potential to seriously impact the public, including 

 

556 58 Federal Register 5102 (January 19, 1993). 557 Ibid. 558 Ibid. 559 Ibid. 560 Ibid. 561 Ibid. 562 Ibid. 563 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001. 564 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001, 3.

001524
West Fertilizer Company Final Report January 2016

192 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

those resulting from self-reactive chemicals and combinations of chemicals and process-specific 

conditions. Take into account the recommendations of this report to OSHA on reactive hazard 

coverage. Seek congressional authority if necessary to amend the regulation.565 

Unfortunately, EPA has not initiated rulemaking consistent with CSB’s recommendation more than 10 

years since its issuance.566 Therefore, CSB has categorized the status of this recommendation as “Open—

Unacceptable Response.”567 

Since issuing its reactive hazard investigation study in 2002, CSB has investigated several industrial 

accidents involving reactive chemicals.568 These are summarized in Table 12. 

Table 12. CSB Investigations Involving Reactive Chemicals Since 2002

Incident Date Location Severity

First Chemical Corp.: 

Reactive Chemical 

Explosion

October 13, 2002 Pascagoula, MS • 3 injured

MFG Chemical Inc.: 

Toxic Gas Release

April 12, 2004 Dalton, GA • 154 hospitalized

Synthron Chemical: 

Explosion

July 31, 2007 Morganton, NC • 1 fatality

• 12 injured

T2 Laboratories Inc.: 

Reactive Chemical 

Explosion

December 19, 2007 Jacksonville, FL • 4 fatalities

• 13 hospitalized

Bayer CropScience: 

Pesticide Waste Tank 

Explosion

August 28, 2008 Institute, WV • 2 fatalities

West Fertilizer 

Company: 

Explosion and Fire

April 17, 2013 West, TX • 15 fatalities 

• More than 260 

injured

It is important to note, however, that Table 12 depicts only those incidents involving reactive chemicals 

that CSB investigated since 2002. That is, these incidents do not represent the universe of reactive 

chemical accidents, which is much larger. 

 

565 CSB. “Hazard Investigation: Improving Reactive Hazard Management.” December 2001, 102. 566 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. 

March 11, 2014. 

567 See: http://www.csb.gov/recommendations/?F_RecipientId=8 (accessed on December 17, 2015). OSHA’s 

associated recommendations are also categorized as “Open—Unacceptable Response.” See: 

http://www.csb.gov/UserFiles/file/CSB-OSHACorrespondence.pdf (accessed on January 15, 2016). 568 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. 

March 11, 2014.

001525
West Fertilizer Company Final Report January 2016

193 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.4.2.3.1.1 General Duty Clause 

After the incident, CSB referenced its reactives study in “Preliminary Findings of the CSB from its 

Investigation of the West Fertilizer Explosion and Fire.”569 With respect to the EPA Risk Management 

Program rule, CSB specifically stated:

In developing the RMP regulation, the EPA did not explicitly include explosives or reactive 

chemicals in the list of covered chemicals. In 2002, the CSB issued a study on reactive hazards, 

identifying 167 prior reactive incidents (including a 1994 explosion at an AN manufacturer). The 

Board recommended that . . . EPA expand [its] standard[] to include reactive chemicals and 

hazards. However, [EPA has not] yet acted upon the recommendation[].570 

On June 6, 2014, after learning the Open—Unacceptable Response status of its recommendation, EPA 

raised, in a letter to CSB, its concern that CSB had mischaracterized in its reactives study the scope and 

history of EPA’s use of the CAA Section 112(r)(1), General Duty Clause (GDC).571 Because the GDC is 

a provision which CSB believes likely could have been used to cite the WFC facility, but was not, CSB 

conducted further research into the requirement.

The GDC is a statutory obligation that makes owners and operators of facilities that possess regulated and 

other extremely hazardous substances responsible for ensuring that their chemicals are managed safely.572 

In CAA Section 112(r)(1), the GDC states: 

The owners and operators of stationary sources producing, processing, handling or storing such 

substances [i.e., a chemical in 40 CFR Part 68 or any other extremely hazardous substance] have 

a general duty [in the same manner and to the same extent as the general duty clause in the 

Occupational Safety and Health Act] to identify hazards which may result from (such) releases 

using appropriate hazard assessment techniques, to design and maintain a safe facility taking such 

steps as are necessary to prevent releases, and to minimize the consequences of accidental 

releases which do occur.573

Accordingly, EPA has the authority to apply the GDC to facilities not only after incidents, but also before 

incidents to prevent them. The GDC is a broad provision with great potential to enhance safety measures 

at facilities that contain certain hazardous substances. 

In addressing the hazards associated with reactive substances and application of the GDC, CSB has stated 

that “many substances are unlikely to be considered ‘extremely hazardous’ since they do not present an 

inherent catastrophic reactive hazard until combined with other chemicals or under process-specific 

conditions.”574 This circumstance should not preclude, and EPA affirms has not precluded, such 

 

569 CSB. “Preliminary Findings of the U.S. Chemical Safety Board from its Investigation of the West Fertilizer 

Explosion and Fire,” June 27, 2013. 

570 Ibid. 571 EPA letter to CSB, June 6, 2014. 572 See: http://www2.epa.gov/sites/production/files/2013-10/documents/gdc-fact.pdf (accessed on December 29, 

2015). 

573 42 U.S.C. § 7412(r)(1). 574 CSB. “Recommendations Status Change Summary.” Improving Reactive Hazard Management, 2001-1-H-R3. 

March 11, 2014.

001526
West Fertilizer Company Final Report January 2016

194 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

substances from enforcement under the GDC. EPA referenced a 1989 Report of the Senate Environment 

and Public Works Committee, which stated that the presumption should be that a substance is extremely 

hazardous if it causes significant adverse impacts by acute toxic effect or “by blast, fire, corrosion or 

other reaction.”575 The report also states that “extremely hazardous substances” would “include other 

agents which may or may not be listed” that “as the result of short-term exposures associated with 

[accidental] releases to the air cause death, injury or property damage due to their toxicity, reactivity, 

flammability, volatility, or corrosivity.”576 According to this report, therefore, EPA could apply the GDC 

to reactive substances. However, EPA did not use the GDC to cite the WFC after the incident for its 

unsafe storage of FGAN.

Considering the totality of the EPA regulatory landscape, CSB determined that requirements for facilities 

to safely store and handle FGAN are insufficient. As discussed, the Risk Management Program rule does 

not regulate FGAN because FGAN is not on the list of regulated substances. Furthermore, while EPA 

could use the GDC to impose requirements on facilities to ensure the safe management of FGAN as a 

reactive substance, EPA does not contend that the GDC is as easy to apply as a regulation. EPA may 

have been able to apply the GDC against the WFC after the incident, but it did not. Therefore, without 

more from the GDC, it is the recommendation of CSB that FGAN be included on the Risk Management 

Program list, especially in light of the fatal incident in West, Texas. 

8.4.2.4 Risk Management Program Rule and Coverage of Anhydrous Ammonia

As previously discussed, although the WFC was not covered under the Risk Management Program rule 

for its storage of FGAN, it was covered under Program Level 2577 of the rule for its storage of more than 

10,000 pounds, the threshold limit, of anhydrous ammonia. The facility submitted its RMP registration in 

1999, 2006,578 and 2011.579 The WFC’s 2006 RMP for anhydrous ammonia included important safety 

elements to prevent, control, and respond to an anhydrous ammonia release.580 For example, the 

insurance company conducted a hazard review to identify major release scenarios and address actions that 

would prevent or mitigate a release.581 Another important feature of the RMP was development of an 

emergency action plan with step-by-step procedures, detailing how employees should respond to an 

anhydrous ammonia release.582 Other program elements included operating procedures, maintenance and 

 

575 EPA letter to CSB, June 6, 2014. 576 Senate Committee on Environment and Public Works, CAA Amendments of 1989, Senate Report No. 228, 101st

Congress, 1st Session 211 (1989). 577 The WFC fell under Program 2 requirements for its storage of anhydrous ammonia because it did not meet the 

requirements for Program Level 3 and was not eligible for Program Level 1 coverage. 578 The WFC did not resubmit its RMP registration as it was supposed to in 2004 because of a change in ownership. 

EPA cited the company in 2006 for failing to refile its RMP in a timely manner. The WFC refiled it in 2006. 579 WFC RMP submissions to EPA. 580 Ibid. 581 Ibid. 582 Ibid. 

001527
West Fertilizer Company Final Report January 2016

195 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

inspection programs, training programs, incident investigations, offsite consequence analyses, and 

compliance audits.583 

The Risk Management Program rule also required the WFC to comply with RAGAGEP for anhydrous 

ammonia, such as ANSI K61.1, “Safety Requirements for the Storage and Handling of Anhydrous 

Ammonia,” and OSHA’s Storage and Handling of Anhydrous Ammonia regulation (29 CFR 

1910.111).584 As previously mentioned, the Risk Management Program list does not include FGAN, so 

the WFC was not required to take related Risk Management Program safety measures for FGAN. Of 

course, FGAN coverage under the Risk Management Program rule likely would have increased awareness

of the explosion hazards of FGAN, leading to better management of the substance through compliance 

with federal safety regulations and best industry practices. If EPA had included FGAN under the Risk 

Management Program rule, the WFC would have been required to apply it for its storage of FGAN and 

perhaps could have reduced the risk of catastrophic accidents like the one that occurred at the WFC. 

8.5 Emergency Planning

The CSB investigation of the WFC incident identified the explosive potential of FGAN. CSB further 

found that no immediate evacuation at the first sign of fire occurred, in part because no in-place 

emergency plan addressed response specifically to an incident at the WFC warehouse. This situation left 

emergency responders and the West community unaware of the urgent need to evacuate. For FGAN 

facilities, there must be a well-exercised local emergency plan that emphasizes immediate notification to 

emergency responders and the community at the first sign of fire, as well as evacuation protocols. If there 

was an immediate evacuation once the fire was detected at the WFC, the number of fatalities and injuries 

likely would have been lower. 

Emergency planning is part of emergency management, which includes four different stages: (1) 

mitigation, (2) planning, (3) response, and (4) recovery. The nation’s emergency management system is 

intended to prepare communities for all types of hazards, including natural disasters, terrorism, and 

hazardous materials (HAZMAT) incidents. The responsibilities of emergency management personnel are 

shared among federal agencies that provide assistance through funding and training. For example, DHS 

primarily focuses its efforts on terrorism and natural hazards and also serves as the umbrella organization 

for other agencies that supply assistance to state and local authorities. Other federal agencies such as 

EPA and OSHA have emergency planning regulations for environmental and occupational accidents 

involving HAZMAT. The next sections discuss these regulations at the federal, state, and city levels and 

discuss their relevance to the WFC incident. 

 

583 Ibid. 584 40 CFR 68.48(b).

001528
West Fertilizer Company Final Report January 2016

196 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.5.1 Federal Emergency Planning 

In response to growing concerns about the safety and health of people and the environment after releases of 

hazardous substances in the U.S. in the 1970s and 1980s and the disaster in Bhopal, India, Congress 

passed new laws authorizing EPA and OSHA to regulate these risks. One was the Emergency Planning 

and Community Right-to-Know Act (EPCRA) of 1986, which was intended to address concerns about 

local preparedness for chemical emergencies and to ensure public access to information. EPCRA 

established a framework for states to organize resources to pre-plan for chemical accidents. EPCRA 

requirements include: (1) emergency planning (SARA Title III, Sections 301–303); and (2) emergency 

and hazardous chemical inventory reporting (SARA Title III, Sections 311 and 312).

585 Each section of 

EPCRA covers a subset of chemicals and the statute and EPA regulations specify quantities that trigger 

reporting requirements (Table 13).586 Because they are pertinent to the WFC incident, requirements for 

emergency planning and hazardous chemical inventory reporting are discussed in greater detail. 

Table 13. EPCRA Chemicals and Reporting Thresholds

Section 302 Sections 311 and 312

Chemicals 

Covered

355 extremely hazardous 

substances (EHSs)

Approximately 500,000 hazardous chemicals 

Thresholds Threshold planning quantity 

(TPQ): 1 to 10,000 lbs. 

onsite at any one time

500 lbs. or TPQ, whichever is lower, for EHSs; 75,000 

gallons for gasoline; 100,000 gallons for diesel; and 

10,000 lbs. for all other hazardous chemicals 

EPCRA emergency planning establishes, in part, requirements for sharing information among industry 

and state, tribal, and local governments. As shown in Table 13, under Section 302, a facility that has an 

extremely hazardous substance (EHS) at or above its specific threshold planning quantity (TPQ) must 

report the substance. Reporting of EHSs, as well as other hazardous chemicals under Sections 311 and 

312, must be made to the State Emergency Response Commission (SERC), Local Emergency Planning 

Committee (LEPC), and local fire department.587 

State governors designated the SERCs which then designated roughly 3,500 local emergency planning 

districts and LEPCs for each district.588 At minimum, LEPCs must be composed of elected state and local 

officials; police, fire, civil defense, public health, transportation, and environmental professionals; 

representatives of facilities subject to EPCRA emergency planning requirements; community groups; and 

 

585 Regulations implementing EPCRA are codified at 40 CFR Parts 350–372. 586 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 

29, 2015). 587 The local fire department receives only inventory information under Sections 311 and 312. 588 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 

29, 2015). 

001529
West Fertilizer Company Final Report January 2016

197 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the media.589 SERCs are supposed to supervise and coordinate the activities of LEPCs, establish 

procedures for receiving and processing public requests for information, and review local emergency 

response plans.590 LEPCs are supposed to develop emergency response plans, review the plans annually, 

and provide information to the public.591 

EPCRA emergency planning also requires LEPCs to develop and update emergency response plans. 

LEPCs are supposed to use information reported by facilities to develop these plans, which cover 

procedures that describe how emergency responders should respond to chemical releases.592 The plans 

must (1) identify EHS facilities and transportation routes; (2) describe emergency response procedures, 

onsite and offsite; (3) designate a community coordinator and facility coordinators to implement the plan; 

(4) outline emergency notification procedures; (5) explain the means to determine the probable area and 

population affected by chemical releases; (6) describe local emergency equipment and facilities and the 

people responsible for them; (7) outline evacuation plans; (8) provide a training program for emergency 

responders (including schedules); and (9) detail methods and schedules for exercising emergency 

response plans.593 

Importantly, EPCRA emergency planning requirements mandate the identification of facilities with EHSs 

only; identification of facilities without EHSs is not required. Thus, although facilities must report EHSs 

and certain non-EHSs (i.e., other hazardous chemicals under Sections 311 and 312), only facilities with 

EHSs trigger EPCRA emergency response plan requirements.594 For purposes of the WFC investigation, 

CSB determined that while anhydrous ammonia is on the EHS list, FGAN is not. CSB found, however, 

that AN is on the list of hazardous chemicals under Sections 311 and 312 that triggers emergency and 

hazardous chemical inventory reporting requirements. 

EPCRA emergency and hazardous chemical inventory reporting requires reporting of certain quantities of 

EHSs and hazardous chemicals. As shown in Table 13, under Sections 311 and 312, an EHS must be 

reported if it is held at the lower of 500 pounds or the substance’s TPQ, gasoline must be reported at 

75,000 gallons, diesel must be reported at 100,000 gallons, and all other hazardous chemicals must be 

reported at 10,000 pounds.595 These reporting requirements are tied to OSHA’s Hazard Communication

Standard (29 CFR 1910.1200). This standard requires employers to maintain SDSs for all hazardous 

chemicals in the workplace.596 SDSs contain crucial information, including chemical and hazard 

 

589 Ibid. See also: 42 U.S.C. §11001(c). 

590 Ibid. See also: 42 U.S.C. §11001(a).

591 Ibid. See also: 42 U.S.C. §11001(c).

592 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 

29, 2015). 593 Ibid. See also: 42 U.S.C. §11003(c). 

594 It should be noted that EPA has suggested, through guidance to SERCs and LEPCs (including the most recent fact 

sheet to these entities), that they include Sections 311 and 312 facilities in their planning process. 

595 See: http://www.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 

29, 2015). 

596 Ibid.

001530
West Fertilizer Company Final Report January 2016

198 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

identification; ingredient composition; first aid measures; firefighting measures; accidental release 

measures; handling and storage precautions; exposure controls and personal protection; physical and 

chemical properties; stability and reactivity properties; toxicological information; ecological concerns; 

disposal considerations; transport information; regulatory requirements; and other information.597 

Facilities must maintain SDSs onsite and submit copies of them (or a list of SDS-covered chemicals) to 

their SERCs, LEPCs, and local fire departments.598 

Facilities covered by Section 311 must also submit Emergency and Hazardous Chemical Inventory forms 

to their SERCs, LEPCs, and local fire departments annually.599 Facilities provide either a Tier I or Tier II 

inventory form.600 Tier I inventory form include the following aggregate information for each applicable 

hazard category:

• An estimate (in ranges) of the maximum amount of hazardous chemicals for each category 

present at the facility at any time during the preceding calendar year.

• An estimate (in ranges) of the average daily amount of hazardous chemicals in each category.

• The general location of hazardous chemicals in each category.601

The Tier II inventory form contains basically the same information as the Tier I, but it must list the 

specific chemicals. Tier II inventory form provide the following for each chemical:

• The chemical name or the common name as indicated on the SDS.

• An estimate (in ranges) of the maximum amount of the chemical present at any time during the 

preceding calendar year and the average daily amount.

• A brief description of the manner of storage of the chemical.

• The location of the chemical at the facility.

• An indication of whether the owner elects to withhold location information from disclosure to the 

public.602

Information submitted under Sections 311 and 312 is available to the public from SERCs and LEPCs.603 

 

597 See: https://www.osha.gov/Publications/HazComm_QuickCard_SafetyData.html (accessed on December 29, 

2015). OSHA does not enforce the ecological information, disposal considerations, transport information, and 

regulatory information sections of SDSs because other agencies regulate this information. 

598 See: http://www2.epa.gov/sites/production/files/2013-08/documents/epcra_fact_sheet.pdf (accessed on December 

29, 2015). 599 Ibid. 600 Ibid. 601 Ibid. 602 Ibid. It is important to note that under Section 312(f), upon request by the fire department with jurisdiction over 

the facility, owners/operators must provide fire departments with location information. They must also allow fire 

departments to conduct onsite inspections. 

603 Ibid.

001531
West Fertilizer Company Final Report January 2016

199 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.5.2 State Emergency Planning in the State of Texas

Texas has suffered some of the worst disasters in U.S. history, both in kind and magnitude. One of the 

first was the devastating hurricane in Galveston in 1900, which almost destroyed the city and killed 

thousands. In 1937, in New London, a gas leak explosion destroyed a school and killed approximately 

300 students and teachers. Ten years later, the FGAN explosion in Texas City inflicted an enormous loss 

of life and property that remains unknown to this day; it is ranked as one of the worst industrial accidents 

in U.S. history.604 

As a result of these disasters, Texas enacted statutes to address all-hazard emergency management.605 

The Texas Disaster Act of 1975 requires local jurisdictions to designate an emergency management 

coordinator to develop an emergency operations plan composed of a basic plan with 22 annexes.606 The 

basic plan and its annexes outline guidance for emergency management activities and assign roles and 

responsibilities to local agencies.607 Although the basic plan offers general guidance, the annexes provide 

more detail.608 For example, Annex Q, “Hazardous Materials and Oil Spill Response,” identifies the 

HAZMAT incidents that could occur in a specific community and how such an incident would likely 

affect nearby populations.609 Once a hazard is identified, appropriate response actions must be planned, 

including timely notification, identification of evacuation routes, and assignment of roles and 

responsibilities.610 Training exercises and drills must also test response effectiveness.611 

When Congress enacted EPCRA in 1986, its provisions were incorporated into Texas’s existing 

emergency planning framework and into state codes.612 The SERC is the Emergency Management 

Council of Texas and includes participation from multiple state agencies.613 Within that group of 

agencies, 10 are considered to be SERC members with specific roles in emergency response and 

planning. For example, the TCEQ is responsible for receiving reports about accidental spills and 

releases;614 the Texas Department of State Health Services is designated to receive the Tier I or Tier II 

Emergency and Hazardous Chemical Inventory forms submitted electronically by facilities;615 and the 

Texas Department of Public Safety, Division of Emergency Management, is tasked with overseeing the 

 

604 Texas Emergency Management Executive Guide (FY 2014 Edition). 605 Ibid. 606 Texas Administrative Code, Title 37, Part 1, Chapter 7. Texas Government Code, Chapter 418. 607 See: Texas Emergency Management Executive Guide (FY 2014 Edition), 4. 608 Ibid. 609 See: McLennan County. Annex Q: Hazardous Materials & Oil Spill Response. Version 2.4, July 2009. 610 See: Texas Emergency Management Executive Guide (FY 2014 Edition), 4. 611 Ibid. 612 Texas Health and Safety Code, Title 6, Subtitle D, “Hazardous Substances,” Chapters 505 through 507. Texas

Administrative Code, Title 37, Part 1, Chapter 7. Texas Government Code, Chapter 418. 613 Texas Department of Public Safety. See: https://www.txdps.state.tx.us/dem/stateLocalOrganizations.htm#EMC

(accessed on December 29, 2015). 614 See: https://www.tceq.texas.gov/response/spills (accessed on December 29, 2015). 615 This designation has changed since the date of the WFC incident. The Tier II Chemical Reporting Program has 

moved to the TCEQ. See: https://www.dshs.state.tx.us/tiertwo/ (accessed on December 29, 2015). 

001532
West Fertilizer Company Final Report January 2016

200 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

all-hazard emergency management program and providing guidance and funding for cities, counties, and 

state agencies so that they can develop their own programs.616 

8.5.3 City Emergency Planning in the City of West

To fully understand the WFC incident, this section reviews emergency planning and management in West 

and at the WFC facility. West is located in McLennan County, which is West’s local emergency 

management district and which formed an LEPC in 1992. The McLennan County LEPC meets four times 

per year.617 Its members are nominated by the county judge and approved by the SERC.618 The LEPC 

membership consists of city, industry, hospital, and emergency response officials.619 CSB found that the 

WFC, however, was not listed on the attendance roster for any LEPC meeting for more than 21 years. 

As required by both state and federal regulations, the McLennan County LEPC prepared an emergency 

response plan (ERP) in accordance with guidance from the Texas Department of Public Safety, Division 

of Emergency Management.620 As discussed previously, this consisted of a basic plan with 22 annexes. 

It described in part McLennan County’s approach toward emergency planning, response, and notification. 

McLennan County officials review the plan annually and officially revise or update it every 5 years, as 

required by Texas law.621 Prior to the WFC incident, McLennan County last formally reviewed its ERP 

in 2010.622 

The McLennan County ERP includes procedures on how to alert the public when natural or humaninitiated disasters occur. ERP annexes describe actions to take in various scenarios, such as how to 

disseminate information quickly,623 how to warn special facilities (e.g., hospitals and schools) and 

populations of a hazard,624 and how to use alert systems to activate immediate evacuation.625 A vital 

component of ERPs and ERP annexes is LEPC engagement and communication. Without these, 

community members might not have the necessary information to respond appropriately to a specific type 

of incident. 

For example, on February 12, 2013, WIS was temporarily evacuated because of a controlled burn at the 

WFC facility. Before the evacuation, the school principal alerted 911 of the fire, but the 911 dispatcher 

did not acknowledge a coordinated burn. Students and staff were evacuated for approximately 30 minutes 

to WMS, using coordinated transportation. The WFC did not notify the WISD or WIS in advance that the 

 

616 See: https://www.txdps.state.tx.us/internetforms/Forms/TDEM-10.pdf (accessed on December 29, 2015). 617 McLennan County LEPC Bylaws, Article II, Section 5, “Meetings.” 618 McLennan County LEPC Bylaws, Article II, Section 1, “Membership.”

619 Ibid. 620 State of Texas. Local Emergency Planning Committee (LEPC): A Primer for Local Planning for Hazardous 

Materials, July 2006. 621 Texas Administrative Code, Title 37, Part 1, Chapter 7, Subchapter B, Rule 7.12. 622 CSB reviewed the 2010 McLennan County ERP for this investigation report. 623 McLennan County Basic Plan, Annex I. 624 McLennan County Basic Plan, Annex E. 625 Ibid. 

001533
West Fertilizer Company Final Report January 2016

201 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

facility was conducting a controlled burn of pallets and brush. After this incident, the WISD asked the 

emergency service providers and the WFC to provide advance notice of future burning activities. The 

WFC could have communicated its plans to the WISD or WIS through LEPC activities. 

The McLennan County ERP specifically includes Annex Q, “Hazardous Material and Oil Spill 

Response,” which requires identification of all regulated facilities within the county.

626 Such facilities are 

those that are regulated by EPCRA. In particular, a regulated facility is:

A plant site where handling/transfer, processing, and/or storage of chemicals is performed. For 

the purposes of [Annex Q], regulated facilities (1) produce, use, or store EHSs in quantities which 

exceed threshold planning quantities or (2) hold one or more hazardous chemicals in a quantity 

greater than 10,000 pounds at any time.627 

Because the WFC was regulated by EPCRA, it would follow that Annex Q might list the WFC. 

However, the WFC was not listed. 

EPCRA covered the WFC for at least two reasons. First, the WFC stored anhydrous ammonia in 

quantities that exceeded the anhydrous ammonia TPQ of 500 pounds. Specifically, CSB found that the 

WFC reported holding 34,000 pounds of anhydrous ammonia at the time of the incident. Clearly, the 

WFC had onsite sufficient amounts of an EPCRA Section 302 EHS. This triggered not only reporting 

requirements, but also emergency response planning requirements.628 Thus, the WFC should have been 

listed in Annex Q for its EPCRA-regulated storage of anhydrous ammonia. 

Second, the WFC stored FGAN, a hazardous chemical under EPCRA Sections 311 and 312, in quantities 

that exceeded the AN threshold quantity of 10,000 pounds. In particular, CSB found that the WFC 

reported 80,000 to 120,000 pounds of FGAN onsite at the time of the incident. As such, the WFC was 

required to report its quantities of FGAN under EPCRA. CSB obtained WFC Tier II form documents, 

dated from 2000 to 2012, and found that the WFC annually reported its quantities of anhydrous ammonia 

to the WVFD, McLennan County LEPC, and Texas Department of State Health Services, but reported its 

FGAN only in its 2012 Tier II report. Ideally, under the best set of circumstances, the WFC should have 

been listed in Annex Q for its storage of FGAN. The WFC was not listed in Annex Q, however, due to a 

misunderstanding of EPCRA’s agricultural use exemption. 

EPCRA’s agricultural use exemption is a statutory exemption to the definition of “hazardous chemical.” 

It reads:

Hazardous Chemical Defined. For purposes of this section, the term “hazardous chemical” has 

the meaning given such term by section 1910.1200(c) of title 29 of the Code of Federal 

 

626 McLennan County Basic Plan, Annex Q. 627 Ibid. 

628 The WFC was also expected to develop an emergency response plan for its storage of anhydrous ammonia, as 

required by the Risk Management Program rule. According to EPA, the EPCRA plan and the RMP must be 

coordinated. See: http://www2.epa.gov/sites/production/files/2013-11/documents/chap-08-final.pdf (accessed on 

December 29, 2015). However, no evidence indicated that the WFC RMP was shared with the LEPC or the WVFD. 

001534
West Fertilizer Company Final Report January 2016

202 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Regulations, except that such term does not include the following: . . . Any substance to the 

extent it is used in routine agricultural operations or is a fertilizer held for sale by a retailer to the 

ultimate customer.

629

It is important to note that this exemption may apply only to Sections 311 and 312 reporting 

requirements; it does not apply to emergency planning requirements under Section 302. Furthermore, the 

agricultural use exemption applies directly to the hazardous chemical itself, not the specific individual or 

entity holding the chemical. That is, the exemption does not relieve an individual or entity of its 

responsibilities; rather, the individual or entity is exempt from EPCRA reporting requirements if the 

chemical in question is exempt. Where individuals or entities hold multiple chemicals, each chemical 

must be assessed individually to determine exemption status. 

The agricultural use exemption impacts those who use substances in “routine agricultural operations” and 

retailers who hold substances as fertilizer for sale to the ultimate customer. With respect to those who use 

substances in routine agricultural operations, CSB referred to guidance on EPA’s website that, in response 

to a question asking which hazardous chemicals are reportable for farmers under Sections 311 and 312, 

states: 

Under Section 311(e)(5), any substance when used in routine agricultural operations is exempt 

from reporting under Section 311 and 312. This exemption is designed to eliminate the reporting 

of fertilizers, pesticides, and other chemicals when stored, applied, or otherwise used at the farm 

facility as part of routine agricultural activities. . . . Thus, the storage and use of a pesticide or 

fertilizer on a farm would be considered the use of a chemical in routine agricultural operations 

and is, therefore, exempt under Sections 311 and 312.630

The belief is that minimal risk is involved when farmers use a substance in routine agricultural operations 

because farmers promptly apply those substances to their crops. Therefore, the exemption eliminates 

EPCRA reporting requirements under Sections 311 and 312 for at least certain farmers. However, for 

retailers who hold a substance as fertilizer for sale to the ultimate customer, CSB found that although 

EPA has published several hypothetical-based questions and answers on its website, it offers little general

guidance. 

CSB discovered that the McLennan County LEPC reported that the WFC’s storage of anhydrous 

ammonia and FGAN appeared to qualify under EPCRA’s agricultural use exemption, a conclusion which 

the county stated was also confirmed by the SERC. The WFC’s anhydrous ammonia and FGAN were 

erroneously considered exempt from both emergency planning and hazardous chemical inventory 

reporting requirements because of the phrase “fertilizer held for sale by a retailer631 to the ultimate 

customer” and because the main WFC customers who bought fertilizer were nearby farmers (ultimate 

 

629 EPCRA, Section 311(e)(5). 40 CFR 370.66. 630 See: https://emergencymanagement.zendesk.com/hc/en-us/articles/211416278-What-hazardous-chemicals-arereportable-for-farmers-under-311-and-312- (accessed on December 29, 2015). It should be noted, however, that 

although farmers may be exempt under Section 311(e)(5) from reporting these fertilizers in their Sections 311 and 

312 reports, they are still required to notify the SERC (or TERC), LEPC (or TEPC), and local fire department under 

Section 302 if they have an EHS at or above its TPQ.

631 There is no definition of “retailer” under EPCRA.

001535
West Fertilizer Company Final Report January 2016

203 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

customers / end users). This reason likely explains why the McLennan County LEPC ERP did not 

include the WFC for its storage of anhydrous ammonia, despite the fact that the exemption does not 

relieve reporting requirements for EHSs under Section 302. 

Because the WFC facility not only sold pure fertilizer but also blended chemicals to make fertilizer (e.g., 

for custom orders), CSB also examined how the agricultural use exemption applies to blends. EPA states 

that chemicals “held for the purpose of producing fertilizer” are “starting materials used to make a 

fertilizer,” not the fertilizer itself, so the retailer therefore should report them.632 EPA recognizes, 

however, that if those chemicals are not blended but rather sold individually to the end customer, then 

those chemicals are exempt.633 EPA confirmed this position in a September 3, 2010, letter to TFI, stating 

that the “mixing of fertilizers” must be reported and reiterating that “fertilizer held for sale by a retailer to 

the ultimate customer . . . is one that is merely held for sale, not one that is mixed or formulated.”634 

To bolster its reasoning, EPA further explained: 

Congress’ intent was to focus Section 311/312 reporting on manufacturers and wholesalers—

those are facilities that typically have large quantities of fertilizer, and that use and manufacture a 

wide range of chemical compounds. Congress appreciated that such manufacturers and 

wholesalers presented significant risks that needed to be addressed by emergency response 

authorities, but that mere retailers did not. Assuming arguendo that Congress’ intent is 

ambiguous, the above interpretation is one that EPA adopts as being the most reasonable 

interpretation of the statute. Therefore, consistent with the Agency’s prior Q&A guidance, the 

amount of chemicals intended for blending and the new product should be reported under Section 

311 and 312 if the reporting thresholds are exceeded.635

On this basis, facilities that blend chemicals to make fertilizer such as the WFC should not apply the 

agricultural use exemption to those chemicals meant for blending. However, there is confusion about 

both who specifically qualifies for the exemption as well as the issue of blending because, although 

hypothetical-based Q&As are available, limited general EPA guidance exists. Therefore, EPA should 

develop a general guidance document pertaining to EPCRA’s agricultural use exemption and make a 

widespread effort to communicate its contents to the fertilizer industry. 

Since the incident, the Agricultural Retailers Association (ARA), a nonprofit trade association that 

represents the interests of agricultural retailers and distributors on legislative and regulatory issues, issued 

an alert to its members on May 14, 2013, warning agricultural retailers that blend (i.e., use nonchemical 

reactions to mix) dry fertilizers to report those fertilizers on their annual Tier I or Tier II inventory reports 

submitted to SERCs, LEPCs, and local fire departments. The alert also warned members that EPA has 

 

632 See: https://emergencymanagement.zendesk.com/hc/en-us/articles/212089537-Are-hazardous-chemicals-blendedfor-fertilizer-exempted-under-agricultural-use-exemption- (accessed on December 29, 2015). 633 Ibid. 634 Dana S. Tulis, EPA Acting Director Office of Emergency Management. Letter to Chris S. Leason, counsel to TFI, 

September 3, 2010. 

635 Ibid. 

001536
West Fertilizer Company Final Report January 2016

204 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

cited agricultural retailers for incomplete inventory forms.636 TFI further noted in a verbal statement on 

November 15, 2013, at the Washington, DC, “Listening Session Regarding President Obama’s Executive 

Order Improving Chemical Facility Safety and Security”: 

As most of you know, there is a fertilizer retail exclusion for reporting under EPCRA. TFI 

supports removal of this exclusion. We feel everyone should report hazardous chemicals stored 

on site to the LEPC and SERC and work with local fire departments without exception.637 

Despite these post-incident efforts, the ARA and TFI cover only some of the thousands of FGAN 

facilities in the United States. Consequently, EPA should take steps to ensure that fertilizer facilities fully 

comply with EPCRA and do not mistakenly apply the agricultural use exemption. In fact, EPA already 

hosted, from May to September 2014, 32 workshops for members of Local Emergency Planning 

Committees, which were held in Texas, Arkansas, Louisiana, Oklahoma, and New Mexico and attended 

by 1,340 representatives from local, state, and federal government as well as industry.638 It also recently 

released an online training module of key requirements for SERCs and LEPCs and a factsheet, “How to 

Better Prepare Your Community for a Chemical Emergency: A Guide for State, Tribal, and Local 

Agencies.”639 While these efforts demonstrate progress, CSB believes the development of more general 

EPCRA guidance, as well as a guidance document on the agricultural use exemption, could help 

significantly improve emergency planning at all levels. 

8.5.4 Other Emergency Planning Requirements

During the course of its investigation, CSB also found issues in emergency planning related to FGAN 

training and compliance with OSHA’s Hazardous Waste Operations and Emergency Response 

(HAZWOPER) standard (29 CFR 1910.120). CSB determined that employees at the WFC had limited 

training on FGAN hazards. The agency learned through interviews that some WFC employees were 

unaware that the FGAN fertilizer stored onsite could explode. Many said the April 1995 Oklahoma City 

bombing was the only basis of their knowledge of this. Nonetheless, WFC employees generally 

understood FGAN security regulations so as to verify that customers buying FGAN were registered and 

were using it only for agricultural purposes. CSB found that the lack of formal training at the WFC was a 

central reason why employees were largely unaware of FGAN hazards. 

Some WFC employees recalled having discussions about avoiding FGAN contact with heat, fire, and 

moisture. However, CSB concluded that FGAN safety training was inconsistent and that no formal 

training addressed FGAN hazards or required discussion of the FGAN SDS. WFC employees also lacked 

formal training on the facility’s ERP for anhydrous ammonia. Employees informally shared information 

 

636 Unfortunately, the alert, even if made before the date of the incident, would have had little impact on the WFC

because the facility was not a member of the ARA. 637 See: http://www.tfi.org/media-center/news-releases/tfis-verbal-statement-presented-nov-15-washington-dclistening-session-re (accessed on December 29, 2015). 638 See: https://www.osha.gov/chemicalexecutiveorder/EO13650FS-ImprovingChemicalFacilitySafety.pdf (accessed 

on December 29, 2015). 

639 Ibid. 

001537
West Fertilizer Company Final Report January 2016

205 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

so that they knew to evacuate as far as possible if such a release occurred. They also knew which 

emergency numbers to call. However, much of the WFC employee training was hands on and job 

specific. Thus, a lack of comprehensive emergency planning and response training played a role in how 

the incident unfolded. 

In addition, CSB discovered issues with OSHA’s HAZWOPER standard, which too is an integral element 

of emergency planning. Under the HAZWOPER standard, the WFC was required to develop an ERP for 

all “hazardous substances.” As defined by the standard, hazardous substances include those covered by 

EPA or DOT.640 FGAN meets this definition because it is listed in DOT’s Hazardous Materials Table.641 

The WFC was therefore required to develop a HAZWOPER ERP, or would be considered exempt if it 

met another OSHA standard, Emergency Actions Plans (29 CFR 1910.38).642 

The HAZWOPER ERP should have addressed pre-emergency planning and coordination with outside 

parties, personnel roles, lines of authority, training and communication, emergency recognition and 

prevention, safe distances and places of refuge, site security and control, evacuation routes and 

procedures, decontamination, and emergency medical treatment and first aid.643 However, no evidence 

indicated that the WFC developed the HAZWOPER ERP or was considered exempt under the Emergency 

Action Plans standard for FGAN. Consequently, OSHA cited the WFC after the incident for not 

providing an FGAN-related HAZWOPER ERP. 

8.6 Fire Protection Codes and Standards

Fire protection codes and standards generally refer to the most recently developed practices to protect 

people and property from fire and natural disasters. When adopted by states or local jurisdictions, codes 

(including building, electrical, plumbing, mechanical, and other codes) represent mandatory regulations. 

Standards, on the other hand, provide methods to achieve compliance with codes. Both codes and 

standards must be adopted through some process, usually state-level fire or building codes. The 

legislature must enact that adoption before a fire protection (or prevention) code or standard applies. 

Because fire and building codes may also include references to many standards, such standards are 

generally not adopted separately but instead are included once the fire or building code is adopted. 

Fire codes specify practices that must be followed; that is, codes are mandatory only if adopted. In 

contrast, fire protection standards typically refer to practices that, despite their mandatory language, are 

voluntary unless adopted into law (e.g., as a state fire code). The nation’s leading fire protection codes 

and standards are issued by the NFPA and the International Code Council (ICC). Both employ a public 

consensus process to produce model codes and standards that jurisdictions can adopt into law. The NFPA 

updated its current code for FGAN, NFPA 400 (Hazardous Materials Code) Chapter 11, after the WFC

 

640 29 CFR 1910(a)(3). 641 49 CFR 172.101. 642 29 CFR 1910.120(q)(1). 643 29 CFR 1910.120(q)(2).

001538
West Fertilizer Company Final Report January 2016

206 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

incident to address the conditions that likely led to the FGAN detonation. The ICC’s International Fire 

Code (IFC) also addresses storage and handling of oxidizing materials. 

Texas does not have a state-wide fire code and as a result, most fire departments in the state have no 

authority to inspect facilities against, or compel them to follow the safe practices outline in these codes, 

unless a fire code is adopted at the county or city level. In July 2015, the Texas Department of Insurance 

did adopt NFPA 1 (Fire Code) for inspections by the Texas State Fire Marshal’s office on the complaint 

of any person. However, even if fire protection standards are incorporated into state and local fire codes, 

catastrophic incidents can occur when such standards are deficient. 

CSB reviewed the ICC IFC and NFPA 1 (Fire Code). The IFC is in use or adopted in 42 states,644 and 

NFPA 1 is adopted statewide in 19 states. CSB also researched fire protection codes on the state, county, 

and city levels—specifically, in the state of Texas, in McLennan County, and in the city of West. The 

first part of this section describes the NFPA, with details on the NFPA standard for FGAN. The second 

part of this section describes the ICC, with details on how it addresses HAZMAT. The third and last part 

of this section describes fire code regimes on a more local level and analyzes codes in Texas, which can 

be improved to better protect emergency responders and the public from fire events. 

8.6.1 National Fire Protection Association

The NFPA is an international nonprofit organization that develops and publishes industry consensus

codes and standards, guides, and recommended practices associated with fire prevention and related 

hazards. Companies can voluntarily comply with NFPA codes and standards or can be required to follow 

a standard if it is adopted by reference in local, state, or federal laws (e.g., in a local or state fire code). 

Many of the NFPA codes and standards are also incorporated in OSHA regulations. The EPA Risk 

Management Program rule and OSHA PSM standard regulations require owners and operators of covered 

facilities to ensure that facility processes are designed to comply with RAGAGEP, which can include 

NFPA codes and standards. However, if these consensus codes and standards are deficient, they can lead 

to insufficient protections. 

8.6.1.1 NFPA Code for FGAN

AN requirements were first covered by NFPA 490 (Storage of Ammonium Nitrate), which was adopted in 

1965. In 2010, NFPA withdrew NFPA 490 when it was incorporated into NFPA 400 (Hazardous 

Materials Code). NFPA 400 establishes provisions for the storage, use, and handling of a number of 

hazardous substances, using four broad categories addressing building construction, storage requirements, 

fire protection systems, and general protections against fire. The 2013 edition had been published and 

was in effect at the time of the incident.

The code has a specific chapter on AN (Chapter 11, “Ammonium Nitrate Solids and Liquids”). This 

distinguishes AN from other chapters because other chapters of the code are organized by chemical 

 

644 The IFC is also adopted in the District of Columbia, NYC, Guam and Puerto Rico.

001539
West Fertilizer Company Final Report January 2016

207 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

properties (such as “oxidizers” or “unstable or water reactive materials”) that can each apply to several 

chemicals. The scope of Chapter 11 covers “the storage, use, and handling of solid or liquid AN” in 

quantities exceeding 1,000 pounds. The chapter does not include FGAN manufacturing operations or the 

composition of FGAN designated as DOT hazard Class 1 explosives. The NFPA 400 code includes 

provisions for indoor and outdoor storage, fire protection systems, and general use; annexes offer 

additional guidance. In addition, the maximum allowable quantity (MAQ) designation is used in building 

and fire codes when addressing the storage, handling, and use of HAZMAT. The MAQ is integral to the 

NFPA 400 approach. It includes provisions for classifying materials, determining their MAQs, and 

adding other protective features if the intention is to use greater quantities of material. 

When evaluating the provisions in NFPA 400 (2013 Edition) against the factors that likely contributed to 

the WFC incident, CSB found code deficiencies concerning scope, building design, storage practices, and 

fire prevention and firefighting response for facilities that store bulk FGAN. However, it is important to 

note that the WFC would not have been required to comply with the code at the time of the incident 

unless the authority having jurisdiction enforced it retroactively. The WFC facility was constructed in 

1962, so the requirements of NFPA 400 did not apply. Nonetheless, in response to some of the lessons 

learned from the WFC incident, CSB and other agencies and organizations participated in meetings with 

the NFPA Technical Committee on Hazardous Chemicals to provide input on the next revision of NFPA 

400 (2016 Edition). 

A significant effort of the NFPA Technical Committee focused on addressing the requirements for 

existing FGAN storage facilities covered under NFPA 400 because the previous editions had primarily 

covered requirements for new facilities.645 As discussed, the wood construction of the WFC warehouse 

and bins that stored FGAN not only assisted in the rapid spread of the fire but also increased the 

sensitivity of the material that led to the detonation. In addition, the WFC warehouse had no installed fire 

detection or suppression systems, allowing the fire to spread through the building. If a building fire 

detection system had been operational, the early stages of the fire possibly could have been extinguished. 

Furthermore, sprinklers could have extinguished the fire before it could heat the FGAN pile sufficiently to 

produce a detonation.

Similar to the OSHA Explosives and Blasting Agents standard, NFPA 400 (2013 Edition) allowed wood 

and combustible construction materials for bulk storage bins for FGAN as long as the bins were 

“protected against impregnation by FGAN.” The code noted in an annex that sodium silicate, epoxy 

coatings, or polyvinyl chloride (PVC) coatings were acceptable means to achieve this protection. 

However, the method used to coat the wood to resist FGAN impregnation does not prevent a fire. The 

presence of combustibles during a fire can create explosive conditions within a building that stores bulk 

FGAN. NFPA 400 (2016 Edition) now prohibits the use of combustible materials for all construction and 

bins at new facilities, even when coatings are applied to protect against FGAN impregnation. 

 

645 Pearce, Nancy. “Safer Storage.” NFPA Journal, May 1, 2015.

001540
West Fertilizer Company Final Report January 2016

208 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

However, the 2016 revisions to NFPA 400 do not apply the same requirements to prohibit combustible 

construction at existing facilities. The NFPA was challenged to reasonably specify construction 

requirements for facilities with combustible construction, which comprise the majority of FGAN storage 

facilities.646 To address existing facilities, NFPA 400 (2016 Edition) contains the new Section 11.1.5, 

“Protection of Existing Buildings.” This includes requirements that apply retroactively, where adopted, 

for existing buildings with combustible content. Facilities are required to install automatic fire sprinkler 

and detection systems. Activation of the fire detection system must automatically initiate an audible and 

visual alarm at the facility as well as a public notification or alert system to warn individuals located 

within one mile of the facility that they need to evacuate.

Another shortcoming of NFPA 400 (2013 Edition) lies in Annex E, “Properties and Uses of Ammonium 

Nitrate and Fire-Fighting Procedures,” which called for large volumes of water to be applied as quickly as 

possible unless the fire reached “massive and uncontrollable proportions,” when responders were advised 

to evacuate and withdraw to a safe location. CSB found this guidance to be vague because the user had to 

determine when to categorize a fire as “massive and uncontrollable” and when to make the decision to 

evacuate rather than attempt to extinguish the fire. Because of FGAN’s unpredictable nature, immediate 

evacuation should be the first action for responders, using a minimum evacuation distance calculated in 

advance based on the quantity of FGAN stored. The 2013 edition of NFPA 400 did not require preplanning, but given the events that unfolded during the WFC response, firefighters should also have a preincident plan to facilitate quick and effective decision making when responding to an FGAN fire.

NFPA 400 (2016 Edition) now requires new and existing facilities to have emergency action plans that 

clearly state that “fire potentially affecting FGAN storage beyond the initial (incipient) stage shall not be 

approached by facility personnel.”647 The emergency plan must also specify whether the FGAN storage 

facility has a sprinkler system and whether it is constructed of combustible materials. For new facilities, 

the plan must establish a safe evacuation distance based on an approved648 analysis of potential offsite 

consequences. If no analysis has been performed, a distance of one mile should be used. The revised 

Annex E of NFPA 400 (2016 Edition) offers additional guidance to firefighters, including information on 

the conditions that cause FGAN explosions. The guidance states that only incipient fires in FGAN 

storage areas (or in vehicles transporting FGAN) should be attacked by using manual fire extinguishing 

methods that require a human operator.649 Firefighters should withdraw to a safe distance and allow the 

structural fire to burn to completion once it progresses beyond the incipient stage.650 

 

646 Ibid. 647 NFPA. NFPA 400: Hazardous Materials Code, 2016 Edition. Quincy, MA: NFPA, 2016. 648 Plan approvals are performed by the authority having jurisdiction, such as the fire department or fire marshal.

649 NFPA. NFPA 400: Hazardous Materials Code, Annex E, 2016 Edition. Quincy, MA: NFPA, 2016. 650 NFPA 400 (2016 Edition) states that “responses to incipient releases of hazardous materials where the material can 

be absorbed, neutralized, or otherwise controlled at the time of release by employees in the immediate release area, 

or by maintenance personnel, shall not be considered emergency responses as defined within the scope of this code.”

001541
West Fertilizer Company Final Report January 2016

209 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Following the WFC incident, the NFPA-sponsored Fire Protection Research Foundation651 (the 

Foundation) conducted a study652 to determine the adequacy of the separation distances prescribed for 

hazardous materials in NFPA 400, with a greater focus on FGAN. NFPA 400 specifies separation and 

clearance distances for newly constructed hazardous chemical storage from other on-site equipment and 

occupied buildings. 

The Foundation’s technical committee was made up of industry representatives, and research and 

engineering organizations that conducted literature reviews of existing methodologies to determine safe 

separation distances and testing to characterize the effect of AN detonations on personnel and processes 

near an explosive event. The study included reviews of various sources for risk-based and consequencebased methodologies for determining the safe distances as well as established distance tables. To study 

the adequacy of the existing separation distances in NFPA 400, the Foundation commissioned explosive 

testing to characterize the effects of nearby processes and personnel using a 3,000 pound ANFO donor 

charge to simulate an explosion.

As part of the analysis, blast consultants compared the blast pressures and data recorded at various 

distances from the donor charge and compared the effects to the recommended distances for Class 3 

Oxidizers in detached unsprinklered storage prescribed in NFPA 400 Chapter 15 (Oxidizer Solids and 

Liquids). The study concluded that the process-to-process separation distances for solid AN may be 

inadequate to provide protection against blast effects, but the process-to-personnel separation distances 

may be acceptable if personnel are inside buildings located at prescribed distances. However, the study 

concluded that additional testing and analysis is necessary to validate the absolute safety of personnel 

based on variations in processes, design, and potential reactants. 

The purpose of the project was to provide guidance to the NFPA technical committee for the development 

of technically-based separation distances for storage. Thus, the Foundation recommends a technicalbased approach to establish safe separation distances that takes into account the risks associated with a 

known material and process, as well as the potential consequences of a catastrophic event involving that 

material. 

8.6.2 International Code Council 

Like the NFPA, the ICC is an international nonprofit organization that develops and publishes consensus 

codes and standards. In addition to publishing the IFC, the ICC also produces the International Building 

Code (IBC), which is in use or adopted in 50 states. Jurisdictions can adopt the model codes by reference.

The ICC views its codes as “companion” documents that work across disciplines (e.g., building

construction, fire protection, mechanical systems, plumbing, zoning). Thus, a regulation for HAZMAT 

storage will affect building code requirements for construction, mechanical code requirements for 

 

651 The Fire Protection Research Foundation is an affiliate of NFPA and plans, manages, and communicates research 

on fire safety issues in collaboration with academics, laboratories, and industry. 

652 See: http://www.nfpa.org/Assets/files/AboutTheCodes/59A/RFSeparationDistancesNFPACodesAndStandards.pdf

(accessed on December 30, 2015). 

001542
West Fertilizer Company Final Report January 2016

210 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ventilation, plumbing code requirements for drainage, and fire code requirements for operations and 

handling. The codes are cross-referenced for ease of use.

The ICC requirements for protecting AN from fire exposure and explosion are based on material 

properties, quantities stored, and storage and handling conditions. The ICC defines storage as “the 

keeping, retention or leaving of hazardous materials in closed containers, tanks, cylinders, or similar 

vessels; or vessels supplying operations through closed connections to the vessel.”653 Therefore, despite 

common references to the WFC FGAN as “in storage,” the IFC would interpret this application as 

“handling,” which it defines as “the deliberate transport by any means to a point of storage or use,” or as 

“use,” which it defines as “placing a material into action, including solids, liquids and gases.”654 

The IFC does not have a separate chapter for AN. The IFC refers to NFPA 400 when AN intended for 

explosive materials is stored, handled, or used. Otherwise, AN is treated as an oxidizing agent, subject to 

the general requirements for each oxidizer class in IFC Chapter 63 (Oxidizers, Oxidizing Gases and 

Oxidizing Cryogenic Fluids) and Chapter 50 (Hazardous Materials). 

8.6.3 State Fire Codes

Without a comprehensive federal standard, states must rely on their own regulations to oversee HAZMAT 

storage. Most states have enacted fire codes or have adopted model fire codes. These codes typically 

include HAZMAT storage and emergency planning provisions. However, at the time of the incident, 

Texas had no state fire code, and the state still has no such code as of publication of this report. 

The majority of states have adopted model fire codes through referencing them into law.655 Two 

recognized model fire codes are the IFC and NFPA 1. Both establish minimum requirements for fire 

prevention and protection systems. Some states and municipalities have developed their own fire codes, 

using model codes as a guide. New York City updated its fire code in December 2007, marking its first 

major revision since 1913.656 After investigating an industrial waste explosion and fire in 2001 in the 

Chelsea district of Manhattan, CSB issued a recommendation to the Mayor and City Council to better 

address HAZMAT.657 The city developed its own code, borrowing heavily from the IFC (2003 Edition) 

but requiring some more stringent provisions. 

States could potentially apply other IFC chapters for storing bulk FGAN. For example, IFC Chapter 63 

(Oxidizers, Oxidizing Gases and Oxidizing Cryogenic Fluids) includes provisions for storage and use of 

oxidizing materials, such as FGAN. This chapter says that indoor storage of oxidizers should be located 

in a detached building with an automatic sprinkler system and smoke detection systems. Additional 

 

653 ICC. Chapter 50, Section 5002.1. International Fire Code, 2015 Edition. Washington, DC: ICC, 2015. 654 Ibid. 655 ICC. “International Code Adoption.” International Fire Code. Washington, DC: ICC, 2014. See: 

http://www.iccsafe.org/gr/Pages/adoptions.aspx (accessed on November 6, 2014). 656 Cassono, Salvatore. “A New Fire Code for New York City.” Building Safety Journal (July–August 2008). 657 CSB. “Chemical Waste-Mixing Incident: Kaltech Industries Group, Inc.” CSB Investigation Report, April 25, 

2002. 

001543
West Fertilizer Company Final Report January 2016

211 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

requirements for storage configuration, separation barriers, and explosion control depend on the class of 

oxidizer, of which the IFC names four. NFPA 1 includes similar requirements for oxidizers in Chapter 70 

(Oxidizer Solids and Liquids). This chapter directs users to follow NFPA 400, which also incorporates 

similar building and fire protection requirements for indoor storage of oxidizers. 

The WFC did not voluntarily implement any of the provisions from the oxidizer chapters of the IFC or 

NFPA 1, nor were they required to do so by the authority having jurisdiction. The WFC did not install an 

automatic sprinkler or smoke detection system in the fertilizer warehouse, nor did it store its FGAN in a 

separate building, away from combustibles. The location where the fire originated was adjacent to the 

FGAN bin, and no fire-rated wall separated the rooms. The WFC was not subject to code provisions 

because none of the relevant jurisdictions—not the state of Texas, McLennan County, or the city of 

West—had adopted a fire code. 

Texas affords counties and municipalities the discretion to adopt or develop fire codes. However, state 

law limits which counties can adopt such codes. Only a county with a population of more than 250,000 

(and counties adjacent to a county with a population of more than 250,000) may adopt a fire code. 

Moreover, even if such a county does adopt a fire code, that code applies only to the unincorporated areas 

of the county. Cities within the county can adopt the county fire code, not adopt a fire code, or develop 

their own fire codes. Adoption of a city fire code does not affect any unincorporated areas outside the 

city. Although many major Texas cities have adopted fire codes, the pattern is inconsistent. 

As of September 2014, 43 facilities stored FGAN in 36 Texas counties. Only one of those 36 counties 

has a population of more than 250,000 people,658 and only six of those counties are adjacent to counties 

with populations that equal or exceed 250,000. Consequently, 79 percent of the 43 FGAN storage 

facilities are located in Texas jurisdictions that, under state law, cannot adopt a fire code.

According to the 2010 census, the population of McLennan County was 241,281. Thus, the county fell 

below the population threshold. However, one of the seven adjacent counties had a population of more 

than 250,000. Accordingly, McLennan County had the authority to adopt a fire code, but this was not 

required. It is also important to note that the WFC facility was only partially within city limits. The 

fertilizer warehouse was located in an unincorporated area of West. If McLennan County had adopted a 

fire code, it would have applied to the WFC fertilizer warehouse only. Furthermore, if West had decided 

to adopt its own fire code, it would have applied to the entire WFC facility except for the warehouse.

Although efforts have been made to make a state fire code in Texas mandatory, such endeavors have not 

been successful. The Texas Legislature debated the issue of adopting a state fire code at least as far back 

as 1978. Legislative committee reports between 1978 and 1984 from the Texas House of Representatives 

and the Texas State Senate identified the severe fire problem, and one report contended that the losses 

from fires exceeded “loss of life and property” from “all natural disasters combined” in the state.659 After 

 

658 U.S. Census Bureau. 2010 U.S. Census. Washington, DC: U.S. Census Bureau, 2011.

659 Texas House of Representatives Committee on Business and Industry. “Interim Report,” October 13, 1978.

001544
West Fertilizer Company Final Report January 2016

212 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

hearing multiple testimonies in public hearings across the state, a committee report concluded that Texas 

was “one of the leading states in property loss and lives lost because of fire.”660 This same committee 

report also found that such major losses occurred not in the most populated municipalities that had

adopted fire and building codes, but in the unincorporated areas where fire codes did not apply.661 It 

stated that unincorporated areas were particularly problematic when annexed into a municipality because 

the city assumed responsibility for fire-prone buildings that were not built to code specifications.662 

Because growth areas in counties are inevitable targets for municipal annexation, if counties are not 

granted proper regulatory authority, cities inevitably inherit the problems thus created. 

The Texas legislative committee reports also identified that without a state fire code, the State Fire 

Marshal cannot fulfill the duty of minimizing fire risks. One report noted that the State Fire Marshal has 

no authority to adopt a fire code, despite holding responsibility for the inspection of state-owned and 

state-leased buildings. Without a code, the State Fire Marshal is unable to set criteria to assess a fire 

hazard and enforce corrective actions. Moreover, although the local fire marshals hold authority to 

inspect facilities in their jurisdictions, without a fire code, they cannot enforce safety measures that are 

not legally required. 

The Texas Fire Protection Standard Committee, a special interim legislative committee, studied the fire 

problem and issued an interim report to the 69th session of the Texas Legislature in December 1984.663 

This committee confirmed many of the findings above.664 In addition, the committee analyzed NFPA 

national fire data from 1978 to 1982.665 These data indicated that the per capita number of fires, deaths, 

and injuries and the dollar loss resulting from fire were all lower in states with fire codes than in those 

without them.666 The data also suggested that education alone to minimize human errors was insufficient 

to reduce fire loss because fire causation was mostly attributable to improper structural design and 

equipment malfunction.667 This committee also received extensive testimony from around the state 

indicating that the loss of life in the volunteer firefighter service was primarily “because there were no 

codes.”668 

Over the years, proposed bills in the Texas Legislature for adoption of a fire code failed to gain support. 

In 1977, the Texas House of Representatives addressed a proposed bill to enforce a “fire prevention code” 

that would apply only to unincorporated areas and would be enforced by the state and county fire 

 

660 Texas Senate Subcommittee on Consumer Affairs. “Final Staff Recommendations,” December 1980. 661 Ibid. 662 Ibid. 663 Texas Fire Protection Standards Committee. “Interim Report to the 69th Texas Legislature.” December 1984. 664 Ibid. 665 Ibid. 666 Ibid. It was noted in the report that the fire loss data had limitations because mandatory reporting requirements 

were not consistent throughout the nation. This limited statistical analysis nonetheless pointed out principal causes 

of fires. 

667 Ibid. 668 Ibid. 

001545
West Fertilizer Company Final Report January 2016

213 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

marshals.669 In 1997, 20 years later, another proposed Texas House bill sought adoption of a code that 

would apply to (1) buildings located in unincorporated areas that have not adopted a fire code, (2) 

municipalities that did not adopt a fire code, (3) public assembly buildings in municipalities that have not 

adopted either model code, and (4) state-owned buildings.670 Neither bill progressed out of committee. 

In 1989, the Texas Legislature granted limited authority to counties with a population of 250,000 or more 

to adopt and enforce a fire code.671 This authority was later amended in 1997 to address growing 

populations and include counties adjacent to those with a population of at least 250,000.672 The failure to 

mandate a statewide fire code left some counties such as McLennan County without minimum fire 

protection measures. 

The absence of a state-wide fire code and the local population restrictions for code adoption remain an 

important issue for CSB. However, since the WFC incident, Texas has amended the administrative code 

to provide the State Fire Marshal with greater authority to enforce some NFPA codes at FGAN storage 

facilities, as well as to enter, upon complaint, and inspect facilities against the provisions of NFPA 1. 

Though the adoption did not create a state-wide fire code, it allows for the State Fire Marshal to inspect 

against a more comprehensive standard than NFPA 101 (Life Safety Code) that Texas previously 

adopted.673 Additional changes to the Texas State Fire Marshal’s authority to inspect FGAN facilities 

were enacted as part of House Bill 942 (described in Section 8.7.2). In addition, the Texas Agriculture 

Code was amended to impose additional requirements on FGAN retailers (described in Section 8.7.1). 

8.7 Post-Incident State and Local Regulatory Developments

Since the 2013 WFC incident, state and local legislators in Texas have attempted to improve FGAN 

safety through regulatory change. These efforts represent important first steps in recognizing the 

potential catastrophic hazards of FGAN under certain conditions. However, they are not entirely 

adequate. For example, when Texas House Bill (HB) 942 became law, it simply codified existing state 

hazardous chemical reporting requirements. Also, although the revised Texas Commercial Fertilizer 

Rules establish requirements for FGAN to be separated by at least 30 feet from combustible and 

flammable materials,674 this requirement is much less restrictive than the newly revised NFPA 400 

 

669 65th Texas Legislative Session. House Bill (HB) 325, “An act relating to the promulgation and enforcement of a 

state fire prevention code for unincorporated areas of the state by the State Board of Insurance.” 670 75th Texas Legislative Session. HB 2922, “An act relating to a statewide building and fire code.” 671 71st Texas Legislative Session. HB 2252, “An act relating to the authority of the commissioners courts of certain 

counties to adopt a fire code for certain buildings in unincorporated areas.” 

672 75th Texas Legislative Session. State Bill (SB) 10, “An act relating to the authority of certain counties to adopt and 

enforce a fire code.” 673 See: 

https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1

&p_tac=&ti=28&pt=1&ch=34&rl=303 (accessed on December 30, 2015). 674 Texas Administrative Code, Title 4, Chapter 65, Section 65.6(d)(3). See: 

http://otscweb.tamu.edu/Laws/PDF/CommercialFertilizerRules.pdf (accessed on December 29, 2015). 

001546
West Fertilizer Company Final Report January 2016

214 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

standard and might not fully eliminate the risk of molten FGAN contamination during a fire. This section 

includes a discussion of the Texas Commercial Fertilizer Rules, a general analysis of HB 942 as well as a 

comparison of HB 942 to other legislation pending in committee as of this report’s publication date, and a 

review of an Athens, Texas, ordinance that mandates a ban on the bulk storage of FGAN. 

8.7.1 Texas Commercial Fertilizer Rules

The Office of the Texas State Chemist (OTSC) regulates the sale of FGAN and FGAN-containing 

materials. Enacted by 2007 amendments to the Texas Agricultural Code Section 65.6, the law places 

limits on FGAN sales. It establishes requirements for registration certificates issued by the Texas Feed 

and Fertilizer Control Service as a condition of selling (or offering to sell) FGAN.675 To reduce theft or 

terrorism, the requirements focus on security measures for FGAN storage and on recordkeeping to 

identify people who purchase FGAN. 

In June 2014, Texas revised the provisions of its Commercial Fertilizer Rules.676 The revised rules 

require FGAN facilities to file Top-Screen information under the federal CFATS rule as well as EPCRA 

Tier II information with the Texas Department of State Health Services as a condition for receiving an 

annual certificate of registration to sell FGAN. The 2014 revisions also require OTSC to inspect FGAN 

storage areas. Such inspections are to confirm that combustible and flammable materials, such as 

potential sources of ignition—fuels, oils, hay, or other organic materials—are separated from FGAN by at 

least 30 feet. If facilities do not comply with these requirements, OTSC can deny, suspend, or revoke 

annual certificates to sell (or offer to sell) FGAN.

8.7.2 Texas House Bill 942

The summary of Texas HB 942 says that it is an “act relating to the storage of certain hazardous 

chemicals; transferring enforcement of certain reporting requirements, including the imposition of 

criminal, civil, and administrative penalties, from the Department of State Health Services to the Texas 

Commission on Environmental Quality.” It became law on June16, 2015.677 The law bars facilities from 

storing FGAN with any nonfertilizer materials, requires that FGAN be stored at least 30 feet away from 

combustible materials, moves FGAN regulation from the Department of State Health Services to the 

TCEQ, allows the State Fire Marshal to inspect FGAN facilities, gives fire departments access for pre-fire 

planning assessments, and requires correction of hazardous conditions within 10 days.678 

Although this law is an effort by state legislators to better regulate FGAN, it is not entirely adequate. For 

example, the requirement that FGAN storage be at least 30 feet from combustible materials was already 

required by the Texas Commercial Fertilizer Rules, as amended in June 2014 (and discussed in Section 

 

675 See: http://www.tlc.state.tx.us/pubssoe/80soe/80soe.pdf (accessed on December 29, 2015). 676 See: http://otscweb.tamu.edu/Risk/AmNitrate/PDF/AN-Compliance-Guide.pdf (accessed on December 29, 2015). 677 Ibid. 678 See: http://kwbu.org/post/abbott-signs-bill-tackles-ammonium-nitrate-storage (accessed on December 29, 2015). 

001547
West Fertilizer Company Final Report January 2016

215 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.7.1), a year before HB 942 became law. During a May 2015 meeting of the Texas Senate Committee 

on Natural Resources and Economic Development, Senator Brian Birdwell, who sponsored the bill, 

affirmed this fact. He said, “To be clear this is not a new regulatory scheme. HB 942 simply codifies 

existing regulations regarding reporting of hazardous chemicals. These are existing regulations which 

100 percent of FGAN storage facilities in this state [must currently comply with].”679 

A related bill, HB 417, would impose penalties for improper FGAN storage and would create rulemaking 

authority over FGAN facilities.680 The bill states, “The commissioner of insurance, after consultation 

with the state fire marshal, by rule shall adopt fire protection standards for FGAN storage facilities, 

including standards for the storage of FGAN at those facilities.”681 State Representative Joe Pickett, the 

author of HB 417, told the Texas House Committee on Environmental Regulation in April 2015 that “the 

rulemaking authority is a way to make changes without the Legislature being in session,” explaining that 

the Commissioner of Insurance would work with state agencies.682 This regulatory authority 

distinguishes HB 417 from HB 942. Although HB 417 does not necessarily establish new regulations, it 

gives the Commissioner of Insurance an opportunity to do so. As of December 2015, however, this bill 

remains pending in committee.683

8.7.3 Athens City Ordinance

After the May 29, 2014, FGAN-related fire at the East Texas Ag Supply facility in Athens, Texas 

(discussed in Section 7.4), the city of Athens initiated efforts to prevent similar events. On May 29, 2015, 

Athens passed an ordinance that banned bulk storage of FGAN and anhydrous ammonia.684 The 

ordinance (No. O-24-14) states in simple terms, “Commercial Fertilizer Storage or Manufacturing 

Facilities used to produce, transfer, store, or offer for sale Bulk FGAN, Bulk FGAN Material and/or 

Anhydrous Ammonia shall not be allowed in any zoning district in the City.” A “commercial fertilizer 

storage or manufacturing facility” is defined as one that “stores, mixes, or manufactures 10,000 or more 

pounds of FGAN and/or anhydrous ammonia and/or is required to register with the Texas Feed and 

Fertilizer Control Service.” The ordinance also streamlines chemical reporting and allows volunteer fire 

departments to inspect facilities.685 However, this ordinance does not apply retroactively to the facilities 

that existed when the ordinance was enacted. 

 

679 Ibid. 680 See: http://www.texastribune.org/2015/04/07/proposed-bill-aims-prevent-another-fertilizer-blas/ (accessed on 

December 29, 2015). 681 Texas HB 417, “An act relating to information regarding the storage of certain hazardous chemicals; providing 

penalties.” 682 See: http://www.texastribune.org/2015/04/07/proposed-bill-aims-prevent-another-fertilizer-blas/ (accessed on 

December 29, 2015). 683 See: http://txlege.texastribune.org/84/bills/HB417/ (accessed on December 29, 2015). 684 See: http://www.kltv.com/story/29192400/one-year-after-fire-city-of-athens-state-make-changes-in-ammoniumnitrate-storage (accessed on December 29, 2015). 685 Ibid. 

001548
West Fertilizer Company Final Report January 2016

216 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

8.8 Industry Standards

Since the WFC incident, the fertilizer industry has implemented initiatives to prevent such an incident 

from reoccurring. In February 2014, TFI and the ARA, two primary agricultural trade associations, 

developed and issued Safety and Security Guidelines for the Storage and Transportation of Fertilizer 

Grade Ammonium Nitrate at Fertilizer Retail Facilities (or Safety and Security Guidelines).686 This 

public document explains the OSHA Explosives and Blasting Agents standard, but also provides more 

specific guidance. In March 2014, TFI and the ARA initiated an FGAN stewardship program. 

Participation involves a voluntary assessment every three years of facility safety and security, focusing on 

FGAN and anhydrous ammonia. 

8.8.1 The Fertilizer Institute (TFI)

TFI is a major trade association for the fertilizer industry.687 TFI members include BP Energy Company, 

Dow AgroSciences, DuPont Sulfur Products, JP Morgan, Mitsubishi International Corporation, Shell 

Sulphur Solutions, and Union Pacific Railroad.688 TFI lists security, energy, the environment, and worker 

health and safety as concerns to its members.689 It also lists product safety stewardship as one of its key 

issues.690 TFI offers tools to enhance the safety and security of products and equipment (discussed in 

Appendix E) across the supply chain.691 Post-WFC incident tools include the Compliance Assessment 

Tool, the Safety and Security Guidelines, and the ResponsibleAg program. Each of these is discussed in

the next sections. 

8.8.1.1 Compliance Assessment Tool 

The Asmark Institute, a private not-for-profit educational organization that is a resource center for the 

agricultural retail industry, developed the web-based Compliance Assessment Tool.692 With regulatory 

compliance consistently cited during the last 18 years as one of the top 10 threats to the long-term 

viability of agricultural retail facilities, the Compliance Assessment Tool is meant to assist the 

agricultural retail industry.693 This tool helps personnel at facilities, terminals, warehouses, and farm 

equipment dealers in identifying the regulations that apply to their specific sites. 694 The Compliance 

Assessment Tool evaluates onsite compliance efforts.695 Through accessing the website, entering facility 

 

686 ARA, TFI. “Safety and Security Guidelines for the Storage and Transportation of Fertilizer Grade Ammonium 

Nitrate at Fertilizer Retail Facilities,” February 2014. 

687 See: http://www.tfi.org/about (accessed on December 29, 2015). 688 See: http://www.tfi.org/about/membership-list (accessed on December 29, 2015). 689 See: http://www.tfi.org/about (accessed on December 29, 2015). 690 See: https://www.tfi.org/advocacy/stewardship (accessed on December 29, 2015). 

691 See: http://www.tfi.org/safety-and-security-tools (accessed on December 29, 2015). 692 See: http://www.tfi.org/compliance-assessment-tool (accessed on December 29, 2015). 

693 See: https://www.asmark.org/Compass/ComplianceAssessmentTool/ (accessed on December 29, 2015). 

694 Ibid. 695 Ibid. 

001549
West Fertilizer Company Final Report January 2016

217 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

information, and describing scope of operations, the user can download a specific compliance assessment 

document and then complete a worksheet.696 Periodic use of the tool is encouraged to help control risk 

and to support compliance efforts.697 

8.8.1.2 Safety and Security Guidelines for the Storage and Transportation of FGAN at 

Fertilizer Retail Facilities

TFI and the ARA created the Safety and Security Guidelines.698 TFI’s website notes that “the document 

was created to fill the void in emergency response guidelines specific to FGAN fertilizer at retail fertilizer 

facilities.”699 The guidelines outline best practices for safe and secure storage and transport of FGAN.700 

They also summarize storage and handling regulations for FGAN facilities as well as recommendations 

for first responders.701 Moreover, they provide rules for transporting FGAN via truck, highway, rail, and 

barge.702 

8.8.1.3 ResponsibleAg

Created by TFI and the ARA in 2014, ResponsibleAg is a third-party auditing program for fertilizer 

retailers.703 Although any business that stores or handles fertilizer product is eligible to participate in the 

ResponsibleAg Certification Program, the first three years of the program focus on companies that store 

and handle AN and/or anhydrous ammonia fertilizer.704 Using federal requirements for the storage and 

handling of fertilizer products, ResponsibleAg has compiled a checklist of more than 320 questions for 

auditing each participating facility.705 The participating facility determines the audit scope; however, all 

participants must have a “base audit.”706 A participating facility may become ResponsibleAg certified 

only if it passes the initial audit or if it takes all necessary steps to correct the issues identified during the 

audit and documented in the facility’s corrective action plan.707 

ResponsibleAg also allows its participating suppliers to access the list of participating facilities that have 

successfully completed the assessment and earned certification.708 This is important because it allows 

suppliers to determine whether prospective buyers have successfully completed the ResponsibleAg 

assessment, which thereby promoted federal regulatory compliance. This approach enables 

 

696 Ibid. 697 Ibid. 698 See: http://www.tfi.org/ammonium_nitrate_guidelines (accessed on December 29, 2015). 699 Ibid. 700 Ibid. 701 Ibid. 702 Ibid. 703 Ibid. 704 See: http://www.responsibleag.org/About.cgi (accessed on December 29, 2015). 705 Ibid. 706 Ibid. 707 These corrective actions must be certified by ResponsibleAg, usually during a verification audit. 708 See: https://www.responsibleag.org/FAQ.cgi#Link02 (accessed on December 29, 2015). 

001550
West Fertilizer Company Final Report January 2016

218 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

ResponsibleAg members to engage in some elements of product stewardship (as discussed in Section 

8.8.3). Notably, CF Industries and EDC, the only AN fertilizer manufacturers in the United States, are 

listed as ResponsibleAg participants.709 Appendix F includes additional information on the 

ResponsibleAg program process.

8.8.2 Agricultural Retailers Association (ARA)

The ARA is also a major trade association for the fertilizer industry.710 It represents agricultural retailers 

and distributors across the United States on legislative and regulatory issues.711 ARA members represent 

the majority of agribusinesses in the United States.712 The ARA works with Congress to create 

legislation, and updates federal agencies and legislators on important issues affecting the industry.713 The 

ARA offers programs and services to keep its members informed of important industry issues.714 

8.8.3 Product Stewardship

As of this report’s publication, only two companies in the United States, CF Industries and EDC, 

manufacture FGAN.715 Fertilizer manufacturers can promote the safe storage and handling of FGAN by 

distributors and retailers by implementing product stewardship programs. According to the Center for 

Chemical Process Safety, product stewardship encourages safety and health in the design, manufacture, 

marketing, distribution, handling, use, and disposal of chemical products.716 Responsibility for safely 

managing the product is shared throughout the supply chain and the product life cycle. Because it is a 

self-regulated program, product stewardship can only be as effective as industry intends and allows. 

CSB determined that components of an effective product stewardship program should generally include 

the following elements for each product: 

• Identifying and communicating all product hazards among manufacturers, distributors, and 

retailers. 

• Providing supplemental technical information on safe handling practices for the product 

(furnished by manufacturers and/or distributors) to other distributors and/or retailers. 

• Establishing accountability for distributors and retailers to promote safe handling of a product 

throughout the chain of customers.

• Performing monitoring and auditing, such as onsite visits to the locations where the product will 

be stored or used. 

 

709 See: https://www.responsibleag.org/ParticipantList.cgi (accessed on December 29, 2015). 710 See: http://www.aradc.org/ARADC/About/About/ (accessed on December 29, 2015). 711 See: http://www.aradc.org/becomeamember/ (accessed on December 29, 2015). 712 Ibid. 713 Ibid. 714 See: http://www.aradc.org/about/about (accessed on December 29, 2015). 715 The WFC also reported receiving imported AN from foreign manufacturers between 2006 and 2013. 716 Center for Chemical Process Safety. Guidelines for Safe Handling of Powders and Bulk Solids. New York: Center 

for Chemical Process Safety/AIChE, 2005: 521.

001551
West Fertilizer Company Final Report January 2016

219 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Developing mechanisms for outreach to communities near the facilities where the products are 

stored or used. 

Information sharing is an important component of product stewardship. When information about product 

hazards or details about the storage practices of a certain facility are known, people and companies 

dealing with the product or with the facility have the opportunity to effectively manage the risks 

associated with that product. The same logic applies to the management of FGAN. The WFC incident 

highlighted the need for greater awareness of the unpredictable nature of AN and the conditions under 

which it can detonate. Two industry programs, Responsible Care and ResponsibleAg, both advocate 

information sharing. Accordingly, the programs have serious product stewardship potential. 

As described in Section 8.8.1.3, the joint TFI-ARA ResponsibleAg program currently addresses some

aspects of product stewardship. In particular, fertilizer sellers (i.e., manufacturers and/or distributors) 

may elect to access the list of ResponsibleAg-participating facilities to determine assessment completion 

and certification of prospective buyers (i.e., distributors and/or retailers). By doing so, the seller verifies 

that the buyer safely stores fertilizer (or at least has a record of safely storing fertilizer). Similarly, the 

American Chemistry Council’s (ACC) Responsible Care initiative includes information sharing in its 

product stewardship program. Participation in Responsible Care is a condition of membership for ACC 

members.717 The program specifies 11 management practices and focuses on leadership commitment, 

accountability and management, prioritization of products, product information, risk characterization, 

management of new information, product safety management, product design and improvement, value 

chain communication, cooperation and outreach, information sharing, and performance assessment and 

continual improvement.718 

Serious participation in product stewardship programs such as ResponsibleAg and Responsible Care can 

promote the safe handling and storage of domestically manufactured FGAN. This is especially true for 

FGAN because there are only two companies, CF Industries and EDC, that manufacture FGAN in the 

United States. As such, domestically manufactured FGAN product can be linked to one of these two 

companies. CF Industries and EDC are already members of ResponsibleAg. Product stewardship 

programs such as ResponsibleAg can ensure that FGAN management practices, starting with FGAN 

manufacturers CF Industries and EDC, are subject to greater scrutiny. However, it is also important to 

make sure that distributors and retailers handle and store the product safely. 

Because responsibility for a chemical product does not always end after it is manufactured, it is important 

that manufacturing companies know how the product is handled and stored once it leaves the production 

site. In other words, a manufacturer cannot simply confirm that its direct buyer safely stores and handles 

the manufacturer’s product because that buyer may in turn sell to another buyer that does not store or 

handle the product safely. The same reasoning applies to communicating product hazards. Of course, 

requiring the manufacturer to communicate the hazards of its product to its buyer is surely a step in the 

 

717 See: http://responsiblecare.americanchemistry.com/ (accessed on November 30, 2015). 718 See: http://responsiblecare.americanchemistry.com/Responsible-Care-Program-Elements/Product-SafetyCode/Responsible-Care-Product-Safety-Code-PDF.pdf (accessed on November 30, 2015).

001552
West Fertilizer Company Final Report January 2016

220 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

right direction, but the buyer must also communicate the same hazards to its buyers, if any. Otherwise, 

catastrophic incidents can occur. Importantly, therefore, these distribution chains must not break; 

effective communication must endure from top to bottom. 

To ensure continuity of communication throughout the supply chain, industry should voluntarily take an 

active role. Because government agencies cannot reasonably be expected to routinely inspect every 

FGAN facility, industry’s product stewardship programs must play a significant role in making sure that 

this top-to-bottom approach is implemented. Product stewardship offers an important opportunity for 

industry to further manage risk, beyond providing SDSs to retailers. Although CF Industries and EDC 

use different business models, both have executed initiatives that ascribe to product stewardship elements 

post-incident. 

8.8.4 Efforts to Address FGAN Hazards Post-Incident

Since the WFC incident, both CF Industries and EDC have made additional efforts to make sure that their 

FGAN product is stored and handled safely as it moves out of their manufacturing facilities. CF 

Industries has implemented a certification process for its customers (purchasing organizations as well as 

facilities that receive FGAN deliveries) to confirm that customers communicate both the hazards and safe 

storage and handling practices of FGAN. As of December 31, 2014, CF Industries requires existing 

facilities to certify through a signed certification letter that they are in compliance with applicable 

guidelines and regulations before they can receive FGAN product. All new purchasing organizations and 

sites must also return the signed certification letter before receiving FGAN from CF Industries. 

Specifically, the letter requires senior responsible officials at both the purchasing organization and the 

delivery facility to certify that they are either in compliance with, or legally exempt from, 17 items. 

These items include, for example, attestations that:

• The purchasing organization provided the FGAN SDS developed by CF Industries to all of its 

sites. 

• The purchasing organization and site provided copies of the CF Industries FGAN SDS to all 

employees. 

• The site complies with OSHA requirements for FGAN storage. 

• The site filed EPCRA and SARA Tier II Chemical Inventory Reports with appropriate emergency 

response organizations. 

• The site maintains and follows an emergency response plan and written procedures for the safe 

handling of AN.

By signing the certification statement, officials at the purchasing organization certify that all relevant 

personnel at the site are aware of FGAN safety handling requirements and that adequate procedures are in 

place to comply with all 17 listed items. The certification packet also includes an up-to-date FGAN SDS 

developed by CF Industries and the TFI-ARA guidance for FGAN. CSB determined that this process 

could provide a reasonable degree of assurance that FGAN product hazards are being communicated as 

the product is delivered to new and existing customers and, most important, that those customers comply 

001553
West Fertilizer Company Final Report January 2016

221 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

with applicable regulations and practices in order to receive product. If CF Industries does not receive a 

completed and signed certification statement, it will not sell FGAN product. 

Although not in the form of a certification statement program, EDC also took steps to enhance the safety 

of its FGAN product post-incident. EDC updated its SDS for FGAN to include more information 

regarding firefighter precautions and added a reference to NFPA 400.719 Moreover, EDC developed a 

product information bulletin to accompany its SDS to emphasize FGAN hazards and safety measures.720 

To better communicate FGAN hazards in response to the WFC incident, EDC conducted mass mailings 

to all of its customers. The mailings included the following:

• EDC’s revised SDS (September 2013 and November 2014 versions). 

• TFI-ARA Safety and Security Guidelines for Ammonium Nitrate. 

• OSHA Guidance on Ammonium Nitrate Storage Requirements in 29 CFR 1910.109(i).

In addition, EDC repaired and replaced wooden bins at its own owned-and-operated retail site locations to 

ensure compliance with OSHA requirements regarding the protection of bins against AN impregnation. 

In gathering information regarding these post-incident safety initiatives, CSB found that CF Industries 

and EDC operate under different business models, despite their status as the only two manufacturers of 

FGAN in the United States. CF Industries does not directly sell to retailers, but may deliver directly to 

retailers at the instruction of a direct customer. It delivers FGAN only to independently owned and 

operated distributors or their retail customers. CF Industries does not own any of the distribution 

facilities to which it ships product, and it does not sell directly to retailers, although it might deliver 

directly to retailers at the instruction of a direct customer. 

Unlike CF Industries, EDC delivers some FGAN product to its own owned-and-operated distribution 

sites. In this regard, the business models of CF Industries and EDC differ. EDC produces FGAN in El 

Dorado, Arkansas, which is shipped by rail or truck to either (1) its own distribution sites, which operate 

under the name EDC Ag Products Company, LLC (EDC Ag Products),721 or (2) its larger customers. 

Approximately 40 percent of the FGAN produced at the EDC Arkansas manufacturing facility is shipped 

to its 11 EDC Ag Products distributor locations (most in Texas), and approximately 60 percent is sold 

directly to customers. From the EDC Ag Products distributor locations, FGAN may be sold to other 

distributors or to retailers or farmers. All of the FGAN sold directly from the EDC manufacturing facility 

in Arkansas is delivered mainly to dealers, with a small quantity to brokers. 

 

719 See: 

http://eldoradochemical.com/MSDS_Sheets/EDC/EDC_Products/EDCC_AN_Prill_SDS_Information_Bulletin_No

v_2014.pdf (accessed December 29, 2015). 720 Ibid. 721 At the time of the incident, the distribution sites operated under the name El Dorado Chemical. El Dorado 

Chemical Company and EDC Ag Products Company, LLC are subsidiaries of LSB Industries, a manufacturing and 

marketing company.

001554
West Fertilizer Company Final Report January 2016

222 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At the time of the WFC incident and as long ago as 2004, EDC sold products to International Chemical 

Company (Inter-Chem), which acted as a trader or supplier of FGAN, among other fertilizer products. 

Through its Domestic Plant Foods Group, Inter-Chem is a distributor of phosphate, nitrogen, and potash 

products in the United States.722 Essentially, Inter-Chem served as a broker and consignee of finished 

fertilizer products to the WFC. Although Inter-Chem did not produce or manufacture the fertilizer 

product that was sold to the WFC, its role as a broker was significant. Importantly, Inter-Chem 

functioned as another link in the chain of commerce as the FGAN traveled from manufacturer to retailer

through the broker. To better understand the chain of hazard communication involved in this 

investigation, CSB started at the top with the manufacturers and analyzed the pre-incident SDSs and 

hazard communication practices of both EDC and CF Industries. 

Before the WFC incident, EDC provided a copy of its SDS to its customers and to Inter-Chem. The EDC 

SDS in use at the time of the 2013 WFC incident was last revised in 2011. CSB reviewed the SDS and 

found that it lacked certain safety information, specifically related to firefighting measures. The 2011 

EDC SDS included warnings about the hazards of AN, such as its capability to support combustion and 

become explosive in the presence of contaminants or when under confinement. Under the firefighting 

measures section, the SDS instructed firefighters to “flood with water” but did not address the proper way 

to handle massive and uncontrollable fires, the need to extinguish such fires from a distance, or the

possible need for evacuation. In addition, the SDS lacked references to applicable AN safety standards, 

such as the OSHA Explosives and Blasting Agents standard and NFPA 400 (2010 Edition). On the other 

hand, the CF Industries pre-incident SDS included a comprehensive list of AN hazards and firefighting 

measures. Nonetheless, both CF Industries and EDC made changes to enhance the safe handling of their 

products after the WFC incident. 

As previously discussed, both U.S. FGAN manufacturers have improved communications with their 

customers about FGAN hazards and safe storage practices since the WFC incident. CF Industries 

implemented a program to certify compliance with applicable standards and guidelines as a condition of 

sale. In contrast, EDC conducted hazard communication in the form of mass mailings, replaced and 

repaired its own wooden bins at EDC Ag Products facilities, and continues to audit and inspect its retail 

sites (which it can readily do because EDC owns and operates these retail divisions) to make sure that 

about 40 percent of its manufactured FGAN is stored in compliance with applicable standards. These 

efforts represent a step in the right direction. However, because both EDC and CF Industries sell 

significant quantities of FGAN through brokers or through independent warehouses or distributors, whose 

direct customers may be unknown to EDC and CF Industries, it might not be possible in certain situations 

for the manufacturers to always ensure that their product is handled and stored in accordance with safety 

guidelines as the product moves downstream. At the very least, however, the certification statement 

program implemented by CF Industries attempts to ensure compliance with applicable regulations by 

causing its customers to attest to having knowledge of them. 

 

722 See: http://www.ictulsa.com/domestic_fert.html (accessed on December 29, 2015). 

001555
West Fertilizer Company Final Report January 2016

223 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

As previously discussed, the CF Industries certification program strives to certify compliance by requiring 

purchasing organizations to affirm that their customers are in compliance with the CF Industries 

certification program elements. CSB found no evidence of such a program at EDC. Because EDC also 

sells product through wholesalers and distributors, a similar certification program, if implemented 

properly in conjunction with other components of product stewardship, will ensure that EDC product is 

handled safely throughout by its chain of customers. In concert with CF Industries’ efforts, this can 

effectively promote the safety of all domestically manufactured FGAN.

9.0 Land Use 

The West Fertilizer Company (WFC) incident led many observers to ask a seemingly simple question: 

Why would a community be located so close to a facility storing a potentially dangerous chemical? 

Although the question might be simple, the answer is not. In fact, the city of West, Texas, was so near the

WFC facility primarily because of the following factors:

• The city “came to” the WFC facility over the years. 

• There was a lack of zoning regulations.

These factors are interrelated. The growth of the community near the WFC facility made it difficult for 

the city to later enact zoning regulations to require risk mitigating actions such as a buffer zone between 

the facility and the community.

This is not to say that West is an anomaly. Many communities in Texas and nationwide are located too 

close to facilities resembling the WFC plant.

723 This reality highlights the need to explore why 

communities live with these hazards so that authorities can better mitigate the offsite consequences from

incidents such as the fire and explosion at the WFC plant in West.

In this section, CSB seeks to explain the previously mentioned factors, providing insights into the 

proximity of the WFC facility to the West community. Following that discussion, other CSB 

investigations involving offsite consequences are highlighted to emphasize the scope of the problem. 

International land use perspectives also are provided to compare various approaches to the issue. In 

addition, efforts to address land use planning after the WFC incident are discussed.

9.1 Land Use Planning: An Introduction

Land use planning is a complex and controversial topic. It provides a framework for limiting private land 

use when necessary for the public benefit. However, economic, social, safety, and environmental 

interests must be effectively balanced to achieve this benefit. Such competing interests generate highly 

emotional and contentious debates. Ultimately, however, the decision is political in nature. The 

community must decide on the best use of land for its development and growth. Urban sprawl, 

 

723 As of December 6, 2013, Texas had 104 facilities storing 10,000 pounds or more of FGAN. 

001556
West Fertilizer Company Final Report January 2016

224 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

environmental concerns, and hazardous conditions are just some of the issues that land use planning 

addresses. 

The United States takes a decentralized approach to land use planning; that is, states are largely vested 

with the authority to regulate and enforce the private use of land. In turn, the states delegate this authority 

to local governments. This approach generally results in municipalities establishing land use regulations 

for various areas within their respective jurisdictions. The federal or state government has asserted 

authority in some areas of land use planning, but the majority of land use planning authority in the United 

States lies with local governments. The benefits of such an approach stem from the regulatory flexibility 

to address issues of land use. The judiciary resolves any potential conflicts.

Land use planning cannot be said to solve all developmental issues that a community encounters. Land 

use regulation does give the community a control mechanism to reduce the consequences of an incident 

but does not eliminate the need for preventive controls. Rather, the mitigative control of land use 

planning must be combined with preventive controls employed by a variety of different stakeholders. 

Land use planning is a critical control to foster community development, but it must be integrated with 

other complementary approaches.

At its heart, land use planning offers the means for dealing with development and growth. However, 

many interests must be taken into account when attempting to effectively ensure a safe and satisfying

community. Land use planning considerations can offer insights into the issues evident in the WFC 

incident. The location of the city of West near the WFC facility produced numerous benefits for the 

community; however, as the WFC fire and explosion revealed, such siting also had deadly consequences.

9.2 The City That “Came to” the WFC Over the Years

The WFC facilities were constructed and began operations in 1962.724 At the time, the facilities were 

largely surrounded by open fields, raising little concern about any potential offsite consequences. 

Furthermore, no zoning regulations existed when the WFC began business.725 Over the years, however,

the city of West began to slowly develop around the WFC property. As the WFC was grandfathered into 

West ordinances and the city was subsequently zoned residential, little attention was paid to the city’s

slow but steady encroachment toward the WFC facility. 

 

724 Crain, Zac. “Love and Loss in a Small Texas Town.” D Magazine (July 2013). See: 

http://www.dmagazine.com/Home/D_Magazine/2013/July/West_Texas_Love_and_Loss_in_a_Small_Town.aspx?p

age=1 (accessed on November 25, 2014). 725 According to the West Code of Ordinances, the earliest zoning regulation was adopted on March 21, 1967. City of 

West. Chapter 14, Section 14.01.001. Code of Ordinances. See: 

http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on November 25, 2014).

001557
West Fertilizer Company Final Report January 2016

225 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

West was officially incorporated as a city in 1892, and with the help of a railroad track and fertile land for 

farming, it thrived.726 Before construction of the WFC plant, the area north of the city was largely open 

fields used for agriculture and ranching. At the time that the WFC began operations, the area maintained 

the same character except for a residence located approximately 250 feet north of the WFC property 

line.727 The location was ideal for such a business—just outside of the city, next to a railroad track, and 

within a convenient distance for local farmers. West lacked zoning regulations when the WFC completed 

its construction, and there appeared to be little need for such regulations as the WFC facilities were far 

removed from the city. Furthermore, the portion of the WFC property where fertilizers and pesticides 

were stored was outside of the West city limits and thus outside of its jurisdiction.728

Within this framework, the city of West began to expand and grow around the WFC facility. As shown in 

Figure 74, the city began developing further north over the years. This growth continued until the 

community was adjacent to the WFC property. Parks, subdivisions, nursing homes, schools, and an 

apartment complex sat within a 600-foot radius of the facilities. Furthermore, as the city continued to 

build its infrastructure near the WFC facility, the area became an even more attractive target for

development. The community hardly noticed the WFC facility. It was only aware of the risk of 

accidental releases of anhydrous ammonia but viewed such events with little concern. Figure 75 shows 

the WFC facility before and after the incident. 

 

726 City of West. “City of West, Our History.” See: http://www.cityofwest.com/our-history (accessed on November 

25, 2014). 727 Determined by using the December 14, 1964, aerial photograph of West, Texas, and employing Google Earth. 728 McLennan CAD. “Property Search Results: Property ID 2013357, Adair Grain, Inc. for Year 2013.” See: 

https://propaccess.trueautomation.com/Map/View/Map/20/201357/2013 (accessed on December 28, 2015).

001558
West Fertilizer Company Final Report January 2016

226 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 74. Progressive Development of West (Source: GeoSearch) 

001559
West Fertilizer Company Final Report January 2016

227 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Figure 75. Aerial Photographs of the WFC Facility Before (left) and After (right) the Incident (Source: NBC 

News) 

This lack of proper foresight played a significant role in explaining why West came to be located so close 

to the WFC plant. Unfortunately, as the WFC was grandfathered into the city’s Code of Ordinances,729

the city was not required to address the risks involved in this encroachment. Not that West is a peculiar 

case; in many instances across the country, similar problems exist.

730

9.3 Lack of Zoning Regulations

Both the federal government and Texas have failed to issue regulations relating to siting facilities that 

store and distribute FGAN near communities such as West. If a regulation had addressed issues such as 

buffer zones, barricades, or other techniques to mitigate consequences, the severity of the casualties and 

damage experienced in West could have been significantly reduced. Moreover, although regulation 

cannot solve all problems, it serves as a mechanism to compel all industries to adopt and implement safer 

operations. Ultimately, the failure to mitigate the consequences of incidents such as the WFC fire and 

explosion in West exists at all levels of government.

U.S. law largely assigns the authority to regulate private land use to the individual states.731 In turn, the 

states generally assign this authority to individual municipalities. It is important to note, however, that 

 

729 City of West. Chapter 14. Code of Ordinances. See: 

http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on November 25, 2014). 730 For example, CSB reports on NDK, DPC, Concept Sciences, and the Caribbean Petroleum Refining tank explosion 

and fire. 731 Because the Federal government is only vested with the powers delegated to it through the Constitution—such as 

the power to regulate interstate commerce, coin money, and so forth—it is limited in its capability to regulate issues 

001560
West Fertilizer Company Final Report January 2016

228 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

the state’s authority can be preempted by the federal government in certain instances, and two of the main 

instances are matters concerning interstate commerce732 and international treaties.733 This dual 

sovereignty can allow for greater flexibility in resolving land use issues that affect the public. Over time,

the federal government has assumed an increasing role in the regulation of land use issues, including 

those relating to storing chemicals such as FGAN. ATF, the U.S. Department of Housing and Urban 

Development (HUD), the Pipeline and Hazardous Materials Safety Administration (PHMSA), OSHA, 

and EPA have all promulgated regulations or recommendations relating to the siting of explosives, 

reactives, oxidizers such as FGAN, and flammable cryogenics such as liquefied natural gas (LNG) near 

populated areas. Table 14 briefly lists the relevant regulations issued by these agencies.

Table 14. Relevant Siting Regulations

Agency Regulation CFR

ATF Commerce in Explosives 27 CFR Part 555

DOT Liquefied Natural Gas Facilities: Federal 

Safety Standards

49 CFR Part 193

HUD Environmental Criteria and Standards 24 CFR Part 51

OSHA Occupational Safety and Health Standards 29 CFR Part 1910

EPA Chemical Accident Prevention Provisions 40 CFR Part 68

Standards for Owners and Operators of 

Hazardous Waste Treatment, Storage, and 

Disposal Facilities

40 CFR Part 264

ATF holds the authority to require setting off stored explosive materials and low-explosive materials from 

inhabited buildings, public highways, public railways, and magazines.734 Although explosive grades of 

FGAN are currently listed as explosive materials, the FGAN stored at the WFC facility is not categorized 

as an explosive material or a low-explosive735 material.736 Therefore, WFC storage of FGAN was not 

 

related to land use. See: 10th Amendment, U.S. Constitution. However, state zoning regulations are subject to 

Federal preemption in areas where the use of land affects interstate commerce, international treaties, and Federal 

government spending powers. 732 U.S. Constitution, Article I, Section 8. 733 U.S. Constitution, Article VI. 734 27 CFR 555.218–219: “Explosive materials” are defined as explosives, blasting agents, water gels, and detonators. 

27 CFR 555.11: “Explosives” are defined as any chemical compound, mixture, or device, the primary or common 

purpose of which is to function by explosion. 

735 Low explosives are defined as “explosive materials which can be caused to deflagrate when confined. See: 

http://www.gpo.gov/fdsys/pkg/FR-2012-09-20/pdf/2012-23241.pdf (accessed on December 29, 2015). 736 See: http://www.gpo.gov/fdsys/pkg/FR-2012-09-20/pdf/2012-23241.pdf (accessed on December 28, 2015). See 

also: 27 CFR 555.220 Note (1), which states: “FGAN, by itself, is not considered to be a [explosive or blasting 

001561
West Fertilizer Company Final Report January 2016

229 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

subject to ATF set-off distances.737 However, ATF has the authority to require a minimum separation 

distance between the FGAN stored at the WFC facility and certain blasting agents.738

DOT received Congressional authorization to “prescribe minimum safety standards for deciding on the 

location of a new liquefied natural gas [LNG] pipeline facility,” which it oversees through PHMSA.739 In 

turn, PHMSA has promulgated a series of recommendations concerning siting requirements for LNG 

facilities.740 The regulations are based on NFPA 59A concerning the production, storage, and handling of 

LNG.741 The siting requirements address issues such as thermal radiation protection, flammable vaporgas dispersion protection, and wind forces. PHMSA applies the regulations to LNG facilities “designed, 

constructed, replaced, relocated or significantly altered after March 31, 2000,” thereby grandfathering 

LNG facilities that existed before the March 31 date.742 However, PHMSA has no regulations concerning 

the siting of AN facilities.

HUD requires projects receiving its assistance to be separated by an acceptable distance from specific 

stationary hazardous operations that store, handle, or process hazardous substances.743 Hazardous 

substances are defined as “petroleum products (petrochemicals)” and other hazardous chemicals 

identified by HUD that can produce blast overpressure or thermal radiation levels in excess of HUD 

standards.744 FGAN is not identified as a hazardous substance for the purposes of this standard.745 In 

addition, the city of West would not qualify for HUD assistance as it does not meet HUD eligibility 

requirements.746

 

agent].” See also: 72 Federal Register 18792, 18796, which states: “[A]lthough FGAN is a component of certain 

explosives such as ANFO, by itself, it is not an explosive. Therefore, it is not regulated by these ATF regulations.”

737 The purpose behind regulating the siting of ANFO was “to protect interstate and foreign commerce against 

interference and interruption by reducing the hazard to persons and property arising from misuse and unsafe or 

insecure storage of explosive materials.” Section 1101, Public Law 91-452, reprinted in: U.S. Code Congressional 

and Administrative News 1109 (1970). 738 27 CFR 555.220.

739 49 U.S.C. § 60103 (2014). 740 49 CFR 193 Subpart B (2014). 741 65 CFR 10950 (2000) and 69 Federal Register 11330 (2004). 742 49 CFR § 193.2051(2014). 743 24 CFR Subpart C; specifically 24 CFR 51.204 and 24 CFR 51.205. See: 

http://portal.hud.gov/hudportal/HUD?src=/program_offices/comm_planning/environment/training/guidebooks/hazfa

cilities (accessed on December 28, 2015). The intent in creating these regulations was “to encourage improvements 

in housing standards and conditions.” “The National Housing Act.” See: 

http://portal.hud.gov/hudportal/documents/huddoc?id=HUD-Guidebook.pdf (accessed on December 28, 2015): 3–4. 744 24 CFR 51.201, 203. 745 24 CFR Part 51, Appendix I to Subpart C. Anhydrous ammonia is also not listed as a hazardous substance; 

however, under special circumstances, the Secretary may require the application of a substance not listed in 

Appendix I to Subpart C. See: 24 CFR 51.207 (2014). 746 See: 

http://portal.hud.gov/hudportal/HUD?src=/program_offices/comm_planning/communitydevelopment/programs/entit

lement (accessed on December 28, 2015). Eligible HUD grantees include (1) principal cities of metropolitan 

statistical areas, (2) other metropolitan cities with populations of at least 50,000, and (3) qualified urban counties 

with populations of at least 200,000 (excluding the population of entitled cities).

001562
West Fertilizer Company Final Report January 2016

230 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

OSHA requires facilities handling highly hazardous chemicals to address facility siting issues; however, 

the requirement only deals with onsite consequences, not the issue of siting communities near highly 

hazardous chemical facilities.747 This requirement is part of the Process Safety Management (PSM) 

regulation, which seeks to prevent or minimize the consequences of catastrophic releases of “highly 

hazardous chemicals.”748 However, the PSM regulation does not include FGAN as a highly hazardous 

chemical.749 In addition, OSHA has the authority to require separation distances between FGAN and 

blasting agents,750 in the same manner as ATF.751

The federal agency concerned with offsite consequences, EPA, addresses the siting of hazardous facilities 

near population centers by issuing various regulations and guidance.752 For example, EPA regulates

facility siting through its Risk Management Program rule, which calls on operators to address “stationary 

source siting” in its Program Level 3 process hazard analysis.753 However, EPA offers little to no 

guidance to operators on how to satisfy the “stationary source siting” requirement.754 The Risk 

Management Program rule also requires operators to conduct an offsite consequence analysis to provide 

government officials and the public with information about the potential consequences of an accidental 

release.

755 However, as FGAN is not classified as a hazardous regulated substance under the Risk 

Management Program rule, the WFC was not required to conduct such an analysis for its stored FGAN. 

In addition, EPA is currently considering the inclusion of “facility and equipment siting factors” in the 

Risk Management Program rule.756

Furthermore, EPA addresses facility siting through regulation and guidance concerning the siting of 

hazardous waste management facilities near communities and sensitive environments.757 EPA also has 

issued guidelines relating to siting schools near potential environmental hazards, which could have proven 

 

747 29 CFR 1910.119(e)(3)(vii). 748 29 CFR 1910.119.

749 29 CFR 1910.119, Appendix A. 750 29 CFR 1910.109, Table H-22. 751 27 CFR 555.220. 752 See: http://www.epa.gov/statelocalclimate/local/topics/land.html (accessed on December 28, 2015). 753 40 CFR 68.67(c)(5) (2014). 754 The only real guidance on these terms is found in API RP 752, “Permanent Building Siting”; API RP 753, 

“Portable Building Siting”; and API RP 756, Tent Siting (to be issued in 2014). However, these guidance 

documents have been developed without any regulatory guidance. Furthermore, the identified standards have 

nothing to do with the relationship of the facility to its surrounding community. See: 

http://www.absconsulting.com/webinars/facility-siting.cfm (accessed on December 28, 2015). 755 40 CFR 68.150–68.195 (2014). The analysis consists of two elements, a worst case release scenario and alternative 

release scenarios.

756 See: https://www.osha.gov/chemicalexecutiveorder/final_chemical_eo_status_report.pdf (accessed on December 

28, 2015): 36. 757 See: http://www.epa.gov/osw/hazard/tsd/permit/site/sites.htm (accessed on December 28, 2015); 42 U.S.C. § 6924 

(2014); 40 CFR 264.18 (2014); 40 CFR 265.18 (2014); 40 CFR 270.14(b)(11) (2014); and 40 CFR 270.32(b)(2) 

(2014). See also: http://homer.ornl.gov/sesa/environment/guidance/rcra/locate.pdf (accessed on December 28, 

2015).

001563
West Fertilizer Company Final Report January 2016

231 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

helpful to West and similarly situated communities.758 Moreover, EPA has recommended using 

information related to the Emergency Planning and Community Right-to-Know Act to inform a 

community’s decisions concerning zoning and land use planning.759

Thus, federal regulations and guidance on land use do exist and do give communities valuable 

information regarding various chemical hazards. However, because FGAN is not defined as an explosive 

or hazardous material, it is excluded from federal zoning regulations. Unfortunately, this situation allows 

fertilizer facilities to store FGAN onsite without any federal oversight to confirm that the associated risks 

of locating communities nearby are mitigated to sufficient levels.

At the state level, Texas does little to oversee land use issues.760 Instead, Texas grants the most land use 

oversight authority to its municipalities.761 Texas has no regulation relating to siting hazardous facilities 

near communities.762 Moreover, no state administrative agency oversees hazardous facility siting.763 At 

the county level, regulatory authority is limited to zoning specific areas (such as Padre Island, Lake 

Tawakoni, and Falcon Lake), which results in a failure to approach county zoning from a general 

perspective.764 This observation does not indicate that a one-size-fits-all approach to zoning is always 

desired.765 In fact, in many instances, land use oversight needs to be tailored to specific political, social, 

economic, and environmental needs of the community.766

 

758 See: http://www.epa.gov/schools/siting/basic.html (accessed on December 28, 2015).

759 See: http://www.epa.gov/osweroe1/docs/chem/notice.pdf (accessed on January 6, 2016): 7; see also: 

http://www.nicsinfo.org/docs/LEPCStudyFinalReport.pdf (accessed on December 28, 2015): 7. 760 See: http://stateimpact.npr.org/texas/2013/04/22/after-west-fertilizer-explosion-concerns-over-safety-regulationand-zoning/ (accessed on December 28, 2015). 761 Texas Statute, Local Government Code, Title 7, “Regulation of Land Use, Structures, Businesses, and Related 

Activities.” See: http://www.statutes.legis.state.tx.us/ (accessed on January 6, 2016). For instance, municipalities 

must adopt a zoning ordinance in accordance with a comprehensive plan; county zoning ordinances deal with 

specific areas such as military zones, Padre Island, and Amistad Recreation Area. See: 

http://www.statutes.legis.state.tx.us/Docs/LG/htm/LG.231.htm (accessed on December 28, 2015). 762 The Texas Administrative Code fails to address such siting issues. The Texas Department of Public Safety, 

Division of Emergency Management, holds responsibility for preparing the state emergency management plan, 

which may include “recommendations for zoning, building restrictions, and other land-use controls . . . to eliminate 

or reduce disasters or their impact . . . .” Texas Government Code, Title 4, Subtitle B, Chapter 418, Section

418.042. However, the state has not issued any such recommendations. See: 

https://www.txdps.state.tx.us/dem/downloadableforms.htm#stateplan (accessed on December 28, 2015). 763 See: http://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC (accessed on December 29, 2015). 764 See: http://www.statutes.legis.state.tx.us/Docs/LG/htm/LG.231.htm (accessed on December 28, 2015).

 Texas House of Representatives, Committee on County Affairs. “Interim Report to the 80th Texas Legislature,” 

December 2006: 7. See also: http://www.lrl.state.tx.us/scanned/interim/79/C832.pdf (accessed on December 8, 

2014). 765 APA discussion on Growing Smart project with Stuart Meck. See: 

http://www.planning.org/growingsmart/background.htm (accessed on January 6, 2016). 766 See: http://www.planning.org/growingsmart/background.htm (accessed on December 28, 2015).

001564
West Fertilizer Company Final Report January 2016

232 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

At the local level, Texas municipalities are granted the authority to regulate private land, including the 

location of hazardous facilities.767 Among other requirements, the zoning regulations must be designed to 

ensure public safety from fires and other dangers.768 However, the municipality is not given the authority 

to remove the hazardous condition on the property that exists at the time the governing body implements 

zoning authority and that is used in a public service business.769 The municipality is allowed to impose 

zoning regulations relevant to the storage and use of hazardous substances.770

In the case of West, Texas, this arrangement led to the city being vested with the most authority in 

regulating public use. West exercised this authority through its Code of Ordinances.771 West had zoned 

all property within the city limits for residential purposes only. However, all real property that had been 

used for commercial purposes before 1987 could remain commercial in nature. Any future development 

with commercial intent required a rezoning procedure.772 This provision is consistent with West’s 

comprehensive plan to zone all property within the city limits as residential property.

In essence, regulatory authority has been delegated to municipalities to oversee the siting of facilities 

storing and distributing FGAN near cities such as West. Neither the federal government nor the state of 

Texas takes any part in oversight. In many instances, however, municipalities are unable to adequately 

address this complex issue through regulatory mechanisms. For instance, facilities such as the WFC plant 

existed before promulgation of the city’s Code of Ordinances, posing an issue of grandfathered facilities. 

Many different economic, safety, environmental, and agricultural interests must also be balanced. 

Furthermore, municipalities already face a shortage of resources for other essential governmental 

functions. However, safety issues can be addressed through reasoned regulation, using a number of 

methods. For example, a regulation requiring separation distances between public receptors and facilities 

handling FGAN could help mitigate offsite consequences in cities such as West. At root, however, 

locating these facilities near communities represents a national concern; therefore, all levels of 

government should give consideration to developing land use regulations to counter this problem.

 

767 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.003. See: 

http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 768 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.004. See: 

http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 769 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.013. See: 

http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). 770 Texas Statute, Local Government Code, Title 7, Subtitle A, Chapter 211, Section 211.017. See: 

http://www.statutes.legis.state.tx.us/Docs/LG/pdf/LG.211.pdf (accessed on December 28, 2015). The term 

“hazardous substances” is not defined in the chapter. 771 See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on December 28, 

2015). 772 Section 14.01.002. See: http://z2codes.franklinlegal.net/franklin/Z2Browser2.html?showset=westset (accessed on 

December 28, 2015).

001565
West Fertilizer Company Final Report January 2016

233 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

9.3.1 Importance of Land Use Planning in Siting Communities Near Facilities 

Storing FGAN and Other Hazardous Chemicals

The issue of siting hazardous facilities storing FGAN near cities such as West is not an anomaly; it is a 

nationwide problem. In addition, although not directly associated with FGAN storage facilities, land use 

issues have been at the forefront of multiple CSB investigations. Furthermore, CSB has identified—

multiple times—the risks of locating a hazardous chemical facility near public receptors. Table 15 lists 

CSB investigations that involved land use issues.

Table 15. Investigations Involving Land Use Issues

Investigation Public Receptors Chemical Involved Offsite Consequences

NDK Crystal, Inc. Interstate commerce, 

businesses

Synthetic quartz crystal 

(silica and NaOH)

1 fatality

DPC (Festus, MO) Highways, railroads, 

residences, businesses, 

farms

Chlorine 63 residents who sought 

medical treatment

Concept Sciences Businesses, residences Hydroxylamine 5 fatalities, 14 injuries, 

significant damage to 

buildings and shattered 

windows at residences

CAI/Arnel Businesses, residences Heptane, isopropyl 

alcohol, n-propyl 

alcohol

10 injuries, 24 houses 

and 6 businesses 

significantly destroyed

DPC (Glendale, AZ) Residences Chlorine 14 injuries

Freedom Industries Residences, businesses, 

drinking water supply

MCHM, PPH 369 residents who 

sought medical 

treatment for exposure

Millard Refrigerated 

Services

Businesses, 

environment 

Anhydrous ammonia 150 people who sought 

medical treatment for 

ammonia exposure

T-2 Laboratories Inc. Businesses, residences, 

railroads

Methylcyclopentadienyl

manganese tri-carbonyl 

28 injuries, significant 

property damage to 

nearby businesses

Silver Eagle Refinery Residences Hydrocarbons Damage to residences

Kaltech Residences, businesses, 

public streets

Chemical waste At least 36 injured 

people, damage to 

residences and 

businesses

Chevron Refinery Residences, businesses, 

public streets

Hydrocarbons Approximately 15,000 

people who sought 

medical treatment

001566
West Fertilizer Company Final Report January 2016

234 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Investigation Public Receptors Chemical Involved Offsite Consequences

Caribbean Petroleum Residences, businesses, 

public streets

Hydrocarbons Shutdown of major 

highways, evacuation of 

local residents

Bayer CropScience Residences, college, 

businesses, interstate 

commerce, waterways

Methomyl, methyl 

isobutyl ketone

Property damage, 

community shelter-inplace activated

In light of this information, the WFC incident in West serves as yet another unnecessary and deadly 

reminder that little has been done to address the risks of locating communities near facilities handling 

hazardous chemicals such as FGAN. Furthermore, if the incident had occurred during school hours, 

many more adults and children could have been injured. This incident represents a microcosm of the 

potential harms that many communities across the nations could endure.

773

9.3.2 International Perspectives

Other countries have confronted problems similar to those in West, Texas, and have taken a variety of 

approaches to address them. The European and Australian strategies merit consideration given their 

sophistication relative to the current U.S. approach. The discussion in this section explores the

approaches taken by the European Union (EU), the United Kingdom (U.K.), and Australia.

9.3.2.1 European Union

Through its Seveso III Directive, the EU requires member countries to take land use planning policies 

“into account” as part of major accident prevention.774 The policy behind the requirement is designed to 

mitigate the consequences of major chemical accidents experienced by public receptors. The EU 

developed this requirement in the aftermath of major industrial incidents, including the FGAN explosion 

in Toulouse.775 In fact, the Seveso III Directive lists AN as a “dangerous substance,” classifying the 

chemical into four different categories, depending on whether it is FGAN, technical grade ammonium 

 

773 See: http://news.yahoo.com/devastated-texas-town-ponders-schools-140711695.html (accessed on December 29, 

2015).

 Jaeah Lee. “Map: Is There a Risky Chemical Plant Near You?” Mother Jones (April 17, 2014). See: 

http://www.motherjones.com/environment/2014/04/west-texas-hazardous-chemical-map (accessed on July 8, 2014). 774 Seveso III Directive, Article 13, “Land-use planning.” See: http://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX:32012L0018 (accessed on November, 2, 2015). 775 G. Vierendeels, et al. “Modeling the major accident prevention legislation change process within Europe.” Safety 

Science. 516 (2010). 

001567
West Fertilizer Company Final Report January 2016

235 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

nitrate (TGAN), off-specification ammonium nitrate (AN), or AN capable of self-sustaining 

decomposition.776 

Under the Seveso III requirements, member countries are to ensure that their policies address “appropriate 

distances” between covered facilities and residential areas. Furthermore, the countries must “set up 

appropriate consultation procedures” with competent authorities to “facilitate the implementation” of the 

land use planning policies. The Seveso III Directive applies to new facilities, facilities undergoing 

modifications, and new developments. Existing facilities must determine whether additional technical 

measures are required to avoid an increase in risk to the nearby community.777

The Seveso III Directive does not prescribe best practice guidance for its technical requirements (such as 

separation distances), consistent with its respect for each country’s political, cultural, technical, and 

economic differences. However, various entities such as the Institute for Systems and Informatics and 

Safety provide best practice guidance, which refers to the use of technical approaches and procedural 

issues.

778 Although such guidance offers helpful insights to member countries, the appropriate response 

for a specific site is still recognized as a matter of interpretation for each country.

Given the immense differences among the approaches to land use planning of the member countries, it is 

difficult to compare EU country land use policies. However, the establishment of groups such as the 

European Commission and the Committee of the Competent Authorities under the Seveso III Directive 

emphasizes the important role that land use planning issues play in the European community.779 

Although issues still remain relating to each country’s practices and methodologies, the emphasis on 

siting of facilities storing hazardous materials near public receptors highlights the importance that the 

European community places on land use planning in major accident prevention.

9.3.2.2 United Kingdom

The U.K. vests a hazardous substances authority with the power to administer and enforce land use 

planning as it relates to storing or using hazardous substances. The hazardous substances authority is 

generally an entity charged with dealing with land use planning and zoning issues, known as the local 

 

776 Seveso III Directive, Notes Section, “AN compounds with more that 28% by weight and AN based fertilizers.” 

2012/18/EU. See: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012L0018 (accessed on 

November 2, 2015). 777 Seveso III Directive, Article 13, “Land-use planning.” 2012/18/EU. See: http://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX:32012L0018 (accessed on November 2, 2015). 778 Christou, M.D., and S. Porter. “Guidance on Land Use Planning as Required by Council Directive 96/82/EC

(Seveso II).” Institute for Systems Informatics and Safety, 1999. See: 

http://ipsc.jrc.ec.europa.eu/fileadmin/repository/sta/mahb/docs/LandUsePlanning/EUR18695EN_LandUsePlanning

Guidance.pdf (accessed on December 28, 2015). 779 Major Accident Hazards Bureau. “Land Use Planning.” See: http://ipsc.jrc.ec.europa.eu/index.php/Land-useplanning/694/0/ (accessed on December 28, 2015).

001568
West Fertilizer Company Final Report January 2016

236 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

planning authority.780 Consequently, the U.K. takes an approach similar to that of the United States in 

decentralizing land use planning to allow a local authority to promulgate and enforce land use 

requirements.781 For the WFC incident in West, Texas, the West City Council would be the analogue to 

the U.K. hazardous substances authority.

The U.K., however, requires land use policies to account for major accidents caused by hazardous 

substances.782 This responsibility is executed through a collaborative effort among the hazardous 

substances authority, U.K. Health and Safety Executive (HSE),783 U.K. Environment Agency,784 and 

other interested stakeholders. Essentially, organizers of a proposed development must seek a hazardous 

substances consent from the hazardous substances authority to establish a facility that will store or use 

hazardous substances785 within its jurisdiction.786 

When the hazardous substances authority receives an application for consent, it must consult with the 

HSE and the U.K. Environment Agency for advice on whether consent to the proposed development is 

warranted. Other interested stakeholders are also consulted or given the opportunity to publicly comment 

on the proposed development.787 Using all of the relevant information provided, the hazardous substances 

authority weighs all competing interests and decides whether to grant a hazardous substances consent to 

the proposed development.788

The U.K. attempts to balance each local community’s interest in deciding the risks that it will tolerate, 

drawing on the expertise and resources of national governmental bodies. Such an approach makes it 

more likely that all relevant issues and concerns about locating a development that stores or uses

hazardous substances near the public will be presented to the hazardous substances authority before a 

 

780 See: 

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/16628/hazardoussubstancesguide.pdf

(accessed on December 28, 2015).

781 The U.K. has experienced similar catastrophic incidents that had effects on the population, including the 

Flixborough (Nypro UK) Explosion in 1974 and the Buncefield incident in 2005. See: 

http://www.hse.gov.uk/comah/sragtech/caseflixboroug74.htm and http://www.buncefieldinvestigation.gov.uk/, 

respectively (accessed on December 28, 2015).

782 Seveso Directive II, Article 12, “Land Use Planning.” See: http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed on December 

28, 2015).

783 The U.K. HSE is a governmental body responsible for enforcing health and safety at workplaces. See: 

http://www.hse.gov.uk/contact/authority.htm (accessed on December 28, 2015). 784 The U.K. Environment Agency is a governmental body responsible for protecting and improving the environment 

and for promoting sustainable development. See: http://www.environment-agency.gov.uk/aboutus/default.aspx

(accessed on December 28, 2015).

785 FGAN is included within the definition of a “hazardous substance.” See: 

http://www.legislation.gov.uk/uksi/1999/981/schedule/1/made (accessed on December 28, 2015). 786 See: http://www.hse.gov.uk/landuseplanning/what.htm (accessed on December 28, 2015). 787 Other stakeholders include the local parish council, fire and civil defense authorities, and the governmental agency

English Nature.

788 See: http://www.environment-agency.gov.uk/aboutus/default.aspx (accessed on December 28, 2015).

001569
West Fertilizer Company Final Report January 2016

237 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

decision is rendered. The U.K. thus believes that major offsite risks can be effectively managed before 

permitting a hazardous substance to be stored near a population in its vicinity.789

9.3.2.3 Western Australia

Australia’s land use planning methods regarding hazardous substances vary across jurisdictions.790 

Although each Australian state and territory applies varying regulations regarding land use planning of 

FGAN storage facilities, the Government of Western Australia employs an insightful and sophisticated 

approach to the issue. In essence, Western Australia uses a risk-based method that subjects FGAN 

storage facility siting to government approval.791

Western Australia legislatively addresses land use issues concerning FGAN through its Dangerous Goods 

Safety Act 2004 (the Dangerous Goods Act). This act places a duty on all people involved with 

dangerous goods to minimize risk associated with those goods.792 To minimize risk, the Dangerous 

Goods Act requires that “all reasonably practicable measures” be used. In determining whether a measure 

is “reasonably practicable,” consideration is given to issues such as the severity of the harm, severity of 

the risk to people, and suitability of the means in question.793 FGAN is treated as a dangerous good under 

the Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007 and the 

Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007, which both support the Dangerous 

Goods Act.794

 

789 See: 

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/16628/hazardoussubstancesguide.pdf

(accessed on December 28, 2015).

790 See: http://www.chemicalspolicy.org/downloads/chemicals-plastics-regulation.pdf (accessed on December 29, 

2015).

791 Dangerous Goods Safety Act 2004. See: 

http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_242_homepage.html (accessed on December 28, 

2015). Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007. See: 

http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12972_homepage.html (accessed on December 28, 

2015). Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007. See: 

http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12983_homepage.html (accessed on December 28, 

2015). Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of 

Solid FGAN: Code of Practice: iii. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-ofsolid-ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015).

792 Dangerous Goods Safety Act 2004, Part 2. See: 

http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_242_homepage.html (accessed on December 28, 

2015).

793 Ibid. 794 Dangerous Goods Safety (Storage and Handling Non-Explosives) Regulations 2007. See: 

http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12972_homepage.html (accessed on December 28, 

2015). Dangerous Goods Safety (Major Hazard Facilities) Regulations 2007. See: 

http://www.slp.wa.gov.au/legislation/statutes.nsf/main_mrtitle_12983_homepage.html (accessed on December 28, 

2015). Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of 

Solid FGAN: Code of Practice: iii. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-ofsolid-ammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015).

001570
West Fertilizer Company Final Report January 2016

238 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Land use planning as related to siting facilities storing FGAN near public receptors is implemented by 

applying separation distances. These distances are subject to acceptance by Resource Safety, a 

department of the Government of Western Australia.795 If it is determined that an FGAN facility is not 

satisfying the separation distance requirement, Resource Safety may limit the quantity of FGAN within 

the facility or require that other safety conditions be met.796

The New South Wales Department developed the required separation distances with the intent of reducing 

the risk of offsite consequences insofar as reasonably practicable.797 The distances were not designed to 

completely eliminate the risks associated with offsite consequences, nor were they intended to replace 

preventive controls.798 The separation distances are categorized by a threshold quantity (i.e., whether 

FGAN is stored in quantities greater than or less than 10 metric tons). For instance, if FGAN exceeding 

10 tons is stored at a facility, it must be separated by at least 300 meters (985 feet) from critical 

infrastructure, 240 meters (790 feet) from residential buildings, and 140 meters (460 feet) from 

commercial buildings.799 

Western Australia seeks to address land use planning through a risk-based scheme that requires 

government permission to site FGAN facilities near public receptors. Depending on the quantity of 

FGAN stored, each facility must be sited at a minimum distance from such public receptors. 

Furthermore, if the facility is not sited at the required minimum distance, it might have to limit the 

maximum quantity of FGAN that it can store. A study of the risk associated with a particular facility 

might be required to reach agreement between the government and the facility on appropriate separation 

 

795 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid 

FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solidammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015).

 See also: http://www.dmp.wa.gov.au/6611.aspx (accessed on December 28, 2015). 796 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid 

FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solidammonium-nitrate-code-of-practice.pdf (accessed on December 28, 2015). 797 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid 

FGAN: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safe-storage-of-solidammonium-nitrate-code-of-practice.pdf. 

 Government of Western Australia. Code of Practice: Safe Storage of solid FGAN, 3rd Edition: 6-7. See: 

http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf

(accessed on December 29, 2015). Hazardous Industry Planning Advisory Paper No. 4—Risk criteria for land use 

safety planning. HIPAP4. See: http://www.planning.nsw.gov.au/Policy-andLegislation/~/media/0D39F08E7889409BBA1FA88D5FB859FD.ashx (accessed on January 7, 2014). 

798 Department of Consumer and Employment Protection Government of Western Australia. Safe Storage of Solid 

Ammonium Nitrate: Code of Practice: 8–10. See: https://miningandblasting.files.wordpress.com/2009/09/safestorage-of-solid-ammonium-nitrate-code-of-practice.pdf (accessed on January 6, 2016). Government of Western 

Australia. Code of Practice: Safe Storage of solid ammonium nitrate, 3rd Edition: 6–7. See: 

http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf

(accessed on December 29, 2015). 799 Government of Western Australia. Code of Practice: Safe Storage of solid ammonium nitrate, 3rd Edition: 6–7. 

See: http://www.dmp.wa.gov.au/Documents/Dangerous-Goods/DGS_COP_StorageSolidAmmoniumNitrate.pdf

(accessed on December 29, 2015). 

001571
West Fertilizer Company Final Report January 2016

239 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

distances. This approach gives Western Australia the capability to balance the risk associated with 

storing FGAN against the need for land development.

9.4 Efforts to Address Land Use Planning After the West Incident

In the weeks, months, and years following the West incident, few inroads have been made to resolve land 

use issues. The federal government has developed a working group that is tasked with developing 

recommendations related to chemical facility safety and security; however, the timeline for delivery has 

been extended.

800 At the state level, general opposition remains to any type of change in the Texas 

approach to land use planning.801 In fact, strong opposition has contested any regulation of FGAN 

facilities in Texas.802 The city of West is currently awaiting recommendations from state and federal 

officials; however, it does plan on siting any new fertilizer facilities away from the community.803

The Texas State Fire Marshal’s Office (SFMO) has taken a proactive approach by providing all counties 

with software demonstrations that estimate blast zones from facilities storing FGAN.

804 In addition to 

assisting first responders, the software gives community leaders the opportunity to assess community 

impacts relating to the siting of a new FGAN facility. In addition, the SFMO will assist each county in 

reviewing best practices for dealing with the storage and handling of FGAN. 

At the county level, the McLennan County Local Emergency Planning Committee (LEPC) has 

emphasized the importance of land use issues in agreeing to focus on “upfront planning” when siting 

community buildings such as schools or hospitals near chemical facilities.805 The LEPC has agreed to

continue to meet quarterly. The city of West has also committed to advising other communities about 

identifying the potential hazards that they might face in locating chemical facilities near their towns and 

citizens.

806

Applied Research Associates, Inc. (Applied Research) has engaged in an effort to understand and validate 

the separation distances prescribed in NFPA 400. After completing a literature review, Applied Research 

selected a consequence-based case study and developed a test plan. The firm then carried out the case 

 

800 See: https://www.osha.gov/chemicalexecutiveorder/index.html (accessed on December 28, 2015). 801 See: http://www.nytimes.com/2013/05/10/us/after-plant-explosion-texas-remains-wary-of-regulation.html?_r=0

(accessed on December 28, 2015).

802 Henry, Terrence, NPR. “Proposals to Prevent Another Fertilizer Explosion Immediately Meet Resistance,” July 2, 

2014. See: http://stateimpact.npr.org/texas/2014/07/02/proposals-to-prevent-another-fertilizer-explosionimmediately-meet-resistance/ (accessed on December 8, 2014). The Associated Press. “New bill on West blast 

would delay new rules.” CBS DFW (August 5, 2014). See: http://dfw.cbslocal.com/2014/08/05/new-bill-on-westblast-would-delay-new-rules/ (accessed on December 29, 2015). 803 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_westretrospective.html

(accessed on December 28, 2015). 804 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_assessment.html (accessed on 

December 28, 2015). 805 Ibid. 806 Ibid.

001572
West Fertilizer Company Final Report January 2016

240 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

study test plan to assess the adequacy of the separation distance for safe storage of AN and the safe 

separation distance for personnel in a process building in the event of an explosion. Applied Research 

then developed a series of recommendations regarding separation distances in NFPA 400, including 

possible approaches for improving those distances, to guide NFPA and its affiliated Fire Protection 

Research Foundation project panel in future research efforts.807

The city of West is currently rebuilding. The blast substantially damaged more than 350 homes, 

completely destroying 150 of them, and caused approximately $100 million in damages.808 The West 

High School has been razed, and a new school will be constructed on the same site.809 The site of the 

accident will likely become an industrial park.

810

10.0 Key Findings

Technical Findings

1. The presence of combustible materials used for construction of the facility and the fertilizer grade 

ammonium nitrate (FGAN) storage bins, in addition to the West Fertilizer Company (WFC) 

practice of storing combustibles near the FGAN pile, contributed to the progression and intensity 

of the fire and likely resulted in the detonation. 

2. The WFC facility did not have a fire detection system to alert emergency responders or an 

automatic sprinkler system to extinguish the fire at an earlier stage of the incident.

3. On the basis of interviews with eyewitnesses and supporting photographic evidence, the first 

observed fire and smoke originated in and above the seed room and progressed throughout the 

northern half of the WFC facility. The radiant heat from the fire, fueled by the structure, 

flammable building contents, and the asphalt roof shingles, likely heated the surface of the FGAN 

pile. Contamination from soot, molten asphalt, and molten polyvinyl chloride (PVC) from an 

overhead conveyer produced a detonable mixture of combustibles and FGAN oxidizers. 

Increased ventilation generated a brighter and hotter flame, heating the FGAN-fuel mixture on the 

surface of the pile.

Regulatory Findings

4. Occupational Safety and Health Administration (OSHA) efforts to oversee facilities that store and 

handle FGAN fell short at the time of the incident.

 

807 Fire Protection Research Foundation. “Separation Distances in NFPA Codes and Standards, 2014.” See: 

http://www.nfpa.org/Assets/files/AboutTheCodes/59A/RFSeparationDistancesNFPACodesAndStandards.pdf

(accessed on September 25, 2015).

808 See: http://www.hazmatmag.com/news/in-harms-way/1002482923/ (accessed on January 6, 2016) and

http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_whatwelearned.html (accessed on 

December 28, 2015).

809 CBS. “DFW, West Getting New Schools After Explosion,” October 30, 2014. See: 

http://dfw.cbslocal.com/2014/10/30/west-getting-new-schools-after-explosion/ (accessed on December 6, 2014). 810 See: http://res.dallasnews.com/interactives/2013_December/westretrospective/1215_westretrospective.html

(accessed on December 28, 2015).

001573
West Fertilizer Company Final Report January 2016

241 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a. Section (i) of the OSHA Explosives and Blasting Agents standard, 29 CFR 1910.109(i), was 

not very well known among those in the fertilizer industry, likely due in part to the fact that 

(1) application of the section was unclear; and (2) the section had rarely been used previously 

to cite fertilizer facilities.

b. OSHA inadvertently omitted ammonium nitrate (AN) from the List of Highly Hazardous 

Chemicals, Toxics and Reactives in its Process Safety Management (PSM) standard, 29 CFR 

1910.119, even though AN possesses reactive characteristics that would have triggered its 

inclusion.

5. Because the WFC facility was covered under the U.S. Environmental Protection Agency (EPA)

Risk Management Program rule for its anhydrous ammonia tanks (but not for its FGAN), WFC 

employees and emergency responders demonstrated a greater awareness of the hazards associated 

with onsite storage of anhydrous ammonia than those associated with FGAN. AN is not on the

EPA Risk Management Program list of chemicals, so the WFC was not required to take safety 

measures for FGAN similar to those for ammonia. 

Insurance Findings

6. WFC’s previous property and liability insurer, which provided insurance to WFC from 2006 

through 2009, did not focus on FGAN hazards in its annual insurance inspections because it was 

not required to do so. However, the insurer did not renew WFC’s commercial property policy in 

2010 because WFC repeatedly failed to comply with the insurer’s safety-related 

recommendations (e.g., to replace corroded electrical wiring), which were identified in loss 

control surveys. The CSB found little evidence of onsite activity or inspections by WFC’s 

subsequent insurer, U.S. Fire, which insured the facility at the time of the incident. 

Emergency Response Findings

7. The West Volunteer Fire Department (WVFD) did not conduct pre-incident planning or response 

training at the WFC facility to address FGAN-related incidents because was no such regulatory 

requirement. Thus, the firefighters who responded to the WFC fire did not have sufficient 

information to make an informed decision on how best to respond to the fire at the fertilizer 

facility. 

8. Federal and state of Texas curriculum manuals used for hazardous materials (HAZMAT) training 

and certification of firefighters placed little emphasis on emergency response to storage sites 

containing FGAN. On the other hand, HAZMAT shipping and transportation were covered 

frequently in the courses. Many federal and state grants support the resource needs of firefighters 

and fire departments; however, these grants are used more often for resources such as personal 

protection equipment or firefighting equipment rather than for training.

9. Lessons learned from previous FGAN-related fires and explosions were not shared with volunteer 

fire departments, including the WVFD. If previous lessons learned had been applied in West, the 

firefighters and emergency personnel who responded to the incident might have better understood 

the risks associated with FGAN-related fire. 

001574
West Fertilizer Company Final Report January 2016

242 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Emergency Planning Findings

10. Despite WFC documentation of its FGAN in a 2012 Tier II report, the WVFD did not conduct 

drills and exercises at the WFC facility before the 2013 fire and explosion. 

11. The agricultural use exemption under the Emergency Planning and Community Right-to-Know 

Act (EPCRA) is not clear about which facilities are covered under the exemption. Before the 

WFC fire and explosion, the state of Texas determined that the WFC was exempt under the 

EPCRA agricultural use exemption. 

Land Use Planning Findings

12. At the time of its construction, the WFC facility was surrounded by open fields, and no zoning 

regulations existed when it began operations.

13. As the city of West developed over the years, it expanded toward the WFC facility.

14. The proximity of the city of West to the WFC facility magnified the offsite consequence impacts.

15. Other FGAN facilities throughout Texas are located in close proximity to schools, residences, and 

care facilities. Of the 40 FGAN facilities in Texas as of October 2015, 48 percent are within 0.5 

miles of a school, nursing home, or hospital while 83 percent are within 0.25 miles of a residence. 

11.0 Recommendations 

U.S. Environmental Protection Agency (EPA)

2013-02-I-TX R1

Develop a guidance document on Emergency Planning and Community Right-to-Know Act 

(EPCRA) requirements that is issued annually to State Emergency Response Commissions

(SERCs) and Local Emergency Planning Committees (LEPCs) and ensure that the guidance

focuses on the following: 

a. Explains which chemicals are exempt and which must be reported. 

b. Describes how emergency responders should use Tier I and Tier II inventory reports and 

Safety Data Sheets, such as in safety training, practice drills, and for emergency planning.

c. Includes comprehensive LEPC planning requirements, with an emphasis on annual 

training exercises and drills for local emergency response agencies.

2013-02-I-TX R2

Develop a general guidance document on the agricultural exemption under EPCRA Section 

311(e)(5) and its associated regulation, 40 CFR 370.13(c)(3), to clarify that fertilizer facilities that 

store or blend fertilizer are covered under EPCRA. Communicate to the fertilizer industry 

publication of this guidance document as well as the intention of Section 311(e)(5). 

001575
West Fertilizer Company Final Report January 2016

243 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2013-02-I-TX R3

Revise the Risk Management Program rule to include fertilizer grade ammonium nitrate (FGAN) 

at an appropriate threshold quantity on the List of Regulated Substances.

a. Ensure that the calculation for the offsite consequence analysis considers the unique 

explosive characteristics of FGAN explosions to determine the endpoint for explosive 

effects and overpressure levels. Examples of such analyses include that adopted by the 

2014 Fire Protection Research Foundation report, “Separation Distances in NFPA Codes 

and Standards,” Great Britain’s Health and Safety Executive, and other technical 

guidance.

b. Develop Risk Management Program rule guidance document(s) for regulated FGAN 

facilities. 

U.S. Occupational Safety and Health Administration (OSHA)

2013-02-I-TX R4

Develop and issue a Regional Emphasis Program for Section (i) of the Explosives and Blasting 

Agent standard, 29 CFR 1910.109(i), in appropriate regions (such as Regions IV, VI, and VII) 

where fertilizer grade ammonium nitrate (FGAN) facilities similar to the West Fertilizer 

Company facility are prevalent. Establish a minimum number of emphasis program inspections

per region for each fiscal year. Work with regional offices to communicate information about the 

emphasis program to potential inspection recipients. 

2013-02-I-TX R5

Implement one of the following two regulatory changes, either option (a) or (b) below, to address 

FGAN hazards: 

a. Add FGAN to the OSHA Process Safety Management (PSM) standard List of Highly 

Hazardous Chemicals, Toxics and Reactives in 29 CFR 1910.119, Appendix A, and 

establish an appropriate threshold quantity. Identify National Fire Protection Association 

(NFPA) 400 as a source of Recognized and Generally Accepted Good Engineering 

Practices (RAGAGEP) for PSM-covered FGAN equipment and processes.

b. Revise the OSHA Explosives and Blasting Agents standard, 29 CFR 1910.109, to ensure 

that the title, scope, or both make(s) clear that the standard applies to facilities that store 

bulk quantities of FGAN. Revise 1910.109(i), “Storage of Ammonium Nitrate,” to 

include requirements similar to those in NFPA 400, Hazardous Materials Code (2016 

Edition), Chapter 11. Ensure the following elements are considered: 

i. For new construction, prohibit combustible materials of construction for FGAN 

facilities and FGAN bins. For existing facilities, establish a phase-in requirement 

for the replacement of wooden bins with bins made of noncombustible materials 

of construction within a reasonable time period (e.g., 3 to 5 years from the date 

standard revisions are enacted), based on feedback from the fertilizer industry.

ii. Require automatic fire sprinkler systems and fire detection systems for indoor 

FGAN storage areas. 

001576
West Fertilizer Company Final Report January 2016

244 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

iii. Define adequate ventilation for FGAN for indoor storage areas. 

iv. Require all FGAN storage areas to be isolated from the storage of combustible, 

flammable, and other contaminating materials. 

v. Establish separation distances between FGAN storage areas and other hazardous 

chemicals, processes, and facility boundaries.

International Code Council (ICC)

2013-02-I-TX R6

In a subsequent edition of the International Fire Code, develop a chapter or a separate section 

under Chapter 50 (“Hazardous Materials”) or Chapter 63 (“Oxidizers, Oxidizing Gases and 

Oxidizing Cryogenic Fluids”) that includes the following requirements for the storage and 

handling of ammonium nitrate (AN): 

a. Require automatic fire detection and suppression systems in existing buildings 

constructed of combustible materials

b. Provide ventilation requirements in accordance with the International Mechanical Code 

to prevent the accumulation of off-gases produced during AN decomposition 

c. Provide smoke and heat vents to remove heat from AN during fire situations

d. Establish minimum safe separation distances between AN and combustible materials to 

avoid contamination in the event of fire.

e. Prohibit the use of combustible materials of construction. 

Department of Homeland Security, Federal Emergency 

Management Agency (FEMA)

2013-02-I-TX R7

Through a new or existing program and in conjunction with training partners, create and 

implement a competitive funding mechanism to provide training to regional, state, and local 

career and volunteer fire departments on how to respond to fire and explosion incidents at 

facilities that store fertilizer grade ammonium nitrate (FGAN). Continue to use available funding 

to ensure training effectiveness. 

2013-02-I-TX R8

During the proposal review process for the program, ensure that the FGAN training includes 

multiple delivery methods to enable a broad reach. Training should allow for instructor-led, webbased, and train-the-trainer courses; initial orientation; and refresher training. Training also 

should accommodate both resident and mobile capabilities to facilitate flexible delivery. 

Objectives of the selected training course should address the following:

a. Previous FGAN fire and explosion incidents, incorporating lessons learned 

b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN 

incompatibility with those materials and chemicals

001577
West Fertilizer Company Final Report January 2016

245 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

c. Pre-incident planning for fires involving FGAN 

d. On-scene emergency response and decision-making requirements for FGAN fires, 

including risk assessment, scene size-up, and situational awareness

e. National Incident Management System and Incident Command System.

2013-02-I-TX R9

Assist training partners to develop and provide continual oversight for an FGAN training 

program. In addition, evaluate the training curriculum to confirm that it adequately meets course 

objectives as well as the details of recommendation 2013-02-I-TX R8.

2013-02-I-TX R10

Develop an outreach program that notifies regional, state, and local fire departments about

available FGAN training opportunities. The program should include the following:

a. Guidance for fire departments on how to identify FGAN hazards within their 

communities by engaging State Emergency Response Commissions and Local 

Emergency Planning Committees

b. Details on how to obtain FGAN training by submitting a proposal in response to the 

funding opportunity

c. Information on training partners and programs that provide FGAN training.

Texas Commission on Fire Protection (TCFP)

2013-02-I-TX R11

Develop minimum standards for course curricula to include hazard awareness of fertilizer grade 

ammonium nitrate (FGAN) for those fire departments that either have FGAN facilities in their 

jurisdictions or respond as mutual aid to other jurisdictions with FGAN facilities. In addition, 

develop a training program specific to FGAN. 

Objectives of the program’s training course should address the following:

a. Previous FGAN fire and explosion incidents, incorporating lessons learned 

b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN 

incompatibility with those materials and chemicals

c. Pre-incident planning for fires involving FGAN 

d. On-scene emergency response and decision-making requirements for FGAN fires, 

including risk assessment, scene size-up, and situational awareness

e. National Incident Management System and Incident Command System.

2013-02-I-TX R12

Implement outreach to regional, state, and local fire departments that either have FGAN facilities 

in their jurisdictions or respond as mutual aid to jurisdictions with FGAN facilities, informing 

them about the new FGAN training certification requirements and opportunities to receive 

training. Include the following in the outreach: 

001578
West Fertilizer Company Final Report January 2016

246 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

a. Guidance for fire departments on how to identify FGAN hazards within their 

communities by engaging State Emergency Response Commissions and Local 

Emergency Planning Committees

b. Encouragement for fire departments in jurisdictions with FGAN facilities to become 

certified in FGAN training.

State Firefighters’ and Fire Marshals’ Association of Texas 

(SFFMA)

2013-02-I-TX R13

Develop a fertilizer grade ammonium nitrate (FGAN) training certification program for fire 

departments that either have FGAN facilities in their jurisdictions or respond as mutual aid to 

other jurisdictions with FGAN facilities. The certification program should include multiple 

delivery methods to enable a broad reach. The certification program should allow for instructorled, web-based, and train-the-trainer courses; initial orientation; and refresher training. The 

training also should accommodate both resident and mobile capabilities to facilitate flexibility in 

delivery. 

The criteria for the certification program should address the following:

a. Previous FGAN fire and explosion incidents, incorporating lessons learned 

b. Hazards posed by other materials and chemicals stored near FGAN, including FGAN 

incompatibility with those materials and chemicals

c. Pre-incident planning for fires involving FGAN 

d. On-scene emergency response and decision-making requirements for FGAN fires, 

including risk assessment, scene size-up, and situational awareness

e. National Incident Management System and Incident Command System.

2013-02-I-TX R14

Develop an outreach component for the training certification program that notifies regional, state, 

and local fire departments with FGAN facilities in their jurisdictions about the training 

certification opportunities available for FGAN. Ensure that the following items are included in 

the development of this program: 

a. Guidance for fire departments on how to identify FGAN hazards within their 

communities by engaging State Emergency Response Commissions and Local 

Emergency Planning Committees

b. Encouragement for members in jurisdictions with FGAN facilities to become certified in 

FGAN training

c. Information on training partners and programs that provide FGAN training.

Texas A&M Engineering Extension Services (TEEX)

2013-02-I-TX R15

001579
West Fertilizer Company Final Report January 2016

247 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Develop and administer a hazardous materials training module for career and volunteer fire 

departments that addresses fertilizer grade ammonium nitrate (FGAN) and other hazardous 

materials or chemicals that could pose new specialized hazards. Ensure that the training includes 

multiple delivery methods to enable a broad reach. The training should allow for instructor-led, 

web-based, and train-the-trainer courses; initial orientation; and refresher training. The training 

also should accommodate both resident and mobile capabilities to facilitate flexibility in delivery. 

Objectives of the training course should address the following:

a. How to respond to industrial fires involving FGAN and other hazardous materials or 

chemicals that could pose new specialized hazards to responding firefighters

b. Previous FGAN fire and explosion incidents, incorporating lessons learned 

c. Hazards posed by other materials and chemicals stored near the FGAN, including FGAN 

incompatibility with those materials and chemicals

d. Pre-incident planning for fires involving FGAN and other hazardous materials or 

chemicals that could pose new specialized hazards to responding firefighters

e. On-scene emergency response and decision-making requirements for FGAN fires, 

including risk assessment, scene size-up, and situational awareness

f. National Incident Management System and Incident Command System.

2013-02-I-TX R16

Develop an outreach program that notifies state, regional, and local fire departments about

available FGAN training opportunities. The program should include the following elements:

a. Guidance for fire departments on how to identify FGAN and other recognized hazards 

associated with other hazardous materials or chemicals within their communities by 

engaging with State Emergency Response Commissions and Local Emergency Planning 

Committees

b. Promotion of use of the hazardous materials training module with TEEX training 

partners.

Texas Department of Insurance (TDI) 

2013-02-I-TX R17

For companies that provide insurance to agricultural facilities storing bulk fertilizer grade 

ammonium nitrate (FGAN) in Texas, including surplus lines insurers and Texas-registered risk 

retention groups, develop and issue guidance to assist in underwriting risk and conducting annual

loss control surveys. Guidance should include the following:

a. Combustible materials of construction for facilities and bins storing FGAN

b. Storage of combustible materials near FGAN piles

c. Adequate ventilation for indoor FGAN storage areas

d. Automatic sprinklers and smoke detection systems for indoor FGAN storage areas

e. Separation distances between FGAN and other hazardous materials onsite

001580
West Fertilizer Company Final Report January 2016

248 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

f. Potential for offsite consequences from a fire or explosion, including the proximity of 

FGAN facilities to nearby residences, schools, hospitals, and other community structures. 

Provide references in the guidance document to existing materials from the following sources or 

to other equivalent guidance:

a. National Fire Protection Association (NFPA), NFPA 400, Hazardous Materials Code, 

2016 Edition, Chapter 11, “Ammonium Nitrate” 

b. FM Global, “Property Loss Prevention Data Sheet 7-89” 

c. U.S. Environmental Protection Agency, Occupational Safety and Health Administration, 

and Bureau of Alcohol, Tobacco, Firearms and Explosives; “Chemical Advisory: Safe 

Storage, Handling, and Management of Solid Ammonium Nitrate Prills” 

d. TDI, “Best Practices for the Storage of Ammonium Nitrate” 

e. National Fire Protection Research Foundation, “Separation Distances and NFPA Codes 

and Standards.”

West Volunteer Fire Department (WVFD)

2013-02-I-TX R18

Develop standard operating procedures for pre-incident planning for facilities that store or handle 

hazardous materials such as fertilizer grade ammonium nitrate (FGAN).

El Dorado Chemical Company (EDC)

2013-02-I-TX R19 

For all distributors and bulk retail sites (i.e., customers) that receive fertilizer grade ammonium 

nitrate (FGAN) manufactured by El Dorado Chemical Company (EDC) for storage, shipment, 

and sale:

a. Encourage customers to conduct internal monitoring and auditing (in accordance with 

recent industry standards and guidelines) in locations where FGAN will be stored or 

used. Communicate that such internal monitoring and auditing may be conducted 

through established product safety programs, including ResponsibleAg. 

b. Develop a process to establish mutual product stewardship expectations for the 

downstream chain of customers. Communicate expectations to existing customers, and 

to new customers before their first shipment of FGAN. Include the following 

components:

i. For all FGAN sold to distributors, encourage distributors to provide Safety Data 

Sheets and FGAN safety guidance to their customers and bulk retail sites to 

which FGAN is sold or shipped

ii. For all EDC bulk retailers and non-EDC bulk retailers that store and sell FGAN, 

encourage bulk retailers to address, such as through certification checklists, the 

following:

• Written procedures for the safe handling of FGAN, including 

employee training

001581
West Fertilizer Company Final Report January 2016

249 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

• Emergency response plans to be sent to Local Emergency Planning 

Committees and local fire departments

• Tier II Chemical Inventory Report submissions.

This signature block is placed immediately after the last recommendation.

By the

U.S. Chemical Safety and Hazard Investigation Board

 Vanessa Allen Sutherland 

 Chair

 Kristen Kulinowski

 Member 

Manuel Ehrlich

 Member

 Richard Engler

 Member

 

Date of Board Approval

001582
West Fertilizer Company Final Report January 2016

250 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

12.0 Appendix A: Rebuilding of the West Independent School 

District 

The West Independent School District (WISD) ultimately decided to demolish the West Intermediate 

School (WIS),1 West High School (WHS), and approximately half of West Middle School (WMS) based 

on the level of damage to these buildings. The WISD is rebuilding by constructing a combined middle 

school and high school consisting of a common entryway, cafeteria, and auditorium but separate offices 

and gymnasiums for each school. The left side of the structure will accommodate the middle school 

students (grades 6 through 8), and the right side will serve high school students (grades 9 through 12). 

Table 16 shows the distribution of grade levels within the old facilities and the new facilities. 

Groundbreaking took place on October 30, 2014, and construction began shortly thereafter; the WISD 

expects the school to open in September 2016. The new West Middle School/West High School will be 

located on the same site as the previous WHS campus. The site will house the WISD baseball field, 

softball field, eight-lane running track and facilities for field events, two practice fields, four tennis courts, 

and supporting concession and restroom facilities.2

 Although the city demolished the WIS campus, the 

existing site paving remained in place so that it could serve as temporary parking for the WISD 

transportation department. The former WIS site currently houses a donated metal building used for 

agriculture shop for WHS students3 but could potentially become the final location of the WISD 

transportation, maintenance, and receiving facility. 

 

1 WIS will not be rebuilt. 

2 See: http://www.restorewestisd.com/assets/sd_west-hs-ms-final-web.pdf (accessed on December 30, 2015). 3 The donated metal building is approximately a block and a half from the temporary high school; however, it would 

take up too much instructional time for students to walk there, so buses take each class to the shop on days when 

students participate in agriculture class. 

001583
West Fertilizer Company Final Report January 2016

251 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Table 16. Distribution of Grade Levels at the Old and New WISD Schools

School Old Facilities

(Grades)

New Facilities

(Grades)

West Intermediate School 4 and 5 Not rebuilt

West Middle School 6 and 7 6 through 8

West High School 7 through 12 9 through 12

West Elementary School K through 3 K through 5

During the rebuild, the WISD created a temporary campus for middle and high school students, ultimately 

locating it on the existing middle school site. Students in grades pre-K through 5 attended school at West 

Elementary School, which sustained minimal damage in the explosion. Students in grades 6 through 12 

were housed in temporary facilities at the existing WMS site.4 The sixth graders from WMS initially 

transferred to portable structures behind the elementary school until the end of the school year before 

moving to the middle school site for the 2013–2014 school year. The students in grades 7 through 12 

moved to empty buildings owned by the Connally Independent School District,

5 which is about 9 miles 

south of West, from April 17, 2013, until the end of the school year. Although the physical location of 

classes changed, WISD teachers still taught these students, who were still enrolled in the WISD. In 

August 2013, all of the students in grades 7 through 12 returned to West for classes in modular and 

portable buildings, and they eventually will transfer to the new school once the rebuild is complete. The 

temporary middle school and high school site consisted of 17 temporary portable facilities, 10 portable 

facilities donated by surrounding school districts that were leased by the WISD, and a temporary structure 

to cover the existing foundation and floor system saved from the original practice gymnasium.6

 

FEMA provided the WISD with a grant totaling nearly $20.8 million to assist in providing secure 

temporary classrooms and administrative buildings to replace those that were destroyed.7

 The FEMA 

grant will pay the federal share, or 75 percent, of the eligible costs for the rebuild, and the WISD will 

 

4 See: http://www.restorewestisd.com/plans.html (accessed on December 30, 2015). 5 Connally Independent School District is a Texas public school district located in central McLennan County, serving 

the cities of Lacy, Lakeview, and Waco as well as the communities of Elm Mott, Chalk Bluff, and Gholson.

6 See: http://www.restorewestisd.com/plans.html (accessed on December 30, 2015). 7 See: http://www.fema.gov/news-release/2013/08/01/fema-obligates-nearly-28-million-west-texas-independentschool-district (accessed on December 30, 2015). See: http://www.wfaa.com/story/local/2015/07/06/14167886/

(accessed on December 30, 2015).

001584
West Fertilizer Company Final Report January 2016

252 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

cover the remaining 25 percent of the cost. The remaining cost to rebuild will be funded by the Texas 

Education Agency, which is providing the WISD with almost $10.3 million in Foundation School 

Program funds.

At the time of the incident, the WISD was insured for $58 million. The school district received $30 

million from the Argonaut Insurance Company, the WISD’s insurance carrier at the time of the explosion; 

however, WISD assessments indicate that the damage to its four schools far exceeded $30 million. 

Currently, the WISD is in litigation with Argonaut Insurance Company,

8 Trident Insurance Services 

LLC,

9

and the Texas Association of Public Educators.10 Based on a district assessment and planning 

presentation to the WISD Board of Trustees on April 29, 2013, the proposed cost for rebuilding 

temporary facilities and renovating the facilities damaged by the explosion would amount to 

$16,562,706.11 This Phase One cost estimate for temporary facilities and renovations includes the 

following:

• Existing administrative and office building renovations. 

• High school football stadium renovations. 

• Existing middle school site (1967 gymnasium repair, 1923 and 1957 building weatherization, 

maintenance and transportation building replacement). 

• Existing elementary school cafeteria additions and building renovations. 

• WISD-wide demolition and temporary classrooms. 

• Loose equipment moving and temporary storage. 

• WISD-wide technology connectivity. 

• Contingency funds.

The initial proposed estimated cost for Phase Two rebuilding—including a new high school, new 

intermediate and middle school, new track and field facility, new maintenance and transportation 

permanent replacement building and contingency, and program financial audit—was $100,791,719.12 

13.0 Appendix B: FGAN Incidents Tables

Appendix B provides two tables, both depicting incidents involving FGAN. CSB listed only those 

incidents that it could confirm. As such, these lists are not meant to be comprehensive. The first table 

 

8 Argonaut Insurance provides specialty property and casualty insurance and is a subsidiary of Argo Group 

International Holdings, Ltd.

9 Trident Insurance Services is a specialty commercial insurance provider for small- to middle-market public sector 

entities; it served as the administrator and adjustor for the insurance policy sold by Argonaut Insurance Company. 10 The Texas Association of Public Educators is a nonprofit organization managed by Argonaut Insurance Company to 

assist in the procurement of insurance and the administration of claims for school districts. 11 See: http://www.restorewestisd.com/assets/west-isd-presentation_final-sm.pdf (accessed on December 30, 2015). 12 See: http://www.restorewestisd.com/assets/west-isd-presentation_final-sm.pdf (accessed on December 30, 2015).

001585
West Fertilizer Company Final Report January 2016

253 U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

(Table 17) provides only those FGAN incidents that occurred at stationary sites. The second table (Table 

18) shows all other FGAN incidents, many of which are transportation-related. 

The incidents are listed chronologically. Date, location, and a brief description of each incident are 

provided. For transportation incidents, the location given is the location where the incident occurred. An 

indication of whether the incident involved fire and/or explosion is also included. Quantity, or mass, of 

FGAN involved in each incident is provided as well. This information may or may not reflect the 

quantity of FGAN that actually caught fire and/or detonated. Where available, a description of casualties 

and property damage is given. Where information could not be found or determined, entries appear 

blank. 

Of the 32 total confirmed FGAN incidents researched by CSB, 22 occurred at stationary sites. At least 

654 fatalities resulted from these stationary-site incidents. Thousands were injured and/or evacuated. Of 

the 10 FGAN incidents that occurred at non-stationary sites, at least 823 were fatally injured. Again, 

thousands were injured and/or evacuated. 

001586
West Fertilizer Company Final Report January 2016

254

Table 17. FGAN Incidents at Stationary Sites

Date Location Description

Fire

Explosion

Quantity (lbs) Casualties Property Damage

References

14-Jan1916Gibbstown NJ, 

USA

Explosion occurred in 

evaporating pan x 4K • One fatality• 12 injured

Plant property heavily 

damaged 

1

21-May 

-1921

Oppau, 

Germany

Detonation involved FGAN 

and ammonium sulfate 

mixture or hidden explosives 

x 900K • 561 fatalities

• 2,000 injured Buildings flattened 2

1-Mar1924New Brunswick 

(Nixon), NJ 

Explosion occurred at 

fertilizer building x x • At least 20 fatalities• A dozen missing 

3

5-Aug1940Miramas, 

France

Explosion of freight car 

launched explosive shell into 

burning mixture of FGAN and 

toluene at storage building

x x 480K 4

26-Aug1947Presque Isle, 

ME

Fire involving fertilizers 

occurred x -- 5

 

1 NFPA. Quarterly of the NFPA, Vol. 16, No. 1. July 1922. See: https://books.google.com/books?id=-

MAdAQAAIAAJ&printsec=frontcover&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false (accessed on December 30, 2015). 2 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45. 3 See: http://query.nytimes.com/gst/abstract.html?res=9E05EEDD1E3CE733A25751C0A9659C946595D6CF (accessed on December 31, 2015). 4 See: http://www.societechimiquedefrance.fr/extras/Guiochon%20VO/exinvolontaireVO.htm (accessed on December 31, 2015). 5 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45.

001587
West Fertilizer Company Final Report January 2016

255

Date Location Description

Fire

Explosion

Quantity (lbs) Casualties Property Damage

References

1-Sep1947St. Stephens, 

Canada

Fire occurred in warehouse 

containing bagged FGAN x -- 800K 6

14-Oct1949Independence, 

KS

Fire occurred in warehouse 

next to storage building 

containing FGAN piled in 

paper bags 

x -- 2.8– 5.4 million 7

9-Nov1966Mt. Vernon, 

MO

Explosion involving bagged 

FGAN occurred x x 100K 8

c. 1967 USA

Screw conveyor shaft for 

FGAN burst after welding 

operation

x x 9

c. 1973 Cherokee, OK Severe storage fire occurred in 

wooden FGAN storage area x x 28 million None injured 10

c. 1978 Rocky 

Mountain, NC

Fire occurred at storage 

facility containing FGAN x -- 1 million Storage facility destroyed by fire

11

 

6 Ibid. 7 Ibid. 8 Ibid. 9 ABS Consulting. “West Fertilizer Incident Support Services Final Report.” August 28, 2015. 10 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3)

(2005): 13–28. 11 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45.

001588
West Fertilizer Company Final Report January 2016

256

Date Location Description

Fire

Explosion

Quantity (lbs) Casualties Property Damage

References

c. 1979 Moreland, ID

Fire involved wood 

framework and belting of 

overhead conveyor system in 

fertilizer plant while being 

used to unload railroad car of 

FGAN

x -- 400K Fire spread to roof 12

c. 1982 United 

Kingdom

Fire in warehouse where 

wooden furniture stored near 

FGAN resulted in deflagration

x x 6 million 750–1,000 evacuated 13

13-Dec1994 Port Neal, IA Two explosions occurred at 

the Terra Industries AN plant x • Four fatalities 

• 18 injured

• Anhydrous ammonia 

released

• Ground water under 

plant contaminated

14

6-Jan1998Xingping, 

Shaanxi, China

Explosions occurred at 

fertilizer company x • 24 fatalities• 56 injured

 

12 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 

2013.

13 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: 

https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 14 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 

2013.

001589
West Fertilizer Company Final Report January 2016

257

Date Location Description

Fire

Explosion

Quantity (lbs) Casualties Property Damage

References

21-Sep2001Toulouse, 

France

Explosion occurred in 

warehouse containing FGAN 

and TGAN

x 

400 – 600 K 

(TGAN+FGAN)

• 29 fatalities

• Nearly 2,500 injured, 

30 of which severe 

Severe damage to plant 

and surrounding 

community 

15

Jan2003Cartagena, 

Murcia, Spain

Fertilizer storage facility held 

self-sustained detonation fire x x 16

Oct2003Saint-Romainen-Jarez, France

Fire occurred in end user 

storage facility containing 

FGAN in bags 

x x 10K Three heavily injured 17

30-Jul2009 Bryan, TX Fertilizer plant caught fire x Over 80,000 evacuated 18

 

15 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: 

https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 16 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 

2013.

17 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3)

(2005): 13–28. 18 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 

2013.

001590
West Fertilizer Company Final Report January 2016

258

Date Location Description

Fire

Explosion

Quantity (lbs) Casualties Property Damage

References

17-Apr2013 West, TX Fire and explosion occurred at 

fertilizer plant x x 80 – 100 K • 15 fatalities 

• Over 236 injured

• Facility destroyed

• Widespread damage to 

over 150 offsite 

buildings, including 

high school, middle 

school, intermediate 

school, apartment 

complex, and nursing 

home

• Early estimates placed 

property damage at over 

$100 million

29-May2014 Athens, TX

Fertilizer warehouse 

containing FGAN caught fire 

and burned

x 19

12-Aug2015 Tianjin, China

Hazardous materials storage 

warehouse containing AN* 

caught fire and exploded 

x x Over 100 fatalities 20

 

19 Babrauskas, Vytenis. “Explosions of ammonium nitrate fertilizer in storage or transportation are preventable accidents.” Journal of Hazardous Materials

(2015). 

20 See: http://www.theguardian.com/world/2015/aug/18/tianjin-blasts-warehouse-handled-toxic-chemicals-without-licence-reports (accessed on January 19, 2016) 

001591
West Fertilizer Company Final Report January 2016

259

Table 18. Non-Stationary FGAN Incidents

Date Location Description

Fire

Explosion

Quantity 

(lbs) Casualties Property Damage

References

16-Apr1947 Texas City, TX Fire occurred in hold of ship 

and detonated

x x 

4–11 

million

• Approximately 500 

fatalities 

• Approximately 3,000 

injured

• 2,000 left homeless

 

• Commercial and 

residential buildings 

damaged or destroyed

• Ships destroyed

• Two planes knocked out 

of sky 

• Barge lifted out of water

• Early property damage 

total estimated at 

approximately $40 

million

21

23-Jan1953 Red Sea, Israel

Spontaneous ignition of paper 

bags containing FGAN on 

ship 

x x 8–16 K Ship destroyed 22

17-Dec1960 Traskwood, AR

Explosion occurred in cars 

containing FGAN, petroleum, 

and paper 

x x 80—100 K 23

 

21 NFPA. “The Texas City Disaster.” The Quarterly. July 1947. 22 Oxley, J.C. et al. “AN: thermal stability and explosivity modifiers.” Thermochimica Acta 384 (2002): 23–45. 23 Ibid. 

001592
West Fertilizer Company Final Report January 2016

260

Date Location Description

Fire

Explosion

Quantity 

(lbs) Casualties Property Damage

References

1972 Taroon, 

Australia

Transport of low density 

bagged AN prills involved in 

fire and explosion

x x Three fatalities 24

c. 1997 Brazil

Delayed explosion occurred 

involving truck loaded with 

FGAN that caught fire due to 

nearby petrol tanker 

x x 25

c. 2000 FL Collision occurred between 

AN truck and gasoline tanker x -- 26

18-Feb2004Neyshabur, 

Khorasan, Iran

Fire and explosion resulted 

from derailment of train 

containing bagged FGAN

x x 840K 300 fatalities 27

Feb2004 Barracas, Spain Accident occurred during road 

transport of FGAN x x 50K • Two fatalities• Three injured 

28

 

24 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3)

(2005): 13–28. 25 Ibid. 26 Ibid. 27 Nygaard, Erik C. et al. “Safety of Ammonium Nitrate.” International Society of Explosives Engineers. Vol. 2, 2006. See: 

https://miningandblasting.files.wordpress.com/2009/09/safety-of-ammonium-nitrate.pdf (accessed on January 4, 2016). 28 Marlair, G., and M.A. Kordek. “Safety and security issues relating to low capacity storage of AN-based fertilizers.” Journal of Hazardous Materials 123(1–3)

(2005): 13–28.

001593
West Fertilizer Company Final Report January 2016

261

Date Location Description

Fire

Explosion

Quantity 

(lbs) Casualties Property Damage

References

May2004Near Bucharest, 

Romania

Truck accident occurred 

during road transport of 

bagged FGAN 

x x 50K At least 18 fatalities 29

17-Feb2007Estaca de 

Bares, Spain

Self-sustained decomposition 

fire of nitrogen, phosphorous, 

potassium (NPK) fertilizer 

occurred in cargo of ship 

x 

12.024 

million 

(NPK)

30

 

29 Ibid. 30 Boggs, Thomas L. et al. “Realistic Safe-Separation Distance Determination for Mass Fire Hazards.” Naval Air Warfare Center Weapons Division. March 

2013.

001594
West Fertilizer Company Final Report January 2016

262

14.0 Appendix C: TFI Safety and Security Tools

The Fertilizer Institute (TFI) offers a wide variety of tools designed to support the fertilizer industry. 

Most of these tools are information based and readily accessible online; some of the tools, however, are 

also interactive, allowing for personalization and customization. These tools include the following: 

• Access to a new online Compliance Assessment Tool. 

• General fertilizer retail industry information resources, such as industry fact sheets, fertilizer 

product fact sheets, and infographics. 

• New fertilizer grade ammonium nitrate (FGAN) guidelines, “Safety and Security Guidelines for 

the Storage and Transportation of Fertilizer Grade Ammonium Nitrate at Retail Facilities.” 

• An educational brochure, “America’s Security Begins with You,” designed to alert the agriculture 

community of the dangers associated with ammonium nitrate (AN) if it ends up in the wrong 

hands. 

• A brochure, “Health Effects of Ammonia,” discussing the sources and uses of ammonia as well as 

how the body processes it. 

• Newly updated liquid fertilizer guidelines, “Aboveground Storage Tanks Containing Liquid 

Fertilizer–Recommended Mechanical Integrity Practices,” which provides recommended uniform 

industry inspection and maintenance procedures for aboveground storage tanks of liquid 

fertilizer.

1

• An anhydrous ammonia brochure, “Recommended Practices for Loading/Unloading Anhydrous 

Ammonia Rail Tank Cars in North America–Reduce and Eliminate Non-Accidental Release,” 

accompanied by an associated DVD. 

• Access to a new nonprofit organization, ResponsibleAg, an industry-led stewardship2 initiative 

founded to promote the public welfare by helping agribusinesses comply with safety and security 

rules regarding the handling and storage of fertilizer products.

3

 

• Access to a multimedia safety training program, the “Anhydrous Ammonia Training Tour,” 

developed through TFI sponsorship of the Transportation Community Awareness and Emergency 

Response and focused on the provision of pertinent information regarding the properties of 

ammonia, steps that should be taken to ensure safe transport of ammonia, appropriate emergency

response measures in case of an ammonia release, and hands-on training.

4

• Access to free web-based anhydrous ammonia safety training, composed of subject-based training 

modules on (1) properties of ammonia, (2) personal protective equipment, (3) transportation of 

ammonia to and from the field, (4) safe hook-up of ammonia tanks in the field, and (5) 

emergency response and first aid procedures.

5

 

1 See: http://www.tfi.org/safety-and-security-tools/recommended-mechanical-integrity-guidelines-abovegroundstorage-tanks-liqu (accessed on December 30, 2015). 2 Merriam-Webster defines a stewardship as “the activity or job of protecting and being responsible for something.” 3 See: http://www.responsibleag.org/FAQ.cgi (accessed on December 30, 2015). 4 See: http://www.tfi.org/safety-and-security-tools/transcaer%C2%AE-anhydrous-ammonia-safety-training (accessed 

on December 30, 2015). 5 See: http://www.tfi.org/safety-and-security-tools/web-based-anhydrous-ammonia-safety-training (accessed on 

December 30, 2015). 

001595
West Fertilizer Company Final Report January 2016

263

• Access to a web-based compliance tool, myRMP Suite of Guidance Materials, a revised version 

of the Retail Guidance Document for Agricultural Retailers supported by the U.S. Environmental 

Protection Agency.

6

• A new suite of second-generation web-based tools, mySPCC Suite of Guidance Materials 

Version 2.0, developed exclusively to assist agricultural retailers in implementing their Spill 

Prevention, Control, and Countermeasures (SPCC) plans, which enables the personalization of 

such plans to specific facilities and incorporates base information from the SPCC rule with 

accumulated knowledge gained by industry over the last 20 years.

7

 

6 See: http://www.tfi.org/safety-and-security-tools/myrmp (accessed on December 30, 2015). 7 See: https://www.asmark.org/mySPCC/ (accessed on December 30, 2015).

001596
West Fertilizer Company Final Report January 2016

264

15.0 Appendix D: ResponsibleAg

As part of the ResponsibleAg program, participating facilities undergo an audit once every 3 years, and as 

many as 17 areas of a facility (e.g., dry fertilizer, liquid fertilizer, anhydrous ammonia, shop, office, and

grounds) are assessed.1

 Within 24 hours after completing the audit, the auditor enters findings into a 

secure portal on the ResponsibleAg website.2

 Once the information is processed, the participating facility 

receives a corrective action plan if applicable, detailing any issues detected during the audit.3

 This plan 

not only lists the issues discovered but also provides information on how to correct the issues and a 

recommended time frame for doing so.4

 At the end of the recommended period of time, the auditor visits 

the facility again for a verification audit. The participating facility obtains certification only after all 

outstanding issues are addressed.5

 To ensure a high level of reliability, a statistically valid sample of all 

participating facilities receives random verification from an independent auditor, approved by 

ResponsibleAg, every year.6

 An annual accountability report includes the number of registered facilities, 

credentialed auditors, completed assessments, and random verifications. 

 

1 See: http://www.responsibleag.org/About.cgi (accessed on December 30, 2015). 2 Ibid. 3 Ibid. 4 Ibid. 5 Ibid. 6 See: http://www.tfi.org/node/736 (accessed on January 6, 2016). See also: 

https://www.responsibleag.org/documents/RAHandout.pdf (accessed on December 30, 2015).

001597
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

REPORT NO. 2008-01-I-CO

AUGUST 2010

XCEL ENERGY HYDROELECTRIC PLANT

PENSTOCK FIRE

(Five Dead, Three Injured) 

 

CABIN CREEK

GEORGETOWN, 

COLORADO

OCTOBER 2, 2007

KEY ISSUES:

 SAFE LIMITS FOR WORKING IN CONFINED 

SPACE FLAMMABLE ATMOSPHERES

 PRE-JOB SAFETY PLANNING OF 

HAZARDOUS MAINTENANCE WORK

 CONTRACTOR SELECTION AND 

OVERSIGHT

 EMERGENCY RESPONSE AND RESCUE

001598
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

2

001599
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

3

Table of Contents 

1.0 EXECUTIVE SUMMARY ........................................................................................................... 10

1.1 Incident Synopsis ........................................................................................................................... 10

1.2 Scope of the Investigation .............................................................................................................. 10

1.3 Incident Description ....................................................................................................................... 11

1.4 Increasing Need for Penstock Recoating ....................................................................................... 12

1.5 Key Findings .................................................................................................................................. 12

1.6 Recommendations .......................................................................................................................... 17

1.7 Conduct of the Investigation .......................................................................................................... 18

2.0 XCEL ENERGY ............................................................................................................................ 21

2.1 Cabin Creek Hydroelectric Plant ................................................................................................... 21

2.1.1 Penstock ............................................................................................................................ 22

2.1.2 Deteriorated Penstock Interior Lining Requires Replacement.......................................... 24

3.0 CONTRACTORS .......................................................................................................................... 26

3.1 RPI Coating, Inc. ........................................................................................................................... 26

3.2 KTA-Tator, Inc. ............................................................................................................................. 26

4.0 INCIDENT DESCRIPTION .......................................................................................................... 27

4.1 Pre-Incident Events ........................................................................................................................ 27

4.1.1 Initial Evaluations of the Penstock Project Hazards ......................................................... 27

4.1.2 Contractor Selection ......................................................................................................... 28

4.1.3 Planning and Preparing for Penstock Recoating Project .................................................. 28

4.1.4 Work Preparation Prior to Recoating ................................................................................ 29

4.1.5 Removal of Old Epoxy Liner ............................................................................................ 31

4.1.6 Additional Evaluations and Inspections of the Penstock Work Space ............................. 32

4.1.7 Staging Equipment and Coating Materials ....................................................................... 33

4.1.8 Preparation for Coating Application ................................................................................. 38

4.1.9 Epoxy Coating Application Problems .............................................................................. 39

4.2 The Incident ................................................................................................................................... 41

4.3 Emergency Response ..................................................................................................................... 41

4.3.1 Fire Extinguishers ............................................................................................................. 41

4.3.2 Initial 9-1-1 Call ................................................................................................................ 42

4.3.3 Emergency Responders Arrive ......................................................................................... 43

001600
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

4

4.3.4 Call for Mutual Aid ........................................................................................................... 44

4.3.5 Attempted Entry by Early Rescuers .................................................................................. 44

4.3.6 Stranded Workers Still Communicating 45 Minutes into Incident ................................... 45

4.3.7 Emergency Responders Evaluate Further Entry into the Penstock ................................... 45

4.3.8 Emergency Responders Enter the Penstock ...................................................................... 45

5.0 INCIDENT ANALYSIS ................................................................................................................ 46

5.1 Pre-Incident Events ........................................................................................................................ 46

5.1.1 Insufficient Ventilation ..................................................................................................... 46

5.1.2 Improper Equipment Choices for Fire Prevention ............................................................ 47

5.1.3 Scheduling and Production Pressures ............................................................................... 52

5.2 Incident Events .............................................................................................................................. 54

5.2.1 Unsafe Sprayer Flushing Method Contributed to a Flammable Atmosphere ................... 54

5.2.2 Most Probable Ignition Source ......................................................................................... 54

5.2.3 Flash Fire Becomes Sustained Toxic Fire, Trapping Workers ......................................... 57

6.0 CONFINED SPACE ...................................................................................................................... 58

6.1 Penstock is a Permit-Required Confined Space ............................................................................. 58

6.1.1 Initial Evaluation of the Confined Space Indicated a Permit-Required Program was 

Necessary 59

6.1.2 The Known Work Activities in the Penstock Necessitated a Permit-Required Confined 

Space Program .................................................................................................................................... 60

6.1.3 Permit-Required Confined Space Inadequately Declassified ........................................... 61

6.2 Lack of Pre-Job Safety Planning for Hazards ................................................................................ 62

6.3 No Monitoring Plan Established .................................................................................................... 64

6.4 No Evaluation of Hazards When Conditions Changed .................................................................. 65

6.5 Safer Solvent Not Chosen .............................................................................................................. 66

6.5.1 The Hazards of MEK ........................................................................................................ 66

6.5.2 Safer Alternatives ............................................................................................................. 70

6.6 Xcel‘s and RPI‘s Confined Space Policies .................................................................................... 70

7.0 EMERGENCY RESPONSE AND RESCUE ................................................................................ 72

7.1 Lack of Preparation by Xcel and RPI to Ensure Availability of Qualified Rescue Personnel....... 73

7.2 Failure by Xcel and RPI to Arrange for Timely Rescue ................................................................ 74

7.2.1 Requirements and Recommendations for Alternate Escape Routes or Safety Chambers 76

001601
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

5

7.3 Lack of a Technical/Confined Space Rescue Certification Progarm for Volunteer Firefighters ... 78

8.0 CONTRACTOR SELECTION AND OVERSIGHT .................................................................... 80

8.1 Contractor Selection....................................................................................................................... 80

8.1.1 Contractor Selection Process for the Penstock Project Request for Proposal ................... 80

8.1.2 RPI Safety Record ―Not Acceptable,‖ but Allowed to Bid .............................................. 82

8.1.3 Contractor Selection and Safety: Historical Background ................................................. 83

8.1.4 Contractor Selection and Safety: Current Industry Guidelines ......................................... 84

8.1.5 Xcel Corporate Policies on Contractor Selection ............................................................. 86

8.2 Contractor Oversight ...................................................................................................................... 87

8.2.1 Safety Addendum Added to Contract ............................................................................... 87

8.2.2 Xcel Cabin Creek Site Contractor Oversight Activities and RPI Safety Performance ..... 88

8.2.3 Xcel Corporate Policies and Other Requirements Addressing Contractor Oversight ...... 90

9.0 EMPLOYEE SAFETY TRAINING .............................................................................................. 92

9.1 Company-Specific Safety Training ................................................................................................ 93

9.2 Training Center Safety Training .................................................................................................... 94

9.3 Generic Onsite Training Provided at Cabin Creek ........................................................................ 96

9.4 Safety Training Needs Specific to the Penstock ............................................................................ 98

9.4.1 Substituting Non-flammables for Flammable Solvents .................................................... 99

9.4.2 Safe Handling and Use of Flammables ............................................................................. 99

9.4.3 Flammable Atmospheres and Confined Space Entry ..................................................... 100

9.4.4 Fire Prevention and Mitigation ....................................................................................... 100

9.4.5 Proper and Safe Use of the Sprayer and Associated Equipment .................................... 101

10.0 REGULATORY AND INDUSTRY STANDARDS ANALYSIS .............................................. 103

10.1 Hazards of Confined Space Work in Potentially Flammable Atmospheres Inadequately Covered 

in Existing Standards ................................................................................................................................ 103

10.2 Other Regulations and Safety Guidelines Set Protective LEL Limits for Work in Potentially 

Flammable Atmospheres .......................................................................................................................... 106

10.3 Colorado Public Utilities Commission ........................................................................................ 108

11.0 FLAMMABLES USED IN CONFINED SPACES: OTHER INCIDENTS ............................... 111

12.0 ROOT AND CONTRIBUTING CAUSES .................................................................................. 113

12.1 Root Causes ................................................................................................................................. 113

12.2 Contributing Causes ..................................................................................................................... 114

001602
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

6

13.0 RECOMMENDATIONS ............................................................................................................. 116

REFERENCES ......................................................................................................................................... 125

APPENDIX A: INCIDENT TIMELINE .............................................................................................. 131

APPENDIX B: REGULATORY HISTORY OF RPI COATING, INC. ........................................... 136

APPENDIX C: INVENTORY OF FLAMMABLE AND COMBUSTIBLE MATERIAL IN 

PENSTOCK............................................................................................................................................. 146

APPENDIX D: EVALUATION OF IGNITION SOURCES .............................................................. 147

D.1 Static Ignition of Explosive MEK Vapor-Air Mixture inside Sprayer Base Hopper ................... 147

D.2 Stray Current Ignition of Explosive MEK Vapor-Air Mixture inside the Sprayer Base Hopper 153

D.3 Ignition of Explosive MEK Vapor-Air Mixture by Halogen Lights atop the Sprayer ................ 155

D.3.1 Ignition Caused by Halogen Lamps ................................................................................ 157

D.4 Hot Surface Ignition by the Sprayer Heater(s) ............................................................................. 161

D.5. Compression Ignition inside One of the Sprayer Piston Pumps .................................................. 161

D.6 Electrical Spark from Heater Control Box ................................................................................... 161

APPENDIX E: MEK FLAMMABILITY PROPERTIES AT PENSTOCK CONDITIONS .......... 162

APPENDIX F: LOWEST MINIMUM IGNITION ENERGY AT PENSTOCK CONDITIONS ... 166

APPENDIX G: WORK ACTIVITIES ALLOWED IN POTENTIALLY EXPLOSIVE 

ATMOSPHERES .................................................................................................................................... 168

APPENDIX H: APPLICABLE OSHA CONFINED SPACE STANDARDS .................................... 175

H.1 OSHA General Industry Standards (29 CFR 1910) ..................................................................... 175

H.2 Electrical Power Generation (29 CFR 1910.269) ........................................................................ 175

H.3 Permit-Required Confined Spaces (29 CFR 1910.146) ............................................................... 176

APPENDIX I: CSB CONFINED SPACE INCIDENTS DATA INCLUSION CRITERION AND 

LIMITATIONS ....................................................................................................................................... 177

APPENDIX J: SIMILAR RECENT CONFINED SPACE INCIDENTS INVOLVING 

FLAMMABLES INVESTIGATED BY THE CSB .............................................................................. 179

13.1.1 ConAgra Foods Processing Plant Explosion .................................................................. 179

13.1.2 TEPPCO Terminal Explosion ......................................................................................... 179

001603
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

7

 Figures 

Figure 1. Location of hydroelectric plant, reservoirs, and penstock pathway ............................................ 22

Figure 2. Penstock configuration ................................................................................................................ 23

Figure 3. Upper reservoir mushroom access hatch ..................................................................................... 24

Figure 4. Access door cut into penstock for recoating work ....................................................................... 30

Figure 5. The epoxy sprayer system used within the penstock ................................................................... 34

Figure 6. The solvent pump on the back side of the epoxy sprayer ............................................................ 35

Figure 7. Aerial view of equipment arrangement in work area of the penstock ......................................... 36

Figure 8. Depiction of contractors working with the sprayer immediately prior to the flash fire .............. 37

Figure 9. Depiction of contractors recoating the penstock interior near the temporary west bulkhead ...... 38

Figure 10. Remains of the halogen light sitting atop the sprayer inside the penstock (left); the same 

remains being compared to an exemplar halogen light (right). .......................................................... 50

Figure 11. The winding, steep and narrow road from Georgetown to the Xcel hydroelectric plant ........... 76

001604
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

8

Acronyms and Abbreviations 

AIHA American Industrial Hygiene Association 

ANSI American National Standards Institute 

API American Petroleum Institute 

APPA American Public Power Association 

ASTM American Society for Testing and Materials 

ATSDR Agency for Toxic Substances and Disease Registry 

ATV all-terrain vehicle 

BLS Bureau of Labor Statistics 

CBI Colorado Bureau of Investigation 

CCC Certified Coatings Company 

CCFA Clear Creek County Fire Authority 

CDFS Colorado Division of Fire Safety 

CFOI Census of Fatal Occupational Injuries 

CSB U.S. Chemical Safety and Hazard Investigation Board 

CURT Construction Users Roundtable 

EMR experience modification rate 

EPA Enviornmental Protection Agency 

EPRI Electric Power Research Institute 

ESD Emergency Services District 

FACE Fatality Assessment and Control Evaluation 

FERC Federal Energy Regulatory Commission 

FSA Formal Settlement Agreement 

HSEES Hazardous Substances Emergency Events Surveillance 

IChemE Institution of Chemical Engineers 

IDLH Immediately Dangerous to Life and Health 

IIPP Injury and Illness Prevention Program 

IMIS Integrated Management Information System 

LEL Lower Explosivity Limit 

LFL Lower Flammability Limit 

MEK methyl ethyl ketone 

MSDS Material Safety Data Sheet 

MW megawatt 

001605
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

9

NACE National Association of Corrosion Engineers 

NFPA National Fire Protection Association 

NIOSH National Institute of Occupational Safety and Health 

OIICS Occupational Injury and Illness Classification 

OSHA Occupational Safety and Health Administration 

PHA Process Hazard Analysis 

PPE Personal Protective Equipment 

ppm parts per million 

PSCo Public Service Company of Colorado 

psig pounds per square inch gauge 

PSCo Public Service Company of Colorado 

PSM Process Safety Management 

PUC Colorado Public Utilities Commission 

QP 1 Qualification Procedure No. 1 

RFP Request for Proposal 

SCBA Self Contained Breathing Apparatus 

SCPDI Southern California Painting and Drywall Industries 

SSPC Society of Protective Coatings (formally Steel Structures Painting Council) 

TRB Transportation Research Board of the National Academies 

001606
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

10 

1.0 Executive Summary 

1.1 Incident Synopsis 

On October 2, 2007, a chemical fire inside a permit-required confined space1at Xcel Energy‘s 

hydroelectric plant in a remote mountain location 45 miles (72 kilometers) west of Denver, Colorado, 

killed five and injured three workers. Industrial painting contractors were in the initial stages of recoating 

the 1,530-foot (466-meter) steel portion of a 4,300-foot (1,311-meter) enclosed penstock2tunnel with an 

epoxy coating product when a flash fire occurred. Flammable solvent being used to clean the epoxy 

application equipment in the open penstock atmosphere ignited, likely from a static spark. The initial fire 

quickly grew as it ignited additional buckets of solvent and substantial amounts of combustible epoxy 

material, trapping and preventing five of the 11 workers from exiting the single point of egress within the 

penstock. Fourteen community emergency response teams responded to the incident. The five trapped 

workers communicated using handheld radios with co-workers and emergency responders for 

approximately 45 minutes before succumbing to smoke inhalation. 

1.2 Scope of the Investigation 

Catastrophic workplace accidents typically are not the result of a single error or one piece of faulty 

equipment; rather, higher-level safety system deficiencies are often found at facilities where such 

accidents occur. It has also been established that accident prevention is most effective when these 

 

1

 The US Occupational Safety and Health Administration (OSHA) defines, in its general industry rule, a confined 

space as having three attributes: (1) large enough to enter and perform work; (2) limited access and egress; and (3) 

not designed for continuous occupancy. OSHA states that a permit-required confined space has one or more of the 

following characteristics: ―(1) contains or has the potential to contain a hazardous atmosphere; (2) contains 

material that has the potential for engulfing an entrant; (3) has an internal configuration such that an entrant could 

be trapped or asphyxiated by inwardly converging walls or by a floor that slopes downward and tapers to a smaller 

cross section; or (4) contains any other recognized serious safety or health hazard. OSHA has identified one type 

of hazardous atmosphere as  ̳[f]lammable gas, vapor or mist in excess of 10% of its lower flammable limit (LFL)‘ 

[29 CFR 1910.146(b)]. 

2

 A penstock in hydroelectric service is typically an enclosed conduit such as a tunnel or pipe that delivers a flow of 

water to a turbine that generates electric power 

001607
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

11 

systemic causes are understood and learned.3 As such, the U.S. Chemical Safety Board (CSB) examined 

both the technical and organizational causes of the fire at Xcel Energy‘s Cabin Creek penstock. 

The investigation found that a number of safety issues contributed to the accident, including a lack of 

planning for hazardous work, inadequate contractor selection and oversight, and insufficient regulatory 

standards pertaining to the use of flammables within confined spaces. The investigation also examined the 

technical aspects of recoating a penstock, the work conditions of the unique confined space, and the 

training the contractors received prior to starting work. Finally, the CSB evaluated aspects of emergency 

response, including planning for timely and qualified rescue and the need for certified confined space 

rescue responders in the state of Colorado. 

1.3 Incident Description 

On October 2, 2007, a work crew of industrial painters employed by RPI Coating, Inc. (RPI) began 

applying a new epoxy coating to the steel interior section of the penstock4

at the Cabin Creek 

hydroelectric plant operated by Xcel Energy, Inc. (Xcel), located south of Georgetown, Colorado. 

Shortly after the epoxy application commenced, the work crew experienced problems with the spraying 

process, resulting in poor coating quality. Spraying was terminated and the crew began cleaning the 

sprayer system equipment with a flammable solvent, methyl ethyl ketone (MEK),5to remove epoxy 

residue before taking the equipment out of the penstock. During this cleaning operation, MEK vapors 

 

3

 The Center for Chemical Process Safety (CCPS) states that identifying the underlying or root causes of an incident 

has a greater preventative impact by addressing safety system deficiencies and averting the occurrence of 

numerous other similar incidents, while addressing the immediate cause only prevents the identical accident from 

recurring (1992). 

4

 The Cabin Creek penstock is a tunnel with a diameter that varies between 12 and 14 feet that runs between two 

reservoirs; water flows from the upper reservoir to the lower reservoir through the penstock, passing over turbines 

which produce electricity (see Section 2.1.1.1). 

5

 Methyl ethyl ketone (MEK) is an organic chemical compound often used as a solvent in painting activities listed 

by the National Institute for Safety and Health (NIOSH) as ―highly flammable.‖ NIOSH MEK International 

Chemical Safety Cards, 1998. MEK is a Class IB flammable liquid, with a flash point below 73°F (23°C) and 

boiling point at or above 100°F (38°C). NIOSH Pocket Guide to Chemical Hazards, 2005

001608
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

12 

inside one of the two epoxy hoppers ignited and flashed. The resulting fire grew quickly, consuming 

several other open containers of MEK and numerous buckets of epoxy material positioned around the 

sprayer. 

Four RPI crew members positioned on the side of the fire nearest the exit evacuated the penstock, 

although three were later treated for injuries: one received minor burns, one fractured his arm, and another 

suffered breathing difficulties. Five additional crew members trapped opposite the exit were unable to 

evacuate due to the fire and narrow configuration of the penstock. The five workers later succumbed to 

smoke inhalation inside the penstock and died. 

1.4 Increasing Need for Penstock Recoating 

Many hydroelectric plants have steel penstocks that have not been relined or recoated for many years. In 

North America, estimates suggest that 3 million feet (1 million meters) of in-service penstocks exist. 

Interior coatings and linings are required to maintain the structural integrity and serviceability of 

penstocks to prevent corrosion and provide water tightness. When periodic internal inspections uncover 

linings that have deteriorated to the extent that rehabilitation is no longer possible, repair projects are 

initiated to remove the old penstock linings and replace them with newer epoxy coatings that typically 

have a 20- to 30-year service life (EPRI, 2000, ch. 1-3). Removing the old linings and applying new 

interior coatings in penstocks present special hazards to workers, including potential flammable and/or 

toxic atmospheres and limited access and egress within these confined spaces. 

Because of the serious nature of this incident and the unique hazards associated with penstock coating 

work, the CSB launched an investigation to determine root and contributing causes and to make 

recommendations to help prevent similar incidents. 

1.5 Key Findings 

1. On the day of the incident, approximately 16 gallons (61 liters) of highly flammable methyl ethyl 

ketone (MEK) solvent stored in plastic buckets was used in the penstock to clean the epoxy 

001609
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

13 

sprayer and associated equipment. The cleaning involved pouring MEK into the sprayer‘s two 

hoppers and circulating it through the sprayer in the open penstock atmosphere. A number of 

ignition sources present or created by the work activity were not eliminated or controlled. The 

circulation of MEK through non-conductive hose likely led to static discharge, igniting the MEK 

in the sprayer hopper and resulting in a flash fire. 

2. Xcel and RPI managers were aware of the plan to operate the epoxy sprayer inside the penstock 

and the need to use solvent to clean the sprayer and associated equipment in the open penstock 

atmosphere during the epoxy application portion of the project. However, they did not perform a 

hazard evaluation of the epoxy recoating work; as a result, they failed to identify serious safety 

hazards involving use of flammable liquids within the confined space. Effective controls were not 

evaluated or implemented during their pre-job safety planning, such as substituting MEK with a 

non-flammable solvent. 

3. During the recoating project, neither Xcel nor RPI treated the Cabin Creek penstock as a permitrequired confined space, nor did they re-evaluate hazards in the space caused by changing work 

activities. Such activities included the introduction of flammables into the penstock, hot work 

within the confined space, and the switch from abrasive blasting to recoating of the penstock 

interior. 

4. Neither Xcel‘s nor RPI‘s corporate confined space programs adequately addressed the special 

precautions necessary to safely manage the hazard of potential flammable atmospheres. Their 

policies and procedures did not address the need for a confined space monitoring plan or the need 

for continuous monitoring in the work area where flammables were being used. Neither of their 

permit-required confined space policies or permit forms required or established a maximum 

001610
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

14 

permissible percentage of the lower explosive limit (LEL)6for safe entry and occupancy inside a 

permit space. 

5. On the day of the incident, RPI monitored the atmosphere of the penstock, a permit-required 

confined space, for flammable atmospheres only at is entrance, 1,450 feet (442 meters) from the 

work activities, rather than where flammables were being used. 

6. The majority of RPI employees working at Cabin Creek had not received comprehensive formal 

safety training; effective training on company policies; or site-specific instruction addressing 

confined space safety, the safe handling of flammable liquids, the hazard of static discharge, 

emergency response and rescue, and fire prevention. The Joint Apprenticeship Training 

Committee and Center, established by the parties to the Painters and Allied Trades District 

Council 36 Master Labor Agreement (including RPI), provide comprehensive safety training on 

these topics as part of its apprenticeship program, but most of the painters hired by RPI had not 

taken these courses nor had they otherwise received documented equivalent safety training. 

7. The U.S. Occupational Safety and Health Administration‘s (OSHA) Permit-Required Confined 

Spaces Rule for general industry establishes no maximum permissible percentage of the LEL for 

safe entry and occupancy inside a permit space. OSHA has interpreted its rule to allow working 

in a permit-required space where the atmosphere is above 10 percent of the LEL.7 However, the 

rule defines a flammable concentration above 10 percent of the LEL as a hazardous atmosphere 

―that may expose employees to the risk of death, incapacitation, impairment of ability to self-

 

6

 LEL is defined as ―that concentration of combustible material in air below which ignition will not occur‖ in 

Recommended Practice for Handling Releases of Flammable and Combustible Liquids and Gases, NFPA 329 

(2005). The terms LEL and lower flammability limit (LFL) have different definitions but are commonly used 

interchangeably. This report uses LEL except where citing other sources that use LFL in their standard or 

regulation. The OSHA Permit-Required Confined Space Standard 29 CFR 1910.146 uses the term LFL in its 

provisions. 

7 Letter to Macon Jones, Blasting Cleaning Products LTD, from John B. Miles Jr., Director, dated September 4, 

1996, concerning entry into a confined space when the LFL is greater than 10 percent. 

001611
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

15 

rescue...injury, or acute illness‖ [29CFR 1910.146(b)]. Other OSHA regulations addressing 

confined and enclosed spaces in the maritime industry and other sectors prohibit entry and work 

activities above a specific percentage of the LEL (such as 10 percent). The recent trend of 

consensus safety guidance and regulatory requirements from other jurisdictions has been to 

establish safe work limits for confined space flammable atmospheres substantially below the 

LEL.

8. The CSB identified identified 53 serious flammable atmosphere confined space incidents 

involving fires and explosions from 1993 to April 2010; 57 percent involved a fatality. These 

incidents caused 54 injuries and 45 fatalities, a majority of which occurred since 2003. These 

flammable atmosphere incidents include two the CSB investigated in 2009 where confined space 

explosions resulted in four fatalities. 

9. The penstock had only one egress point. Published safety guidance for penstocks discusses the 

importance of alternative escape routes in the event of an emergency (ASCE, 1998, pp. 2-8). Xcel 

Energy had identified the sole egress point as a major concern in the penstock planning as had 

RPI personnel; however, no remedial action was taken. When the flash fire occurred, five RPI 

workers who were on the side of the sprayer opposite the exit became trapped by the growing fire 

and restricted egress. 

10. The planned use of flammable solvent in the open atmosphere inside the penstock created the 

potential for an immediately dangerous to life or health (IDLH)8

flammable atmosphere. Xcel‘s

and RPI‘s emergency response plan for rescue services for the penstock reline project was to call 

 

8

 IDLH, or Immediately Dangerous to Life or Health, is a personal exposure limit for a chemical substance set forth 

by the National Institute of Occupational Safety and Health (NIOSH); it is typically expressed in parts per million 

(ppm). OSHA‘s Permit-Required Confined Spaces rule for general industry states that IDLH ―means any condition 

that poses an immediate or delayed threat to life or that would cause irreversible adverse health effects or that 

would interfere with an individuals ability to escape unaided from a permit space‖ [29 CFR 1910.146(b)]. 

001612
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

16 

9-1-1 emergency dispatch. No emergency responders with confined space technical rescue 

certification were at the hydroelectric plant and immediately available for rescue on the day of the 

incident, and the approximate response time of the closest identified certified community rescue 

service was approximately 1 hour and 15 minutes. The trapped workers died from smoke 

inhalation approximately 1 hour before this response service arrived on site. 

11. While the Colorado Division of Fire Safety (CDFS) does not track technical rescue certification 

in the state, available evidence indicates a limited number of Colorado emergency response 

organizations with personnel certified individually by an accredited program in technical rescue. 

The CDFS has a voluntary accredited certification program for firefighters and hazardous 

materials responders but does not offer certification for technical rescue, including confined space 

rescue. 

12. Xcel‘s prequalification process9for determining which potential contractors were allowed to 

participate in the Cabin Creek bid process considered only the contractors‘ financial capacity and 

did not disqualify bidders based on unacceptable past safety performance. 

13. Once prequalified, Xcel reviewed and ranked the contractors‘ proposals, considering factors such 

as past performance, quality, and safety records in addition to price. RPI received the lowest 

score, ―zero,‖ in the safety category, which, according to Xcel‘s evaluation form, meant that the 

proposal should have been automatically rejected. However, RPI was still allowed to compete for 

the contract. While another contractor‘s proposal was judged the best from a technical and quality 

perspective, RPI‘s proposal received the highest ranking in the evaluation process, based 

primarily on low price. 

 

9

 When contractors are selected, an initial prequalification process is often used during which each potential 

contractor must meet basic qualifications. In this case, Xcel‘s prequalification process considered only the 

financial capacity of the potential contractor. 

001613
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

17 

14. Due to concerns about RPI‘s record of injuries and fatalities in past projects, Xcel added a safety 

addendum to the penstock recoating contract affirming that Xcel would ―closely observe‖ RPI‘s 

safety performance during the recoating project. During the initial penstock project activities 

prior to the incident, Xcel managers became aware of several significant safety problems 

attributable to RPI, including a recordable injury where an RPI worker was sent to the hospital; 

the evacuation of the penstock due to high readings of carbon monoxide, a toxic gas; and 

electrical problems that resulted in the destruction of penstock equipment. These problems did not 

result in Xcel increasing its scrutiny of RPI‘s safety performance or taking corrective action. 

15. Prior to the incident, Xcel corporate officials had not conducted safety audits examining company 

adherence to its corporate policies on contractor selection and oversight at each of its powergenerating facilities. 

1.6 Recommendations 

As a result of this investigation, the CSB makes recommendations to the following recipients: 

U.S. Occupational Safety and Health Administration (OSHA) 

Governor of Colorado 

Colorado Public Utilities Commission 

Director of the Colorado Division of Fire Safety 

Director of the Colorado Division of Emergency Management 

Xcel Energy 

RPI Coating 

American Public Power Association 

Society for Protective Coatings 

001614
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

18 

Southern California Painting and Drywall Industries Joint Apprenticeship and Training 

Committee 

Section 13.0 of this report provides the detailed recommendations. 

1.7 Conduct of the Investigation 

The CSB investigation team arrived at the incident scene on October 3, 2007, the day after the incident. 

They joined the Incident Command structure and began on-scene investigation activities. That same day, 

Incident Command demobilized, and emergency responders disbanded after the five deceased RPI crew 

members were removed from the penstock. Investigative teams from the Colorado Bureau of 

Investigation (CBI), OSHA, and the CSB remained onsite and worked with Xcel management to protect 

and preserve evidence at the Cabin Creek site within the penstock, as well as those areas of the Cabin 

Creek site relevant to the case, including the upper reservoir. 

After careful and extensive pre-entry safety planning with all involved parties, the CSB entered the 

penstock on two separate occasions (November 6 and 11, 2007) to examine the incident scene, and was 

present onsite when evidence was removed from the penstock on December 19, 2007. Investigators 

video-and photo-documented evidence, took numerous size and distance measurements, and physically 

examined all items within the penstock. Through joint agreements with all involved parties, the 

equipment and associated evidence within the penstock were removed to a secure site; the evidence was 

more thoroughly examined on two separate occasions: December 12, 2007, and January 7, 2009. 

The team conducted more than 54 interviews throughout the course of its investigation, collecting the 

testimony of employees from the various companies involved in the penstock project, emergency 

responders, officials from the sprayer system manufacturer, supervisors from other contractors involved 

in penstock recoating work, Colorado state officials, and union training center representatives. The CSB 

examined a variety of company documents, including those pertaining to contractor selection and 

management, safety policies and practices, and employee training, as well as the contractual agreements 

001615
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

19 

between Xcel and the various contractors involved in the penstock project. Samples of material taken 

from burned buckets and the sprayer hoppers were also tested in a laboratory for identification and 

composition analysis. This investigative work activity was coordinated with OSHA, the CBI, and the 

various companies involved in the penstock coating project. 

The CSB encountered a number of obstacles and lack of cooperation in regard to the involved parties of

the investigation, including Xcel and RPI. Xcel failed to fully respond to a number of CSB requests for 

both records and interrogatories. The CSB required the assistance of the U.S. Attorney‘s Office for the 

District of Colorado, Civil Division, to attempt to obtain information relevant to its investigation from 

Xcel. RPI did not respond to numerous interrogatory requests and a number of RPI managers asserted 

their constitutional right against self incrimination. 

Near the end of the CSB‘s investigation in the spring of 2010, Xcel and RPI who faced criminal charges 

arising from the Cabin Creek fatalities took the unprecedented step of going to federal court to block the 

publication of the CSB report.10 Ultimately, the presiding judge squarely rejected Xcel‘s effort to prohibit 

publication of the CSB‘s findings and recommendations: 

Based on the evidence presented at the June 24, 2010 hearing, the arguments, and the applicable 

law, I find Defendants‘ arguments to be without merit. Moreover, the Defendants cite no 

authority in support of their request that I bar the issuance of the CSB‘s final Cabin Creek report. 

First, I find the CSB acted as an independent federal agency in conducting its investigation and 

drafting its report as required by 42 U.S.C. §7412(r)(6)(A)-(S). There is no evidence whatsoever 

that the CSB acted in concert with the prosecution in investigating this accident or intentionally 

delayed the issuance of its report.11

While CSB‘s position was supported by a federal district judge, Xcel and RPI‘s legal action delayed 

completion of the CSB report for several months, and diverted CSB resources from other ongoing 

 

10 United States v. Xcel Energy, Inc., et al., No. 09-cr-00389-WYD (District of Colorado).

11 Id. Order of June 30, 2010 (docket #178).

001616
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

20 

investigations. Despite the clear findings to the contrary in the judge‘s ruling, Xcel representatives 

continued to make unsupported claims that the CSB had delayed release of its report to prejudice Xcel in 

the federal criminal prosecution in which the company is a defendant. 

Finally, in early August 2010, an Xcel attorney provided an incomplete draft of the CSB report to the 

media on the eve of the Board‘s completion of its work. This last Xcel effort caused yet further delays in 

the process, and has created a risk that Xcel‘s Directors and shareholders will draw incorrect conclusions 

about the accident at Cabin Creek. Accordingly, the Board included in this report a formal 

recommendation that Xcel shareholders be directly notified by management of the significant findings 

and recommendations of this report, and of the actions Xcel management intends to take to implement 

needed safety improvements. 

001617
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

21 

2.0 Xcel Energy 

Xcel Energy (Xcel) is a Minneapolis, Minnesota-based holding company founded in 1909 with four 

wholly owned regulated utility subsidiaries that serve electric and natural gas customers in eight western 

and Midwestern states: Colorado, Michigan, Minnesota, New Mexico, North Dakota, South Dakota, 

Texas, and Wisconsin. The company employs nearly 12,000; serves 3.3 million electricity and 1.8 million 

natural gas customers; and exceeds $9 billion in revenues annually (2008). 

2.1 Cabin Creek Hydroelectric Plant 

The Public Service Company of Colorado12 (PSCo) Cabin Creek hydroelectric plant, which began 

operating in 1967, is located off Guanella Pass, a partially paved road that winds through a remote area in 

the Rocky Mountains [10,018-foot (3053 meters) elevation] approximately 6 miles (10 kilometers) south 

of the Georgetown, Colorado and 45 miles (72 kilometers) west of Denver. PSCo is a subsidiary of Xcel; 

this report will refer to PSCo and Xcel Energy collectively as Xcel. 

Cabin Creek is a pumped storage plant, with upper and lower water reservoirs totaling 1,977 acre-feet 

(2439 megaliters), used to generate electricity primarily during peak demand periods. Electricity is 

generated by releasing water from the upper reservoir where it flows into an intake structure, which is 

connected to a penstock; the water passes through turbines before being deposited in the lower reservoir 

(Figure 1). The flowing water rotates the turbines, which turn shafts that power the generators, producing 

electricity. When electricity use is low, the water is pumped back into the upper reservoir through the 

penstock to be used again. The plant has two generators capable of producing 150 megawatts (MW) of 

electricity for 4 hours. 

 

12 The Public Service Company of Colorado, a Denver-based company founded in 1869, is a regulated utility 

company in Colorado that operates seven coal, six hydroelectric, and two natural gas plants, and one wind turbine 

field, to provide electricity and natural gas utility services to 1.3 million customers located in Denver, other 

Colorado cities, and some rural areas. 

001618
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

22 

Figure 1. Location of hydroelectric plant, reservoirs, and penstock pathway 

2.1.1 Penstock 

The penstock is 4,163 feet (1,269 meters) long from the upper reservoir‘s intake to the point at which the 

penstock splits into two pipes to feed the turbines in the powerhouse. Of this space, 3,123 feet (952 

meters) can be traveled by foot. RPI was hired by Xcel to recoat roughly one-half of this relatively 

horizontal space (1,560 feet, or 475 meters, at a 2 degree incline). This section of the penstock is 12 feet 

(3.7 meters) in diameter, welded and steel-lined. The remaining portions of the penstock going up into the 

mountain vary in length and degree of gradient, with the 55 degree section too steep to traverse (Figure 

2). The last 1,040 feet (317 meters) of the penstock requires climbing aids, ropes, or ladder structures to 

be traversed. 

001619
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

23 

Figure 2. Penstock configuration 

At the highest elevation point of the penstock in the upper reservoir is the intake structure known as the 

―mushroom.‖ The mushroom is a 40-foot (12 meter) tall, cylindrical concrete and steel tower with 

screened openings near the top that open to the penstock. The mushroom has an access hatch 

approximately 20 feet (6.1 meters) above grade at a reverse incline position that requires climbing skill 

and significant physical strength to enter (Figure 3). 

001620
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

24 

Figure 3. Upper reservoir mushroom access hatch 

While the penstock runs underground for most of its length, as it exits the mountain rock face near the 

lower reservoir, a 15-foot (4.6 meter) section is accessible from the powerhouse yard. In this portion of 

the penstock, a 4 by 6 foot (1.2 by 1.8 meter) opening was flame-cut into the steel penstock pipe to 

provide access for the recoating project workers and equipment. 

2.1.2 Deteriorated Penstock Interior Lining Requires Replacement 

During the fall 2000 plant outage,13 a Federal Energy Regulatory Commission14 (FERC)-mandated 

internal inspection of the penstock found numerous indications of deterioration of the epoxy coating 

(flaking, blistering, and checking) in the interior of the steel-lined pipe section, which resulted in areas of 

 

13 An outage is a period when a plant, such as this one, is not in normal operation because of maintenance work 

and/or inspections. 

14 FERC is a self-funded, independent regulatory agency within the U.S. Department of Energy with jurisdiction 

over electricity sales, wholesale electric rates, hydroelectric licensing, natural gas pricing, and oil pipeline rates. 

FERC also reviews and authorizes liquefied natural gas (LNG) terminals, interstate natural gas pipelines, and 

approximately 1,600 non-federal hydropower projects in the U.S. 

001621
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

25 

rusting and pitting corrosion to the steel pipe. Although the structural integrity of the pipe had not been 

compromised, the inspection report recommended repairs to the coating before more damage resulted. 

After obtaining an extension for repairs from FERC for several years, a project to remove the lining and 

replace it with a new epoxy lining was scheduled for the fall 2007 outage. 

001622
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

26 

3.0 Contractors 

3.1 RPI Coating, Inc. 

Xcel selected RPI Coating, Inc. (RPI), a commercial painting and coating company headquartered in 

Santa Fe Springs, California, to remove the old liner from the steel portions of the Cabin Creek penstock 

and apply the new epoxy (for additional information on the selection process, see Sections 4.1.2 and 8.0). 

RPI, which operated as Robison-Prezioso, Inc. until 2007, was ranked the nation's seventh-largest 

specialty paint company based on revenues in 2005, according to the Engineering News-Record (2005). 

At the time of the incident, RPI had approximately 275 employees and more than 13.5 million in annual 

sales. 

Prior to this incident, when RPI was still Robison-Prezioso, federal and state OSHA had inspected the 

company 46 times since 1972. Of these inspections, 31 had been initiated due to a complaint, referral, or 

accident; 90 violations were issued with fines totaling $135,569. Some violations were issued after 

accidents that had resulted in serious injuries and/or fatalities to employees (Appendix B). 

3.2 KTA-Tator, Inc. 

Xcel hired KTA-Tator, Inc. (KTA), a 250-employee consulting/engineering firm, for several work tasks 

associated with the penstock project. These tasks included writing the technical specifications for the 

application of the new epoxy coating in the penstock, assisting in the selection of the coatings contractor 

by reviewing and evaluating submitted bids, helping resolve technical issues arising from application of 

the coating, and performing periodic quality control checks to ensure proper old coating removal and new 

coating application.15

 

15 The first three tasks were completed by a KTA chemical engineer specializing in coatings applications in the 

water and power industries; the fourth was performed by a KTA coatings inspector certified by the National 

Association of Corrosion Engineers (NACE). 

001623
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

27 

4.0 Incident Description 

The penstock fire occurred on October 2, 2007, but the recoating project had been initiated months 

earlier. 

4.1 Pre-Incident Events 

4.1.1 Initial Evaluations of the Penstock Project Hazards 

Almost a year before the October 2, 2007, incident, Xcel conducted a hazard assessment of the penstock 

project, which was later provided to potential contractors during the bidding process. However, this 

―Safety and Health Hazard Assessment Survey‖ focused only on the abrasive blasting portion of the 

recoat project work and did not examine the risks of epoxy recoating associated with the penstock, the use 

of flammables inside the confined space, or the limited access and egress of the penstock. This was the 

only hazard assessment Xcel conducted for the entire penstock recoating project. 

Later in the penstock project development process, during the spring of 2007, a civil engineer employed 

by Xcel highlighted a number of difficulties specific to the unique and challenging penstock work that 

would affect the success of the project in his document, ―Cabin Creek Penstock Major Items of Concern.‖ 

Within the document, the civil engineer identified the need for an additional point of access, as the 

penstock‘s single entryway – a 20-inch (51 centimeters) man hole – was the only existing penstock 

opening at the start of the project. The civil engineer also discussed the challenges of trying to achieve the 

necessary temperature conditions within the penstock for successful epoxy application and the significant 

difficulties of completing the project in the 10 weeks allotted, suggesting that the harsh weather 

conditions typical of October and November in the Colorado mountains would hinder timely completion. 

These concerns were given to the Xcel Cabin Creek principal engineer, who later became responsible for 

preparing for the project with RPI, and a number of other Xcel employees, prior to the start of the 

recoating work. Yet neither Xcel‘s submission to the potential bidders for the recoat project, nor RPI‘s bid 

response, discussed methods for minimizing or rectifying the concerns raised by the civil engineer. 

001624
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

28 

4.1.2 Contractor Selection 

Xcel issued a Request for Proposal (RFP) for a competitive bidding process to several contractors in July 

2007. The contractor selected to perform the work was to be chosen based upon the ―best value/best 

overall evaluated offer,‖ which was supposed to consider factors such as schedule, price, qualifications, 

and safety performance (TRB, 2006, p.S-3). The Xcel process also included an initial prequalification 

step that examined the contractors‘ financial capacity to carry out the work but did not consider safety 

performance. 

Due to key safety criteria deficits in RPI‘s safety record, Xcel rated the company as ―zero‖ in that 

category, which should have meant its automatic disqualification from the bidding process; however. 

RPI‘s bid was not rejected, and it was eventually awarded the contract despite its poor safety record 

(Section 8.0). 

4.1.3 Planning and Preparing for Penstock Recoating Project 

While RPI employees prepped the job site, Xcel held a preconstruction meeting for the penstock recoating 

project on September 5, 2007, attended by an RPI vice president, the RPI Safety and Quality Control 

representative, and two RPI project foremen. During this meeting, the Xcel project manager indicated that 

this was a ―high profile project with [the] attention of FERC‖ and that a high standard toward quality 

control needed to be maintained. On September 10, at the request of RPI‘s safety director, an instructor 

with the Southern California Painting and Drywall Industries (SCPDI) District 36 Training Center 

conducted a six-hour safety refresher training session at the Xcel Cabin Creek site for some RPI industrial 

painters to address gaps that the Xcel safety director had identified in RPI‘s contract bid submissions. 

Only nine of the 14 RPI crew members were on site to attend this general safety training, and no make-up 

session was offered to those not in attendance (Section 9.0). 

001625
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

29 

4.1.4 Work Preparation Prior to Recoating 

Before the old liner could be removed from the steel sections and the new epoxy applied, the plant was 

shut down and water drained from the penstock. This occurred during the first week of September 2007, 

as a number of RPI personnel began arriving at the Cabin Creek site to set up for the job. 

After the water was drained from the penstock, a 4-foot wide by 6-foot (1.2 by 1.8 meters) tall access 

opening was flame-cut16 into the side of the steel penstock pipe for personnel and equipment access. 

Wooden stairs and a ladder at the access door provided means for personnel to enter and exit the penstock 

(Figure 4). 

Xcel and RPI personnel then entered the penstock to remove standing water, dead fish, mud, and debris. 

Eyewitnesses reported that the penstock was extremely slippery due to moss buildup, and that personnel 

often slipped during initial entries. One RPI employee dislocated his shoulder when he slipped and fell. 

 

16 The access opening was cut by a specialty welding contractor. 

001626
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

30 

Figure 4. Access door cut into penstock for recoating work 

To contain the sandblasting debris and control ventilation, RPI built a wooden bulkhead west of the 

penstock area to be recoated (―west bulkhead‖), with a 2 by 2 foot (0.7 by 0.7 meter) access hatch near 

the bottom, and sealed it against the walls of the penstock with foam. RPI built a second sealed wooden 

bulkhead about 20 feet east of the penstock‘s access door (―east bulkhead‖). Two 20-inch (51 

centimeters) diameter flexible ventilation ducts, connected to dehumidification, heating, and dust 

collection equipment located outside the penstock, were brought into the penstock to dry and dehumidify 

the air and collect dust. The air supply duct was routed along the penstock wall and terminated near the 

west bulkhead at the steel/concrete transition where the air was discharged; the air return duct terminated 

near the penstock access door. 

Compressed air and 120/240-volt electrical service were brought into the penstock to power equipment 

and provide lighting. Power cables for the electrical service were connected to a portable transformer 

001627
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

31 

located outside the penstock. A 240-volt heavy gauge power cable (6 AWG17) ran along the penstock 

floor from the access door and terminated at power distribution centers (commonly called ―spider 

boxes‖), one of which was located about 100 feet (30.5 meters) from the west bulkhead to provide power 

to the work area; this cable had non-watertight twist lock connector fittings joining sections of cable. The 

spider box contained 240- and 120-volt GFCI-protected electrical power supply outlets. On the day of the 

incident, the electric heaters on the sprayer, halogen work lights positioned on top of the sprayer, and 

explosion-proof lighting mounted on a scaffold immediately adjacent to the bulkhead were plugged into 

this spider box. 

On September 16, 2007, another contractor performing inspection work inside the penstock complained 

to Xcel about being delayed entry into the penstock for 2 hours due to high carbon monoxide (CO) levels; 

he also noted a problem with RPI‘s electrical service inside the penstock when some of the contractor‘s 

testing equipment was damaged after it was plugged into an RPI spider box. An RPI foreman later 

rewired this electrical box, which was located near the sprayer on the day of the incident. 

4.1.5 Removal of Old Epoxy Liner

Beginning on September 20, 2007, RPI sandblasted and removed the old liner from the the steel section 

immediately east of the west bulkhead; sandblasting continued until September 28, when the first 500-

foot section was completed. On September 22, the Xcel project manager for the penstock recoating work 

observed RPI conducting abrasive blasting inside the penstock, noting that ―[w]ork conditions inside the 

penstock are highly hazardous on many levels. In the best of conditions, the coating removal is dirty, 

nasty work.‖ Beginning September 28 and continuing for 4 days, leaks were patched, and the abrasive 

 

17 AWG (American Wire Gauge) is a U.S. standard set of non-ferrous wire conductor sizes. 

001628
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

32 

blasting medium was vacuumed up and removed from the penstock. An Xcel worker entered the penstock 

during this period on two occasions to weld weep holes to stop leaks.18

4.1.6 Additional Evaluations and Inspections of the Penstock Work Space 

On September 22, KTA conducted its own initial pre-job hazard assessment of the penstock. In this 

assessment, the KTA inspector noted that the Material Safety Data Sheets (MSDSs) for all coatings and 

solvents to be used in the project were available and would be reviewed relative to personal protective 

equipment (PPE) and respiratory protection needs, and that the contractor and Xcel project manager were 

told about this review. In the assessment, the use of solvents was once again identified when the need for 

eye protection was pinpointed due to the use of ―solvents, paints, abrasives, etc.‖ According to the 

assessment document, the project manager was to be advised on the use of solvent. 

In this same inspection, the KTA inspector also indicated that the project would require workers to enter a 

work area classified as a permit-required confined space. By delineating the space as such, several 

requirements were outlined to be followed, including review entry procedures and entry permit, verify 

that air monitoring is performed prior to and during entry, verify that an attendant is present and rescue 

equipment is onsite, and use respiratory protection in accordance with controlling employer‘s entry 

procedures. Despite these requirements, entry procedures were not developed and the required daily 

permits were incomplete and lacking detail pertaining to the hazards of the day‘s work activities. Air 

monitoring was performed almost exclusively at the entrance, about 1,450 feet (442 meters) away from 

the actual work area within the penstock. Finally, rescue equipment was not available and ready for use 

onsite throughout the project or on the day of the incident. 

Two days later, on September 26, the KTA inspector conducted an inspection of the penstock interior, 

indicating in his documentation that thinner would be used as part of the coating materials‘ mixing and 

 

18 Neither Xcel Energy nor RPI could provide copies of hot work permits for this welding work to the CSB. 

001629
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

33 

pre-application process. Thinner/solvent was required to be run through the sprayer system equipment 

(including hoses, nozzles, and the sprayer itself) prior to the introduction of the epoxy components. This 

step ensured that the machine was completely free of all residue or contaminants prior to usage for actual 

spraying.19

On October 1, an Xcel safety consultant inspected RPI employees working in the penstock, but noted no 

unsatisfactory conditions. 

Sandblasting activities, including hand-sanding and grinding of the walls, were completed on the morning 

of October 2, and 13 RPI crew members20 began preparing the penstock interior for the new coating. No 

reevaluation of the safety hazards was held that morning to specifically assess new risks that could be 

associated with the change in planned work activities from sandblasting to epoxy coating application, nor 

were special precautions taken within the work environment beyond those put in place prior to the start of 

the sandblasting operation. 

4.1.7 Staging Equipment and Coating Materials 

The sprayer, a plural component (two-part) epoxy spraying system manufactured by Graco, is typically 

used in industrial epoxy application projects (Figure 5). 

 

19 In the September 26, 2007, KTA Inspection Report, ―Task Summary: Coating Observation Hold Points,‖ the 

inspector indicates that thinner would not be used in any ratio with the paint during either the first or second coat 

of paint. More traditional types of paint require a thinner or solvent to adjust the viscosity of the paint for proper 

application. However, the Duromar HPL-2510 two-part epoxy selected as the paint for the penstock interior did 

not require thinner to be added, as the two parts of the epoxy themselves are mixed according to a specific ratio of 

hardener to base. While a thinner or solvent was unnecessary for the actual paint mixture to be applied to the 

penstock interior, the solvent was needed to flush the sprayer system and clean equipment prior to and throughout 

the spraying process to keep the machine running smoothly for proper application of the two-part epoxy. 

20 One of the 14 contractors left the site prior to October 2nd for personal reasons. 

001630
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

34 

Figure 5. The epoxy sprayer system used within the penstock 

Each epoxy component – a base and a hardener – is poured into its respective hopper, and each flows 

through a heater to achieve the proper application viscosity. Pumps for each component force the heated 

material through separate hoses to a mixing block, where the hardener and base are homogeneously 

blended. This separation of heating prior to mixing is necessary because once the two components blend, 

they begin to ―set,‖ forming an epoxy bond that hardens rapidly. The combined epoxy product is then 

carried through a hose from the mixing block to the spray wand for surface application. Workers stated 

that the epoxy components used in the Cabin Creek project, once mixed, had a short ―pot life‖—a period 

of approximately 20 minutes before they began to permanently harden together.21

 

21 The epoxy product data sheet gives the ―pot life‖ as 45 minutes at 70 oF, but the workers described the period 

before the mixed epoxy began to set up as much shorter in actual working conditions. 

001631
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

35 

Solvent, such as MEK, is needed if problems arise when applying the epoxy mixture. If the combined 

epoxy product was to set, it would harden within the hoses and spray wands, destroying the equipment. 

Solvent would be used to flush out the mixing block and hoses to the spray wands to ensure that the 

epoxy mixture was fully removed from the equipment and would not permanently render it unusable. 

Solvent would be introduced into these portions of the spray system using a third smaller pump on the 

back of the machine that would take in solvent from an open bucket placed on the ground at the back of 

the sprayer (Figure 6). A hose ran directly from this pump to the mixing block. 

Figure 6. The solvent pump on the back side of the epoxy sprayer 

The sprayer was positioned in the penstock on wheeled scaffolding, which the RPI crew called the 

―stage,‖ about 1,450 feet (442 meters) from the access door and approximately 90 feet from the west 

bulkhead (Figure 7). The controls for the sprayer faced the west bulkhead, so that when a contractor was 

in position to manipulate the controls, he was looking in the direction of the access door, with the sprayer 

between him and that single point of egress. 

001632
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

36 

Figure 7. Aerial view of equipment arrangement in work area of the penstock 

In the hour leading up to the incident, five of the 13 contractors were working around the sprayer system 

(Figure 8). Three of these individuals – two of whom were foremen – worked the controls of the sprayer, 

while two others were stationed on the sides, each responsible for manning a hopper. Four additional 

contractors were runners, bringing epoxy, solvent, and other equipment to and from the work area to 

assist the five at the sprayer, and one person was stationed as the ―hole watch‖ attendant at the access 

door 1,450 feet (442 meters) away.22

 

22 Among other responsibilities, the assigned ―hole watch‖ is responsible for tracking who enters the confined space 

and the duration of time each spends within the space. 

001633
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

37 

Figure 8. Depiction of contractors working with the sprayer immediately prior to the flash fire 

001634
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

38 

The last two of the 13 contractors – besides the general foreman – were at the far end of the work area 

near the temporary west bulkhead, preparing to begin recoating the penstock interior using a wheeled 

scaffold that had been built for the crew as they used spray wands to recoat the penstock interior (Figure 

9). 

Figure 9. Depiction of contractors recoating the penstock interior near the temporary west bulkhead 

4.1.8 Preparation for Coating Application 

In preparation for applying the epoxy, approximately 10 gallons of MEK was brought into the penstock in 

5-gallon plastic buckets to flush out the entire sprayer system prior to applying the epoxy. This flushing 

cleans out the mixing block and combined epoxy product hose lines to the spray wands and involves 

pouring MEK into each of the hoppers and re-circulating the solvent through the sprayer from the hopper 

001635
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

39 

to the discharge of the pump.23 This full flushing process ensures that all foreign matter, debris, and 

leftover epoxy products are completely removed from the equipment before new epoxy products are 

introduced. 

MEK is highly flammable and can produce hazardous atmospheres with air and be ignited under almost 

all ambient temperature conditions (NIOSH, 1998; NFPA 2007b, Table 6.2) (Section 6.5.1 details the 

hazards of MEK). 

On October 2, after this flushing process was completed, the open buckets of used MEK were kept within 

the sprayer area for future use. Immediately prior to the incident, at least eight buckets of epoxy and three 

buckets [about 11-12 gallons (42-45 liters)] of MEK were on the stage. One of these buckets was a 5-

gallon (19 liters) pail that sat open underneath the solvent pump on the back side of the sprayer. A 

halogen lamp sat on top of the pumps, projecting light onto the hoppers. In addition, more than 95 plastic 

buckets of base and hardener epoxy products were distributed throughout the penstock (Appendix C 

provides an inventory of epoxy and solvent within the penstock at the time of the incident).

The KTA inspector and RPI general foreman examined the penstock work area and determined that the 

contractors could begin applying epoxy. The inspector and general foreman then left the site for lunch at 

about 1:10 pm, while the other 12 RPI workers remained at the site, 11 of whom continued working 

within the penstock.24

4.1.9 Epoxy Coating Application Problems 

The application process did not go smoothly, and solvent (MEK) had to be used several times to flush out 

the equipment. Eyewitnesses reported that the sprayer was not flowing accurate hardener-to-base ratios 

 

23 This preparatory cleaning of the equipment is discussed in the Duromar epoxy application guide and the Graco 

sprayer manual as normal practice during general commercial or industrial painting prior to introducing epoxy into 

the sprayer system. 

24 The twelfth contractor was the attendant stationed at the access door. 

001636
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

40 

and that its electronic display continually gave error readings, which automatically shut down the sprayer.

Because of ―fingering,‖ or uneven application of the epoxy to the surface, the contractors were able to 

spray only about a 10-foot (3-meter) area of the penstock wall interior. 25

Each time the sprayer shut down, the contractors ran MEK from the sprayer‘s solvent pump to the mixing 

block, through the two hoses of combined epoxy product to the spray wands, where the solvent flushed 

the epoxy out of the hoses into plastic buckets. 

This flushing between attempts of epoxy application occurred approximately four times before one of the 

RPI foremen decided that the contractors would be unable to apply the epoxy evenly. He instructed the 

contractors to flush the entire sprayer system by circulating MEK through all the equipment in 

preparation for removing the sprayer from the penstock.

After flushing the mixing block and the spray wands, the two contractors at the west bulkhead who had 

been operating the spray wands took the buckets containing a mixture of MEK and epoxy waste to the 

sprayer area. Other members of the crew began cleaning out the sprayer by removing the epoxy products 

within each hopper. 

Another contractor brought in about 6 more gallons (23 liters) of MEK in several trips using 2-gallon (7.6 

liters) plastic buckets that had originally contained the hardener. As a result, about 11-12 gallons (42-45 

liters) of pure MEK and another 12 gallons (45 liters) of epoxy/MEK waste product [of which about 5 

gallons (19 liters) were MEK] were in close proximity to the sprayer. 

At this time, two of the contractors retrieved some of the nearby buckets of MEK to flush out the sprayer 

system, while two others began walking toward the access door to retrieve even more buckets of the 

solvent. MEK was poured into the hardener side and circulated through the sprayer system. The 

 

25 ―Fingering‖ is painting jargon for uneven paint application: when a thick residue of paint is left in long vertical 

lines, like fingers, up and down a surface. 

001637
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

41 

contractors then poured MEK in the base hopper for circulation. This circulation through the base side of 

the sprayer was ongoing when the initial flash fire occurred. 

4.2 The Incident 

At approximately 1:55 p.m., on Tuesday, October 2, 2007, a flash fire ignited at the sprayer in the 

immediate vicinity of the base hopper while the contractors were flushing the system with MEK. An RPI 

contractor was circulating the MEK from the base hopper through the pump, discharging the solvent back 

into the hopper through a nylon hose. At the time of the ignition, the contractor was holding the end of the 

hose equipped with a metal fitting inside the base hopper; he reported witnessing the initial flash arising 

from the interior of the hopper. The burning solvent forcefully erupted from the hopper and sprayed onto 

the contractor and the surrounding area. The flash fire caught the contractor‘s sleeve on fire and quickly 

engulfed the buckets of MEK. Another contractor, who left the work area to retrieve portable fans to help 

dissipate the strong MEK odor, was about 40-50 feet (12-15 meters) from the sprayer when the fire 

ignited. Two others, on their way out of the penstock to retrieve more MEK, heard a loud rumble; they 

turned in the direction of the noise and saw a flash of fire that seemed to roll toward them. These 

eyewitnesses reported that the fire appeared to come from the base hopper. 

This rapidly growing fire separated the contractors who were standing on either side of the equipment. 

The five contractors who were on the far side of the sprayer found their exit blocked by the fire and were 

unable to escape. The trapped men shouted for fire extinguishers. 

4.3 Emergency Response 

4.3.1 Fire Extinguishers 

No fire extinguishers were staged near the sprayer where the initial fire started. After the initial flash, the 

fire died down enough for those trapped behind the sprayer to communicate with the survivors on the 

other side. Those trapped instructed the others to retrieve extinguishers. The contractors on the side of 

001638
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

42 

sprayer with access to the entrance ran about 1,450 feet (442 meters) down the penstock to retrieve the 

fire extinguishers, which were located outside of the penstock. 

While they ran for the access door, several flash fires ignited and loud booms reverberated down the 

penstock as the initial fire ignited the solvent and caused the epoxy buckets surrounding the sprayer to 

burst. The fire increased in size and intensity and spread to additional epoxy buckets in the vicinity of the 

sprayer. The trapped men retreated uphill, away from the sprayer and farther up into the penstock. 

With extinguishers in hand, two of the crew ran back inside toward the fire and sprayer with the intention 

of putting out the fire. The thick black smoke reduced their visibility to almost zero and made breathing 

difficult; as a result, they could not get near enough to the sprayer and burning epoxy products to 

effectively extinguish the fire. This initial attempt, and all additional re-entries the work crew made to 

extinguish the fire, failed. 

4.3.2 Initial 9-1-1 Call 

One of the crew members who retrieved the first two fire extinguishers from outside the penstock handed 

the extinguishers to his coworkers before running to the nearest phone, located at the Cabin Creek 

powerhouse entrance east of the penstock. He called the Cabin Creek power house control board, 

notifying them of the penstock fire and need for 9-1-1 assistance. 

Clear Creek County Emergency Dispatch received the first 9-1-1 call from an Xcel control room operator 

at 2:03 p.m. The caller told the 9-1-1 operator that there was a fire in the penstock, but did not explain that 

the penstock was a confined space or that specialized rescue personnel and equipment would be required 

to fight the fire and rescue trapped workers.26 The 9-1-1 operator immediately broadcast a request to Clear 

 

26 The caller told the 9-1-1 operator that there was ―a fire in our penstock...in our tunnel...outside on our surface 

deck, outside of the plant...on the surface.‖ 

001639
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

43 

Creek County Emergency Services27 to respond to the Cabin Creek site, indicating that there was a fire on 

the ―surface deck.‖

The RPI worker also called the company corporate office to notify management of the emergency. He 

then went back to the access door of the penstock and found that the RPI general foreman and KTA 

inspector had arrived. 

During this time the trapped workers used a radio to remain in communication with the crew that 

escaped.28

4.3.3 Emergency Responders Arrive 

Upon arriving at the Cabin Creek site, emergency responders established an Incident Command structure. 

At 2:11 p.m., the first Clear Creek County Sheriff‘s officers arrived on the scene, followed shortly by a 

volunteer paramedic and firefighter from the Clear Creek County Fire Authority (CCFA). These 

responders saw no signs of a surface fire when they arrived. Xcel and RPI employees quickly informed 

them that the fire was inside the penstock and that several workers were trapped. At 2:20 p.m., the 9-1-1 

center broadcast an update indicating that the fire was 1,000 feet (305 meters) inside the penstock tunnel 

and below ground. The message also informed responders that they would need 1,000 feet (305 meters) of 

hose and the equipment necessary to fight an underground fire. 

The CCFA responders lacked the necessary equipment and resources to safely enter the penstock; they 

were also concerned that they lacked the appropriate training to perform rescue within the confined space. 

 

27 Clear Creek Fire Authority (CCFA) is a consolidated fire protection and emergency service agency serving the 

municipalities of Empire, Georgetown, Idaho Springs, and Silver Plume, and the unincorporated lands of Clear 

Creek County previously represented by the Clear Creek Emergency Services District (ESD). CCFA‘s territory 

includes I-70 (Colorado‘s primary east-west transportation corridor); Clear Creek (a rafting river); four 14,000-

foot (4,300 meters) peaks; two ski areas; several hundred abandoned mines; and residential and business districts. 

(Colorado Division of Emergency Management, http://dola.colorado.gov/dem/operations/operations.htm, accessed 

July 30, 2010). 

28 The CSB determined this timeline by correlating events discussed in interviews with security video footage of the 

area outside the penstock. 

001640
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

44 

4.3.4 Call for Mutual Aid

CCFA personnel en route to the site, based on information broadcast over their radios (i.e., that the fire 

was located deep inside the penstock and that workers were trapped), contacted Denver‘s West Metro Fire 

Protection District (West Metro) to request firefighting and rescue assistance.29 West Metro Emergency 

Response personnel are located on the west side of Denver, approximately 1 hour and 15 minutes travel 

time (about 45 miles or 72 kilometers) from Cabin Creek. 

At one point, firefighters requested and received the MSDSs from RPI. 

At 2:30 p.m. the Incident Commander contacted Climax Molybdenum Company‘s (Henderson Mine) 

mine rescue team to request support in rescuing the stranded workers. 

4.3.5 Attempted Entry by Early Rescuers 

Approximately 45 minutes after the initial fire, but before West Metro or Henderson Mine emergency 

personnel arrived, four Clear Creek firefighters entered the penstock to assess the fire and the prospect of 

rescuing the five trapped RPI employees. Wearing protective fire-fighting clothing and self-contained 

breathing apparatuses (SCBAs), they used a small gasoline-powered all-terrain vehicle (ATV)30 to 

explore the penstock. Because of the smoke and lack of visibility, they were able to move only about 200 

feet (61 meters) into the penstock before they stopped and returned to the entrance, concluding that they 

were unable to extinguish the fire and/or rescue the trapped workers. CCFA did not attempt further entry 

into the penstock until after Henderson Mine rescue personnel cleared the penstock. 

 

29 West Metro and CCFA have a Mutual Aid agreement for technical firefighting and confined-space rescue. 

30 The ATV was placed in the penstock at the beginning of the project to transport personnel and supplies 

throughout the steel portion to be recoated. 

001641
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

45 

4.3.6 Stranded Workers Still Communicating 45 Minutes into Incident 

Radio communications between the trapped contractors and those outside the penstock continued for 

about 45 minutes after the initial flash fire. The trapped workers were instructed to move to the upper end 

of the penstock, away from the burning sprayer, epoxy, and solvent. 

4.3.7 Emergency Responders Evaluate Further Entry into the Penstock 

West Metro arrived at the Cabin Creek site around 3:40 p.m., but because they did not know about the 

conditions inside the penstock—whether explosive hazards existed—they did not enter to fight the fire or 

attempt rescue. Instead, they joined CCFA and another rescue group, Alpine Rescue, at the top of the 

penstock (the mushroom). Upon arrival at the mushroom, West Metro was told that breathing air bottles 

and respirators, a light, and a radio were lowered down into the vertical portion of the penstock in the 

hopes of reaching the trapped contractors. This activity posed its own difficulties due to the winding potholed road leading to the mushroom and the challenges of using the mushroom‘s access hatch. 

4.3.8 Emergency Responders Enter the Penstock 

The first of two Henderson Mine rescue teams arrived shortly after 4:00 p.m. and prepared to enter the 

penstock at the access door. 

Sometime between 4:45 p.m.and 5:30 p.m., Xcel operations personnel reversed the penstock ventilation 

fans to try and reverse the penstock airflow and draw the smoke away from the stranded workers. 

Henderson Mine responders entered the penstock at 5:45 p.m. After verifying that the fire had burned out, 

they continued up the penstock to determine if any of the workers had survived. They found the first body 

approximately 100 feet (30.5 meters) uphill of the fire. The four remaining were located even further 

uphill, near the point at which the penstock‘s incline abruptly steepens. Post incident, it was determined at 

all five died of asphyxiation shortly after radio communications ceased, at approximately 2:45 p.m. 

001642
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

46 

5.0 Incident Analysis 

The CSB found that numerous safety issues collectively contributed to the October 2, 2007, incident. 

5.1 Pre-Incident Events 

Insufficient ventilation, improper equipment for fire prevention, and a tight schedule created an unsafe 

work environment even before the epoxy application activities began. 

5.1.1 Insufficient Ventilation

Adequate ventilation was an important safety issue of the penstock work environment. The work area 

being sandblasted and coated was sandwiched between two wooden bulkheads built to confine the 

sandblasting medium and epoxy coating materials, and to isolate the work area space of the penstock. 

Ventilation and the control of nuisance dust was to be accomplished using two desiccant-style 

dehumidifiers that would force air into the space at a rate of approximately 13,000 cubic feet per minute 

(CFM).31 Additionally, a 12,000 CFM dust extractor was to be used that would pull air out of the 

penstock and remove dust particles before discharging the air outside. This ventilation setup, if operating 

optimally, equated to approximately 4.4 air changes per hour (ACH)32 in the work area between the two 

bulkheads.33 In constrast, the Flammable and Combustible Liquids OSHA standard requires a room that 

simply stores flammable and combustible liquids be ventilated at a rate of six air changes per hour in 

order to prevent explosive vapors from accumulating [29 CFR 1910.106(d)(4)(iv)]. None of the 

 

31 The inlet air was delivered into the work area via a 20-inch (52-centimeter) diameter flexible plastic supply duct 

magnetically attached near the floor of the metal-walled penstock. The return duct located near the access door 

directed the air from the penstock through the dust collector before it was discharged to the outside atmosphere. 

During sandblasting, additional portable blowers and fans moved the dust-laden air down the penstock toward the 

east bulkhead near the access door. The additional portable blowers or fans were not used while the epoxy coating 

was being applied. 

32 The number of times air is replaced in an hour. 

33 Volume of Air: 13,000 CFM x 60 min = 780,000 CFH; Volume of Space: (6 ft)2

x 1560 ft x π = 176,432 ft3; Air 

Changes: 780,000 CFH/176,432ft3 = 4.4 air changes per hour 

001643
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

47 

ventilation design documents obtained by the CSB indicated any analysis of the adequacy of 4.4 air 

changes per hour in relation to the dissipation of flammable vapors in the work space. The penstock‘s 

ventilation setup was designed soley for the purpose of ensuring the penstock ambient conditions were 

optimal for the sandblasting and epoxy application activities. 

After using MEK to clean the spray wands on the scaffold near the west bulkhead, one of the contractors 

left the work area to get a fan to dissipate the buildup of solvent ―fumes‖ that he smelled through his 

respirator. He told the CSB that, as he squeezed past the scaffold holding the sprayer, there was ―no air 

movement at all‖ in the vicinity of the sprayer. Post-incident, OSHA cited RPI for not ensuring 

ventilation equipment provided acceptable confined space entry conditions [OSHA 21 Mar 2008, 

inspection 310470034, citation 2(8)]. While adequate ventilation is a necessary component for managing 

the hazards of confined space work, the CSB has concluded that ventilation alone was insufficient to 

safely control the risks of using flammables in the open atmosphere of the penstock. 

5.1.2 Improper Equipment Choices for Fire Prevention 

Penstock recoating equipment choices made by RPI personnel, including management officials, increased 

the likelihood of a fire. 

5.1.2.1 Decision not to Use Heated Hose Lines 

The CSB determined that the primary reasons for the epoxy application difficulties were due to the 

inability to achieve and maintain the necessary temperatures of the epoxy components for application, 

which likely would have been avoided had heated hose lines been used. Heated hoses are often used in 

specialized industrial painting projects to overcome the negative impact of temperature, which can affect 

the viscosity of the epoxy and thus the quality of the coating application. However, a decision was made 

to use regular spray hoses instead, despite the penstock ambient and surface temperatures being below 

recommended levels for proper epoxy application. 

The product data sheets for the epoxy base and hardener, RPI provided to Xcel as a part of its bid 

submission package, state that the minimum surface temperature during application must be no colder 

001644
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

48 

than 60 oF (16 oC). However, in the week leading up the incident, ambient temperatures averaged 58 oF 

(14 oC), and on October 2, the KTA inspector recorded the interior surface temperature of the penstock as 

54 oF (12 oC). The General Application Guidelines for the epoxy, also included in the bid package, 

indicate that the base and hardener components be stored in ―a warm area where the temperature remains 

between 60-90 oF (16-32 oC). Cold products are very viscous and will be very difficult to mix and apply.‖ 

While the epoxy components were initially stored in a heated trailer, more than 95 buckets of epoxy were 

brought into the penstock and staged in groups along 1,450 feet (442 meters) of the penstock‘s cold steel 

floor. 

The RPI work crew reported that the sprayer was having trouble heating the cold material, particularly the 

base, due to its thickness and initial cold temperature. When mixing the two epoxy components together, 

the combined product should have been between 70-80 oF (21-27 oC). A RPI contractor taking 

temperature readings of the unmixed products within the hoppers with a laser gauge immediately prior to 

application stated that the temperature readings of the base that day reached no greater than ―45 o, 47 o.‖ 

Furthermore, the sprayer had difficulties maintaining the required epoxy temperature for an extended 

period. When workers circulated the two epoxy components several times through each side of the 

sprayer and the attached heaters, the limited quantity of each component within the sprayer system was 

able to achieve the requisite temperature.34 However, after the heated components were sent to the mixing 

block for blending, additional (cold) epoxy had to be added to each hopper to keep the flow of combined 

product out of the spray wands consistent. But additional time was needed for the cold epoxy to circulate 

through the heaters to warm up to the appropriate application temperature. The CSB concluded that the 44 

feet (13 meters) of hose from the sprayer to the mixing block and the additional 40-60 feet (12-18 meters) 

of hose from the mixing block to the spray wands was too great a distance to maintain the requiste 

 

34 Testimony from an RPI crew member stated that the crew had to circulate the material multiple times to get the 

paint to the requisite temperature. 

001645
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

49 

temperature as cold epoxy was added to the sprayer and then passed through hose that ran along the cold 

penstock floor to the area being recoated.35

The RPI vice president discussed the plan to use in-line heated hose as late as five days prior to the 

incident, yet they were not incorporated into the equipment setup within the space. The lack of heated 

hose, in combination with the extensive length of hose required to complete the application work, 

contributed to the crew‘s inability to keep the epoxy at the appropriate temperature for proper epoxy 

application. As a result, the sprayer would not function effectively and the crew was forced to repeatedly 

flush the hoses from the mixing block to the spray wands with MEK between each failed attempt, which 

contributed to the buildup of MEK in the atmosphere. 

5.1.2.2 Electrical Safety Precautions not Met 

Equipment used to handle flammable material must be properly bonded and grounded, and hoses must be 

electrically conductive. These electrical safety precautions were not met on the day of the incident; 

specifically, the CSB determined that some of the hose chosen for the penstock job was likely nonconductive. 

Non-conductive flexible hoses are not recommended for use with flammable liquids due to their staticaccumulation capabilities unless, at a minimum, all conductive couplings (e.g., end fittings or connectors) 

are bonded and grounded (NFPA 77, 2007a, Section 8.4.3.2). 

While most of the hoses around the sprayer were destroyed in the fire, an examination of the equipment 

post-fire uncovered the remains of the hose used to circulate solvent through the hardener hopper and its 

associated equipment still attached to the sprayer, including a hose connector (metal swivel) and the inner 

woven metal sheath. The hose used to circulate solvent through the base side of the sprayer was destroyed 

 

35 An RPI crew member with experience working with this product recommended that the paint come out of the 

spray wands at a temperature of 110 oF for correct application. 

001646
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

50 

in the fire and the inner woven metal sheath was not observed to be attached to the sprayer was not found 

in the surrounding debris. Due to the lack of an inner metal sheath, the CSB concluded that the base side 

solvent hose was likely non-conductive and did not establish appropriate bonding to allow for the 

dissipation of static electricity on the metal hose connector. (Appendix D.1). A static charge likely built 

up as solvent travelled through this hose; eventually an electrical spark between the hose connector and 

the metal base-side hopper of the sprayer likely resulted in the initial flash fire (Section 5.2.2 and 

Appendix D discuss this ignition scenario in detail). To prevent static charge buildup, conductive, rather 

than non-conductive, hose should have been used with the sprayer. 

5.1.2.3 Use of Unsafe Lighting 

Unsafe lighting was also used within the penstock when flammables were present. RPI‘s ―Spraying 

Equipment and Operations‖ policy within its IIPP states: ―Explosion proof [sic] portable lamps must be 

used to illuminate the spray areas.‖ However, the penstock spray area, including where the sprayer system 

was setup, was illuminated with a variety of lighting, not all of which was explosion-proof. Specifically, 

several halogen lamps were placed around the sprayer, with one resting on top of the sprayer pumps at the 

time of the incident (Figure 10). 

Figure 10. Remains of the halogen light sitting atop the sprayer inside the penstock (left); the same 

remains being compared to an exemplar halogen light (right). 

Halogen light frame

001647
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

51 

Equipment and supplies needed for the penstock project were planned by the onsite foremen, the RPI 

shop manager, and RPI upper level management in advance of the work crew‘s activities inside the 

penstock. While the ignition of MEK vapor from the heat of a halogen light was determined to be a less 

likely ignition scenario (Appendix D), the CSB concluded that this unsafe lighting choice was a serious 

safety risk when used in conjunction with the introduction of flammables within a confined space. 

5.1.2.4 No Fire Extinguishers Within the Work Area 

Fire extinguishers were not immediately available to the contractors after the initial flash fire because 

they were not situated by the sprayer and within the work area. Contractors had to go approximately 

1,450 feet (442 meters) – a length of over four football fields – to the exit of the penstock and retrieve 

extinguishers after the initial fire. RPI‘s ―Fire Protection and Prevention‖ policy, within the IIPP, states 

that fire extinguishers ―must be in close proximity to all painting operations.‖ While ―close proximity‖ is 

not defined, it is reasonable to conclude that 1,450 feet (442 meters) does not meet the definition. 

Additionally, NFPA 851, Recommended Practice for Fire Protection for Hydroelectric Generating Plants 

(2005), states that fire suppression equipment should be ―provided where risk of fire exists‖ and ―located 

for easy access‖ (NFPA 851, section 8.8.1). It goes on to state ―Portable fire extinguishers of suitable 

capacity should be provided where...flammable liquids are stored or handled‖ (NFPA 851, section 

8.8.2).36 Had extinguishers been present at the location of the sprayer work activities, the solvent flash fire 

likely could have been suppressed or extinguished at the time of initial ignition prior to the combustion of 

the larger quantities of the epoxy products. 

 

36 Section 1.3.2 of NFPA 851 states that the recommendations within the Recommended Practice are intended for 

new installations, but notes that ―the recommendations contained in this document represent good industry practice 

and should be considered for existing installations.‖

001648
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

52 

5.1.3 Scheduling and Production Pressures 

A tight 10-week project completion schedule, severe weather concerns, several unplanned work delays, 

and perceived production requirements placed RPI employees under intense pressure to complete the 

recoating work. These stressors contributed to a rushed work pace on the day of the incident, which likely 

affected the crew‘s ability to focus on safety. Decisions made in haste and under stress can often have 

deleterious side effects, including inadvertent step deletion or heavy focus on one issue while minimizing 

the significance of others (Dismukes, Berman, & Loukopoulos, 2007, p.261). Evidence indicates that the 

RPI workers experienced a rushed work pace the morning of the incident, and safety was likely 

negatively impacted as a result. 

For a power plant like the Xcel Cabin Creek site, the downtime of the penstock would be costly. An RPI 

foreman involved in the initial planning of the recoating project confirmed that the project was set on a 

―short schedule,‖ where work would be conducted on a 24-hour/7-days-a-week schedule until completed 

in order to be able to accomplish the recoating project in shortest time period possible. In addition, the 

vice president of RPI noted the very tight schedule in emails during the planning phase of the project, 

questioning if only one coat of epoxy, rather than two, could be applied to the floor of the penstock to 

accelerate the work pace and decrease curing time of the epoxy. 

The project‘s timing was also one of five items emphasized as problematic in the Xcel ―Major Items of 

Concern‖ penstock project planning document (Section 4.1.1), written by an Xcel civil engineer who 

noted that the time it would take to drain the penstock, coat the interior lining, allow the epoxy to cure, 

and refill the penstock for hydroelectric power would be difficult to accomplish, even in the best 

conditions, within the allotted 10-week schedule. He added that the weather during the time of year the 

penstock would be recoated – September through November – would ―not lend itself to the best of 

conditions.‖ 

As the project began, several delays in the initial work tasks constrained the already tight schedule 

significantly from the initial timeline RPI submitted to Xcel with its bid submission documentation. A 

001649
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

53 

compressor was blown out during the sandblasting portion of the work. The RPI crew experienced 

electrical problems, blowing out a few of the electrical ―spider‖ boxes and lighting, which required repair 

and replacement; and the contractors had to spend extra time sandblasting to remove the necessary 

amount of old liner prior to recoating. Specifically, the submitted schedule stated that the first quarter of 

the 1,560 feet (475 meters) of the penstock being recoated would be sandblasted and coated by the first of 

October; but the crew was just making its initial application attempts on October 2, over one week behind 

schedule. 

In interviews with the CSB, the RPI employees confirmed that they were behind schedule before they 

even began the epoxy application process. Penstock crew personnel stated that they heard the general 

foreman report to RPI headquarters that a number of work tasks were completed before they actually 

were. The day of the incident, eyewitnesses stated that the general foreman was anxious about the crew‘s 

progress and was pushing to get the recoating portion of the project underway. A number of the 

employees stated that with past projects they typically had regular safety meetings to review work tasks 

and safety concerns, but that the penstock job was different in that such safety discussions were not held 

as often, nor were they as focused on safety, as in previous jobs. According to the workers, any 

discussions held the morning of the incident focused on preparing equipment within the penstock for the 

recoating work, not on any safety risks inherent with the work, such as with using a flammable within a 

confined space, nor on any steps taken to mitigate those risks, such as ensuring fire extinguishers are 

located within close proximity to the sprayer system. Instead, the employees reported that the focus that 

day was solely on getting the epoxy on the walls. 

In addition to the work delays and schedule pressures, RPI employees reported that the company used 

unofficial financial incentive programs – both in the past and in this recoating project – to ensure that 

work was completed in a timely manner. A number of the survivors asserted that if the crew finished the 

project on time or earlier than scheduled, the general foreman would receive a financial bonus. Some 

contractors stated that the general foreman would share the bonus with the hardest working members of 

001650
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

54 

the crew. Employees testified that this incentive was based purely on the timeliness of work completion. 

Incentive programs like these are common in many workplaces; however, attention must be given to 

ensure that such rewards do not have unintended negative consequences, such as a decline in work quality 

or safety in order to ensure on-time work progress (Hopkins, 2005, p.51 – 60; Hopkins, 1999, p.13 and 

94).

5.2 Incident Events 

The use of solvent within the confined space of the penstock to clean the sprayer created a flammable 

atmosphere. A static spark most likely ignited the flammable atmosphere within the sprayer hopper, 

resulting in a flash fire that quickly intensified as additional solvent and the combustible epoxy 

surrounding the sprayer ignited. The rapid spread of fire and toxic smoke from burning epoxy prevented 

the workers uphill of the sprayer from exiting through the penstock‘s only egress point, resulting in their 

deaths. 

5.2.1 Unsafe Sprayer Flushing Method Contributed to a Flammable 

Atmosphere 

On October 2, the contractors flushed the entire sprayer system with MEK while it was still within the 

penstock‘s confined space, creating a flammable atmosphere within the work area. Flushing the sprayer 

system with solvent outside the penstock could have avoided creating this flammable atmosphere, as none 

of the equipment, with the exception of the mixing block itself and the hoses going to the spray wands, 

required immediate flushing with a solvent. It is only when the hardener and base epoxy components are 

combined that they react with each other and solidify (Section 4.1.7). The potential for a flammable 

atmosphere to develop would have been greatly reduced, had the solvent only been used to flush the 

mixed epoxy material from the hoses extending from the mixing block to the spray wands. 

5.2.2 Most Probable Ignition Source 

The CSB concluded that the fire inside the penstock was most likely ignited by a static spark that 

originated from the electrically isolated (ungrounded) metal swivel connector attached to one end of the 

001651
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

55 

non-conductive hose being handheld inside the base hopper of the sprayer as MEK was being flushed 

through (Appendix D.1). The CSB calculated that the MEK concentration in the vapor surrounding the 

metal swivel connector was between 7.6 and 9.1 volume percent, which is well within the flammable 

limits of 1.8 and 11 volume percent, based on the MEK vapor-liquid equilibrium concentration adjusted 

for penstock environmental conditions (Appendix E). The CSB determined that the MEK circulation flow 

through the sprayer was likely capable of developing a charging current, accumulating stored energy on 

the electrically isolated metal swivel connector and producing incendiary sparks of sufficient magnitude 

to ignite the flammable MEK vapor (Appendix F). 

While the CSB determined that a static spark was the most probable ignition source, two other potential 

ignition sources could not be completely ruled out: 

An electrical arc produced inside the base hopper by a stray current inside the sprayer system 

(Appendix D.2), or 

Autoignition of flammable MEK vapor by the hot bulb of the portable halogen lights 

positioned above the sprayer (Appendix D.3) 

Fire damage to the sprayer and associated equipment precluded the CSB from completely dismissing a 

stray current arc as the ignition source. The two electrical discharge ignition scenarios (static spark and 

stray current arc) are similar with respect to the location of the spark (metal swivel connector attached at 

the end of the hose) and vapor composition constraints limited to the base hopper. However, since a static 

spark requires a non-conductive hose and a stray current arc requires a conductive hose, these two 

electrical discharge mechanisms are mutually exclusive. Available evidence indicates that the base 

hardener hose was constructed from a non-conductive (nylon) material and the end connector was 

attached without any internal electrical bonding. 

Conflicting testimony and fire damage to the sprayer‘s heaters and control panel also meant that the CSB 

could not conclusively verify whether the MEK was being heated as it circulated through the sprayer at 

001652
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

56 

the time the fire occurred. Thus, the CSB could not totally eliminate the possibility that the MEK 

temperature was hot enough to develop a flammable atmosphere above the sprayer, where the hot bulb 

surface from the portable halogen lights could have caused autoignition of the flammable MEK vapor. 

However, witnesses stated that the fire originated inside the base hopper and the CSB considered it 

unlikely for the fire to have been ignited at the halogen lights with a flame front traveling back to the 

hopper without being observed. 

Three additional ignition scenarios were evaluated and eliminated as probable ignition sources: hot 

surface ignition by the sprayer heater(s) (Appendix D.4); compression ignition inside one of the sprayer 

piston pumps (Appendix D.5); or electrical spark from the heater control box (Appendix D.6). In 

summary, although either autoignition by the halogen bulb or a stray current arc were both possible 

ignition sources, evidence suggests that the most likely ignition source was a static spark between the 

metallic end connector on the non-conductive hose and the wall of the hopper. 

To reduce the risk of fire or explosion, fire safety measures should employ protections aimed at 

eliminating at least two legs of the fire triangle 37: oxygen, fuel, and ignition source (Scarbrough, 1984, 

pp.521-552). Potential ignition sources are often difficult to identify and control in situations where 

flammable liquids are being used. Because oxygen is normally present and difficult to remove, especially 

when people need to employ or interact with equipment that uses flammable liquid, fire safety measures 

stress the need to keep concentrations of flammable vapors well below the LEL38 to prevent flash fires 

and explosions. This is especially important in a confined space where the number of air changes can be 

 

37 The fire triangle is a concept used to explain the three conditions – heat, fuel, and oxygen – that must be present 

for combustion. 

38 LEL is defined as ―that concentration of combustible material in air below which ignition will not occur.‖ 

―Recommended Practice for Handling Releases of Flammable and Combustible Liquids and Gases, NFPA 329 

(2005). The terms lower explosive limit (LEL) and lower flammability limit (LFL) have different definitions but 

are commonly used interchangeably. This report will use LEL except where citing other sources that use LFL in 

their standard or regulation. The OSHA Permit-Required Confined Space Standard 29 CFR 1910.146 uses the 

term LFL in its provisions. 

001653
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

57 

limited, causing flammable vapors to quickly concentrate. In this incident, a lack of fire safety measures 

to control or eliminate the concentrations of flammable vapors being generated during the flushing 

operation resulted in the penstock fire igniting when a suitably energetic ignition source appeared. 

5.2.3 Flash Fire Becomes Sustained Toxic Fire, Trapping Workers 

Approximately 16 gallons (61 liters) of MEK and at least 30 of the 95 buckets of epoxy39 were destroyed 

in the fire. The initial flash fire involved only the solvent being used directly within the hopper; however, 

the large amount of solvent surrounding the sprayer, as well as numerous buckets of epoxy hardener and 

base, caused the flash fire to grow into a sustained, intense toxic fire. 

Neither the MEK nor the epoxy components needed to be in the penstock in such large quantities. The 

amount of solvent required to flush the lines from the mixing block to the spray wands was significantly 

less than what was needed to clean out the entire sprayer system. 

Had the decision been made to remove the sprayer from the penstock prior to flushing – a decision that 

should have been made by management prior to any onsite activities related to the penstock recoating 

project – the creation of a flammable atmosphere likely would have been avoided. And, had there not 

been additional MEK in buckets surrounding the sprayer, the initial flash fire likely would not have 

intensified. Finally, the subsequent ignition of the combustible epoxy components turned the growing fire 

into a toxic one.40 This sustained fire prevented the trapped contractors from climbing around the sprayer. 

They had no choice but to run up the penstock, away from the burning products and their only exit. 

 

39 Because the fire burned many of the plastic buckets, leaving only the metal handles, it was impossible to discern if 

these melted buckets were 2-gallon hardener or 5-gallon base buckets. Therefore, a more precise quantity (in 

gallons) of epoxy burned in the fire could not be determined. 

40 The MSDS for the epoxy hardener states that ―heat and fire can generate toxic or irritating decomposition 

products that may cause a health hazard. Sudden reaction wand [sic] fire may result if product is mixed with an 

oxidizing agent‖ (Duromar HPL-2510 Hardener, 7/2/2007). The MSDS for the epoxy base states that ―heat from 

fire can generate flammable vapor and decomposition products that may cause a health hazard.‖ The base is also 

noted as a ―known human carcinogen‖ (Duromar HPL-2510 Base, 3/21/2007). 

001654
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

58 

6.0 Confined Space 

The penstock recoating project was hazardous in that introducing and using flammable and toxic 

chemicals within a confined space presents numerous safety risks. The unique features of the penstock, 

including its extensive size and lack of a secondary point of egress, amplified the danger. Extensive and 

detailed pre-job safety planning was needed to evaluate and address the hazards inherent in this 

maintenance work. 

The CSB concluded that Xcel, RPI, and KTA initially recognized the Cabin Creek penstock as a permitrequired confined space, but did not treat it as such during the penstock project. As a result, the 

companies did not effectively coordinate and plan to control the hazards inherent in the recoating work. 

Nor did RPI re-evaluate the hazards when working conditions changed inside the penstock, such as the 

introduction of flammable MEK into the work area. Xcel‘s and RPI‘s lack of sufficient planning and 

coordination for the hazardous recoating work within the confined space was causal to the incident. 

6.1 Penstock is a Permit-Required Confined Space 

The Cabin Creek penstock is a permit-required confined space, as defined by OSHA: it is large enough 

and so configured that an employee can bodily enter and perform assigned work, it has limited or 

restricted means for entry or exit, and it is not designed for continuous human occupancy [29 CRF 

1910.146(b)]. The penstock‘s 12-foot (4-meter) diameter space is large enough for workers to enter and 

work inside; entry and exit are feasible only through the temporary 4 by 4-foot (1.2 by 1.2-meter) opening 

cut at the lower end and, when generating hydroelectric power, the penstock is full of flowing water. The 

penstock also meets an additional criterion: it ―contains or has the potential to contain a hazardous 

atmosphere,‖ making it not just a confined space, but a permit-required confined space [29 CRF 

1910.146(b)]. A hazardous atmosphere, as defined by the OSHA Permit-Required Confined Spaces 

001655
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

59 

Rule,41 is one that may expose employees to the risk of death; incapacitation; impairment of ability to 

self-rescue; injury; or acute illness from flammable gas, vapor, or mist in excess of 10 percent of its lower 

flammability limit (LFL).42 OSHA requires employers to evaluate their workplace to determine if any 

confined spaces meet the criteria for a permit-required confined space [29 CFR 1910.146(c)(1)]. Despite 

initial recognition that the penstock was a permit-required confined space, neither Xcel nor RPI treated 

the penstock as a permit-required confined space while the recoating work was being conducted. 

6.1.1 Initial Evaluation of the Confined Space Indicated a Permit-Required 

Program was Necessary 

In early 2007, an Xcel safety consultant, at the request of the penstock recoating team, prepared the 

―Safety and Health Hazard Assessment Survey‖ for abrasive blasting inside the penstock, which lists 

confined space entry as one of the potential health hazards associated with the recoating work, in 

conjunction with applying epoxy or other surface coatings. The survey states that ―a confined space air 

monitor is required,‖ which is a key safety requisite in a permit-required confined space program. While 

this document was made part of the bid package and sent to potential contractors, Xcel did not implement 

a permit-required confined space program or issue permits for its personnel who entered the penstock on 

numerous occasions for inspection and maintenance. 

In addition, a KTA inspector completed a separate ―Initial Pre-Job Hazard Assessment,‖ which it 

submitted to Xcel on September 24, 2007, for abrasive blasting inside the penstock, explicitly indicating 

that the penstock was a permit-required confined space. 

 

41 In addition, the OSHA Permit-Required Confined Space rule states that these risks follow from one or more of 

the following causes: (1) flammable gas, vapor, or mist in excess of 10 percent of its LFL; (2) airborne 

combustible dust in a concentration that meets or exceeds its LFL; (3) atmospheric oxygen concentration below 

19.5 percent or above 23.5 percent; and/or (4) atmospheric concentration that could result in employee exposure in 

excess of its dose or permissible exposure limit. 

42 The terms LEL and lower flammability limit (LFL) have different definitions but are commonly used 

interchangeably. This report uses LEL except where citing other sources that use LFL in their standard or 

regulation. The OSHA Permit-Required Confined Space Standard 29 CFR 1910.146 uses the term LFL in its 

provisions. 

001656
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

60 

RPI wrote a number of partially completed confined space permits with air monitoring logs between 

September 11 and October 2, 2007, where the crew indicated that continuous air monitoring was required 

inside the penstock—another element of a permit-required confined space program.43,44

Although Xcel, RPI, and KTA acknowledged that elements of a permit-required space were necessary for 

the penstock work, the companies did not take the steps necessary – and required by OSHA – to manage 

the risks inherent in the space. 

6.1.2 The Known Work Activities in the Penstock Necessitated a PermitRequired Confined Space Program 

The potential atmospheric hazards related to future work activities in the penstock known to Xcel and RPI 

during the early stages of the penstock recoating project should have triggered the application of a permitrequired confined space program. These potential atmospheric hazards in the confined space included 

High carbon monoxide (CO) levels that caused air monitors to alarm and required the 

penstock to be briefly evacuated; 

Fumes created from welding conducted inside the penstock by an Xcel employee on two 

occasions; 

Irritating dust and breathing hazards created by abrasive blasting; and 

Flammable vapors generated while using MEK to flush and clean the sprayer. 

 

43 The logs typically listed only the gas detector readings for oxygen written on a page taken from RPI‘s multipage 

confined space permit form. No other pages of the permit form were completed 

44 Even number of the unsuccessful bidders for the penstock recoating project identified the penstock as a permitrequired confined space in their submissions to Xcel. A proposal from a prospective bidder on the recoating 

project stated that the penstock would be considered a permit-required confined space when certain activities were 

undertaken, such as abrasive blasting, abrasive cleanup, and epoxy application. 

001657
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

61 

6.1.3 Permit-Required Confined Space Inadequately Declassified 

Once work began at Cabin Creek, Xcel, RPI, and KTA treated the penstock as a non-permit-required 

space; however, the companies did not take the OSHA-required steps to formally declassify the penstock 

to a non-permit confined space. Indeed, had they taken the requisite steps to attempt to declassify the 

penstock, they would have determined that the penstock space could not have been safely declassified. 

OSHA‘s Permit-Required Confined Spaces Rule states that if an employer wishes to reclassify a permitrequired confined space as a non-permit confined space, the employer must develop monitoring and 

inspection data demonstrating that the space poses no actual or potential atmospheric hazards, and this 

data must be documented by the employer [29 CFR 1910.146(c)(7), 1910.146(c)(7)(i), 

1910.146(c)(5)(i)(F)]. Additionally, the employer is required to ―document the basis for determining that 

all hazards in a permit space have been eliminated, through a certification that contains the date, the 

location of the space, and the signature of the person making the determination‖ [29 CFR 

1910.146(c)(7)(iii)]. Neither RPI nor Xcel provided the CSB with a documented basis for declassifying 

the penstock space as non-permit required. 

More important, the penstock‘s unique size – more than 4,000 feet (1200 meters) long – makes it an 

exception in the Permit-Required Confined Spaces Rule for declassifying a space. The rule states that ―if 

isolation of the space is infeasible because the space is large or part of a continuous system (such as a 

sewer), pre-entry testing shall be performed to the extent feasible before entry is authorized and, if entry 

is authorized, entry conditions shall be continuously monitored in the areas where authorized entrants are 

working‖ [29 CFR 1910.146(d)(5)(i)]. The American Public Power Association (APPA), an industry 

organization for public utilities – of which Xcel is not – instructs its member organizations as follows: ―If 

a hazard increasing work activity is to take place in a confined space (i.e., welding, painting, working 

001658
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

62 

with solvents and epoxy), the air in the space shall be continuously tested for the presence of flammable 

or toxic gases and vapors or insufficient oxygen‖ (APPA, 2007).45

The expansive size of the penstock required continuous monitoring at the location of the work, which at 

the time of the incident was 1,450 feet (442 meters) from the access door; this continuous monitoring 

within the penstock was not being performed by the RPI crew, the KTA inspector, or any Xcel personnel. 

The penstock‘s large size and the companies‘ lack of documented basis for declassifying the space require 

it to be treated as a permit-required confined space. 

6.2 Lack of Pre-Job Safety Planning for Hazards 

Despite a lengthy period of over one year devoted to pre-job safety planning for the recoating project of 

the Cabin Creek penstock, the CSB noted that serious hazards identified by the Xcel recoating project 

team and RPI management were not addressed before work began (Section 4.1).

In early 2007, Xcel completed the ―Safety and Health Hazard Assessment Survey‖ for the recoating 

project; however, this assessment was incomplete, as it considered only the high pressure abrasive 

blasting work, not the recoating of the penstock interior (Section 4.1.1). As a result, the fire potential due 

to the use of solvents within the confined space of the penstock was not evaluated. 

As an experienced contractor and the seventh-largest specialty paint company in 2005, RPI would be 

reasonably expected to understand the need for safety during relining operations in confined spaces 

(Engineering News-Record, 2005). Indeed, documents from the RPI bid and safety program reveal that 

the company was aware of the potential hazards posed by the penstock itself and those created when 

performing spraying operations inside it. The RPI bid contained several references to prior projects where 

similar safety issues to that of the penstock were encountered, including limited access in confined spaces 

 

45 Although APPA is an industry association for public utilities, which Xcel is not, the good practice guidance 

APPA publishes is useful to both public and private utility groups. 

001659
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

63 

that created ―inherent risks.‖ RPI stated in its bid submission to Xcel that it handled these risks by 

providing training; confined space watch personnel; and emergency equipment, such as breathing 

apparatus and extraction devices. Whether these safety actions were actually implemented in the prior 

projects is unclear; however, that RPI listed them as precautionary steps taken in previous projects speaks 

to the company‘s familiarity with managing the hazards. Yet, training was less than adequate (Section 

9.0), and no emergency breathing apparatuses were provided to the work crew at the penstock. 

A KTA project engineer sent a review of RPI submittals46 for the penstock recoating project to the Xcel 

Reline Project Team Leader. The RPI coating application plan clearly states that the sprayer would be 

brought inside the penstock. The product-specific application procedures for the epoxy describe the short 

working time after the base and hardener are mixed and the need to flush the sprayer with a solvent before 

introducing the epoxy into the system and to clear any blockages as necessary in the spraying equipment 

during use. Based on his review, the KTA project engineer recommended including eight additions and 

clarifications to the contract between Xcel and RPI, three of which had safety implications.47 Yet the 

project engineer made no recommendations to Xcel concerning safeguards that would need to be 

employed if flammable solvents were used to flush the sprayer inside the penstock (such as ventilation 

and explosion-proof lights), nor did he provide recommendations for use of safer (e.g., nonflammable) 

solvents for flushing the sprayer. Xcel also had its own employees review the RPI bid submission 

documentation, but no actions were taken to manage the hazards associated with using flammables within 

a confined space. 

 

46 KTA reviewed a number of RPI‘s bid documents, including a surface preparation and coating application plan, a 

project schedule, product-specific application procedures, and product data sheets for the two-part epoxy material. 

47 The three additions that had potential safety implications were the need (1) for adequate heating inside the 

penstock, (2) to ensure the bulkheads were fitted with manways, and (3) to install strung lighting supplemented 

with spotlights. 

001660
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

64 

In the September 5, 2007, preconstruction meeting, Xcel and RPI management and safety personnel 

discussed the need for additional safety precautions for the recoating project. Handwritten notes on an 

agenda in the files of the Xcel safety director indicate that both a safety addendum to the contract (Section 

8.2.1) and the need to enforce Xcel‘s ―Stop Work Authority‖ policy during the recoating project were 

discussed. Additionally, the Xcel safety director‘s handwritten notes indicate his recognition of the need 

for an external rescue team during the penstock work. 

Months prior to the incident, the Xcel penstock recoat project leader emailed a power plant engineer and 

the Xcel plant manager stating that the contractors involved in the penstock work were requesting 

information concerning the site‘s confined space entry procedures, whether the air was being monitored, 

and who was responsible for the monitoring. The project leader received a reply email from the Xcel plant 

manager that this information would be covered in contractor orientation. This brief orientation –

consisting of a 30-60-minute checklist review of potential hazards – was held on three separate occasions, 

led by different Xcel personnel and attended by various members of the crew. During one of the sessions, 

the Xcel employee leading the orientation did learn that RPI would be using a ―ketone‖ solvent to clean 

the sprayer inside the penstock, but even after the incident he stated he was unaware if Xcel had received 

a copy of the solvent MSDS before epoxy application began. 

6.3 No Monitoring Plan Established 

Neither Xcel nor RPI had a monitoring plan established for safe entry and work inside the penstock. The 

OSHA Permit-Required Confined Spaces Rule discusses appropriate procedures for atmospheric testing 

to include evaluating the atmospheric hazards of the permit space that may exist or arise so that both entry 

procedures and safe entry conditions are clearly stipulated in advance of conducting work [29 CFR 

1910.146] (Appendix B). Recommended practices for monitoring potential flammable atmospheres 

suggest that any company performing atmospheric monitoring should implement a ―written, established 

protocol that describes the sampling procedures, sampling locations, and required sample collection time‖ 

(Levine, 2004, pp.35). Because hazardous gases or vapors may be stratified within the atmosphere, the 

001661
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

65 

location of air monitoring can significantly impact a worker‘s ability to determine if a flammable 

atmosphere exists. Additionally, the sampling procedures should address if continuous atmospheric 

testing is necessary. Criteria for determining this need includes work spaces with the potential for changes 

in work activities that ―may affect the composition, concentration, flow rate or volume, pressure and/or 

temperature of flammable liquids, vapors or gases‖ or changes in ―ambient conditions such as 

temperature, wind direction and wind speed‖ (Levine, 2004, p.36). Both of these factors were present in 

the penstock recoating work environment the day of the incident. 

However, interviews with surviving RPI employees revealed that the atmosphere was not monitored 

continuously in the work area inside the penstock. Instead, readings were taken only two to three times 

per day at the penstock entrance by the RPI attendant, which did not meet the OSHA Permit-Required 

Confined Spaces Rule requirement for continuous monitoring of entry conditions in the areas where 

authorized entrants are working if the permit space is large, or part of a continuous system, and where 

isolating the space is infeasible [29 CFR 1910.146(d)(5)(i)]. While this monitoring requirement is related 

to the size of the space and not to the specific hazard of using a flammable solvent in the confined space, 

RPI was nonetheless required to continuously monitor the work area in the penstock.48

6.4 No Evaluation of Hazards When Conditions Changed 

When work conditions inside the penstock changed from blasting to recoating, Xcel or RPI should have 

re-examined the space for new hazards, as per the OSHA Permit-Required Confined Spaces Rule.49 As 

listed in 6.1.2, the CSB noted that RPI workers experienced a number of potential hazardous atmospheric 

 

48 Post-incident, OSHA issued a willful violation to RPI Coating ($63,000 proposed penalty) [OSHA, March 21, 

2008, inspection 310470034, citation 2(9)] and serious violations to both Xcel and KTA ($4,500 proposed 

penalties, each) [OSHA, March 21, 2008, inspection 310470059, citation 1(9) and inspection 310470083, citation 

1(6), respectively] for not continuously monitoring the air during the penstock recoating project. 

49 The Rule states: ―When there are changes in the use or configuration of a non-permit confined space that might 

increase the hazards to entrants, the employer shall reevaluate that space and, if necessary, reclassify it as a permitrequired confined space‖ [29 CFR 1910.146(c)(6)] and certify it through the required documentation [29 CFR 

1910.146(c)(7)(iii)]. 

001662
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

66 

conditions within the penstock, including dust from abrasive blasting, flammable atmospheres from the 

use of solvents, welding fumes from hot work, and accumulation of toxic carbon monoxide from the use 

of an ATV with an internal combustion engine. Each time one of these hazards was introduced or 

encountered in the confined space, the permit should have been updated to accurately reflect the hazard(s) 

and the appropriate safeguards to protect the entrants and ensure that acceptable entry conditions were 

maintained. But neither RPI nor Xcel reassessed the hazards as conditions changed, thus these hazards 

were unmanaged.50

 

6.5 Safer Solvent Not Chosen 

As the application procedures supplied to both Xcel and RPI made clear, the use of the sprayer inside the 

confined space required the use of a solvent to flush and clean the sprayer, which would occur in the open 

atmosphere of the penstock at least daily, given the project work schedule. Flammable MEK was chosen 

as the solvent for the penstock recoating project. 

Bringing a flammable into a confined space to use in the open atmosphere increases the likelihood of a 

potential fire because it adds the second of the three conditions required for combustion: fuel, oxygen, and 

an ignition source – oxygen was already present in the penstock. Fire risk is significantly heightened 

because ignition sources can be difficult to identify and control where flammable liquids are being used. 

These hazards were not adequately assessed when MEK was chosen as the penstock recoating project 

solvent. 

6.5.1 The Hazards of MEK 

MEK is an organic chemical compound often used as a solvent in painting and industrial recoating 

activities. MEK is listed by the National Institute for Safety and Health (NIOSH) as ―highly flammable‖ 

 

50 The CSB also noted that none of the forms were filled out completely and only portions of forms were retained for 

some dates. 

001663
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

67 

(NIOSH, 1998). MEK is a Class IB Flammable Liquid, with a flash point below 73 °F (23 °C) and boiling 

point at or above 100 °F (38 °C) (NFPA 704, 2007b, Table 6.2; NIOSH, 1998). 

As a highly flammable liquid, MEK poses significant hazards if used in a work area and the safety risk 

potential increases dramatically when the location of work is within a confined space. The epoxy 

application procedure specifically highlights the flammability risk involved with the use of MEK,51 as do 

the MSDSs Xcel and RPI provided to the CSB.52 ,53

As part of its investigation, the CSB conducted a brief review of available MSDSs on MEK and found a 

number of MSDSs with warnings that the product should not be used in confined spaces.54 The MEK 

MSDSs – including the MSDS Xcel provided to the CSB55– warn that MEK vapors may cause a flash 

fire or ignite explosively, and that the solvent‘s vapors may travel considerable distance to a source of 

ignition and flash back.56 The MSDSs instruct the user to ―prevent buildup of vapors or gases to explosive 

concentrations.‖57 The various MSDSs also warn that MEK is sensitive to static discharge, so containers 

of the solvent should be bonded and grounded for transfer to avoid static spark.58

 

51 The procedures states in capital bold letters that MSDSs should be consulted and ―proper fire and ventilation 

procedures should be followed. 

52 The MSDS provided by Xcel states, ―DANGER! EXTREMELY FLAMMABLE LIQUID AND VAPOR. 

VAPOR MAY CAUSE FLASH FIRE‖ (emphasis in original), and the MSDS RPI provided to the CSB also states 

that MEK is ―EXTREMELY FLAMMABLE...vapors will accumulate readily and may ignite explosively‖ 

(emphasis in original). 

53 According to RPI, this MSDS was sent via fax to the Cabin Creek site by the company post-incident; it was 

provided to the CSB upon subpoena request in July 2008. 

54 Carboclor MSDS on MEK, June 2008; Sunnyside Corporation MSDS on MEK, 1/12/06; RAW Chemical 

Distribution Limited MSDS on MEK, 11/11/02; Linchem, Ltd. MSDS on MEK, 9/10/02. 

55 Mallinckrodt Baker, Inc. MSDS on MEK, 8/17/05 (retrieved online by Xcel Energy on 10/12/07 from 

www.jtbaker.com/msds/englishhtml/M4628.htm). 

56 Sunnyside Corp. MSDS on MEK, 1/12/06; RAW Chemical Distribution Limited MSDS on MEK, 11/11/02; 

Linchem, Ltd. MSDS on MEK, 9/10/02. 

57 Sunnyside Corp. MSDS on MEK, 1/12/06; RAW Chemical Distribution Limited MSDS on MEK, 11/11/02. 

58 Mallinckrodt Baker, Inc. MSDS on MEK, 8/17/05; Sherwin-Williams Co. MSDS on MEK, 10/2/07; Sunnyside 

Corporation MSDS on MEK, 1/12/06. 

001664
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

68 

Despite the warnings within the MSDSs about MEK‘s extreme flammability and RPI‘s own safety 

policies that require flammable liquids to be stored and handled in safety cans, 59 2- and 5-gallon (7.6 and 

19 liters) plastic buckets were used to transport and store MEK solvent in the penstock. One open 5-

gallon (19 liter) plastic bucket of MEK was placed under the solvent pump of the sprayer to supply 

solvent to the mixing block. After using MEK to clean out the spray wands, the 5-gallon (19 liters) plastic 

buckets of used solvent were left opened adjacent to the sprayer system instead of removed from the work 

area. Approximately 6 additional gallons (23 liters) of MEK were brought into the penstock in 2-gallon 

(7.6 liter) plastic buckets specifically to flush and clean the sprayer system immediately prior to the 

incident. Additionally, the MEK solvent was transferred from a 55-gallon (208 liter) drum in the storage 

trailer, hand-carried into the penstock, and stored in plastic buckets around the work area; these buckets 

were reportedly not covered when inside the penstock prior to and during the solvent cleaning process. 

6.5.1.1 Evidence that Xcel and RPI Knew that MEK would be Used 

While Xcel has disputed its knowledge of the use of MEK in the penstock recoating project, from the 

totality of evidence – including the fact that the Xcel project scheduler stated he was made aware that RPI 

would be using a ―ketone‖ during the recoating work – the CSB has concluded that Xcel was aware of the 

use of flammable solvent in the penstock, and that both companies were aware that MEK solvent would 

be used during the epoxy application process. 

Xcel sent all potential bidders for the penstock recoating project the document ―Surface Preparation and 

Repainting of Interior of the Cabin Creek Penstock‖ prepared by KTA and reviewed by a number of Xcel 

employees involved in the penstock project planning, which states that a solvent would be used within the 

 

59 RPI‘s ―Fire Protection and Prevention‖ policywithin its IIPP, as well as several others requires all flammable 

liquids to be stored and handled in safety cans. A safety can, as defined in the IIPP, is an approved container of not 

more than 5 gallons capacity, having a flash arresting screen, spring closing lid and spout cover.

001665
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

69 

penstock for initial cleaning of the surface, and instructs the bidders on appropriate storage methods for 

solvents and thinners during the project. 

As part of its bid submission package to Xcel, RPI provided the three-page ―Surface Preparation and 

Application Guide‖ from the manufacturer of the two-part epoxy product, that also referenced the need 

for a solvent for cleaning purposes. During the bid evaluation and selection process, this contractual 

documentation was reviewed by numerous management and safety personnel from both companies. 

In August 2007, RPI‘s vice president provided the Xcel Cabin Creek project manager with the more 

detailed epoxy ―Specification and Application Procedures,‖ which discusses the use of solvents in the 

recoating process several times.60

Once RPI was onsite, evidence of the planned use of MEK within the penstock was witnessed by workers 

and supervisors from both companies. On September 12, 2007, 110 gallons (416 liters) of MEK [two 55-

gallon (208 liters) drums] was delivered to the Cabin Creek site and signed for by an RPI crew member. 

According to testimony of the crew, the Xcel principle engineer and project scheduler witnessed the 

delivery of the MEK and confirmed with the crew that it was the solvent being delivered. 

That same day, RPI conducted a test spray with the epoxy products and solvent on the Xcel Cabin Creek 

site. Five gallons of MEK were purchased for the test spray and used afterward to clean the equipment. 

The Xcel principle engineer was present during these activities and signed off on the invoice for the 

solvent and epoxy. 

 

60 The procedure document instructs that, upon initial setup, ―solvent should be flushed through the line to check for 

any foreign matter, leakages, or blockages.‖ These procedures state that if blockages or other stoppages occur, 

―immediately shut off the heater, and place a clean bucket of solvent underneath the pump and flush the lines.‖ It 

goes on to state that merely spraying the material will build pressure and cause the epoxy product to begin to set; 

as a result, the user is instructed to ―flush solvent through the system‖ and ―re-circulate solvent until the pump and 

lines are clear.‖ Finally, the procedures provide guidance about cleanup: ―Any mixing and application tools should 

be immediately wiped or scraped clean. Any residue can be removed with a solvent, such as 1,1,1-trichloroethane, 

MEK or an appropriate blend.‖

001666
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

70 

6.5.2 Safer Alternatives

None of the companies considered safer alternatives to the flammable MEK, nor did they identify work 

tasks involving the solvent that could have been performed outside the penstock. 

One significantly less hazardous option is a citrus-based solvent, a variety of which are available for 

industrial purposes and are often biodegradable, non-toxic, and have significantly higher flash-points than 

flammable solvents like MEK.61 ANSI Z117.1, ―Safety Requirements for Confined Spaces‖ recommends 

that the hierarchy of controls be followed to address confined space hazards [ANSI Z117, 2009, p.17]. 

Using this method of hazard control, primary consideration is given to eliminating the hazard or using 

engineering controls such as substitution; for instance, using less hazardous, non-flammable substitute 

solvents for the highly flammable MEK. 

Another more effective safety approach within the hierarchy of controls would have been to conduct the 

work outside the confined space.62 In the Cabin Creek penstock incident, while the hoses from the mixing 

block to the spray wands required immediate flushing due to the mixing the two-part epoxy, the sprayer 

itself did not need to be cleaned inside the confined space. 

6.6 Xcel’s and RPI’s Confined Space Policies

Xcel‘s and RPI‘s corporate confined space policies in effect prior to the incident did not effectively 

establish safe limits for flammable atmospheres that would prohibit entry or occupancy when the limits 

were exceeded. Xcel‘s corporate confined space policies did not effectively establish acceptable entry 

conditions for flammable atmospheres as a specific percentage of the LEL, nor did they provide explicit 

 

61 A less flammable, but still hazardous, option is 1,1,1-trichloroethane. This organic compound has a history of use 

as a solvent within the industrial painting industry; however, its use has lessened due to its toxicity. The 

manufacturer of the two-part epoxy used in the penstock recoating project has communicated that several nonflammable solvents would be effective for cleanup activities, including n-Propyl Bromide and citrus-based 

products. 

62 The United Kingdom Confined Spaces Regulation [Statutory Instrument 1997, No. 1713] imposes the duty of first 

avoiding entry into the confined space by conducting the work outside the space, unless entry is unavoidable. 

001667
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

71 

warnings to prohibit entry or occupancy based upon a specified flammable atmosphere limit. Xcel‘s 

confined space permit form allowed entry even when ―atmospheric and/or serious hazards in the space 

that cannot be controlled or eliminated‖ were present, if certain unspecified precautions were being 

implemented. The confined space entry policy in effect at the time of the incident of Northern States 

Power Company, a subsidiary of Xcel, however, provides effective specific entry and occupancy limits 

for flammable atmospheres. The policy establishes 10 percent of the LEL as an alarm point and states: 

―If the air monitor alarms all entrants shall immediately evacuate the space.‖ After the Cabin Creek 

incident, Xcel revised its confined space policy with improvements that designated greater than 10 

percent of the LEL as an ―alarm limit.‖ However, the new policy does not explicitly prohibit entry or 

occupancy based upon the alarm limit, unlike the Northern States‘ policy.

RPI‘s confined space entry policy and permit provided to Xcel as part of the contractor selection process 

did not provide for safe entry and occupancy limits or effectively prohibit entry when those limits were 

exceeded. Neither the policy nor the permit defined a hazardous atmosphere or provided for acceptable 

confined space entry conditions. 

The failure of Xcel‘s and RPI‘s confined space policies to establish safe flammable limits undermines the 

importance of monitoring in permit-required confined spaces; the need for periodic or continuous 

monitoring will not be effectively communicated to managers and workers if no limits are specified. This 

safety gap can also lead to a failure to address the serious hazards of flammable atmospheres, as was the 

case in the Cabin Creek penstock. 

001668
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

72 

7.0 Emergency Response and Rescue 

The CSB determined that the flash fire inside the penstock occurred at approximately 1:55 p.m. and the 9-

1-1 call was placed at 2:03 p.m.. While the initial emergency responders arrived at the Cabin Creek site in 

less than 10 minutes from the dispatch notification, the first community emergency responder capable of 

performing a confined space rescue operation, West Metro Fire Rescue, did not enter the property for 

more than an hour and a half after the fire started due to their distant location. The trapped workers likely 

succumbed to smoke inhalation about one hour prior to West Metro‘s arrival. An immediately available 

qualified confined space technical rescue provider likely would have been able to effectively control the 

fire and prevent the worker fatalities. However, no such rescuers were immediately available outside the 

penstock on the day of the incident. 

The lack of competent technical rescue services at Cabin Creek was the result of: 

Xcel‘s and RPI‘s lack of a competency evaluation of available confined spaces rescue services, as 

required by the OSHA Permit-Required Confined Spaces Rule; 

The failure of Xcel and RPI to identify the life-threatening hazards of using flammable solvents 

in the penstock and arrange for immediately available emergency response services onsite prior to 

the start of the epoxy application. 

As a result of not evaluating the competency of available emergency service providers to perform permitrequired confined space rescue, nor arranging for emergency response support to be onsite prior to the 

start of the penstock work activities, neither Xcel nor RPI were prepared to handle a confined spaces 

emergency such as they experienced on October 2, 2007. And because the first responders to the incident 

were voluntary firefighters without the training or qualifications to peform permit-required confined space 

rescue, no one was immediately available and capable to successfully enter the penstock to rescue the 

trapped workers. The CSB also notes that alternative egress and/or safety chambers were not provided in 

001669
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

73 

the penstock and the State of Colorado lacked a training and certification program for technical rescuers 

including confined space technical rescue. 

7.1 Lack of Preparation by Xcel and RPI to Ensure Availability of 

Qualified Rescue Personnel 

The OSHA Permit-Required Confined Spaces Rule [29 CFR 1910.146(k)] requires the employer to either 

arrange for a competent outside rescue and emergency services provider, or ensure that its employees can 

perform rescue and emergency services competently when they are working within a permit-required 

confined space. However, RPI and Xcel did neither. 

The emergency response and rescue preparation conducted by Xcel and RPI ineffectively consisted of 

instructing RPI personnel that, in the event of an emergency inside the penstock, 9-1-1 would be called by 

Xcel personnel. On October 2, 2007, this was the emergency response step taken. Unfortunately, the first 

and closest emergency responders arriving at the Cabin Creek site were not prepared for entry into the 

penstock‘s confined space. Approximately less than 10 minutes after the 9-1-1 call, the first community 

emergency responder to arrive onsite was the Clear Creek County Sheriff‘s office, who established the 

Incident Command. Several volunteer Clear Creek County Fire Authority (CCFA) emergency medical 

and firefighters arrived next, but none of these responders had the necessary equipment or training to 

extinguish the fire in the penstock or initiate a rescue of the trapped RPI personnel.63 Additionally, the fire 

service organizations had no pre-knowledge of the hazards of the chemicals onsite, their quantities, or 

locations. The site was not pre-equiped with appropriate firefighting equipment specific to the unique 

hazards of the penstock. Such planning and communication should have been implemented with 

designated emergency responders in advance of any recoating work being conducted withtin the penstock. 

 

63 This was noted by the Xcel control room operator, who added the following entry in the control room logbook: 

―14:20 Emergency services w/out confined space fire training – they have summoned a Denver team.‖

001670
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

74 

When an employer chooses to rely on an outside rescue and emergency service, the OSHA Confined 

Spaces Rule requires the employer to evaluate the service‘s ability, in terms of proficiency with rescuerelated tasks and equipment, to function appropriately while rescuing entrants from the particular permit 

space or types of permit spaces identified [29 CFR 1910.146(k)(1)(ii)]. However, neither Xcel nor RPI 

evaluated CCFA‘s or other nearby responders technical capabilities. 

Had Xcel and RPI arranged for a competent outside rescue and emergency services provider prior to 

beginning work inside the penstock and supplied the provider with pertinent information about the 

chemicals being used within the confined space, the first responders to the incident would likely have 

been prepared for entry, firefighting, and rescue activities. 

7.2 Failure by Xcel and RPI to Arrange for Timely Rescue 

Local fire service officials told the CSB that any attempted rescue of the trapped RPI workers could have 

been successful only with sufficient numbers of responders and the appropriate equipment immediately 

available onsite to fight a fire that was more than 1,450 feet (442 meters) inside the penstock. 

The OSHA Permit-Required Confined Spaces Rule requires that emergency response be timely, based on 

the specific hazards involved in the entry. According to a December 9, 2003, settlement agreement 

between OSHA and the American Petroleum Institute (API), a ―timely‖ response to a confined space 

emergency depends on the hazards the entrants may face. If entrants encounter hazards that are deemed 

potentially Immediately Dangerous to Life and Health (IDLH), 64 a rescue team must be stationed outside 

the confined space and ready for immediate entry. The use of MEK inside the penstock created the 

 

64 IDLH or Immediately Dangerous to Life or Health, is a personal exposure limit for a chemical substance set forth 

by the National Institute of Occupational Safety and Health (NIOSH); it is typically expressed in parts per million 

(ppm). OSHA‘s Permit-Required Confined Spaces rule for general industry states that IDLH ―means any condition 

that poses an immediate or delayed threat to life or that would cause irreversible adverse health effects or that 

would interfere with an individuals ability to escape unaided from a permit space‖ [29 CFR 1910.146(b)].

001671
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

75 

potential for a flammable atmosphere and life-threatening conditions in the event of an ignition, 

especially when coupled with a single exit for evacuation. 

An immediately available rescue and response team is especially important for a worksite like Cabin 

Creek, which is situated in a remote mountainous location where timely response would be extremely 

difficult. 

Depending on the road conditions, vehicle type, and speed, driving the 5.5 miles (8.9 kilometers) from the 

Georgetown fire station – the closest community emergency response facility – to the Cabin Creek 

hydroelectric plant takes between 10 and 30 minutes. At the time of the incident, the only improved road 

to the site, Guanella Pass, was steep, narrow, and winding (Figure 11). This road had no guardrails, was 

partially unpaved with loose gravel and potholes, and has many hairpin turns that made it hazardous to 

drive at speeds above 20 miles an hour (32 kilometers per hour).65

 

65 CCFA personnel told the CSB investigators that the turns were so tight that one of their fire support vehicles had 

to completely stop and back up several times to navigate through the turns. 

001672
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

76 

Figure 11. The winding, steep and narrow road from Georgetown to the Xcel hydroelectric plant 

7.2.1 Requirements and Recommendations for Alternate Escape Routes or 

Safety Chambers 

While the need for immediately available qualified technical rescue services was critical given the 

hazards in the penstock, another safety precaution that should have been taken by Xcel and RPI was to 

plan for an alternative escape route out of the penstock or a safety chamber within it. However, there was 

no plan for an alternate escape route out of the penstock if the primary route were to be blocked in an 

emergency.66

The penstock is a 4,163-foot (1269-meter) long sloping, underground confined space that required an 

access door in the side of the penstock to be cut for the recoating work crew to enter; this access opening 

 

66 Bid documents indicate that one of the unsuccessful bidders contemplated building a stairway to an egress 

opening in the mushroom. 

001673
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

77 

was effectively the only way in or out of the penstock for RPI workers. Once the penstock starts its 55 

degree incline, it is physically impossible to traverse the penstock without climbing paraphernalia setup in 

advance from the mushroom67 and individual skill and qualifications in rigging and rope climbing, which 

none of the contractors were prepared or trained to do from inside the penstock. All of the deceased RPI 

workers were found beyond the west bulkhead with most near the start of the 55 degree incline. 

The need for secondary escape routes from penstocks is identified in the American Society of Civil 

Engineering (ASCE) Task Committee‘s ―Guidelines for Inspection and Monitoring of In-Service 

Penstocks‖ (ASCE, 1998, Section 2.3.6.1). 

Alternatively, a safety/rescue chamber68 inside the penstock could have housed fresh air, water, and 

reliable communication equipment for the trapped workers. The CSB notes that a useful guidance 

document was published in 2009 by the National Institute for Occupational Safety and Health (NIOSH) 

addressing instructional materials on refuge chamber setup, use, and maintenance (2009). At a minimum, 

self-contained breathing apparatuses could have been placed west of the west bulkhead, so that potentially 

trapped workers would have access to fresh air until rescue could be performed.69

Addressing the lack of secondary egress hazard by creating an alternative/emergency exit or installing a 

rescue chamber,70 and staging qualified emergency rescuers near the penstock entrance would have likely 

have prevented the fatalities in this incident. 

 

67 In September 2007, Xcel employees used climbing equipment to enter the penstock from the mushroom‘s vertical 

shaft entrance to inspect the interior for potential wear and damage of the concrete portion of the penstock. 

68 A safety/rescue chamber is an airtight chamber stocked with food, water, and oxygen, and typically used in 

underground mines. Such a chamber recently saved 72 miners who were trapped underground for 30 hours at the 

Mosaic Potash Mine in Saskatchewan, Canada. 

69 Three people survived a Bunker, Missouri, mine fire in January 2010 although their escape route was blocked by 

burning equipment; the mine had a rescue chamber with compressed air supplies that kept them alive until rescue 

teams were able to save them six-and-a-half hours later. 

70 This list also is not intended to be all inclusive, as other solutions could include actions such as increasing the 

ventilation and installing fire suppression. 

001674
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

78 

7.3 Lack of a Technical/Confined Space Rescue Certification 

Progarm for Volunteer Firefighters 

The first responders to the Cabin Creek penstock fire were local voluntary firefighters from the CCFA; 

none of these individuals held technical rescue qualifications or had received up-to-date workplace 

confined space training. The significant hazards inherent with confined spaces require specialized training 

and certification. 

The Colorado Department of Public Safety, Division of Fire Safety, administers the firefighter voluntary 

certification program [8 CCR 1507] in the state. The purpose of this program is to measure the level of 

knowledge, skills, and abilities of firefighters and to attest that they meet nationally recognized standards. 

At the time of the incident, the state had certifications for various levels of firefighters and fire officials, 

fire inspectors, fire instructors, hazardous materials responders, fire apparatus drivers, and emergency 

medical first responders, but no certification program for technical and/or confined space rescue. 

Interviews with Division of Fire Safety personnel revealed that the state does not track how many 

firefighters in the state are trained or certified in technical rescue because there is no certification program 

for this specialty. Interviews with various state fire officials revealed that several fire service and response 

organizations have achieved the operational capacity to conduct technical rescue, including confined 

space rescue71; however, only a small number of Colorado firefighters have been individually certified to 

perform technical rescue.72

 

71 NFPA 1670: Standard on Operations and Training for Technical Search and Rescue Incidents (2009) issued by the 

National Fire Protection Association (NFPA), establishes levels of functional capability for conducting technical 

rescue operations. Several Colorado fire service and responder organizations have been deemed to have 

established functional capability under this standard, including organizations affiliated with the Colorado Urban 

Rescue Task Force. NFPA 1670 does not, however, address individual technical rescuer qualifications. 

72 NFPA 1006: Technical Rescuer Professional Qualification (2008) establishes job performance requirements for 

rescue technicians. 

001675
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

79 

At the time of the penstock incident, only two entities in the region were identified to have the 

organizational experience and training to handle the technical rescue issues this incident presented: West 

Metro Fire Rescue,73 located in Denver (45 miles or 72 kilometers, approximately 1 hour 15 minutes 

travel time); and the Henderson Mine,74 located near Empire, Colorado (21 miles or 34 kilometers, 

approximately 35 minutes travel time). The CCFA contacted and requested both to support the incident; 

due to the time each required to assemble a rescue team and travel to the Cabin Creek site, neither arrived 

at the penstock until approximately an hour after the trapped workers succumbed to smoke inhalation. 

State fire officials informed the CSB that the availability of state voluntary certification for technical 

rescue, including confined space rescue, would improve the capabilities and capacity of Colorado fire 

service personnel to respond to events similar to the Cabin Creek incident. 

 

73 Members of the West Metro Fire Rescue have been trained in technical rescue in confined spaces as part of their 

duties as members of a regional FEMA Urban Search and Rescue Team, but were unfamiliar with the 

configuration of the Cabin Creek penstock 

74 Although the rescue team at the Henderson Mine is not trained in confined space rescue, the team has specialized 

training in underground mine rescue. As the penstock was bored through solid granite, it has many of the same 

characteristics and hazards as an underground mine. This rescue team is a private entity and not a public 

emergency response organization. 

001676
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

80 

8.0 Contractor Selection and Oversight 

Having both a strong contractor selection methodology and contractor oversight policy ensures that the 

owner receives both quality work from its contractors and worker safety is maintained for its own 

employees and those of the contractor. However, neither the methodology nor the oversight Xcel 

employed for the Cabin Creek penstock project adequately ensured that the recoating work would be 

conducted safely. 

8.1 Contractor Selection 

Xcel‘s contractor selection methodology did not disqualify contractors with substandard safety records 

from bidding on the penstock project. 

8.1.1 Contractor Selection Process for the Penstock Project Request for 

Proposal 

In April 2007, Xcel initiated the competitive bidding process to select a coating contractor for the Cabin 

Creek penstock recoating project. The company issued an RFP 75

 to several contractors who were to be 

selected based upon the ―best value/best overall evaluated offer‖76 rather than price alone. The Xcel RFP 

stated that the contractor would be evaluated, scored, and chosen using weighted rating factors, such as 

pricing (15%), safety experience modification rate (EMR)77 (5%), historical quality of services and 

equipment (10%), operating history (10%), completeness of proposal (5%), and key personnel experience 

 

75 Xcel used the RFP procurement method for selecting suppliers of goods and services in more substantial 

acquisitions or projects. 

76 The ―best value‖ procurement method considers a variety of factors in selecting contractors in addition to price, 

such as experience with similar projects, on-time completion, employee training, and safety record (TRB, 2006, 

p.S-3). 

77 EMR is used by the U.S. insurance industry ―to determine premiums for workers‘ compensation insurance. An 

EMR less than 1 indicates above-average injury and illness performance, and an EMR greater than 1 indicates 

below-average performance. An owner can get some indication of a contractor‘s past safety performance by 

reviewing the contractor‘s EMR. A comparison of the EMRs of contractors bidding on a project may improve the 

selection process‖ (API RP 2220, 2005a, p.13). The RFP called for reporting the interstate EMR. 

001677
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

81 

and continued availability (5%).78 The RFP also established minimum qualifications and experience, 

including the need for at least five years of successful similar recoating experience and a QP 1 

certification from the Society for Protective Coatings (SSPC), an industrial protective coatings trade 

association. 79 The Xcel contractor selection process for larger projects, such as the Cabin Creek penstock 

recoat, also included a prequalification80 step that examined the contractor‘s financial capacity to 

successfully perform the work; however, the prequalification step did not consider safety performance. 

Xcel‘s first attempt to select a contractor was unsuccessful. Of the three bidders submitting proposals, 

only one bid, from Certified Coatings Company (CCC), was evaluated as technically and commercially 

complete; however, its proposal was $450,000 above the budgetary allotment. Rather than increase the 

capital budget, Xcel re-bid the penstock project to find additional interested contractors. In late July 2007, 

an Xcel team that included the Cabin Creek plant manager and the penstock recoat project manager 

evaluated and scored the second group of proposals from four bidders. 

 

78 Other rating factors were exceptions to terms and conditions (10%), compliance with performance guarantees 

(15%), technical exceptions (5%), creative proposal options (10%), and QP 1 Certification/Experience (10%). 

79 SSPC certifies coating contractors based on demonstrated competence in areas such as technical capabilities, 

safety and environmental compliance, quality control, and management procedures. The certification process 

requires an evaluation of submittals to SSPC and an onsite audit of an active job site to verify that the stated 

programs are implemented. SSPC has established a QP 1 disciplinary action system with criterion for issuing 

warnings and placing contractors on probation or suspension based upon the severity of critical faults or violations 

in the areas of competence. (SSPC, http://www.sspc.org/certification/PCCP/QP1main.html , 

http://www.sspc.org/certification/PCCP/DAC.html, accessed March 8, 2009.) 

80 Contractor selection processes often have an initial prequalification during which each potential contractor must 

meet basic qualifications, including safety. A prequalification process is typically pass/fail; owners evaluate 

contractors and craft workers to determine if they meet the identified criteria and only firms that meet or exceed 

those requirements are allowed to bid in the final selection process. In this case, Xcel‘s prequalification process 

considered only the financial capacity of the potential contractor. 

001678
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

82 

8.1.2 RPI Safety Record “Not Acceptable,” but Allowed to Bid 

The top two evaluated proposals from the second round of bidding were from CCC and RPI.81 Xcel‘s

project manager summarized the results of the proposal evaluations stating ―from a technical and quality 

perspective, Certified Coatings (CCC) is the best evaluated proposal. They are at least $500 k over 

budget. The second best evaluated proposal is Robinson-Prezioso (RPI). Their safety EMR is high[,] 

although their OSHA incident rate does not reflect a safety problem. Their proposal is very close to 

budgetary requirements.‖ The KTA consultant assisting Xcel stated that RPI‘s high EMR may have been 

the result of fatalities from their work on the ―recent Golden Gate bridge project.‖82 The RPI EMR was 

trending upward from 1.03 in 2005 to 1.28 in 2006; the contractor evaluation team was aware that under 

Xcel‘s policies, an EMR rate of 1.0 or above was unacceptable. In fact, the Xcel team gave RPI‘s 

proposal a safety rating of ―zero‖ in the evaluation process. The RFP evaluation form the team used 

states that the rating of zero signifies that the bidder‘s proposal for that rating criterion ―does not meet 

minimum requirements [and means] automatic rejection.‖83

RPI‘s penstock recoating proposal, however, was not rejected. The Cabin Creek plant manager concurred 

with the project manager: ―I agree with you that RPI be the one selected due to cost and the fact that they 

are qualified.‖ He recommended that the Xcel Colorado safety supervisor evaluate RPI‘s safety record 

and contact the contractor to discuss its EMR number. The project team asked the safety supervisor to 

investigate ―whether a pattern of negligence is evident for this company [RPI].‖ When the Xcel safety 

 

81 RPI‘s total score of the weighted rating elements was 4.3 with a technical ranking of 2.9; CCC‘s total score was 

4.25 with a technical ranking of 2.95. RPI‘s bid was slightly over $1.3 million and CCC‘s was $1.7 million, a 

difference of less than $400,000. 

82 RPI had two fatality incidents during the Golden Gate retrofitting project. In September 2001, a passing motorist 

was killed by a falling scaffold. Then, in January 2002, an employee was crushed and four co-workers were 

injured when a platform buckled as it was being lowered onto a truck (Bjelland, S., et al., 11 Oct 2007). 

83 The Cabin Creek recoating proposals were rated with a scoring system that ranged from 0-5, with ―0‖ representing 

the lowest score and defined on the scoring sheet as ―does not meet minimum requirements, automatic rejection.‖ 

The rating score of ―5‖ was defined as ―exceeds all requirements.‖

001679
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

83 

supervisor inquired, the RPI safety director stated that the company‘s EMR was high due to the Golden 

Gate Bridge job and that the company‘s EMR was trending down in 2007.84

8.1.3 Contractor Selection and Safety: Historical Background 

An influential Business Roundtable report published in 1982, ―Improving Construction Safety 

Performance,‖ found that construction was one of the ―most hazardous occupations‖ in the U.S. with a 54 

percent higher injury and fatality rate based upon data from that period.85 The report determined that 

contractors with a history of positive safety performance are more likely to perform safely in the future 

than those with a poor safety record. The report recommends that safety be considered when selecting 

construction contractors and that factors such as past safety performance and present safety capabilities be 

evaluated. The report includes a model safety prequalification form for use in selecting contractors. 

A 2008 comprehensive report on contractor safety prequalification, ―Contractor Safety Prequalification,‖

(Phillips and Waitzman, 2008) refers to a 1991 John Gray Institute report, ―Managing Workplace Safety 

and Health: the Case of Contract Labor in the U.S. Petrochemical Industry,‖ as a ―bellwether‖ for 

subsequent industry interventions addressing contractor safety, including the issue of contractor safety 

 

84 This information is not completely accurate. OSHA‘s ―300 Log of Work-Related Injuries and Illnesses for 2006,‖ 

the year that RPI experienced an EMR of 1.28, listed no injuries or illnesses that occurred in the area of the Golden 

Gate Bridge or the Bay Bridge in California. Robison-Prezioso, Inc. was cited by OSHA for a fatality incident on 

a Bay Bridge on January 4, 2002, and another fatality incident on the Bay Bridge on September 25, 2001, where a 

motorist was killed. Both of these cases are still listed as ―open‖ on the OSHA website. The reference to the 

―Golden Gate Bridge‖ and RPI‘s high EMR rate was made by the Colorado Safety Supervisor in the Safety 

Addendum to the penstock contract signed by both parties. 

http://www.osha.gov/pls/imis/establishment.inspection_detail?id=300890555 , 

http://www.osha.gov/pls/imis/establishment.inspection_detail?id=300890100 , accessed June 4, 2009. 

85 The Business Roundtable represents the CEOs of some of the largest corporations in the U.S. The association 

develops policy and advocates positions on diverse issues such as workforce development, sustainable growth, and 

corporate leadership. CURT is an independent offshoot of the Construction Committee of the Business Roundtable 

and represents the viewpoints of member construction owners seeking to improve construction industry practices 

including safety performance [CURT, 1990]. 

001680
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

84 

prequalification.86 The report found an association between rigorous screening in the selection of 

contractors and positive safety performance (Phillips and Waitzman, 2008, pp.49-50).87

8.1.4 Contractor Selection and Safety: Current Industry Guidelines

Recent studies note a modern trend of alternative procurement methodologies that use factors other than 

low price to select construction contractors, such as quality, past performance, and safety88 (TRB, 2006, 

pp.40). Several organizations and industry associations, including the Construction Users Roundtable 

(CURT),89 the American National Standards Institute (ANSI), the American Industrial Hygene 

Association (AIHA), and FM Global, have developed guidelines and recommended practices addressing 

the use of safety criteria for selecting contractors. One common method is prequalification, typically a 

pass/fail system that ensures that only contractors who meet specific requirements, including safety, are 

allowed to compete (CURT, 2004, pp. 1, 5). Another common alternative construction procurement 

 

86 While the John Gray Institute report addresses contractor safety issues in the petrochemical industry, recent 

reports note the applicability of the conclusions from the 1991 report to general industry construction safety 

(Phillips and Waitzman,2008, pp.49-50). A case study examining the protection of contract workers at the 

Department of Energy‘s facilities found the John Gray Institute report to be the ―most comprehensive study of 

safety related to contract labor‖ (Gochfeld and Mohr, 2007, pp.1607-1613). 

87 In 1989, an explosion and fire at the Phillips Chemical Complex in Pasadena, Texas, killed 23 and injured 232 

workers. In the wake of the Phillips‘ incident, OSHA released a report to the President of the United States that 

identified multiple safety system failures that led to the incident including contractor safety issues (1990, pp.25-

26). As a result, OSHA commissioned a major study to examine the health and safety issues related to the use of 

contractors in the U.S. petrochemical industry. OSHA specifically directed that the study examine the ―the role of 

safety and health in the selection of contractors‖ (1990, p.64). Consequently, the John Gray Institute report used 

industry national surveys and case studies to understand the extent to which safety performance was considered in 

the selection of contractors (2006, pp.85-91). Partly in response to the John Gray report, OSHA‘s contractor safety 

requirements in the Process Safety Management Standard, C.F.R. 1910.119, include a requirement that employers 

when selecting a contractor ―shall obtain and evaluate information regarding the contract employer‘s safety 

performance and programs,‖ 1910.119(h)(2)(ii).

88 The TRB (Transportation Research Board) report addresses highway procurement; however, the discussion of 

procurement methodologies more generally references industry or public sector procurement trends. 

89 CURT is an industry organization that promotes advocacy by users of construction services on national issues that 

includes ―developing industry standards and owner expectations with respect to safety, training and worker 

qualifications‖ http://www.curt.org/2_0_about_curt.html, accessed 10/27/09. CURT is composed of 66 member 

companies, organizations, and government entities that represent some of the largest industrial corporations and 

users of construction services in the U.S. including DuPont, ExxonMobil, Dow Chemical, Intel, Proctor & 

Gamble, Duke Energy, General Motors, Shell, the U.S. General Services Administrations, and the U.S. Army 

Corp of Engineers. 

001681
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

85 

method is referred to as ―best value‖ contracting where, in addition to price, other key factors such as 

safety can be considered in evaluating the bid package—this method typically involves a rating system 

where bidders are scored and the highest evaluated bidder is selected (TRB, 2006, pp. S-2 – S-8). A third 

common procurement method combines prequalification and best value practices: only prequalified 

bidders are allowed to compete in the final selection process and the evaluation and rating of the bidders 

is based on best value parameters (CURT, 2005, pp.6-9; TRB, 2006, p.1). Xcel used both prequalification 

and best value components in its selection of the Cabin Creek penstock recoating contractor. 

Industry guidelines addressing contractor selection support using a prequalification process that includes 

safety criteria. CURT has developed user practices addressing safety and contractor selection that are 

intended to educate CURT members and industry. The CURT User Practice, ―Construction Safety: The 

Owner‘s Role,‖ states that ―[c]ontractors must be prequalified by the owner to participate in the final 

contractor selection process. Demonstrated safety performance is a critical criterion used in the 

prequalification process‖ (CURT, 2004b, p.6). CURT guidance lists a variety of typical criteria for safety 

prequalification: staff qualifications, accident history, EMR, a contractor‘s safety program, and an 

owner‘s previous experience.90 Safety guidelines published by the AIHA, ―Health and Safety 

Requirements in Construction Contract Documents‖ identify a number of specific prequalification criteria 

including EMR, OSHA injury and illness logs, OSHA citations, and training certifications. ANSI 

Standard Z-10, ―Occupational Health and Safety Management Systems‖ also recommends that the 

 

90 The CSB noted in its BP Texas City investigation report (2007) that particular attention must be given by 

companies in developing effective safety performance metrics, which should include leading and lagging 

indicators (pp.184-185). Additionally, performance metrics that are commonly utilized may be inappropriate in 

some circumstances. For example, one contractor safety standard noted that the use of EMRs may not always be 

effective (API Standard 2220, 2005a, p.13). 

001682
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

86 

contractor prequalification process include consideration of safety criteria for successful contractor safety 

performance management91 (ANSI/AIHA Z-10, 2005, p.20). 

8.1.5 Xcel Corporate Policies on Contractor Selection 

Xcel had corporate policies in place prior to the incident that addressed contractor safety and the role of 

safety in selecting contractors. However, while these policies allowed a prequalification process to be 

used, and a rating and ranking RFP competitive bid process that awarded the contract to the ―lowest 

evaluated bidder,‖ using a prequalification process was not mandatory and the minimum specified 

requirements were left to the procurement representative. Thus, the use of safety criteria in the 

prequalification process was not required, nor was it considered in the prequalification step at the Cabin 

Creek project. 

In addition to the score of zero that RPI received, the Xcel evaluation team was also aware of RPI‘s 

accident history that involved fatalities. Had Xcel examined RPI‘s OSHA inspection database and other 

sources publically available, they would have discovered a lengthy history of serious OSHA citations, 

including a number of violations specifically involving the unsafe handling of flammable liquids 

(Appendix B). Although the terms of the RFP relied on contractors to self-report accident histories, RPI 

did not provide Xcel with records related to several other serious relevant regulatory actions. 92, 93

 

91 API Recommended Practice (RP) 2221, ―Contractor and Owner Safety Program Implementation‖ also 

recommends contractor prequalification using a variety of safety criteria. The recommended practice states that 

―[t]he selection of a qualified contractor is the first step toward obtaining safe contractor performance‖ (API RP 

2221, 2005b). API‘s RP 2221 provides a comprehensive prequalification form that includes 48 questions and data 

requests. While the API publication addresses refining and petrochemical industry facility owners, it is persuasive 

guidance for general industry to improve contractor safety performance, particularly in performing hazardous 

repair, maintenance, and construction as in the Xcel penstock recoating project. 

92 In 2006 RPI agreed to pay a penalty of $145,000 to a division of the California Environmental Protection Agency 

to settle violations that included illegally disposing of hazardous waste and making false statements to government 

officials. 

93 Xcel‘s ―Contractor Safety, Health and Environmental Questionnaire,‖ attached to the Cabin Creek penstock 

recoating RFP, required submission of any citations received from a regulatory agency during the past three years. 

RPI did not disclose to OSHA a 2005 serious OSHA violation in Arizona that occurred within the 3-year time 

period. 

001683
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

87 

Moreover, Xcel‘s policies addressing contractor selection do not require that the records be verified and, 

in fact, Xcel confirmed to the CSB that it had not verified RPI‘s submissions or researched its 

background. 

Xcel‘s ―Contractor Safety‖ corporate policy provided for a health and safety evaluation of the contractor 

bids and recommended a review of the contractor‘s EMR. The policy stated that an EMR above 1 ―would 

normally be considered unacceptable for the construction industry,‖ but did not explicitly require a 

rejection of a bid proposal based upon the EMR. Xcel‘s policies allowed a contractor with ―unacceptable‖ 

safety performance to further compete in the contractor selection process. CURT guidance on contractor 

selection prequalification illustrates an approach that more effectively ensures safety: 

Any contractors that do not meet base criteria fail and are not included on the potential list. An 

example of this type of pass/fail criteria might be: only contractors with an Experience 

Modification Rate less than 1.0 are acceptable (CURT, 2004a, p.5). 

A prequalification policy consistent with industry guidelines would have disqualified RPI and prevented 

the firm from being considered in the final selection process. 

8.2 Contractor Oversight 

Xcel did not provide sufficient oversight to ensure that safe practices were upheld during the hazardous 

recoating work within the penstock. 

8.2.1 Safety Addendum Added to Contract 

In response to negative information about RPI‘s safety record, the Xcel safety supervisor proposed 

additional safety requirements for the penstock project. The agreement between Xcel and RPI included a 

safety addendum that required a number of additional safety measures. It reads as follows: 

001684
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

88 

1. RPI will be extra diligent toward safety, ensuring [that] they are carefully 

following their safety policies and procedures.94

2. RPI will respond to safety questions and concerns from Xcel Supply in a timely 

manner. 

3. Xcel Supply will observe closely the work and report any concerns immediately 

to RPI‘s on site supervision (daily by on site personnel and randomly by Energy 

Safety). 

4. Xcel Supply will provide our Stop Work Policy to RPI and that all understand 

that any Xcel Supply employee can stop a job. This is routine and covered in our 

contractor orientation at the start of all jobs. 

Xcel concluded that if it kept a ―close watch‖ on RPI, the penstock recoating project would be safe and 

successful. 

8.2.2 Xcel Cabin Creek Site Contractor Oversight Activities and RPI Safety 

Performance 

Xcel did not increase its oversight of RPI nor did it implement corrective actions even though, during the 

penstock recoating project site activities prior to the incident, Xcel managers had identified serious safety 

hazards associated with the work and were aware of several significant safety problems attributable to 

RPI: 

An RPI worker slipped and fell inside the penstock due to the wet, slippery interior surface 

conditions. The worker suffered a dislocated shoulder and was treated at the hospital. 

The penstock was evacuated on several occasions prior to the incident due to high readings of 

CO, a toxic gas. 

 

94 RPI provided its entire ―Injury and Illness Prevention Program‖ safety manual to Xcel as part of its bid package 

submission; therefore, Xcel was aware of RPI‘s safety policies and procedures and could ensure that they were 

followed. 

001685
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

89 

Electrical problems that destroyed of penstock lighting, electrical junction boxes, and other 

equipment. 

Xcel welded a ―weep hole‖ inside the penstock on the day of the incident without issuing a 

hot work permit. Xcel‘s entry into the confined space lacked a confined space permit; that 

welding fumes could create a potential hazardous atmosphere was not analyzed. 

The Xcel penstock project manager identified serious hazards in the penstock work, stating in 

an email that ―work conditions inside the penstock are highly hazardous on many levels.‖

Despite Xcel‘s knowledge of these serious safety problems, Xcel managers conducted safety observations 

of RPI‘s penstock activities on only two documented occasions: September 20, 2007 and October 1, 

2007. The project manger completed an inspection checklist, noting the ―extremely slick surfaces‖ inside 

the penstock. The penstock inspection form also stated ―environment continuously monitored,‖ but 

employee interviews and documentation indicate that the penstock was only periodically monitored at the 

access door entrance for hazardous atmospheres.95 An Xcel safety representative visited the penstock for a 

safety observation the day before the incident, during sandblasting operations. The completed safety 

observation form listed a number of worker protection categories that were marked off as satisfactory, 

unsatisfactory, or not applicable. The safety representative had marked the worker protection category of 

―confined space entry permit‖ as ―satisfactory.‖ The comments section noted that an RPI worker was at 

the penstock entrance accounting for the personnel inside. However, as discussed, RPI and Xcel had not 

effectively implemented important elements of a permit-required confined space program. For example, 

the confined space permits were only partially completed and RPI had not established acceptable entry 

 

95 A few witnesses stated that the RPI supervisor also occasionally monitored the air farther inside the penstock, but 

not on the day of the accident. There is, however, no documentation of these readings. 

001686
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

90 

conditions for the penstock. The form the project manager completed during the September 20 safety 

inspection similarly checked ―OK‖ under the category of confined space safety practices. 

8.2.3 Xcel Corporate Policies and Other Requirements Addressing 

Contractor Oversight 

While Xcel‘s corporate policies and contracting documentation place primary responsibility for safety on 

the contractor for work under its control, Xcel policies also contain specific contractor safety oversight 

requirements. In the wake of the Cabin Creek incident, Xcel spokespersons stated that safety was RPI‘s 

responsibility and the contractors are ―experts in the field and that‘s why we hired them‖ (Lipsher, 

Mitchell, and McPhee, 2007). However, Xcel‘s ―Construction and Contractor Management‖ policy states: 

―[c]ontractor oversight or project control shall be established by both parties for all contracts with regard 

to health and safety standards.‖ Xcel‘s ―Contractor Safety‖ policy provides several contractor oversight 

requirements including the establishment of effective daily communication addressing safety issues 

between Xcel and the contractor, periodic jobsite visits by Xcel personnel to verify safety performance, 

and prompt notification and correction of deficiencies where violations of health and safety standards or 

regulations are discovered. Xcel‘s corporate policy is consistent with industry safety guidelines for owner 

oversight of contractor safety. CURT user practices recognize that ―[t]he owner must monitor contractor 

behavior to ensure effective implementation,‖ which includes auditing, measuring, and analyzing safety 

results, participating in incident investigation, and participating in contractor safety training (CURT, 

2004b, pp.7-9). 

However, Xcel ineffectively implemented its program for contractor safety oversight in a number of key 

areas identified by its contractor safety policy: 

Xcel and RPI managers did not establish effective daily communication concerning the 

hazards associated with the penstock recoating project. Xcel did not effectively plan and 

coordinate with RPI to identify and control serious hazards in the recoating project, including 

the use of a flammable solvent within the penstock confined space. 

001687
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

91 

The Xcel project manager or safety staff made documented safety observations only on two 

occasions at the penstock; these safety observations were ineffectively performed and failed 

to identify the serious confined space hazards. 

Violations of Xcel safety standards and OSHA regulations were not promptly communicated 

and corrected. The serious safety issues that were known to Xcel during the penstock work 

did not lead to increased scrutiny of RPI or effective corrective action. 

Xcel acknowledged to the CSB that it had not audited the performance of its corporate contractor 

selection and safety oversight program prior to the incident. Periodic corporate audits play an important 

role in ensuring that safety policies and procedures are applied and effectively implemented so that safety 

hazards can be controlled or eliminated (ANSI/AIHA Z-10, 2005, p.25). 

Xcel did not follow an effective contractor selection methodology that would ensure that contractors with 

a known unacceptable safety record would be disqualified from the bidding process. The company also 

failed to provide sufficient oversight to ensure that its contractors maintained a safe work environment 

while performing hazardous maintenance work at its Cabin Creek site. 

001688
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

92 

9.0 EMPLOYEE SAFETY TRAINING 

Employee safety training is integral to the success of a company‘s safety and health program. First and 

foremost, the company is responsible for ensuring that its employees are trained and capable of 

conducting work safely.96

Three broad types of training were available to RPI employees: 1) company-specific training provided by 

RPI; 2) general continuing education training provided through a union and the company partnership 

committee‘s Training Center; and 3) work-site specific training provided by RPI and Xcel. However, all 

of these modes of training were deficient in providing appropriate safety information to the penstock 

work crew, either by the administration of the training or the content of the material. 

Specifically, the RPI employees were ill-prepared to safely conduct work inside the penstock because 

RPI did not provide adequate training to its employees on its safety policies and procedures 

RPI relied primarily on the partnership committee‘s Training Center to provide training to its 

employees, but the Training Center is not responsible for providing company- or site-specific 

training to its members; 

Only individuals hired as an apprentice or those specifically referred to the Training Center 

for enrollment in the apprenticeship program‘s semester-long courses receive the 

comprehensive and in-depth safety training the Training Center provides; consequently, just 

 

96 The American National Standard, ―Occupational Health and Safety Management Systems (OHSMS), 

ANSI/AIHA Z10-2005,‖ provides good practice guidance on training and competency. It states that the employer 

will ―establish processes to ensure through appropriate education, training or other methods that employees and 

contractors are aware of applicable OHSMS requirements and are competent to carry out their responsibilities as 

defined in the OHSMS‖ (ANSI/AIHA, 2005).

001689
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

93 

two of the 14 contractors97 on the penstock project who had gone through portions of the 

program received some of this in-depth training. 

Employees referred to the Training Center for evaluation are assessed only on their technical 

painting skills, not their safety knowledge.98 And because the two RPI employees referred by 

RPI to the Training Center had skill levels at or above a mid-level apprentice, they were not 

required to take the basic painting level courses that included much of the in-depth safety 

training. 

Only nine of the 14 RPI employees received onsite training at Cabin Creek prior to the start 

of the recoating project, and that training was both abbreviated and did not effectively address 

the hazards inherent to the penstock recoating work. 

As a result, the RPI work crew received inadequate training on the specific and unique hazards of the 

penstock, including the safe handling of flammables, proper and safe use of spray equipment in a 

confined space, fire prevention and mitigation, and emergency response and rescue awareness. Had the 

existing apprenticeship safety training been provided to all journeyman painters, the RPI work crew 

would likely have been better prepared to manage the unique hazards of the penstock. 

9.1 Company-Specific Safety Training 

Employers are responsible for providing appropriate and effective safety training to its employees. RPI‘s

IIPP manual describes safe work practices and procedures on a wide array of safety issues, and while 

many are deficient (Section 6.6), a number address specific hazards that were associated with the 

penstock project, including the safe handling of flammables, proper confined space entry, and fire 

 

97 RPI had 14 employees working at the Cabin Creek site for the penstock recoating project; however, one left prior 

to the day of the incident for personal reasons. Twelve contractors and a general foreman remained on site. 

98 The only safety issue individuals are evaluated on is their knowledge of proper PPE 

001690
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

94 

prevention. Training on the safety information within the IIPP manual likely would have mitigated some 

of the risks inherent with the recoating work. 

Unfortunately, the company‘s method to ensure that newly hired individuals understood the IIPP 

information was simply to have them sign off on a Certificate of Compliance, which states that the 

employee received the IIPP Manual and the Employee Safety Handbook and agrees to comply with the 

rules and practices of these documents. At the time of the incident, RPI did not test or otherwise verify 

comprehension of the IIPP and its contents on an ongoing basis throughout an employee‘s career with the 

company. In fact, a 2006 audit of RPI by the SSPC found that RPI had ―[n]o documentation of craftworker assessment.‖ In response to this finding, RPI stated that it was ―currently implementing a training 

and documentation plan that will meet the requirements...‖ outlined in the audit. RPI went on to state that 

―[o]ur training[,] which will now be more stringently documented, will consist of; [sic] Ongoing Safety 

Training, Specialized Material Application Training, New Equipment Training, Site Specific 

Training...etc...).‖ Available evidence indicates that this training did not occur.

9.2 Training Center Safety Training 

A Master Labor Agreement between the Painters and Allied Trades Union, District Council 36, and 

several participating multi-employer associations created the Southern California Painting and Drywall 

Industries (SCPDI) Joint Apprenticeship Training Committee and Center.99 The SCPDI Training Center 

is charged with providing an apprenticeship training program for beginners in the industrial painting 

trade. Integrated within this apprenticeship training program are a number of critical safety components. 

Those who fully complete the program have the opportunity to build a solid foundation of technical 

painting skill and safety awareness. 

 

99 This Committee, and its Training Center, is maintained through a Master Labor Agreement between the Painters 

and Allied Trades Union (District Council 36) and several contractor associations, of which RPI is a member. 

001691
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

95 

However, the number of individuals who benefit from the apprenticeship program training courses is

limited, in that the SCPDI Training Center is responsible for providing in-depth safety training only to 

individuals who are either just entering the industrial/commercial painting field or those referred to the 

Training Center by their employer for a skills evaluation and are subsequently found to be lacking in 

painting skills and abilities. None of the 14 RPI employees working on the penstock project were 

graduates of the apprenticeship program; only two were referred to the Training Center by RPI for skills 

evaluation. And because the two RPI employees referred to the Training Center had skill levels at or 

above a mid-level apprentice, they were not required to take the basic painting level courses that included 

much of the in-depth safety training. 

Additionally, those referred to the Training Center are evaluated solely on technical painting skill and 

expertise; safety knowledge is not assessed as part of the evaluation process. An individual could qualify 

at the fourth stage within the seven-stage Apprenticeship Program based on his/her demonstrated 

knowledge of proper painting techniques and abilities, without having to demonstrate that he/she has the 

safety knowledge necessary to perform work at that painting skills level within the program. Indeed, the 

evaluation procedure utilized by the Training Center does not include an assessment of safety knowledge. 

Individuals that enter midway into the Apprenticeship Program miss out on multiple opportunities for indepth safety training, and those hired by the company and deemed sufficiently skilled in the trade are not 

sent to attend the semester-long Apprenticeship courses, and consequently are not exposed to the in-depth 

safety training. 

These training gaps are compounded because the Training Center does not, and is not expected or 

required to, provide instruction on company-specific policies or site-specific hazards. 

001692
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

96 

The SCPDI Training Center does offer general OSHA-required continuing education training 

opportunities100 to its union members; however, this training is not worksite-specific. 

9.3 Generic Onsite Training Provided at Cabin Creek 

The RPI work crew did not receive comprehensive safety training specifically pertaining to the penstock 

work environment from either their employer (RPI) or the host company (Xcel). 

An Xcel safety supervisor, after reviewing RPI‘s penstock project bid submittal, noted that a number of 

the RPI employees lacked several training courses pertinent to the penstock work, including confined 

space entry and electrical safety. He communicated this lapse in training to the RPI safety manager, who 

asserted that all RPI employees involved in the project would receive onsite training to cover these and 

other safety topics prior to starting work. The RPI safety manger asked a trainer at the SCDPI Training 

Center to come to the Cabin Creek site to provide basic OSHA-required continuing education/refresher 

training to the work crew. 

Only nine of the 14 RPI employees on the penstock project received this onsite training on September 10, 

2007. This training consisted of 6 hours of refresher-level safety review on six topics (each lasting about 

an hour). The contractors watched a safety video on each topic and were tested through multiple-choice 

exams. Those who had not arrived onsite until after September 10 were not provided an opportunity to 

take a make-up session. 

In testimony to the CSB, the trainer stated that the review of safety topics was kept ―pretty brief‖ because 

the contractors had attended the refresher courses multiple times. While repetition may seem burdensome, 

the real challenge in preparing for safe work is to ask: What about this job and these planned activities are 

 

100 CPR, Respirator Use and Fit Test, and Lead Worker Refresher is required annually; First Aid is required every 

three years; and the following courses are reviewed at least once per year in the Apprenticeship program but 

journeymen are required to take the training only once: Fall Protection, Scaffold/Swing Stage, Confined Space 

Awareness, Hazard Communication, Hearing Protection, Asbestos Awareness, Aerial Mobile Power Lifts, Forklift 

& Drywall. 

001693
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

97 

different from what we‘ve done before? What are the hazards of those different activities? How can that 

risk be eliminated or controlled?101 Approaching hazards this way focuses attention on the risks that may 

not be readily apparent when reviewing generic training materials before the start of work. 

The onsite training for the RPI employees was brief and generic and included only a basic review of 

confined space awareness. It included an overview of the definition of a confined space, but not how to 

evaluate a confined space for potential hazards, how to properly complete confined space entry forms, or 

how to prepare and arrange methods for evacuation. The onsite training also included a basic review of 

electrical safety, the material provided focused on the importance of using grounded equipment and 

following lockout/tagout procedures, but not on the need to use conductive hoses to prevent static 

discharge, nor did it explicitly instruct the crew about how to wire and ground equipment properly for 

safe use. 

The hazardous communication training on September 10 did not include a site-specific discussion of safe 

use of flammable solvents in confined spaces, despite plans by both companies to use a solvent within the 

penstock during the recoating process102 (Section 6.5). Nor were flammable and explosive atmospheres, 

fire prevention, and fire extinguisher use within the penstock incorporated in any onsite training for the 

contractors; also excluded was a discussion of procedures for emergency evacuation of the penstock. 

Neither Xcel nor RPI discussed the lack of a secondary egress with the work crew during the onsite 

training, and specific emergency response and rescue training did not extend beyond the instruction to the 

crew to call the Xcel control room for 9-1-1 services if an emergency should arise.103

 

101 A U.S. aircraft commander, who is also a human performance specialist, often prepares his crews by asking, 

―What is dumb, different, and dangerous about this specific mission?‖ to provoke their collective thinking about 

the specific and potentially unique risks of a given mission. 

102The hazardous communication training on September 10 consisted of an employee‘s right to know the chemicals 

onsite, how to read an MSDS, and proper PPE.

103 One likely reason for the lack of pertinent training on the issues inherent with the penstock project work was the 

trainer‘s lack of penstock experience. The trainer relied on a more experienced contractor within the RPI crew to 

001694
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

98 

The RPI employees also received a brief onsite safety overview from Xcel as they arrived at Cabin Creek 

and began preparing for work inside the penstock.104 This brief orientation – consisting of a checklist 

review of potential hazards – was held on three separate occasions, led by different Xcel personnel and 

attended by various crew members.105 The orientation provider addressed confined space by asking the 

RPI crew if they had been trained on the safety topic, but the provider did not verify this training, nor 

were MSDSs of chemicals to be used within the penstock discussed or requested. The orientation did not 

cover a number of safety issues related to the penstock work, including emergency response and 

evacuation plans or safeguards for minimizing fire hazards within the confined space. 

9.4 Safety Training Needs Specific to the Penstock 

The unique characteristics of the penstock and the recoating work require knowledge and skill on a 

number of safety topics, including the safe handling and use of flammables, confined space entry and 

monitoring, fire prevention, and emergency preparedness. Many of these safety topics are covered 

effectively in the SCPDI apprenticeship program; others are covered within the safety policies of the host 

and contractor companies. Through interview testimony and training records, the CSB found that the 

necessary safety information pertaining to the penstock project was not, in most cases, effectively 

administered to the RPI workforce, nor did either company uphold and reinforce safe work practices at 

the work site. This section identifies where safety training and information existed but was not 

incorporated into the work activities at Cabin Creek. 

 

inform the others of the penstock‘s hazards; however, according to witness testimony, the experienced contractor 

focused on slip, trip and fall hazards, not on the major confined space hazards of the penstock or the risks of 

working in flammable atmospheres. 

104 This orientation was meant to focus on Xcel policies and procedures; topics covered included lockout/tagout, 

forklift use, slipping hazards, and waste removal from the site.

105 Each member attended the orientation once. 

001695
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

99 

9.4.1 Substituting Non-flammables for Flammable Solvents 

The use of potentially safer alternatives to MEK is discussed in the SCPDI apprenticeship program‘s 

training course, ―Solvent and Hazardous Materials.‖ The training materials state: ―Whenever possible, 

organic solvents should be replaced with either water-based solvents or another less harmful organic 

solvent.‖ The importance of exploring opportunities to exchange flammable solvents for non-flammable 

substitutes is reiterated throughout the training materials, which provide a substitution example dealing 

explicitly with MEK: ―a citrus based [sic] cleaner could be used in place of MEK for tool clean up.‖ Only 

one RPI crew member attended the ―Solvent and Hazardous Materials‖ course (as part of his training 

through the Apprenticeship program). The use of a non-flammable solvent would have prevented the 

Cabin Creek fire. 

9.4.2 Safe Handling and Use of Flammables 

Training on the safe handling and use of flammables is offered only to employees who are going through 

the apprenticeship program or when specifically requested by a company. The IIPP safety policies 

concerning the safe handling and use of flammables were not provided to employees through in-house 

company-provided training, nor were employees‘ comprehension of these polices assessed.

106 As a result, 

RPI employees were not sufficiently trained on the safe use of flammables. 

The proper and safe handling of flammables is covered in the ―Basics of Solvents and Thinners‖ and 

―Solvent and Hazardous Materials‖ training courses the SCPDI Training Center offers. However, records 

going back five years prior to the incident show that none of the RPI employees working inside the 

penstock took the ―Basics of Solvents and Thinners‖ course and, as stated, only one of the crew took the 

―Solvent and Hazardous Materials‖ training course. 

 

106 When subpoenaed for all training materials, RPI did not provide any documentation that employees were tested 

on the IIPP safety information. 

001696
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

100 

The ―Basics of Solvents and Thinners‖ course materials provide many warnings about the risks of using 

flammables, and the ―Solvents and Hazardous Materials‖ course goes further, stating: ―NEVER leave 

solvent products open when not in use‖ (emphasis in original) and ―Place solvent soaked rags or materials 

in all-metal containers with tight sealing tops‖ to prevent dangerous vapor accumulation in the work area. 

The training materials also warn: ―Transport and store solvents ONLY in approved, properly labeled and 

marked containers‖ (emphasis in original). By following these safety rules, the training material asserts, 

the chance for a fire or explosion is reduced. 

Some RPI employees stated they knew how to safely transfer flammables, but as metal safety cans for 

MEK transfer were not made available for use at Cabin Creek, adhering to this safety policy was 

impossible. 

9.4.3 Flammable Atmospheres and Confined Space Entry 

SCPDI Training Center training materials for ―Confined Space Entry‖ state: ―If the atmosphere contains 

flammable gas, vapor or mist in excess of 10 percent of its lower flammable limit (LFL), that atmosphere 

is not acceptable for entry.‖ Yet on October 2, 2007, the Cabin Creek confined space work did not 

prohibit entry or occupancy of the penstock where the LFL was in excess of 10 percent, nor did Xcel or 

RPI‘s policies require this safeguard. The attendant was conducting atmospheric monitoring at the access 

door, more than 1,450 feet (442 meters) away from the crew using the solvent to flush the hoses, wands, 

and sprayer system with MEK, which was too far away to get an accurate measurement. MEK vapor 

produced with the flushing activities resulted in the accumulation of solvent vapors to levels above the 

maximum allowable for entry around the equipment and work crew. 

9.4.4 Fire Prevention and Mitigation 

Both the SCPDI fire prevention training course material and RPI‘s IIPP section, ―Fire Protection and 

Prevention,‖ stress the importance of both clear access to emergency response equipment and its 

placement close to the actual painting operation. Yet RPI provided only six of the 14 contractors with a 

001697
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

101 

general course on proper fire extinguisher placement within the worksite; this training occurred 

approximately two months prior to the incident. 

The SCPDI fire prevention training also included instructions that there should be more than one exit in 

the area of work and that all workers keep their backs to an exit in case a fire necessitated escape. Despite 

these fire safety recommendations, the arrangement of spray equipment within the narrow confines of the 

penstock kept contractors separated from the work area‘s only exit. No remedial action was taken to

address the lack of a secondary exit, although a number of RPI employees expressed concern about 

having only one egress point. The positive affects of training are significantly diminished when the good 

practices promoted in the training cannot be adhered to. Interestingly, a penstock project contract 

addendum, which both Xcel and RPI agreed to, empowered Xcel employees with ―stop work authority‖ 

during the project, allowing Xcel employees to order RPI to cease work within the penstock if they 

observed unsafe work practices. This stop work authority was given specifically to Xcel employees, not 

the RPI work crew. 

9.4.5 Proper and Safe Use of the Sprayer and Associated Equipment 

RPI employees were not trained on the proper and safe use of the Graco epoxy sprayer system. The 

SCPDI Training Center does not train on Graco spray equipment exclusively, but a plural component 

(two-part) spray system is a topic within the apprentice spray painting course curriculum. However, only 

two of the 14 contractors went through the apprenticeship semester course that covers this information. 

This training, which was provided by a third party in agreement with RPI, had taken place two years prior 

to the penstock project. Working with unfamiliar equipment likely contributed to the operational 

problems the crew was experiencing during their application attempts. 

The RPI crew working inside the penstock lacked the in-depth safety training and knowledge necessary to 

work safely within this unique and challenging confined space environment. RPI did not provide adequate 

training addressing the safety risks of the penstock recoating work to its employees. The Training Center 

001698
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

102 

Apprenticeship Program does provide comprehensive safety training; however, few RPI employees 

received this in-depth safety training. 

001699
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

103 

10.0 Regulatory and Industry Standards Analysis 

RPI‘s and Xcel‘s policies and permits failed to established safe limits that prohibit entry or occupancy of 

a confined space with a hazardous flammable atmosphere. However, existing federal regulations for 

general industry do not require that employers establish such safety limits. Specifically, the current OSHA 

Permit-Required Confined Spaces Rule does not prohibit entry or occupancy in a confined space above a 

maximum permissible percentage of the LFL nor does it require continuous monitoring throughout the 

duration of the work107 to ensure the concentration of flammable gases does not exceed that percentage. 

The CSB determined that, even if combustible gas monitoring had been performed on the day of the 

incident in the area where flammable solvent was being used, this monitoring would likely not have been 

enough to prevent the initial flash fire in the penstock; with no set limit for flammable atmospheres, the 

RPI crew had no evaluation and action level in which to use to determine when it was safe to work and 

when cessation and/or evacuation was necessary. 

10.1 Hazards of Confined Space Work in Potentially Flammable 

Atmospheres Inadequately Covered in Existing Standards 

OSHA‘s Permit-Required Confined Spaces Rule for general industry states that a confined space must be 

permit-required when the space has a potential to contain a hazardous atmosphere, which is defined for 

flammables as an atmosphere that exceeds 10 percent of the LFL [29 CFR 1910.146(b)] (Section 6.1). A 

permit-required confined space program mandates that employers specify acceptable entry conditions and 

take actions such as purging or ventilating the space to eliminate or control atmospheric hazards such as a 

flammable atmosphere [29 CFR 1910.146(d)(3)(i), (iv)]. However, the rule does not define acceptable 

 

107 In this incident, the penstock space was ―large or...part of a continuous system,‖ which would require continuous 

monitoring (See Sections 6.1.3 and 11.2.2.2, which discuss 29 CFR 1910.146 (d)(5)(i)). However, the fact alone 

that a flammable was being used within a confined space would not have triggered the requirement for continuous 

monitoring. 

001700
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

104 

entry conditions or specify what additional precautions must be taken for working in a permit-required 

confined space with a potential flammable atmosphere, nor does it limit entry based upon measureable 

critieria such as a specific maximum percentage of the LFL, even though OSHA defines an atmosphere as 

hazardous when it exceeds 10 percent of the LFL. Appendix C of the rule gives examples of permitrequired programs, including a scenario where interior coatings/linings are applied in portable tanks. This 

scenario describes an approach to control the hazards by establishing forced air ventilation to keep the 

potentially flammable atmosphere below 10 percent of the LFL [29 CFR 1910.146 Appendix C, Example 

3]. However, Appendix C provides only examples of permit-required programs; it does not establish 

enforceable requirements. 

In 1996, OSHA issued a letter of interpretation that allows work to be performed in atmospheres in excess 

of 10 percent of the LFL, stating that when the atmosphere is above 10 percent, ―all of the requirements 

of the rule must be met‖; however, it provides no specific safety guidance (OSHA, 1996). The letter 

concludes that because the Permit-Required Confined Spaces Rule for general industry is a performance 

standard, ―it does not specify procedures for conditions where the permit-required space has a hazardous 

flammable atmosphere‖ (OSHA, 1996). Rather, the employer must implement control measures based 

upon a hazard analysis of the ―the means, procedures, and practices necessary for safe permit space entry 

operations‖ [29 CFR 1910.146(d)(3)]. In fact, the letter does not suggest any limits on entry based on 

measurements of the flammable atmosphere or even that safe entry conditions need be defined in terms of 

the LFL, which directly contradicts the more recent OSHA shipyard standards and recent NFPA 

guidance, as discussed below. 

The Permit-Required Confined Spaces Rule requires ―purging, inerting, flushing or ventilating the permit 

space as necessary to eliminate or control atmospheric hazards‖ [29 CFR 1910.146(d)(3)(iv)]. Under the 

rule, a hazardous atmosphere is one ―that may expose employees to the risk of death, incapacitation, 

impairment of ability to self-rescue...injury, or acute illness‖ [29 CFR 1910.146(b)]. The logic of the 

provisions would appear to demand that for safe entry, the confined space flammable atmosphere would 

001701
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

105 

need to be reduced to 10 percent or less of the LFL or inerted to prevent the formation of a flammable 

mixture inside the permit space and the possibility of death or injury; however, the Rule has no such 

explicit requirement. 

The following support the need for effective requirements or limits for working in flammable 

atmospheres in terms of confined space entry and occupancy: 

1. Establishing safe flammable limits as a percentage of the LFL, with the effective use of 

appropriate monitoring devices (e.g., combustible gas detectors), is an accurate method for 

obtaining quantitative data to evaluate the potential degree of hazard and protect personnel 

(McManus, 1999, p.748). 

2. Safe flammable atmosphere limits are needed because no adequate PPE is available that can 

protect workers from an explosion within a confined space (NFPA 1006, 2008). 

3. Sources of ignition for a fire or explosion are typically plentiful and difficult to eliminate entirely, 

as illustrated in the number of possible ignition sources available in the Cabin Creek penstock; as 

such ―there is no ready assurance that all sources of ignition could be eliminated‖ (McManus, 

1999, p.746). 

4. Lacking specific regulatory requirements based upon measureable parameters, employers may 

fail to establish adequately protective limits for working in potentially flammable atmospheres. In 

this incident, neither Xcel nor RPI had established safe entry conditions for flammable 

atmospheres based upon a percentage of the LFL in their procedures and permits. 

5. Failure to establish safe flammable limits undermines the importance of monitoring in permitrequired confined spaces; the need for periodic or continuous monitoring will not be understood 

by employers and personnel if no limits are specified. This safety gap can lead to a failure to 

conduct critical combustible gas testing in appropriate locations and with the needed frequency, 

as was the case in the Cabin Creek penstock. 

001702
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

106 

6. Unlike flammable atmospheres, other atmospheric hazards have explicit and measureable 

requirements elsewhere in the OSHA regulatory scheme to confirm compliance with the PermitRequired Confined Spaces Rule. For example, OSHA standards for toxic substances establish 

quantitative permissible exposure limits and other standards require quantitative monitoring of 

potentially oxygen-deficient atmospheres.108

 

7. Confined space entry is a frequent activity in U.S. workplaces-OSHA estimates that more than 

4.7 million permit-required confined spaces are entered by workers annually (OSHA, September 

2008). 

8. A flammable atmosphere is a serious confined space hazard. According to noted confined space 

expert McManus (1999), fires and explosions are a ―major cause‖ of deaths and injuries in 

confined spaces and have led to a relatively ―large portion of fatalities per incident compared to 

other situations‖ (p. 112). The CSB concluded that serious confined space incidents involving 

flammable atmospheres are still a significant problem and that adequate combustible gas 

monitoring, clearly defined limits for working safely in potentially flammable atmospheres, and 

other control measures such as eliminating the hazard or adequate ventilation of the space can 

prevent these accidents (Section 11.0). 

10.2 Other Regulations and Safety Guidelines Set Protective LEL 

Limits for Work in Potentially Flammable Atmospheres 

The approach in the Confined Spaces Rule sharply contrasts with more stringent, recently promulgated 

OSHA standards, such as those for confined spaces in shipyard employment [29 CFR 1915, Subpart B], 

which limit work activities that can be conducted in atmospheres that exceed 10 percent of the LEL. The 

shipyard standard requires that confined spaces containing a flammable concentration of 10 percent of the 

 

108 For example, see OSHA‘s Table Z-1, ―Limits for Air Contaminants‖; 29 CFR 1910.1000; and the Respiratory 

Protection Standard, 29 CFR 1910.134. 

001703
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

107 

LEL or higher be labeled as ―Not Safe for Workers‖ [29 CFR 1915.12(b)(2)]. In the discussion related to 

the final rule for confined spaces in shipyard employment, OSHA argued that adopting 10 percent of the 

LEL limit for safe occupancy was more appropriate than other proposed levels: ―The Agency believes 

that a compartment in which any portion is above 10% of the LEL is unsafe‖ [59 FR 37816-37863]. 

Yet the general industry Permit-Required Confined Spaces Rule allows employers to adopt limits higher 

than 10 percent of the LEL as an acceptable entry condition. McManus, in Safety and Health in Confined 

Spaces (1999), defends the use of lower LEL limits, noting that conducting a confined space hazard 

analysis can be difficult and uncertain because of several factors: 1) the accurate detection of ignitable 

atmospheres depends on the position of the intake of the instrument relative to the source, 2) the relative 

response of the sensor based the on substance(s) being sampled to the substance(s) used to calibrate the 

sampler, and 3) the timing of the samples (pp. 745-752).109

A number of organizations, standard-setting bodies, and other government regulatory agencies have also 

adopted guidelines that prohibit or limit work activities in confined spaces in atmospheres above 10 

percent of the LEL (Appendix G). McManus (1999) suggests that ―[t]he consensus expressed through 

more recent standards indicates decreased tolerance‖ for hazardous flammable atmospheres (p. 745). An 

important example of this trend can be found in the 2008 edition of NFPA 1006, Standard for Technical 

Rescuer Professional Qualifications. This consensus standard addresses acceptable entry conditions for 

confined space rescue and states in its explanatory material that ―[r]escuers should not enter confined 

spaces containing atmospheres greater than 10 percent of a material‘s LEL, regardless of the personnel 

protective equipment worn. There is no adequate protection for an explosion within a confined space‖ 

[NFPA 1006, 2008, Annex A.7.1.1]. 

 

109 Webber (2007) summarizes relevant research showing conditions where flammable vapors can be ignited even 

when concentrations are below the LEL that result in localized flash fires. 

001704
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

108 

A number of other confined space consensus safety standards and industry guidelines recommend special 

precautions to detect and control flammable atmospheres and explicitly establish safe work limits for 

confined spaces that are substantially below the LFL, such as 10 percent of the LFL [ANSI Z117.1, 2009, 

p.24; ASTM D4276-02, 2007, p.3; NFPA 326, 2005; API 2015, 2001a, p.28; API 2016, 2001b, pp.43, 60; 

IChemE, 2005, p.66]. 

NFPA 326, Standard for the Safeguarding of Tanks and Containers for Entry, Cleaning, or Repair,

requires that ―[a]ll work in or around the tank or container shall be stopped immediately when the 

flammable vapors in the atmosphere exceed 10% of the lower flammability limit (LFL). The source of the 

vapors shall be located and eliminated or controlled‖ [NFPA 326, 2005, p.9]. A number of countries 

including Australia, New Zealand, and nearly all Canadian provinces prohibit confined space entry above 

a defined safe flammable atmosphere limit that is substantially below the LEL (Appendix G). 

Therefore, in light of the existing consensus of confined space codes and regulations establishing lower 

LEL limits for safe entry and the improved understanding of the increased hazards of working in permit 

spaces in atmospheres above 10% of the LEL, the CSB recommends that OSHA limit confined space 

work activities in the presence of flammables in the same manner and to the same degree as the agency 

has done in shipyards and as many other consensus standards recommend.

10.3 Colorado Public Utilities Commission 

The Colorado Public Utilities Commission (PUC) is a state regulatory agency that oversees a wide variety 

of electric power and other utilities. Xcel is one of two investor-owned electric utilities operating in 

Colorado that are regulated by the PUC. The stated mission of the PUC is to serve the public interest ―by 

effectively regulating utilities and facilities so that the people of Colorado receive safe, reliable, and 

001705
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

109 

reasonably priced services consistent with the economic, environmental and social values of our state.‖110

The PUC has promulgated the Rules Regulating Electric Utilities (4 Code of Colorado Regulations 723-3, 

Part 3) that address a range of subjects including safety; construction, maintenance, and operation of 

electric utility facilities; and competitive bidding processes related to areas such as the acquisition of new 

utility resources. 

The PUC rules require that the construction, maintenance, and operation of a utility be ―in accordance 

with accepted engineering practice in the electric industry to assure continuity of service, uniformity in 

the quality of service, and the safety of persons and property.‖111

 The PUC rules provide that in the event 

of an incident resulting in death, serious injury, or significant property damage, the regulated utility shall 

inform the Commission within two hours of learning of the incident and submit a written report within 30 

days.112

 The only content requirements of the written report are the date, time, place, location, and type of 

the incident; names of persons involved; and nature and extent of injury and damage. For the Cabin Creek 

incident Xcel sent a one-page letter to the PUC on November 1, 2007, briefly describing the incident and 

the number of people killed and injured. PUC rules state that if a utility conducts an internal investigation 

of an incident that any report developed shall be made available to the Commission upon request.113 The 

PUC Commission was not notified of the availability of any internal investigation report by Xcel nor did 

the Commission receive any report. Xcel did not inform the Commission of the root causes of the Cabin 

Creek incident, recommendations for prevention, or any subsequent preventative measures taken by Xcel. 

PUC electric utility contracting rules describe procedural requirements and criteria other than price to 

consider in the competitive bidding process but the provisions do not include any safety considerations. 

 

110 Mission of the Public Utilities Commission, http://www.dora.state.co.us/puc/about/AboutMission.htm

accessed 7-13-10. 

111 Colorado Department of Regulatory Agencies, 4 Code of Colorado Regulations (CCR) 723-3, Part 3, Rules 

Regulating Electric Utilities, Rule 3200(a), Construction, Installation, Maintenance, and Operation. 

112 Id. Section 3204(a) and (b). 

113 Id. Section 3204(c). 

001706
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

110 

The rules contain provisions that regulate resource planning such as those resources that provide electrical 

capacity and renewable energy. The acquisition of utility resources can include new construction, 

maintenance, and repairs that significantly impact capacity or prevent service interuption. PUC rules 

favor competitive bidding for the acquisition of new resources and address requirements for the 

competitive bidding processes, requests for proposals (RPFs) and bid evaluation criteria. In 2010, the 

Colorado General Assembly approved renewable energy legislation that requires the Colorado Public 

utilities Commission to implement new ―best value‖ contracting bid criteria for electric resource 

acquisition114. The additional criteria that need to be considered in the competitive bidding process 

include workforce training certifications, long-term career opportunities, and industry standard health care 

benefits. However, neither the existing PUC rules nor the new mandated criteria require that past safety 

performance be considered as a factor in the competitive bidding process, nor do they include safety 

prequalification or disqualification procedures. 

 

114 The 2010 Colorado General Assembly amended Colorado Revised Statutes 40-2-124 by House Bill 10-1001, 

http://www.dora.state.co.us/PUC/rulemaking/HB10-1001/HB10-1001_enr.pdf , accessed 7-13-10.

001707
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

111 

11.0 Flammables Used in Confined Spaces: Other Incidents 

As part of its investigation of the Xcel penstock case, the CSB collected and compiled confined space 

incident data from the past 17 years to ascertain the prevalence of confined space flammable incidents and 

determine if the rate has been impacted by the promulgation of the Permit-Required Confined Spaces 

Rule. The CSB has determined that the hazard of flammable atmospheres in confined spaces has been a 

significant workplace safety issue since the promulgation of OSHA‘s Permit-Required Confined Space 

Rule on April 15, 1993. 

The CSB compiled and researched incident data on 105 previous confined space incidents; of these, 53 

were determined to be the result of a flammable atmosphere in a confined space. (Appendix I describes 

CSB‘s incident data collection methodology used to obtain this data.) The CSB also found that the 

number of confined space flammable incidents has increased the past nine years, as a majority of the 53 

incidents from 1993 until April 2010 occurred since 2003. These flammable atmosphere confined space 

incidents include two the CSB investigated in 2009 that resulted in four fatalities (Appendix J).

The 53 identified confined space flammable incidents caused 45 fatalities and 54 injuries from 1993 to 

April 2010; approximately 57 percent included a fatality. The number of fatalities and injuries increased 

in the 17 years, with 49 percent of the total fatalities and approximately 57 percent of total injuries 

occurring since 2003. In the past 14 months, from February 2009 to April 2010, the CSB identified seven 

additional confined space incidents that resulted in six fatalities and four injuries. 

The CSB analysis shows that a flammable atmosphere was present in the confined space prior to entry in 

60 percent of the incidents sampled. Flammables were brought into the confined space for activities like 

painting/recoating, cleaning, or welding in the remaining approximately 40 percent. This data underscores 

the importance of monitoring the confined space both before entry and continuously in the work area 

where the confined space work activity includes the use of flammables. Continuous monitoring under 

these circumstances combined with flammable atmosphere limits established in procedures and permits 

001708
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

112 

are likely to alert workers to the importance of rapid changes that can lead to a flammable atmosphere so 

that workers can evacuate.115

The data suggest that, even after the promulgation of the Permit-Required Confined Space Rule, a 

significant number of confined space incidents with fatalities and serious injuries were attributed to 

flammable atmospheres. Furthermore, the increasing numbers of fatalities and injuries post-promulgation 

of the Permit-Required Confined Spaces Rule suggests the need for more protective requirements for 

work in potential flammable atmospheres in confined spaces. 

 

115 An example of how continuous monitoring can prevent worker fatality or injury is evident from a confined space 

incident that occurred on January 7, 2010 in Amsterdam, NY. Two telephone workers were conducting repair 

work in a telephone vault (similar to a manhole) when their combustible gas meter alarmed. They were able to 

evacuate the confined space prior to a small fire breaking out. 

001709
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

113 

12.0 ROOT AND CONTRIBUTING CAUSES 

12.1 Root Causes 

1. Xcel and RPI management did not ensure effective planning and coordination of the Cabin Creek 

penstock recoating project to control or eliminate the serious confined space hazards that were 

present. 

An effective hazard evaluation of the penstock confined space was not performed; the work 

required the use of a solvent to clean the epoxy sprayer and associated equipment in the open 

penstock atmosphere, yet the serious safety hazards of using a flammable solvent inside the 

confined space were not identified or addressed. 

Substituting a non-flammable solvent was not considered. 

Important safety precautions when using a flammable in a confined space, such as continuous 

monitoring in the work area, providing adequate ventilation, and eliminating or controlling 

ignition sources, were not implemented. 

2. Xcel‘s and RPI‘s corporate safety policies and permits did not effectively establish safe limits for 

flammable atmospheres in permit-required confined spaces that would prohibit entry or 

occupancy when those limits were exceeded. 

3. Early in the planning process, Xcel identified the Cabin Creek penstock‘s single point of egress in 

the event of an emergency as a major concern; RPI personnel also raised safety issues about a 

single exit. However, neither Xcel nor RPI management took remedial action. 

American Society of Civil Engineering (ASCE) published safety guidance addressing 

penstock inspections advises on the importance of alternative escape routes in the event of an 

emergency (ASCE, 1998, p.2-8).

001710
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

114 

As a result of the flash fire, five RPI workers, who were located on the side of the sprayer 

opposite the sole exit, were trapped by the growing flames and eventually succumbed to 

smoke inhalation. 

4. Xcel management did not provide effective oversight of RPI to ensure the penstock recoating 

work was safely conducted. 

Due to concerns about RPI‘s record of injuries and fatalities in past projects, Xcel added a 

‖Safety Addendum‖ to the penstock recoating contract affirming that Xcel would closely 

observe RPI‘s safety performance. However, Xcel managers conducted safety observations of 

RPI on only two documented occasions in the 29 days that RPI personnel were on the job. 

During the penstock recoating work prior to the incident, Xcel managers were aware of 

several significant safety problems attributable to RPI, yet Xcel did not increase scrutiny of 

RPI‘s safety performance or implement corrective actions. 

12.2 Contributing Causes 

1. Xcel‘s corporate policies and practices addressing contractor selection did not adequately ensure 

contractor safety performance for the penstock recoating project. 

During the contractor selection process, Xcel managers graded RPI safety performance as a 

zero, the lowest possible score; however, Xcel‘s contractor selection practices typically 

provided only for disqualification from the bidding process based upon financial capacity, not 

safety criteria. 

The evaluation rating form stated that the score of zero did not met Xcel‘s minimum 

requirements and required automatic rejection; however, RPI was still allowed to compete for 

the penstock recoating contract. RPI‘s proposal was ranked as the best overall based 

primarily on its low price. 

001711
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

115 

RPI did not disclose to Xcel regulatory violations resolved within the requested three-year 

period as part of the RFP evaluation process. Xcel‘s corporate policies addressing contractor 

selection relied upon self-reporting and did not include specific procedures to verify the 

contractor‘s submissions.

2. Xcel and RPI managers did not plan and coordinate the immediate availability of qualified 

confined space technical rescuers outside the penstock, although the use of flammable solvent in 

the open atmoshere of the permit space created the need for immediate rescue due to the potential 

for IDLH conditions. 

Neither company ensured that emergency response organizations or personnel with confined 

space technical rescue qualifications were immediately available with the necessary firefighting equipment outside the penstock. 

The approximate travel time of the closest identified public emergency response organization 

with confined space technical rescue qualifications was approximately 1 hour and 15 minutes.

After the penstock fire erupted, firefighting and rescue activities likely would have been 

sucessfully provided to prevent the fatalities had qualified personnel and equipment been 

immediately available; the trapped RPI workers were in radio communication with coworkers 

and emergency responders for 45 minutes after the initial 9-1-1 call.

3. RPI did not ensure that the majority of its workforce at Cabin Creek had received comprehensive 

formal safety training, effective training on company safety policies, or site-specific instruction 

addressing confined space safety, the safe handling of flammable liquids, the hazard of static 

discharge, emergency response and rescue awareness, and fire prevention. 

001712
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

116 

13.0 RECOMMENDATIONS 

Occupational Safety and Health Administration (OSHA) 

2008-01-I-CO-R1 Amend the OSHA Permit-Required Confined Spaces Rule for general industry 

(29 CFR 1910.146) to establish a maximum permissible percentage substantially 

below the lower explosive limit (LEL) for safe entry and occupancy in permitrequired confined spaces. 

2008-01-I-CO-R2 Publish a ―Safety and Health Information Bulletin‖ addressing the hazards and 

controls when using flammable materials in confined spaces that includes 

actionable guidance regarding: 

a. The importance of implementing a hierarchy of controls to address 

hazards in a confined space that first seeks to eliminate hazards or 

substitute with a less hazardous material(s) or method(s). Examples 

include performing work outside of a confined space where reasonably 

practicable or substituting a flammable material with a non-flammable 

one. 

b. The necessity of establishing a maximum permissible percentage 

substantially below the lower explosive limit (LEL) for safe entry and 

occupancy of permit required confined spaces. 

c. The need to comprehensively control all potential ignition sources and 

continuously monitor the confined space at appropriate locations and 

elevations when work activities involve the use of flammable materials 

or where flammable atmospheres may be created. 

d. The importance of treating confined spaces with the potential for 

flammable atmospheres above 10 percent of the LEL as a hazard 

001713
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

117 

immediately dangerous to life or health (IDLH) that requires rescuers to 

be stationed directly outside the permit space and available for 

immediate rescue with appropriate fire-extinguishing and rescue 

equipment. 

e. The requirement that confined spaces such as penstocks be managed as 

permit-required that are so large or part of a continuous system that they 

cannot be fully characterized from the entry point. Such spaces need to 

be monitored for hazardous atmospheres both prior to entry and 

continuously in areas where entrants are working. 

The Governor of the State of Colorado 

2008-01-I-CO-R3 Implement, through the Division of Fire Safety, an accredited firefighter 

certification program for technical rescue that encompasses appropriate specialty 

areas including confined space rescue. 

The Colorado Public Utilities Commission 

Revise your rules regulating electric utilities, 4 Code of Colorado Regulations 723-3, to: 

2008-01-I-CO-R4

a. Require regulated utilities to investigate the facts, conditions, and circumstances 

of all incidents resulting in death, serious injury or significant property damage 

as defined in Section 3204 

b. Require utilities to submit a written investigation report to the Commission 

within one year of the incident that contains the investigation findings, root 

causes and recommendations for preventing future incidents that focus on needed 

changes to utility safety systems. All reports shall be made public. 

001714
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

118 

c. Authorize the commission to issue orders addressing needed corrective actions to 

be taken as a result of the incident. 

d. Require utilities to submit periodic reports to the Commission detailing action 

taken on the incident report recommendations and Commission orders. All 

reports shall be made the public. 

2008-01-I-CO-R5

Require all regulated utilities to fully cooperate with all government safety 

investigations including facilitating access to witnesses, facilities, and equipment; 

providing copies of requested records; and responding to interrogatories and other 

investigative requests for information as expeditiously as possible. 

2008-01-I-CO-R6

Require that competitive bidding and contractor selection rules for construction, 

maintenance or repair of regulated utilities include procedures for prequalifying or 

disqualifying contractors based on specific safety performance measures and 

qualifications. 

Director of the Division of Fire Safety and the Director the Division of Emergency 

Management for the State of Colorado 

2008-01-I-CO-R7 Publish a safety communication that will inform fire service and emergency 

planning organizations in the state about the confined space safety lessons 

learned from the Cabin Creek incident including 

a. The need to train and certify emergency response personnel who perform 

technical, including confined space, rescue. 

b. The importance of a written confined space rescue plan for each 

designated permit space that includes 

001715
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

119 

i. Methods of rescue and determination of whether a rescue 

team is required to standby outside the space. 

ii. Rescue equipment requirements and plan of action. 

c. The importance of treating confined spaces with the potential for 

flammable atmospheres above 10 percent of the LEL as a hazard 

immediately dangerous to life or health that requires rescuers to be 

stationed directly outside the permit space and available for immediate 

rescue with appropriate fire-extinguishing and rescue equipment. 

d. The need for confined space rescue procedures to instruct emergency 

responders to not enter or occupy a confined space containing a 

flammable atmosphere 10 percent of the LEL or greater. Personal 

protective equipment (PPE) will not protect rescuers from an explosion 

in a confined space. 

Xcel Energy, Inc. 

2008-01-I-CO-R8 Revise your policies for solicitation and procurement of construction services to 

a. Ensure that requests for proposals (RFPs) and selection processes include 

criteria and procedures for prequalifying or disqualifying contractors 

based on specific safety performance measures and qualifications. 

b. Implement written verification procedures for the safety information and 

documentation submitted by contractors during the bidding and selection 

process. 

2008-01-I-CO-R9 Revise your contractor safety policies to require a comprehensive review and 

evaluation of contractor safety policies and procedures such as the permitrequired confined space program and safety performance of contractors working 

001716
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

120 

in confined spaces to ensure that any bidding contractor meets or exceeds Xcel 

Energy safety requirements.

2008-01-I-CO-R10 Conduct periodic safety audits of contractor selection and oversight at your 

power-generating facilities to ensure adherence to corporate contractor 

procurement and safety policies. 

2008-01-I-CO-R11 Report key findings, causes and recommendations of the CSB report to Xcel 

shareholders so that the owners of Xcel are fully informed of the report contents 

and how Xcel intends to prevent a similar accident in the future. 

Xcel Energy, Inc. 2008-01-I-CO-R12 

See below for recommendation text.

RPI Coating Inc. 2008-01-I-CO-R13

Revise your confined space entry program and practices. At a minimum 

a. Require continuous monitoring for flammable atmospheres at 

appropriate locations and elevations within a confined space where work 

activities involve the use of flammables or where flammable 

atmospheres may be created. 

b. Prohibit entry or require evacuation of a confined space if the 

atmospheric concentration of flammable vapors is 10 percent of the LEL 

or higher. 

c. Ensure that confined spaces such as penstocks be managed as permitrequired that are so large or part of a continuous system that they cannot 

be fully characterized from the entry point. Ensure that such spaces are 

001717
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

121 

monitored for hazardous atmospheres both prior to entry and 

continuously in areas where entrants are working. 

d. Ensure that evacuation plans for penstocks that have only one egress 

point provide for alternative escape routes and/or refuge chambers. 

e. Ensure the implementation of a written confined space rescue preplan for 

each designated permit space. Address staging and methods of rescue for 

each designated permit space including whether a rescue team is required 

to standby outside the space. Require that confined space rescue teams be 

standing by at the permit spaces where the hazards pose an immediate 

threat to life or health including the hazard of a potential flammable 

atmosphere. 

RPI Coating, Inc. 

2008-01-I-CO-R14 Based on the findings and conclusions of this report, hire a certified safety 

professional to conduct periodic safety audits at your worksites. At a minimum, 

assess safety training, confined space safety, safe handling of flammables, 

emergency response, rescue, and fire prevention. 

2008-01-I-CO-R15 Ensure that all journeyman painters have received safety training equivalent in 

content to that covered in the Joint Apprenticeship program. At a minimum, 

address confined space safety, safe handling of flammables, emergency response 

and rescue, and fire prevention. 

001718
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

122 

The Society for Protective Coatings (SSPC) 2008-01-I-CO-R16 

See below for recommendations text. 

American Public Power Association (APPA) 2008-01-I-CO-R17

Publish safety guidance addressing the hazards and controls for using hazardous materials including 

flammables in confined spaces and the unique hazards of penstocks. At a minimum 

a. In controlling hazards in confined spaces, implement a hierarchy of 

controls by first attempting to eliminate hazards or substitute with a less 

hazardous material(s) or method(s). Examples include performing work 

outside of a confined space where reasonably practicable or substituting 

a flammable material with a non-flammable one. 

b. Establish a maximum permissible percentage substantially below the 

LEL for safe entry and occupancy of permit-required confined spaces. 

c. Recommend that confined spaces that are large, or part of a continuous 

system such as a penstock, always be managed as permit-required as 

defined in the OSHA Confined Space Standard, and that such spaces 

always be monitored for hazardous atmospheres both prior to entry and 

continuously in areas where work is being performed. 

d. Ensure that evacuation plans for penstocks that have only one egress 

point provide for alternative escape routes or refuge chambers. 

e. Provide guidance for implementing a written confined space rescue plan. 

Address staging and methods of rescue for each designated permit space 

including whether a rescue team is required to stand by outside the space. 

Require that confined space rescue teams be standing by at the permit 

001719
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

123 

spaces where the hazards pose an immediate threat to life or health, 

including the hazard of a potential flammable atmosphere. 

Southern California Painting and Drywall Industries Joint Apprenticeship and 

Training Committee 

2008-01-I-CO-R18 Require that all journeyman painters who are employees and/or members have 

received safety training equivalent in content to that covered in the Joint 

Apprenticeship program. At a minimum, address confined space safety, safe 

handling of flammables, emergency response and rescue, and fire prevention. 

2008-01-I-CO-R19 Include a safety knowledge and skills component to your journeyman and 

apprentice evaluation criteria. 

001720
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

124 

BY THE 

U.S. Chemical Safety and Hazard Investigation Board 

Rafael Moure-Eraso 

Chair 

John S. Bresland 

 Member 

 

Mark Griffon 

Member 

 William B. Wark 

 Member 

 William E. Wright 

 Member 

Date of Approval August 25, 2010 

001721
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

125 

REFERENCES 

American Industrial Hygene Association (AIHA), 2005. AIHA Guideline 4, Health and Safety 

Requirements in Construction Contract Documents. 

American National Standards Institute (ANSI), 2009. ANSI Z117.1, Safety Requirements for Confined 

Spaces.

ANSI/AIHA, 2005. ANSI/AIHA Z-10, American National Standard for Occupational Health and Safety 

Management Systems.

American Petroleum Institute (API), 2005a. Recommended Practice (RP) 2220, Contractor Safety 

Performance Process, 2nd ed.

API, 2005b. RP 2221, Contractor and Owner Safety Program Implementation.

API, 2001a. Standard 2015, Safe Entry and Cleaning of Petroleum Storage Tanks.

API, 2001b. Recommended Practice 2016, Guidelines and Procedures for Entering and Cleaning 

Petroleum Storage Tanks. 

American Public Power Association (APPA), 2007. Safety Manual: Promoting a Safe and Injury Free 

Work Environment for Public Power, 14th ed., Washington, DC. 

American Society of Civil Engineering (ASCE), 1998. Guidelines for Inspection and Monitoring of InService Penstocks.

American Society for Testing and Materials (ASTM), 2007. ASTM D4276-02, Standard Practice for 

Confined Area Entry. 

―Atmospheric Pressure at Site Elevation,‖ 2004. Universal Industrial Gases, Inc., 

http://www.uigi.com/Atmos_pressure.html (accessed February 2009). 

Babrauskas, V., 2003. ―Halogen Lamps,‖ Ignition Handbook, Isaquah, WA: Fire Science Publishers. 

001722
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

126 

Bjelland, S., Goad, B., Asbury, J., and Miller, J. October 11, 2007 ―Company safety violations preceded 

the pipeline deaths of 4 Inland men,‖ The Press Enterprise,

http://www.pe.com/localnews/inland/stories/PE_News_Local_R_pipe11.6c3269.html (accessed 

January 22, 2009). 

Brandes, E., Hirsch, W., and Stolz, T., 2005. ―Autoignition Temperatures for Mixtures of flammable 

Liquids with Air at Elevated Pressures,‖ Proc. European Combustion Meeting, pp.1-5. 

Britton, L.G., 2002. ―Using Heats of Oxidation to Evaluate Flammability Hazards,‖ Process Safety 

Progress, 21(1), pp. 47-49. 

Britton, L.G., 1999. ―Body Capacitance and Resistance,‖ Avoiding Static Ignition Hazards in Chemical 

Operations, New York, NY: AIChE-CCPS. 

Calcote, et al., 1952. ―Spark Ignition: Effect of Molecular Structure,‖ Ind. Eng. Chem., p. 2659. 

Cayless, M.A., and Marsden, A.M, eds., 1983. Lamps and Lighting, 3rd Ed., Edward Arnold, London. 

Center for Chemical Process Safety (CCPS), 1992. Guidelines for Investigating Chemical Process 

Incidents, AIChE. 

―Confined Space Entry,‖ 2005. BP Process Safety Series, Rugby, U.K: Institution of Chemical Engineers 

(IChemE). 

The Confined Spaces Regulations, 1997. Statutory Instrument 1997, No. 1713, United Kingdom, 

http://www.opsi.gov.uk/si/si1997/19971713.htm. 

Construction Users Roundtable, 2010. ―About us, CURT,‖ http://www.curt.org/About-Us.aspx (accessed 

July 30, 2010). 

CURT, 2005. Construction Strategy: Selecting the Right Contractor, UP-1002. 

CURT, 2004a. Construction Safety: Contractor and Craft Worker Prequalification, UP-801.

CURT, 2004b. Construction Safety: The Owner’s Role, UP-802.

001723
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

127 

CURT, 1990. ―Improving Construction Safety Performance,‖ Report A-3, 

http://www.curt.org/pdf/135.pdf. 

Consumer Product Safety Commission (CPSC), 22 April 1996. Torchiere Lamps Test Protocol --

Halogen & Incandescent -- Phase I (memorandum). 

Dismukes, R.K., Berman, B.A., Loukopoulos, L.D., 2007. The Limits of Experience: Rethinking Pilot 

Error and the Causes of Airline Accidents, Burlington, VT: Ashgate Publishing Company. 

Electric Power Research Institute (EPRI), 2000. Steel Penstock-Coating and Lining Rehabilitation: A 

Hydropower Technology Roundup Report, TR-113584-V3, Palo Alto, CA. 

―ENR Top 600 Specialty Contractors 2005,‖ 17 Oct 2005. Engineering News-Record. 

Final Rule, Confined and Enclosed Spaces and other Dangerous Atmospheres in Shipyard Employment 

[59 FR 37816-37863]. 

Gochfeld, M. and Mohr, S. 2008. ―Protecting Contract Workers: Case Study of the US Department of 

Energy‘s Nuclear and Chemical Waste Management,‖ American Journal of Public Health, 97(9),

1607-1613. 

Hopkins, A. 2005. Safety, Culture and Risk: The Organizational Causes of Disasters, Sydney, Australia: 

CCH Australia Limited. 

Hopkins, A. 1999. Managing Major Hazards – The Lessons of the Moura Mine Disaster, Sydney, 

Australia: CCH Australia Limited. 

―International Chemical Safety Card 0179: Methyl Ethyl Ketone,‖ 1994. National Institute for 

Occupational Safety and Health, http://www.cdc.gov/niosh/ipcsneng/neng0179.html (accessed 

Aug. 18, 2009). 

Levine, S.P. and Thornton, J.R. (Feb 2004). ―LEL Monitoring During Hazard Surveys for Issuance of Hot 

Work Permits: The Need for Definitive Requirements,‖ Professional Safety, pp.31-39. 

001724
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

128 

Lewis, B., and von Elbe, G., 1961. Combustion, Flames and Explosions of Gases, New York, N.Y.: 

Academic Press. 

Lipsher, S., Mitchell, K., and McPhee, M., 4 Oct 2007. ―Epoxy smoke stymied rescue,‖ The Denver Post. 

Lundquist, S., Fredholm, O., and Lovestrand, K.G., 1975. ―Dangerous Electrostatic Charging During 

Airless Paint Spraying,‖ Static Electrification, London, U.K.: Inst. Phys. Conf. Ser. 11, pp. 260-

270. 

―Managing Workplace Safety and Health: The Case of Contract Labor in the U. S. Petrochemical 

Industry,‖ YEAR. John Gray Institute, Lamar University System. 

McManus, N., 1999, Safety and Health in Confined Spaces, New York, N.Y.: Lewis Publishers. 

National Fire Protection Association (NFPA), 2009. NFPA 1670: Standard on Operations and Training 

for Technical Search and Rescue Incidents. 

NFPA, 2008. NFPA 1006: Standard for Technical Rescuer Professional Qualifications. 

NFPA, 2007a. NFPA 77: Recommended Practice on Static Electricity. 

NFPA, 2007b. NFPA 704: Standard System for the Identification of the Hazards of Materials for 

Emergency Response, Table 6.2, Degrees of Flammability Hazards. 

NFPA, 2005. NFPA 326: Standard for the Safeguarding of Tanks and Containers for Entry, Cleaning, or 

Repair.

NFPA, 1994. NFPA 325: Guide to Fire Hazard Properties of Flammable Liquids, Gases, and Volatile 

Solids (out of print). 

National Institute for Occupational Safety and Health (NIOSH), 2009. Guidelines for Instructional 

Materials on Refuge Chamber Setup, Use, and Maintenance, IC 9514. 

NIOSH, 1998. ―Methyl ethyl ketone,‖ International Chemical Safety Card (ICSC) 0179. 

001725
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

129 

NIOSH, 1994, ―Worker Deaths in Confined Spaces, A Summary of NIOSH Surveillance and 

Investigative Findings,‖ Cincinnati, O.H.: US Department of Health and Human Services. 

Occupational Safety and Health Administration (OSHA) Permit-Required Confined Spaces Rule 29 CFR 

1910.146 

OSHA, Sept 2008. Supporting Statement for the Information Collection Requirements for the Standard on 

Permit-Required Confined Spaces (29 CFR 1910.146). Office of Management and Budget 

(OMB), Control No. 1218-0203. 

OSHA, 21 Mar 2008. Inspection No. 310470034: RPI Coating, Inc. Citation and Notification of Penalty, 

U.S. Department of Labor, OSHA, Denver Area Office. 

OSHA, 21 Mar 2008. Inspection No. 310470059: Public Service Co. of Colorado dba Xcel Energy 

Citation and Notification of Penalty, U.S. Department of Labor, OSHA, Denver Area Office. 

OSHA, 21 Mar 2008. Inspection No. 310470083: KTA-Tator Citation and Notification of Penalty, U.S. 

Department of Labor, OSHA, Denver Area Office. 

OSHA, 4 Sept 1996. Standard Interpretations – Entry into A Confined Space When the Lower Flammable 

Limit is Greater than Ten Percent, OSHA. 

OSHA, Apr 1990. ―The Phillips 66 Company Houston Chemical Complex Explosion and Fire,‖ A Report 

to the President, OSHA, Washington, DC. 

Phillips, P. and Waitzman, N., 2008. ―Contractor Safety Prequalification,‖ University of Utah. 

Scarbrough, D., 1984. ―Spray Finishing and Powder Coating,‖ Industrial Fire Hazards Handbook, 

Second Ed., NFPA, Quincy, MA, pp. 521-551. 

Transportation Research Board of the National Academies (TRB), 2006. ―Best Value Procurement 

Methods for Highway Construction Projects,‖ NCHRP Report 561, Washington DC. 

001726
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

130 

Universal Industrial Gases, Inc. (UIG), 2004. ―Atmospheric Pressure a Site Elevation,‖

http://www.uigi.com/Atmos_pressure.html (accessed September 2009). 

Webber, D., 2007. ―On Defining a Safety Criterion for Flammable Clouds,‖ HSE Contract Research 

Report HSL/2007/30, HSE Health and Safety Laboratory. 

001727
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

131 

APPENDIX A: INCIDENT TIMELINE

Date Time Detail

Summer 1964 Construction of upper dam and reservoir underway, as part of the Cabin Creek 

Pumped Storage Hydroelectric Project.

1967 Original coal tar-based epoxy coating applied in penstock.

September 20, 2000

- December 9, 2000

Initial inspection and evaluation of the penstock determines that the internal epoxy 

coating of the steel-lined section shows signs of deterioration, including blistering and 

cracking.

June 4, 2001

Xcel internal report on the 2000 inspection states that corrective action to repair the 

areas of deterioration must be implemented to prevent continued corrosion and 

unacceptable pitting damage.

September 25, 2001 Robison-Prezioso Bay Bridge project incident kills a private citizen.

January 4, 2002 Robison-Prezioso Bay Bridge project employee fatality incident.

2004

Xcel hires a contractor to explore the possibility of creating a permanent access to 

penstock, but the project is rejected due to insufficient time to obtain FERC approval.

RPI interstate Experience Modification Rate (EMR) is 0.93.

~ October 2004

A decision is made to recoat the penstock during the 2004 outage as a result of a 

metallurgist’s inspection, which notes that the interior liner is peeling up to the concrete 

section.

2005 RPI interstate EMR is 1.03

2006

2006 SSPC audit finds that RPI has “No documentation of craft-worker assessment.” 

RPI interstate EMR is 1.28.

January 3, 2006 The KTA-Tator Coating inspection contractor submits proposal for the penstock 

recoating project to Xcel.

November 1, 2006 Xcel reviews the existing penstock recoating plan.

October 1, 2006

Xcel conducts “Safety and Health Hazard Assessment Survey,” focusing on the 

abrasive blasting portion of the recoating project work, but not the risks of epoxy 

recoating work associated with using a solvent in a confined space.

2007

Robison-Prezioso, Inc. is renamed RPI Coating; the company is ranked the nation's 

seventh-largest specialty paint company based on revenues in 2005, according to 

Engineering News-Record.

001728
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

132 

January 16, 2007 The KTA-Tator coating assessment contractor contracts with Xcel to inspect and report 

on the quality of RPI’s penstock re-coating work for 2007 penstock recoating project.

January 17, 2007 Xcel’s internal hazard assessment of the penstock re-lining project identifies the 

penstock as having a confined space hazard.

Spring 2007 An Xcel civil engineer identifies “major items of concern” with the penstock recoating

project, including a lack of an alternative exit.

April 2007

Xcel issues an RFP to multiple vendors to recoat the penstock. Proposal asserts that 

an Xcel project manager will be fully integrated into the contractor’s safety program. 

Only one vendor meets criteria for successful completion of the job, but the vendor’s 

cost estimate exceeds Xcel’s anticipated budget.

June 2007 First bid submissions evaluated; one company meets criteria but cost estimate is 

$450,000 over Xcel’s estimated budget; Xcel resubmits the project for additional bids.

July 11, 2007

Clear Creek County Fire Authority conducts an emergency drill at the Cabin Creek 

facility, rehearsing a fire response to the power production office facility; this drill does 

not involve the penstock or a confined space rescue.

Late July 2007

RPI and one other company meet the criteria for consideration as the potential 

recoating contractor; although the competing bidder is more technically qualified and 

RPI Coating’s safety record is poor, RPI is selected due to cost.

August 27, 2007

RPI requests a copy of Xcel’s Cabin Creek site confined space procedures from the 

penstock recoating project team leader and the Xcel Cabin Creek plant manager. Plant 

manager states information will be covered in contractor orientation. 

Late August – mid 

September 2007

RPI contractors begin arriving at the Xcel Cabin Creek site.

September 4, 2007

KTA-Tator project engineer sends review of RPI coating application plan, project 

schedule, coating application procedures, and product data sheets for epoxy materials

to the Xcel recoating project team leader.

The Xcel project scheduler provides contractor orientation with an RPI foreman and five 

contractors (of the 14 RPI employees involved in the penstock work).The orientation 

form indicates that all contractors are trained for confined space entry and that MSDSs 

have been provided to Xcel plant management. RPI notifies the Xcel scheduler that the 

contractors will be using a “ketone” solvent to clean the sprayer inside the penstock.

September 5, 2007

Xcel and RPI Coating hold a “Preconstruction Meeting” where project-specific safety 

concerns are to be identified; however, the use of flammables within a confined space 

and the need for emergency response and rescue plans are not discussed. 

Xcel identifies RPI's high EMR rate during the meeting and requires RPI to take extra 

precautions and informs RPI that Xcel’s Stop Work Policy will be enforced during the 

penstock recoating project. 

September 4-9, 

2007 The upper reservoir is dewatered.

001729
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

133 

September 10, 2007

An instructor from Southern California Painting and Drywall Industries (SCPDI) District 

36 Training Center conducts a six-hour safety refresher training session pertaining to 

OSHA-required topics at the Xcel Cabin Creek site for nine of the 14 RPI industrial 

painters at the request of RPI’s safety director. This training consists of watching safety 

videos on each topic and multiple-choice exams on the information; the training is 

general in nature and not tailored to all site-specific safety risks of the penstock work.

September 11-

October 2, 2007

A number of confined space entry permits and air monitoring logs are completed by 

RPI that indicate that continuous air monitoring is required inside the penstock.

Logs reveal that KTA-Tator and Xcel employees entered the penstock on several 

occasions to inspect and/or review RPI Coating’s work progress.

September 12, 2007

110 gallons of MEK (two 55-gallon drums) delivered to Cabin Creek site.

RPI conducted a test spray with the epoxy and MEK at Cabin Creek site; the Xcel 

principle engineer was present during this test spray. 

September 15, 2007

RPI reports trouble with 480 volt power feed to equipment in the penstock. Xcel

employees enter the penstock to troubleshoot the electrical equipment. Incorrect wiring 

is modified. 

September 16, 2007

Entry into the penstock is delayed 2 hours due to high carbon monoxide (CO) levels.

RPI experiences additional electrical service problems inside penstock.

Foreman rewires an electrical spider box in the penstock for RPI Coating.

September 19, 2007 Xcel Cabin Creek personnel leave high bay fans on to ventilate errant CO from coming 

down penstock to hydroelectric plant’s substation lower level.

September 21, 2007 RPI Coating begins sandblasting inside the penstock; the company is 5 days behind its 

tight 10-week schedule.

September 22, 2007

The Xcel Penstock Reline Project Manager observes RPI Coating conducting abrasive 

blasting inside the penstock and notes: “Work conditions inside the penstock are highly 

hazardous on many levels. In the best of conditions, the coating removal is dirty, nasty 

work.” 

KTA-Tator conducts an initial pre-job hazard assessment of the penstock, noting that 

the MSDSs for all coatings and solvents used in the project are available. Inspector 

also notes that RPI and the Xcel penstock recoating project manager were advised on 

the MSDSs.

September 26, 2007

Xcel employees enter the penstock to perform welding on weep holes to stop leaks. 

The KTA-Tator inspector conducts a “Task Summary: Coating Observation Hold 

Points” inspection of the penstock interior. Inspection identifies the use of thinner as 

part of the coating materials mixing and pre-application process, and documents the 

necessity of using thinner/solvent to flush the sprayer system equipment (including 

hoses, nozzles, and the sprayer itself).

001730
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

134 

October 1, 2007 8:00 AM Xcel personnel conduct a safety evaluation of RPI’s sandblasting work inside penstock; 

no unsatisfactory items are noted.

~12:00 PM

An Xcel welder enters with the RPI Coating foreman to begin welding around the 

leaking seep hole/cap in the penstock. The welder does not sign into the log book at 

the penstock’s entrance.

October 2, 2007 Morning of 

Sand-blasting activities, including hand sanding and grinding of the walls, are

completed. RPI employees began the preparatory steps for applying the new coating 

onto the penstock interior. No special precautions are taken beyond those in place prior 

to starting the sandblasting operation.

8:00 AM Xcel welder completes welding job around the leaking seep hole/cap in the penstock.

1:10 PM

RPI project supervisor and KTA-Tator inspector leave for lunch.

RPI employees continue attempts to apply epoxy to the first 12-15 feet of the 

penstock’s interior, but difficulties with the sprayer and epoxy mixture prevent 

satisfactory application.

~1:55 PM

A flash fire ignites at the sprayer in the immediate vicinity of the base hopper 

while the contractors flush the system with MEK solvent. This rapid fire catches 

one contractor’s sleeve on fire and quickly engulfs a number of buckets of 

solvent located on and around the scaffold of the epoxy sprayer.

1:59 PM A worker rapidly exits from the penstock access door and runs to notify the Xcel control 

board operator about the fire in the penstock.

~2:00 PM The Xcel employees at upper reservoir mushroom hear a “whoosh,” followed by yelling, 

but what is being said is unintelligible.

2:03 PM Clear Creek County dispatch receives a 9-1-1 call from the Xcel control board operator 

regarding the fire and initiates emergency response.

2:11 PM The Clear Creek County Sheriff's officers’ response vehicle arrives at the Cabin Creek 

site.

2:20 PM Xcel operator log book documents: “Emergency services w/o confined space fire 

training arrived. They have summoned a Denver team." 

2:22 PM Additional emergency responders from various districts/units arrive at Cabin Creek site.

2:25 PM West Metro Rescue asked to respond to Cabin Creek site.

2:30 PM

An RPI contractor retrieves and gives the MSDSs to the Georgetown Police 

Department.

Henderson Mine Rescue team asked to respond to Cabin Creek site.

~2:45 PM Final radio communication from the trapped workers is received by emergency 

responders and co-workers.

001731
Cabin Creek Hydroelectric Plant Final Investigation Report 8/25/2010 

135 

2:47 PM

A small group of responders and an RPI employee enter the penstock through the 

access door, travel up the penstock, but exit shortly thereafter due to the thick black 

smoke conditions.

~3:00-3:15 

pm

Xcel employees at the upper reservoir mushroom intake report seeing ash and flecks of 

burned material come out of the penstock.

3:15 PM SCBA oxygen tanks are dropped into mushroom upper end of penstock.

3:25 PM Residual smoke evident from penstock access door.

3:30:37 PM A growing smoke cloud is evident around the penstock access door.

3:40 PM West Metro Fire Rescue arrives at Cabin Creek.

3:54 PM A cloud of smoke remains evident in front of the penstock access door.

4:10 PM Henderson Mine Rescue arrives at Cabin Creek

4:45 PM Emergency responders wearing SCBA enter the penstock 

5:35 PM Emergency responders on site receive the first order from Incident Command to 

fight/extinguish the fire; Henderson Mine team to enter.

5:45 PM Henderson Mine team enters the penstock through the access door to check air quality, 

size up the fire, and locate/rescue the trapped contractors.

~9:00 PM Xcel personnel allowed back into the Cabin Creek substation building, as air monitoring 

results are found to be at safe levels.

October 3, 2007 2:00 PM Fatally injured workers are removed from the penstock.

8:00 PM The incident scene is released back to Xcel.

001732
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

136 

APPENDIX B: REGULATORY HISTORY OF RPI COATING, INC. 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

10/7/2008 312279870 Overton NV Planned - Safety OSHA 300 log errors $0 $0 Closed

5/14/2008 311643977 Jean NV Referral - Health None Closed

11/5/2007 311634307 Las Vegas NV Compliant - Health Special - Construction None $0 $0 Closed

10/2/2007 310470034

Georgetown

CO

Accident - Safety; 5 

fatalities

National - Lead; 

Special - Electrical; 

Special - Fall from 

Height; Special - Lead; 

Special - Powered 

Industrial

Working surfaces; flammable liquids; 

respirators; confined space; welding; 

electrical wiring; hazard communication $845,100 

Contested

12/29/2005 125529636 Santa Rosa CA Planned - Safety Special - Construction No ROPS or seatbelt installed on 

equipment $150 $150 Closed

10/13/2005 110569803

Davis Monthan 

AFB AZ

Program Related1-

Safety

No body belt worn on vehicle-mounted 

rotating work platform $1,375 $1,375 

Formal 

Settlement 

Agreement

(FSA); Closed

 

1

 A Program Related inspection is one where OSHA conducted an unannounced programmed inspection at an establishment and also inspected RPI, who was 

working at the establishment as a contractor. 

001733
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

137 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

10/5/2005 125529289

Santa Rosa

CA

Planned - Safety Special - Construction Flaggers not used at a construction site 

when warning signs and barricades 

could not be used to control traffic

$150 $150 

Closed

9/27/2002 305639262 Vantage Bridge 

I-90 WA Complaint - Health None $0 $0 Closed

9/23/2002 305551491 Vantage Bridge 

I-90 WA Planned - Safety Local - Construction No written fall protection work plan; No fall restraints/fall arrest systems; $600 $600 State Decision

5/10/2002 300891090

San Francisco

CA

Complaint - Health National - Lead; 

Special - Construction

Cadmium - Improper removal and 

storage practices

$13,500 $280 

FSA; 24 

citations 

deleted; 

closed

1/4/2002 300890555

San Francisco

CA

Accident - Safety; 1 

fatal; 4 hospitalized

Improper scaffold design; Rated load 

capacity exceeded on suspended 

scaffold; Platform on suspended scaffold 

not wide scaffold not wide enough or 

missing a guardrail; Improper erection or 

dismantling of scaffolds; Scaffold 

overloaded

$41,400 $41,400 Open

9/25/2001 300890100

San Francisco

CA

Accident - Safety Special - Construction Framed panels not securely anchored, 

guyed, or braced; Machinery and 

equipment components not designed, 

secured, or covered to minimize hazards 

caused by breakage, release of 

mechanical energy (e.g., broken 

$18,000 $18,000 Open

001734
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

138 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

springs), or loosening and falling

6/19/2001 304706450 Cape 

Canaveral AFS FL Program Related -Safety

Local - Fall, FLCare; 

Special - Construction, 

Construction Fatalities

No medical services/first aid available; 

Unsafe abrasive blasting respirators; 

Flammable liquid dispensing units 

not protected against collision 

damage; “No smoking” signs were 

not posted in flammable liquid areas; 

Spinner knobs were attached on 

steering wheels of equipment; Industrial 

truck did not meet ANSI standard 

requirements 

$9,375 $5,250 FSA; Closed

4/23/2001 304422132 Henderson NV Planned - Safety Special - Construction None $0 $0 Closed

4/23/2001 304425416 Henderson NV Planned - Health Special - Construction None $0 $0 Closed

3/20/2001 126030634 Coalinga CA Accident - Safety; 1 

hospitalized

Injury not immediately reported to CalOSHA; Forklift operating rules not 

enforced

$935 $935 

Closed

001735
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

139 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

3/7/2001 125637058 San Francisco CA Planned - Health National - Lead; 

Special - Construction

Cadmium - No regulated area or 

demarcation, no monitoring, prohibited 

activities conducted, no medical for 

respirator use, torn PPE not replaced; 

Machinery not maintained in safe 

condition; Separate shower facilities not 

available for females; Safety glasses 

interfere with respirator; Compressed 

gas cylinder not secured while being 

transported; Pinch points on machinery 

not guarded

$83,925 $20,250 

FSA; 19 

violations 

deleted; open

2/27/2001 125619239 San Francisco CA Accident - Safety; 1 

hospitalized

Ramps/Runways not 20-inches wide; 

Metal scaffolds - Railings and planks not 

secured; Improper anchorages for 

personal fall protection equipment

$26,100 $18,000 

FSA; One 

item deleted; 

Closed

10/11/2000 300888401

Bay Bridge -

Lower Deck, 

San Francisco

CA Accident - Safety None $0 $0 Closed

12/17/1999 120266846 Pasadena CA Complaint - Health Local – Regulated 

carcingen None $0 $0 Closed

5/28/1999 302528437

Spring 

Mountain 

Overpass, Las 

Vegas

NV Complaint - Safety None $0 $0 Closed

001736
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

140 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

3/2/1999 119737997

Yeruba Buena 

Island, San 

Francisco

CA Planned - Safety

Local - Regionp12

None $0 $0 Closed

12/28/1998 11967461

Yeruba Buena 

Island, San 

Francisco

CA Planned - Health

Cadmium - No initial monitoring; 

Respirators not worn; Torn PPE not 

replaced; Fall protection - Positioning 

systems not used

$2,495 $1,685 FSA; Closed

10/13/1998 302524384 Las Vegas NV Planned - Safety

More than 25 gallons of flammable or 

combustible liquids stored in a room 

outside of an approved storage 

cabinet; No portable fire extinguisher, 

having a rating of not less than 20-B 

units, located outside of, but not 

more than 10 feet from, the door 

opening into any room used for 

storage of more than 60 gallons of 

flammable or combustible liquids; 

Flammable liquids were used where 

there were open flames or other 

sources of ignition within 50 feet of 

the operation

$375 $375 

Review 

Commission 

Decision

 

2

 This is a code for a state of California local emphasis program. 

001737
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

141 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

7/15/1998 126141324 Oxnard CA UnProgrammed 

Related3- Health Cadmium $185 $185 FSA; Closed

1/8/1998 115218703 Highway 17N, 

Soap Lake WA Complaint - Health None $0 $0 Closed

5/28/1997 125658047

Los Vacqueros 

Dam, 

Brentwood

CA Planned - No 

Inspection Local-Tunnel None

5/27/1997 126207984 Santa Maria CA Accident - Safety; 1 

hospitalized

Improper portable wooden ladders; 

Injuries not immediately reported; no 

Injury and Illness Prevention Program

$150 $150 Closed

5/23/1997 126053537 Los Angeles CA Complaint - Health No Injury and Illness Prevention 

Program $185 $185 Closed

1/17/1997 115236564 Highway 17N, 

Soap Lake WA

Complaint - No 

Inspection/Process 

Inactive

None

 

3

 An UnProgrammed Related inspection is one where OSHA was conducting a fatality, compliant, or referral inspection at an establishment and also inspected 

RPI, who was working at the establishment as a contractor. 

001738
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

142 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

10/11/1996 119772846

Los Vacqueros 

Dam, 

Brentwood

CA Planned - No 

Inspection Local-Tunnel None

2/5/1996 119874667 Los Angeles CA UnProgrammed 

Related - Health None $0 $0 Closed

9/26/1995 11966949 Rodeo CA UnProgrammed 

Related - Health None

5/9/1995 112130059 Carson CA Accident; 1 

hospitalized

No training on aerial lifts; Foundation soil 

not maintained in safe condition $5,525 $600 

FSA; 1 

citation 

deleted

3/10/1994 123834228 Tracey NV Planned - Safety Hazard communication - improper 

labeling, MSDS, training; no respirators $3,000 $3,000 FSA; Closed

12/1/1993 112173331 Calabasas CA UnProgrammed 

Related - Health

No monitoring for hazardous substances 

(deleted); No eyewash $900 $225 

Administrative 

Law Judge 

(ALJ)

Decision; 1 

citation 

deleted; 

Closed

4/8/1993 12386675 Las Vegas NV Planned - Safety

No bonding/grounding when 

transferring flammable liquids 

between containers; Containers not 

provided for waste rags; Improper 

$125 $125 

State 

Decision; 

Closed

001739
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

143 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

temporary wiring; Unapproved forklift

9/24/1992 119989457 Cardiff CA Complaint - Health Improper temporary wiring, ladders, floor 

openings $2,770 $2,475 ALJ Decision; Closed

9/23/1992 119988425 Carlsbad CA Complaint - Health -

No Inspection None

8/7/1992 107108474

Alyeska 

Pipeline Marine 

Terminal, 

Valdez

AK Compliant - Safety

Improper air compressors for abrasive 

blasting; HAZCOM labeling and MSDSs; 

No first aid training; No washing 

facilities; No respirators; Temporary 

heaters too close to combustibles; 

Improper electrical wiring; No fall 

protection

$14,300 $4,054 

Informal 

Settlement; 4 

citations 

deleted; 

Closed

7/7/1992 114570963 Henderson NV Planned - Safety

Smoking not prohibited where flammable 

liquids are present; Hazard 

communication; Flammable liquids 

stored or transferred in unapproved 

containers; Respirators; Air powered 

tools

$4,650 $2,325 

Informal 

Settlement; 

Citation 

Amendments; 

Closed

6/9/1992 11566424 Phoenix AZ Complaint - Health None

6/9/1992 115561169 Phoenix AZ Complaint - Safety None

001740
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

144 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

5/5/1992 112051784 Lancaster CA Accident; 2 

hospitalized

No head protection; Improper rolling 

platform scaffold planks and construction $2,250 $2,250 Closed

4/3/1992 111872867 Playa Del Ray CA Accident - 1 

Hospitalized Portable ladders not secured $0 $0 ALJ Decision; Closed

1/10/1992 11199040 Playa Del Ray CA UnProgrammed 

Related - Safety Personal Fall Protection not used $600 $600 ALJ Decision; Closed

10/30/1991 112088117 Carson CA Program Related -

Safety Local - Refinery Respiratory protection not used $0 $0 Closed

8/8/1991 111994851 Oakley CA UnProgrammed 

Related - Safety Safe Code of Practices not posted $0 $0 Closed

5/16/1991 112223318 Goleta CA UnProgrammed 

Related - Health Respiratory protection no used $0 $0 Closed

4/24/1991 111979316 Fountain Valley CA UnProgrammed 

Related - Safety None

4/5/1991 111869483 Playa Del Ray CA UnProgrammed

Related -Safety None

1/7/1991 112113501 Playa Del Ray CA UnProgrammed 

Related - Safety

Flammable vapors were not 

controlled; Flammable liquid containers 

not marked; No portable fire extinguisher 

outside flammable storage room; Open 

flames not prohibited in flammable liquid 

$0 $0 Closed

001741
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

145 

OSHA Inspection and Citation History

Robison-Prezioso Inc. (RPI Coating, Inc.)

5/27/88 - 12/31/2008

Date Inspection 

Number Location State Inspection Type Emphasis Program Citation Summary Initial Penalty

Final 

Penalty Resolution

storage rooms

12/4/1990 112117767 Playa Del Ray CA UnProgrammed 

Related - Safety Improper temporary stairs $0 $0 Closed

10/26/1990 112082862 Wilmington CA Program Related -

Safety Local - Refinery Lack of suitable eye and face protection; Hazard communication $0 $0 Closed

5/27/1988 106775455 New Hall CA UnProgrammed 

Related - Safety

Respirators; PPE; Flammable liquids in 

unapproved containers $540 $540 Closed

001742
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

146 

APPENDIX C: INVENTORY OF FLAMMABLE AND COMBUSTIBLE 

MATERIAL IN PENSTOCK 

Flammable and Combustible Material in Penstock Distance from Sprayer Number of 

buckets119

One (2-gal) bucket with MEK, heavily melted at scaffolding120 Between 79 ft and 91 ft 1

Three 5-gallon buckets of epoxy/MEK mixture (~12 gallons, of which 

~5 gallons were MEK) on penstock floor, adjacent to sprayer stage

On floor, adjacent to 

sprayer

3

Three buckets of MEK (~11-12 gallons) and at least eight buckets of 

epoxy (epoxy buckets completely melted and, therefore, unable to 

determine if base or hardener; only handles survived fire) 

On stage with sprayer 11

Eight (5-gal) buckets of base; three (5-gal) additional melted buckets 

of base; one (2-gal) bucket of hardener; and indeterminate number of 

completely melted buckets

13 ft, 9 3/8 in 12+

Twelve (2-gal) buckets of hardener; indeterminate number of 

completely melted buckets 101 ft, 1 in 12+

Ten (5-gal) buckets of base; 20 (2-gal) buckets of hardener 172 ft, 11 7/8 in 30

Four (2-gal) buckets of hardener 228 ft, 3 3⁄4 in 4

Ten (5-gal) buckets of base at 500’ mark in penstock 380 ft, 3 5/16 in 10

Nineteen (5-gal) buckets of base 532 ft, 2 7/8 in 19

TOTAL NUMBER OF BUCKETS INSIDE PENSTOCK 102+

 

119 The number of buckets, instead of actual volumetric quantity, of the epoxy and MEK are provided here because a 

number of the buckets were destroyed in the fire; only the wire handles of these buckets remained post-incident. 

As a result, the CSB could not determine if the handles belongs to 2-gallon or 5-gallon buckets. 

120 The exact location of this bucket is unknown because it was moved while victims were being removed; distance 

estimate is based on CBI initial entry report that buckets were located on and under scaffolding, and knowledge 

that scaffolding was 12 feet long, adjacent to the west bulkhead. 

001743
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

147 

APPENDIX D: EVALUATION OF IGNITION SOURCES 

As Section 5.2.2 explains, numerous potential ignition sources existed in the immediate area of the 

sprayer at the time of the fire. Below is a detailed analysis of each potential ignition source the CSB 

considered. Supporting evidence for each analysis is based on examination of physical evidence, 

interviews with witnesses, tests on equipment preserved from the scene as evidence, and the physical and 

chemical properties of the materials involved at the time of the incident based on local environmental 

conditions inside the penstock. In certain cases, conflicting witness statements and extensive fire damage 

to the equipment made it impossible for the CSB to determine events and/or exact equipment 

configurations just before the fire; as a result, the CSB could not positively rule out several potential 

ignition sources due to lack of evidence. 

D.1 Static Ignition of Explosive MEK Vapor-Air Mixture inside 

Sprayer Base Hopper 

The CSB concluded that static electricity generated while flushing MEK in the base hopper was the most 

likely source of ignition. One worker testified that he was looking into the base hopper and saw the initial 

flash of MEK near the bottom of the hopper. The worker stated that he was holding a 3/8-inch diameter 

braided nylon, non-metal reinforced, hose with a metal JIC121 swivel connector at the end, close to the 

inside wall of the metal hopper. This was about 6 inches (15 centimeters) from the top and about 1foot 

(30 centimeters) above the MEK surface. The hopper contained a 3-inch (8-centimeter) depth of MEK, or 

about one-half gallon (2 liters). The MEK was being circulated from the base hopper through the 

sprayer‘s air-driven piston pump, electric heater, piping, and hose, back into the base hopper to flush 

remaining epoxy particles from the sprayer. 

 

121 JIC stands for Joint Industrial Council, which revised specifications for these types of connectors in the 1960s. 

001744
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

148 

Assuming that the electric heater for the base hopper on the sprayer was not operating and the 

temperature of the MEK was the same temperature as the penstock122 (approximately 47-53 °F or 8-12 

°C), the CSB determined that the hydrocarbon-air mixture in the region where the journeyman painter 

was holding the swivel connector was likely near its most easily ignitable composition (Appendix E). 

Once ignited, the brightest flame would have appeared in the bottom of the base hopper where the 

hydrocarbon-air mixture was optimal for combustion. Ignition inside the base hopper would have 

produced a rapid deflagration with an outwardly directed pressure wave, thus producing a ―fireball.‖ This 

scenario matches descriptions given by the workers who saw the initial flash. 

After the incident, the JIC swivel and the base hopper hose could not be located. However, the fitting on 

the other end of the base hopper hose was still attached to the valve on the sprayer. This fitting had an 

internal diameter of 0.117 inches (0.297 centimeters). In addition, remnants were found of an inner woven 

metal sheath that had belonged to the hose used to circulate MEK in the hardener hopper. The lack of a 

similar metal sheath on the base hopper hose led the CSB to conclude that the base hopper hose was most 

likely constructed from a non-conductive material, which was likely consumed by the fire. 

Based on testimonial evidence that the pump was being operated with an air supply pressure of 10-15 psig 

(0.7-1.0 barg) and using the performance curves for the 56:1 King piston pump supplied by the sprayer 

manufacturer, the CSB estimated a maximum liquid flow rate of 4-5 gallons (15-19 liters) per minute 

during circulation. The maximum flow velocity of MEK through the JIC swivel was then estimated to be 

12-16 feet (3.7-4.9 meters) per second. This estimate neglects the pressure drop from the King Pump to 

the JIC swivel connector outlet by extrapolating the pump curves to ambient pressure. Frictional losses 

would have occurred in the heater, the quarter-turn valve, piping, hoses, and the JIC swivel connector 

 

122 The air temperature inside the penstock was fairly constant, as demonstrated by daily temperature readings taken 

by the KTA-Tator inspector from the beginning of the project. 

001745
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

149 

itself. Since the MEK was being used to clean residual epoxy base resin from the system, it is plausible 

that the narrowest parts of the system (i.e., the quarter-turn valve and JIC swivel connector) could have, at 

least periodically, become partly blocked with resin. Therefore, a range of different flow velocities, up to 

a maximum of 16 feet (4.9 meters) per second, was possible during circulation, accompanied by a range 

of different pressures at the JIC swivel connector, depending on its orientation and any additional 

restrictions created by resin blockage. 

The JIC swivel connector operated as a spray nozzle with pulsed flow produced by the King piston pump. 

Consequently, MEK liquid flowing through the JIC swivel connector would have broken up into droplets. 

This shearing action would have resulted in electrical charge separation with respect to the metal 

connector, leaving a net charge on the spray and an equal but opposite charge on the ungrounded JIC 

swivel connector. 

The potential for static charges to accumulate on the isolated JIC swivel connector increases as the length 

of the hose increases and as the hose diameter decreases. The electrical resistance is proportional to hose 

length and inversely proportional to the hose cross-sectional area. Static charge accumulation in the 

swivel also becomes more likely as the MEK velocity through the swivel end connector increases, as the 

rate of charge separation increases, and as the operation more closely resembles a spray nozzle. Provided 

the liquid breaks up into a spray, the only continuous electrical path from the JIC swivel connector to 

ground is through the column of MEK liquid in the hose. Since circulation was carried out using a King 

piston pump, pulsation spraying increases the probability of a non-continuous outlet jet. Charging may 

have been further increased if suspended epoxy particles were present in the MEK, especially if these 

particles created flow restrictions at narrow points in the valve and/or JIC swivel. 

The following analysis estimates the potential ―spark energy‖ that could be stored by an isolated JIC end 

connector and demonstrates that the spark energy was sufficient to ignite the MEK vapor-air mixture 

inside the base hopper. This discussion assumes that the resistance of the hose is infinite (i.e., constructed 

001746
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

150 

of a non-conductive material) compared to that of the column of conductive MEK contained within it; 

that the MEK was ejected as a pulsating spray jet offering no continuous conductive path to ground; and 

that the JIC swivel connector was held close to the hopper wall creating a potential spark gap of a few 

millimeters: 

The CSB calculated that the Minimum Ignition Energy (MIE) of an optimum MEK vapor-air 

mixture under penstock conditions to be about 0.5 mJ (Appendix E). 

Although the capacitance of the isolated JIC swivel end connector might be only 3-5 pico 

Farads (pF), which is typical for a small metal object, this would have increased several-fold 

by coupled capacitance with both the hopper wall and journeyman painter‘s gloved hand. The 

estimated range of capacitance (―C‖) is 7-15 pF, although larger values are possible.123

Using the formula W = 1⁄2(CV2) to describe the energy of charged capacitors, where W is the 

stored energy (Joules), C is the estimated capacitance (Farads), and V is the spark voltage 

(Volts), the voltage required to yield an incendiary spark of 0.5 mJ is in the range 8,160-

12,000 volts. 

The resistance to ground (R) via the column of conductive MEK contained within the hose is 

determined by the formula R = ρL/A, where ρ is the resistivity of MEK (approximately 1 x 

105

ohm-meters); L is the length of the hose (7.0 feet or 2.1 meters); and A is the internal 

cross sectional area of the hose (approximately 31.7 mm2or 3.17 x 10-5 m

2

). If these values 

are substituted, the resistance to ground via the hose is approximately 6.6 x 109ohms (or on 

the order of 1010 ohms). 

 

123 An experimental simulation would be needed to obtain a more accurate value. 

001747
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

151 

Using Ohm‘s Law (I = V/R), where I is the charging current (Ampere); V is the required 

voltage of the isolated end connector (V = 8,160-12,000 volts); and R is the ground resistance 

through the MEK in the hose (6.6 x 109ohms), the required charging current is in the range 

of 1.2-1.8 microamperes (μA). This is the charging current needed to support a voltage of 

8,160-12,000 volts on the swivel connector given the leakage resistance of 6.6 x 109

ohms 

back to ground through the MEK in the hose. 

The estimated voltage of 8,160-12,000 volts could have produced a spark several millimeters 

long. Spark energies of 0.5 mJ are very small (roughly 1 percent of an automobile spark plug) 

and unlikely to be observed, even if a succession of such sparks were to occur. 

A circuit containing a resistor and capacitor is called an ―RC‖ circuit. In this type of a circuit, 

current varies with time. The RC time constant of the JIC swivel is about 0.1 seconds—this 

is the product of resistance to ground (on the order of 1010 ohm) and capacitance (on the order 

of 10-11 F). The connector would be capable of charging to its maximum voltage in about five 

time constants, or one-half second. Sparks could therefore have occurred on a frequency of 

about two per second given these assumptions. Incendiary sparking would have been 

prevented by gaps much larger than a few millimeters or by a continuous stream of liquid 

from the swivel to the wall. The worst case (most frequent sparking) is for the liquid to 

continuously break up into spray and the swivel to be held about 0.12 inches (3 millimeters) 

from the hopper wall and spraying downwards. This is consistent with journeyman painter‘s 

testimony of how the hose was positioned to minimize splashing the MEK inside the base 

hopper. 

High-velocity MEK spraying through an isolated JIC swivel connector (i.e., ―nozzle‖) with a charging 

current of 1.2-1.8 μA could have accumulated sufficient stored energy to produce a series of incendiary 

sparks capable of igniting the MEK vapor-air mixture (i.e., having at least 0.5 mJ energy). The ignition 

001748
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

152 

probability would have been greatly increased by the large number of sparks possible during circulation, 

plus the variety of charging conditions, spark gap geometries, and mixture compositions involved. 

Although the journeyman painter was not electrically grounded, the CSB considers it unlikely that static 

ignition occurred from a ―doorknob type‖ spark between the journeyman painter and the sprayer. The 

CSB also considers it unlikely that electrical charging of the journeyman painter‘s Tyvek®coveralls124

could have resulted in brush static discharges because evidence indicates that he was essentially stationary 

on the sprayer platform during the circulation operation. However, the painter might have become 

charged while holding the circulation swivel nozzle, which is considered a variation of this ignition 

source scenario. Had the painter‘s glove had a hole, notably in the thumb or index finger holding the 

nozzle, he could have become charged to many kilovolts while the nozzle was not contacting the hopper 

wall. This would have allowed a spark to subsequently occur once the nozzle approached the hopper wall. 

Assuming his capacitance was 200 pF,125 an incendiary spark would require a voltage of 2.2 kV and a 

charging current of about 0.33 μA. Accordingly, there is less than an order-of-magnitude reduction in the 

charging current requirement to give an incendiary static spark and this variation has little practical 

importance. 

Lundquist et al. (1975) observed charging currents up to about 6 μA during airless paint spraying of 

conductive liquids. Although the MEK circulation operation was being carried out at much lower 

pressures and with a larger nozzle diameter than those used for airless paint spraying, the Lundquist et al. 

work shows that conductive liquids such as alcohols produce higher charging currents than less 

conductive liquids and that larger diameter nozzles and higher pressures (i.e., higher liquid velocities) 

produce higher charging currents. Their article implies that charging currents vary widely with conditions, 

 

124 The manufacturer of Tyvek coveralls cautions users against wearing this type of protective clothing in flammable 

or explosive atmospheres as doing so can generate static. 

125 200 pF is frequently used as an average value for the capacitance of a person (Britton, 1999, p. 44). 

001749
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

153 

and overall, supports the static charging scenario, although the magnitude of the charging current would 

need to be resolved experimentally. The need for proper grounding of paint spray nozzles is stressed in 

the Lundquist article. In addition, NFPA 77 (2007), the operating manual for the sprayer, and even RPI‘s

safety program, contain safety warnings about proper grounding of equipment and the need to use 

conductive hoses. 

D.2 Stray Current Ignition of Explosive MEK Vapor-Air Mixture inside 

the Sprayer Base Hopper 

Some RPI workers‘ statements reveal that a dimming of the lights at the work area inside the penstock 

nearly coincided with the initial flash of the fire. These lights were powered from PDC 3, the power 

distribution center closest to the sprayer. PDC 3 also powered the 240-volt heaters on the pump outlets. 

During interviews with the CSB, these workers associated the dimming lights with the base heater 

coming on, but the CSB found no other evidence to support this. It can be inferred only that the voltage 

supplying the lights suddenly dropping was caused by increased power load as a result of the base heater 

turning on. The dimming lights could equally well have been caused by events outside the penstock. 

Power distribution center PDC 3 was preserved as evidence and examined closely by the CSB and other 

parties at an offsite location; no evidence of internal ignition (such as shorting) was found inside. 

However, the examination did reveal that the 240-volt power supply for the heaters was wired with a 

three, rather than a four, -prong connector. Thus, there was no ground connection in the circuit and the 

sprayer was operated with a floating neutral.126 Although the sprayer was equipped with an independent 

 

126 A floating neutral means no neutral-to-ground bond in the electrical distribution system, which causes the neutral 

conductor to ―float,‖ or lose its reference to ground. Should the loading become unbalanced or an electrical short 

occur, the phase voltages fluctuate severely. This spider box had been damaged as a result of electrical problems 

early in the recoating project and repaired by an RPI employee. This individual was not a licensed electrician and 

lacked training certifications to perform electrical work. 

001750
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

154 

grounding wire, the ground wire was not connected to any ground point when it was examined after the 

incident. 

At the time of the flash, two spray hoses (one containing the base, the other the hardener) were attached to 

the sprayer, each going out to the metal mixing block. While preparing the spraying equipment inside the 

penstock, an apprentice painter stated that he saw a series of ―sparks‖ jumping from the sprayer unit to 

one of the spray hoses when he connected it with a crescent wrench, implying faulty bonding in the spray 

hose. The CSB physically examined the spray hoses after the fire. Both hoses were metal-reinforced and 

thus, should have had electrical continuity to the mixing block, although no continuity measurements 

could be made due to fire damage. These sparks may have been caused by a stray current arc between the 

floating neutral of the sprayer chassis and the grounded metal hose connector. A ground path was likely 

provided, via the metal reinforcement sheath inside the hose, to the metal mixing block lying on the steel 

tunnel floor. 

Grounding via the spray hoses to the mixing block is likely, but required the mixing block to have been in 

good electrical contact with the floor of the steel tunnel. The CSB noted that the position of the box on the 

drain pipe may have produced only intermittent contact grounding. Similarly, grounding via a spray wand 

requires electrical continuity through the mixing block out to the spray wand, which would also need to 

be in electrical contact with the steel tunnel. After the incident, the spray wands were found laying on the 

wood deck platform of the sprayer scaffold, so they were not grounded. The CSB concluded that at the 

time of the flash, the sprayer may have been grounded, but it is unlikely that the sprayer was reliably 

grounded. 

Assuming that current was flowing to ground from the floating neutral connection, different metal 

components of the sprayer would have been at slightly different voltages, depending on the impedances 

between the components. Thus, a change in load on the 240-volt supply, caused by a sudden voltage drop 

at PDC 3 (resulting in the observed dimming of the lights), may have produced a change in the floating 

001751
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

155 

neutral voltage on the sprayer chassis. The outcome may have been an electrical arc caused by a high 

voltage transient between the base hopper and the metal nozzle on the circulation hose physically held 

inside the base hopper by the journeyman painter. An arc could have occurred during contact/separation 

between the nozzle and the hopper wall. However, the use of a non-conductive hose (Section D.1) rules 

out a stray current arc as the ignition source. 

D.3 Ignition of Explosive MEK Vapor-Air Mixture by Halogen Lights 

atop the Sprayer 

The sprayer unit was mounted on a wheeled cart sitting on a wheeled portable tube and coupler scaffold 

positioned about 100 feet (30 meters) from a plywood bulkhead that had been erected to block off the 

steel section of penstock. The only source of illumination for the workers on the scaffold127 on which the 

sprayer was sitting was a dual fixture halogen light assembly. Based on examination of physical 

evidence128 and employee statements, the CSB determined that the halogen light assembly was placed on 

top of the sprayer pumps. Each halogen light fixture contained two 300-watt halogen bulbs. The CSB 

concluded that neither light had been equipped with a glass lens; witness testimony substaintiated the lack 

of glass lenses and insufficient glass residue was found in the area after the fire to account for them.129

The lamps were swivel-mounted on an assembly and could be oriented to point down. The base and 

hardener hoppers were situated below and to either side of the sprayer, with the top of each hopper 

approximately 25 inches (64 centimeters) from the nearest bulb, depending on the lamp orientation. 

As worker statements (Section D.1) place the initial flash of the MEK vapor-air mixture inside the base 

hopper, ignition of a flammable (i.e., greater than LEL) MEK vapor-air mixture in the atmosphere by hot 

 

127 A second scaffold, positioned near the west bulkhead, had explosion-proof lights mounted to it to provide 

illumination for the two painters applying the epoxy to the penstock walls. 

128 The charred and melted remains of the halogen light were found on top of the sprayer pumps after the incident. 

129 The only remains of glass found in the fire debris were identified as coming from the sprayer control panel. 

001752
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

156 

halogen lights, followed by an unobserved flashback into the base hopper, is possible, but considered 

unlikely. One of the experienced painting contractors told the CSB that the explosion-proof light on the 

scaffold dimmed, which he caught out of the corner of his eye while looking down primarily into the base 

hopper to ensure that the MEK being dispensed from the hose was not splashing – and then he saw the 

flash inside the base hopper. During this short period of distraction, it may not have been possible for the 

contractor to discern flashback from an ignition source outside the hopper. Flashback of a lean flame 

would have occurred in just a few seconds, and the flame would likely have been bluish. However, the 

CSB considers it unlikely that the contractor would not have seen the flashback from the location of the 

halogen lamps. 

As discussed in Section D.1, it is also unlikely that an optimum vapor-air mixture (approximately 5.5 

volume percent MEK) would have existed at the elevation of the halogen lights unless the base heater was 

operating. It is possible that a flammable mixture (>1.8 volume percent MEK) migrated by convection to 

the location of the halogen lights, if air ventilation was minimal, but a mixture near the LEL would have 

been more difficult to ignite. The work area was provided with forced, clean air ventilation conveyed 

through a 20-inch (51-centimeter) diameter plastic duct, magnetically attached to the metal wall of the 

penstock near the floor. It is unknown whether there was any appreciable air movement in the zone 

between the hoppers and halogen lights. The lights were located approximately at the axis of the 12-foot 

(3.7-meter) diameter tunnel. Assuming the air flow from the duct was directed toward the bulkhead at the 

time of the incident, the flow velocity back toward the tunnel entry would have been slow; the average 

upstream velocity in the penstock would be reduced by a factor of approximately 52 relative to the duct 

outlet velocity. Air velocity would have been highly variable across the tunnel at the location of the 

sprayer unit, and additional evidence suggests that a stagnation region may have existed on the upstream 

side of the unit. After using MEK to clean the spray wands on the scaffold near the west bulkhead, one of 

the two contractors at the bulkhead left the work area to get a fan due to the buildup of MEK ―fumes.‖ He 

001753
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

157 

told the CSB that, as he squeezed past the scaffold holding the sprayer, there was ―no air movement at 

all‖ in the vicinity of the sprayer. 

Since the MEK was being sprayed into the hopper at about 12-16 feet (3.7-4.9 meters) per second, it is 

possible that some liquid mist would have migrated toward the lamps by convection, increasing the 

overall fuel concentration and/or that some splashing of coarse droplets occurred (Section D.3.3). 

However, ignition of the MEK vapor-air mixture at the halogen lamps would have produced an 

unconfined flash fire centered at the contractor‘s head, rather than a deflagration inside the base hopper 

that propagated toward him. 

While an eyewitness statement indicates that the base heater was turned off, this would not rule out the 

possibility of a sudden catastrophic failure of the base heater thermostat. If the 3.4 kW electric heater did 

come on, causing the observed dimming of the lights, the MEK temperature could have increased very 

rapidly. A malfunctioning thermostat may have led to unregulated heating; the set point of 95 oF (35 °C) 

for the base epoxy corresponded to a level of 5.5 on the thermostat dial, which had a scale of 1-9. Under 

penstock conditions, MEK boils at 154 oF (68 °C). Only a small volume of MEK was in the lines between 

the heater and the end of the hose. It is plausible that this volume was heated sufficiently to convect 

―easily ignitable‖ concentrations of vapor up to the halogen lights. For this to occur, the entire volume of 

MEK in the hopper would not have had to have been heated to the same temperature, since heated liquid 

would have been sprayed over a large area inside the hopper, creating a large surface for evaporation. 

However, this scenario represents a great deal of inference from the fact that the lights dimmed just before 

the flash and is inconsistent with eyewitness accounts that the initial flash was inside the base hopper. 

Since the thermostat was destroyed by the fire, the CSB cannot rule out the possibility that the thermostat 

failed catastrophically.

D.3.1 Ignition Caused by Halogen Lamps 

The CSB also evaluated four distinct sub-cases involving ignition by halogen lamps. 

001754
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

158 

D.3.1.1 Ignition Caused by Halogen Bulb Breakage 

Halogen bulbs can break spontaneously and explode, due to the pressurized gas inside. Bulb breakage can 

be caused by contamination of the quartz surface, such as by a fingerprint, or via halide migration 

(Babrauskas, 2003). The internal filament of a halogen bulb can operate at 5,072 °F (2,800 oC) with 

somewhat lower temperatures on the support. The inside bulb wall temperature may be around 1,382 °F 

(750 oC) (Cayless & Marsden, 1983). These temperatures certainly would have been capable of igniting 

an explosive MEK vapor-air mixture. In the current case, bulb breakage might have been attributed to 

excessive vibration from the pumps or impact of MEK droplets sprayed from the hoppers. A portion of a 

hot filament from a bulb could have even fallen into the base hopper. However, the CSB ruled out 

halogen bulb breakage as a potential ignition source, when intact bulbs from both halogen lamp fixtures 

were found still mounted in their ceramic housings on top of the sprayer after the fire. All the bulbs were 

covered in soot, but that can be attributed to rich combustion of MEK during the fire. 

D.3.1.2 Ignition by Bulb Terminal Arcing 

In this scenario, a loose electrical connection at one end of a halogen bulb would periodically arc at the 

spring contact fitting. This arcing could be exacerbated by vibration from the pump fixture on which the 

lamps were positioned. It is unlikely a standard torque was applied to the mounting plates, so these might 

also have been subject to excessive vibration. 

If the lamp prongs were made from hard tungsten or tungsten alloy, evidence of arcing (local melting or 

pitting) is more likely to be found on the spring contacts in the ceramic connectors. The spring contacts 

have a much lower melting point than the lamp prongs, assuming they are made of brass or steel. While 

arcing at the bulb terminals was not specifically investigated, visual inspection of these terminals did not 

reveal arcing patterns. 

001755
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

159 

D.3.1.3 Ignition by Hotspot on Bulb 

In a published account describing a vapor ignition by a 300-watt halogen bulb involving gasoline vapor 

(Babrauskas, 2003), violent impact caused the filament to move, which created an external hotspot on the 

quartz envelope without bulb breakage. In the absence of hotspots, gasoline vapor ignition did not occur. 

Most gasoline listed in NFPA 325 (NFPA, (out of print)) have roughly the same autoignition temperature 

as MEK. No violent impact occurred in the penstock; however, a hotspot could have developed via 

impact of coarse droplets from the base hopper. 

If a droplet of MEK containing dissolved ―base‖ resin were splashed onto the hot bulb region, the result 

could have been formation of a transient hotspot on or near the bulb. The nominal 1,832 °F (1,000 oC) 

hotspot would be created as residual epoxy resin decomposed and combusted either as a glowing ember 

or small flame. 

Upon impact of an MEK-based mixture on a hot surface at approximately 932 °F (500 oC) or more, the 

MEK solvent will immediately evaporate. If the MEK vapor does not ignite first, the residual base might 

decompose and combust either as a glowing hotspot or small flame, which would create very high local 

temperatures commensurate with MEK‘s lower limit flame temperature of about 2,192 °F (1,200 oC). It is 

well known that the hotspot ignition temperature of ignitable gas mixtures is a strong function of hotspot 

size and contact time, although the ignition phenomenon is complex. At temperatures close to the lower 

limit flame temperature, hotspots on the order of 1 millimeter in diameter can cause almost immediate 

ignition of optimum vapor-air mixtures. As the halogen bulbs were covered by soot during the fire, the 

CSB cannot determine if a hotspot occurred on one or more of the bulbs. 

D.3.1.4 Autoignition of Heated MEK Vapor Volume 

A review of the literature shows that the surface temperature of individual 300-watt halogen bulbs in 

torchiere lamps is about 968 oF (520 oC) (CPSC, 1996); higher values approaching 1,100 oF (593 oC) have 

also been reported. The temperature varies with bulb diameter, design, and degree of confinement. The 

001756
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

160 

halogen lights had top reflectors and should have achieved higher temperatures than torchiere lamps, 

which are open at the top and lose heat by free convection. 

The halogen lamp fixtures used in the penstock each contained two closely spaced 300-watt bulbs, so the 

bulb surface temperatures would have been greater than for single bulbs, especially on the adjacent hot 

quartz surfaces. To the CSB‘s knowledge, no relevant tests have been done on the type of halogen lamp 

fixtures involved in the MEK fire. Bulb surface temperatures could, in principle, be measured by twocolor pyrometry or other means, but no such testing was performed. 

An experiment would need to be devised and run to determine whether an MEK vapor-air mixture could 

be ignited by a hot halogen bulb fixture at optimum concentration; if not, it would rule out autoignition at 

all concentrations. Standard autoignition temperature (AIT) tests hold the vapor-air mixture for several 

minutes in a glass vessel at the test temperature; they are conservative relative to transient heating by a 

hot halogen bulb surface. The lack of confinement (i.e., lenses not present) means that transitioning from 

cool to hot flames could not have occurred via pressure increase.130

 The CSB found various published 

values for the AIT of MEK, but the most reliable is reported to be 887 oF (475 oC) at one atmosphere (760 

mmHg) (Brandes, et al., 2005, pp.1-5); this corresponds to the minimum temperature for spontaneous 

ignition of the optimum MEK-air mixture in a 200 milliliter (ml) glass flask using the IEC 60079-4 test 

method. However, the low atmospheric pressure in the penstock may have elevated the MEK AIT. 

The CSB concluded that the halogen bulb surface temperatures would likely need to be significantly 

higher than the AIT of MEK (at least 125-212 °F (52-100 oC) above the standard AIT) for MEK vapor 

ignition. Ignition is far more likely had a hotspot (or small flame) been created on a bulb or an adjacent 

hot surface. 

 

130 MEK is subject to forming cool flames, a phenomenon that can result in a range of reported AITs. 

001757
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

161 

D.4 Hot Surface Ignition by the Sprayer Heater(s) 

The CSB determined that even if the sprayer base heater had been operating at full output, its surface 

temperature would be too low to create MEK vapor-air ignition. The heater was rated for a Class 1, 

Division 2 atmosphere, with a T2 (482 °F/250 oC) rating; the standard AIT of MEK is 887 °F (475 oC).

In addition, both heaters (base and hardener) were radiographed, electrically tested, and physically 

examined after the fire by an independent consultant hired by OSHA. The consultant determined that the 

heaters did not provide an ignition source for the fire, nor did they contribute to the spread of the fire. 

D.5. Compression Ignition inside One of the Sprayer Piston Pumps 

In theory, if an air-operated piston pump runs ―dry,‖ adiabatic compression of air plus residual vapor 

could lead to temperatures that exceed the MEK AIT. The CSB was able to rule out this potential ignition 

source, as both hoses were reportedly circulating MEK at the time of the fire. The journeyman painter 

also reported a level of about 3 inches (8 centimeters) of MEK in the base hopper where the initial flash 

was observed.131 Thus, neither piston pump could likely have been running ―dry‖ at the time of ignition. 

D.6 Electrical Spark from Heater Control Box 

Electrical power for the two heaters was supplied by the heater control panel. Unlike the sprayer control 

panel, which used low voltage electronics supplied from a pneumatic generator and was approved for use 

in flammable atmospheres, the heater control box was an aftermarket addition and was not rated for use in 

flammable atmospheres. Although the heater control box was severely damaged by the fire and its 

internal components were charred,132 visual examination by the CSB revealed that the incoming power to 

 

131 The CSB could not determine the amount of MEK inside the hardener hopper at the time of the incident, but 

survivor statements indicate that MEK was also being circulated in this hopper at the time of the incident. 

132 The CSB found no evidence that an internal deflagration had occurred inside the box. 

001758
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

162 

the box was 240-volts and fuses. The heater control box was found to contain open circuits, relays, and 

other solid-state components. Consequently, the CSB determined that it was possible for an electrical 

spark generated inside this box to ignite an explosive MEK vapor-air mixture, but for the same reasons 

described in Section D.2, this ignition source is unlikely because the heater controls were not likely being 

used at the time of the incident; an explosive MEK vapor-air mixture probably did not exist outside the 

base hopper, and a spark, if it did occur, would have had to flash back into the base hopper unobserved. 

APPENDIX E: MEK FLAMMABILITY PROPERTIES AT PENSTOCK 

CONDITIONS 

Flammability data, such as flashpoints and lower and upper explosive limits are typically measured at 

standard atmospheric conditions. As this incident occurred inside a penstock at an elevation of 10,050 feet 

(3,063 meters) above sea level, the CSB needed to recalculate this data to account for the effects of the 

elevation. 

Using data showing changes in atmospheric pressure at various site elevations (UIG, 2004), the CSB 

calculated the atmospheric pressure at the penstock fire location to be 523 mmHg. 

Next, the equilibrium vapor pressure equation is given by 

EVP = exp (A + B/T + ClnT + DTE) 

Obtaining constants A-E from the Design Institute for Physical Properties Research (DIPPR) database,133

the boiling point of MEK at 523 mmHg was calculated to be 154 oF (67.8 oC). This compares with the 

―normal‖ value of 175 oF (79.4 oC) at 760 mmHg (standard atmospheric pressure).

 

133 The DIPPR database stores thermophysical properties and parameters for correlations of temperature-dependent 

property models of over 1,900 components. It has been under development since 1980 and is continuously updated 

and enhanced. DIPPR is an industrial consortium, operating as part of AIChE. 

001759
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

163 

At 523 mmHg, the vapor-liquid equilibrium curve (Figure E-1) shows that the lower and upper flammable 

limits of MEK in air (1.8-11 volume percent) are attained at respective equilibrium temperatures of 3 to 

60 oF (-16 to 15 oC). Between these temperatures, MEK vapor in equilibrium with liquid, such as deep 

inside the liquid hoppers on the sprayer, is ignitable. MEK vapor becomes most easily ignitable at an 

―optimum‖ concentration of about 5.5 volume percent, attained at an equilibrium temperature of about 36 

oF (2.4 oC). 

0

10

20

30

40

50

60

70

80

0 10 20 30 40 50 60 70

Equilibrium Vapor Pressure of MEK Near Liquid Surface in Base Hopper

(Penstock Estimated Ambient Pressure = 523 mmHg)

(Assumed Hopper Liquid Temperature 47-53F)

Vapor Pressure (mmHg)

Temperature (F)

MEK Concentration range = 7.6-9.2 mol%

Upper Flammable Limit = 11 mol%

Lower Flammable Limit = 1.8 mol%

NON-FLAMMABLE

Optimum (~5.5 mol%)

Figure E- 1. Equilibrium vapor pressure of MEK near liquid surface in base hopper 

Although the low atmospheric pressure in the penstock (523 mmHg) has negligible effect on the 

flammable limits, it significantly increases the mole fraction of vapor in air at any given temperature; 

consequently the flash point is decreased (Figure E-2). The calculated lower theoretical flash point, 

temperature limit of flammability (TLF), is -16 oC (3.4 oF). For ignition in the base hopper, this TLF 

should be more accurate than a measured flash point because of the ambient pressure and upwards flame 

001760
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

164 

propagation, which occurs at lower vapor concentrations than in a standard flash point test apparatus 

(where flame propagation is downward). 

Similarly, the ―upper temperature limit of flammability‖ (UFL) can be calculated. The UFL is generally 

not sensitive to pressure in the range being considered, so the corresponding MEK vapor pressure is 57.5 

mmHg to achieve 11 mole percent MEK in the vapor and the theoretical upper flammability limit (TUF) 

is found to be 15 oC (60 oF). This result shows that MEK in the penstock could be within the flammable 

range (ignitable) at all times inside a pail or hopper. 

0

50

100

150

200

250

300

-20 -10 0 10 20 30 40 50

Equilibrium Vapor Pressure of Methyl Ethyl Ketone (MEK)

Vapor Pressure (mmHg)

Temperature (Celsius)

theoretical lower limit @ 523 mmHg

 (TLF) = -16 C (3F)

VP = 9.41 mmHg

theoretical upper limit @ 523 mmHg

 (TUF) = 16 C (60F)

VP = 57.5 mmHg

Figure E- 2. Theoretical MEK flammability limits at penstock conditions 

With the base side pump heater not operating, the CSB determined that the circulated MEK would have 

been at 50 ± 3 oF (10 ± 2 °C). This range compares favorably with the unheated base resin temperature of 

001761
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

165 

47 °F (8.3 °C) measured by the journeyman painter with a laser temperature indicator, and the air 

temperature of 53 °F (12 °C) inside the penstock measured earlier that day by the KTA inspector. Hence, 

near the liquid surface in the bottom of the hopper (i.e., where the vapor-liquid equilibrium assumption is 

most applicable), the MEK vapor concentration should have been in the range of 7.6-9.1 mole percent. 

This is slightly greater than optimum concentration (approximately 5.5 mole percent), but less than the 

upper flammable limit (UFL) of 11 mole percent. To summarize, with the heater not operating, the entire 

volume of the hopper should have been within the ignitable range and capable of deflagration (i.e., rapid 

burning with the creation of an upward pressure wave). 

001762
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

166 

APPENDIX F: LOWEST MINIMUM IGNITION ENERGY AT PENSTOCK 

CONDITIONS 

Calculation of this parameter is significant with respect to static ignition sources having very small 

energies. Faulty electrical equipment is unimportant since electrical arcs should be sufficiently energetic 

to ignite MEK vapor over the entire flammable range. 

Calcote, et al. (1952) reported the Lowest Minimum Ignition Energy (LMIE) of MEK as slightly below 

0.3 mJ. However, they reported the LMIE of n-pentane at about the same value, 0.28 mJ. This is higher 

than the approximately 0.24 mJ published for similar paraffin hydrocarbons such as butane and hexane 

(Lewis & von Elbe, 1961). The latter authors also reported a significantly lower value for cyclopropane, 

0.17 mJ versus the 0.22 mJ found by Calcote et al. The CSB noted that the data of Calcote et al. tend to be 

high compared with other LMIE values. Indeed, most of the Calcote et al. data were measured at 

stoichiometric composition, and only a few compounds such as MEK were tested at optimum 

composition (approximately 1.5 times stoichiometric in the case of MEK). The test method used by 

Calcote et al. usually involved electrodes with 1/8-inch hemispherical tips versus the 1/16-inch tips used 

by Lewis & von Elbe. Quenching effects presumably caused the measured values of Calcote et al. to be 

somewhat high. It has been observed that the lowest LMIEs are found with pointed electrodes at very low 

circuit capacitance. Since Calcote et al. used various test procedures, it is not clear exactly which 

procedure was used for the MEK tests. It is possible that lower values would have been found by 

optimizing the circuit capacitance. In conclusion, the LMIE of MEK was found to be about the same as npentane, whose LMIE is about 0.24 mJ. No MEK tests have been reported under truly ―optimum‖ 

conditions of spark gap geometry and circuit capacitance. 

Britton‘s method (2002) uses the heat of oxidation to estimate the LMIE of CH and CHO organic 

compounds: 

LMIE (mJ) = 4.0056 – 0.06231 (- HC /S) + 0.00024333 (- HC /S)2 

001763
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

167 

Where ( HC /S) = Heat of Oxidation (-100.07 kcal/mol for MEK) 

Hence LMIE = 0.21 mJ 

From the preceding discussion, the most easily ignitable composition should be about 1.5 times 

stoichiometric or 5.50 mol%. 

Lowest MIE = 0.21 mJ (5.50 mol % MEK in dry air at 298 K, 1 atm) 

However, the LMIE generally increases as pressure decreases. In the penstock, the ambient pressure was 

about 523 mmHg (0.69 atmospheres). By analogy with data for propane (Figure F-1), the LMIE of MEK 

at 0.69 atmospheres (523 mmHg) should be approximately 0.5 mJ. (Britton, 1999): 

Figure F-1. Effect of pressure on MIE of propane in various oxygen-nitrogen mixtures 

Hence, the lowest MIE for MEK is approximately 0.5 mJ (5.50 mole percent MEK in dry air at 298 K, 

0.69 atm). 

0.001

0.01

0.1

1

10

0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

MIE @ 0.20 atm

MIE @ 0.33 atm

MIE @ 0.50 atm

MIE @ 1.00 atm

Minimum Ignition Energy (mJ)

O2/(O2+N2)

001764
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

168 

APPENDIX G: WORK ACTIVITIES ALLOWED IN POTENTIALLY EXPLOSIVE ATMOSPHERES 

Source Industry/Personnel Citation/Reference Requirement

OSHA Permit-required confined spaces in general 

industry

1910.146(d) Entry into permit-required confined spaces above 10% of the LFL is allowed 

provided that acceptable entry conditions for flammable vapors listed on the 

permit are followed.

Appendix C

Examples of PermitRequired Confined Space 

Programs

Example 3. Workplace. Workplaces where tank cars, trucks, and trailers, dry 

bulk tanks and trailers, railroad tank cars, and similar portable tanks are 

fabricated or serviced.

Sources of hazards. In addition to the mechanical hazards arising from the 

risks that an entrant would be injured due to contact with components of the 

tank or the tools being used, the risk also exists that a worker could be injured 

by breathing fumes from welding materials or mists or vapors from materials 

used to coat the tank interior. In addition, many of these vapors and mists are 

flammable, so failure to properly ventilate a tank could lead to fire or explosion. 

Application of interior coatings/linings. Atmospheric hazards shall be 

controlled by forced air ventilation sufficient to keep the atmospheric 

concentration of flammable materials below 10% of the lower flammable limit 

(LFL) (or lower explosive limit (LEL)), whichever term is used locally). The 

appropriate respirators are provided and shall be used in addition to providing 

forced ventilation if the forced ventilation does not maintain acceptable 

respiratory conditions.

Std Interpretation letter, 

9/4/96

The permit-required confined spaces standard [29 CFR 1910.146] does not 

prohibit working in a permit-required space where the atmosphere is above 

10% of the LFL. However, once the atmosphere is above 10% of the LFL, all 

requirements of the standard must be met. The employer must identify and 

evaluate each hazard to which entering employees will be exposed. Based on 

the hazard analysis, the employer must develop and implement the means, 

procedures, and practices necessary for safe permit space entry operations. If 

the flammable atmosphere is the result of a process involving equipment, there 

may be precautions with regard to the equipment that an employer would be 

required to follow.

001765
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

169 

Source Industry/Personnel Citation/Reference Requirement

Confined spaces using alternative entry 

provisions in general industry

1910.146(c)(5)

OSHA Directive 2.100, page 

19.

58 FR 4488

In confined spaces using alternative entry procedures, entry is permitted 

provided the concentration of the flammable substance does not exceed 50% 

of what would constitute a “hazardous atmosphere” (e.g., 5% of the LFL).

Confined and enclosed spaces and other 

dangerous atmospheres in shipyard 

employment

1915.13(b)(3) An employee may not enter a space where the concentration of flammable 

vapors or gases is equal to or greater than 10% of the LEL. Exception: An 

employee may enter for emergency rescue or for a short duration to install 

ventilation equipment necessary to start work, provided no ignition sources are 

present, the atmosphere in the space is monitored continuously, atmospheres 

at or above the upper explosive limit are maintained, and respiratory and other 

appropriate PPE and clothing are provided. 

Excavations 1926.651(g)(1)(iii) In excavation and trenches, adequate precautions shall be taken, such as 

providing ventilation, to prevent employee exposure to an atmosphere 

containing a concentration of a flammable gas in excess of 20% of the lower 

flammable limit (LFL) of the gas.

Underground construction (tunneling) 1926.800 When air monitoring shows, for 3 consecutive days, 10% or more of the LEL for 

methane or other flammable gases measured at 12 inches from the roof, face, 

floor, or walls in any underground work area, additional safety precautions are 

required. These include using more stringent ventilation requirements, using 

diesel equipment only if it is approved for use in gassy operations, posting each 

entrance with warning signs, prohibiting smoking and personal sources of 

ignition, maintaining a fire watch when hot work is performed, and suspending 

all operations in the affected area until all special requirements are met or the 

operation is declassified. Additional air monitoring is also required.

Confined spaces in construction, except for 

diving, non-sewer excavations, and 

underground construction

1926.1028 (proposed) Entry into permit-required confined spaces (PRCS) above 10% of the LFL is 

allowed provided conditions under which the authorized entrants can work 

safely are defined, including hazard levels and methods of employee 

protection. Monitoring procedures must also be in place to detect an increase in 

atmospheric hazard levels in sufficient time for the entrants to safely exit the 

PRCS in the event the ventilation system stops working.

001766
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

170 

Source Industry/Personnel Citation/Reference Requirement

72 FR 67391 OSHA requests comment on the advisability of reconciling the difference in 

LFLs between the excavation standard in subpart P and this proposed 

standard, including which LFL (that is, 10% or 20%) should be adopted.

MSHA Underground Coal Mines 75 CFR 323 When 1.0% or more methane (20% of LEL) is present in a working place or an 

intake air course, including an air course in which a belt conveyor is located, or 

in an area where mechanized mining equipment is being installed or removed--

except intrinsically safe atmospheric monitoring systems (AMS), electrically 

powered equipment in the affected area shall be de-energized, and other 

mechanized equipment shall be shut off; changes or adjustments shall be 

made at once to the ventilation system to reduce the concentration of methane 

to less than 1.0%; and no other work shall be permitted in the affected area 

until the methane concentration is less than 1.0%. 

When 1.5% or more methane (30% of LEL) is present in a working place or an 

intake air course, including an air course in which a belt conveyor is located, or 

in an area where mechanized mining equipment is being installed or removed--

everyone except those persons referred to in §104(c) of the Act shall be 

withdrawn from the affected area and, except for intrinsically safe AMS, 

electrically powered equipment in the affected area shall be disconnected at 

the power source.

Underground Metal Non-Metal Mines 57 CFR 22231- 22238 If methane reaches 0.25% (5% of LEL) in the mine atmosphere, changes shall 

be made to improve ventilation, and MSHA shall be notified immediately.

If methane reaches 0.5% (10% of LEL) in the mine atmosphere, ventilation 

changes shall be made to reduce the level of methane. Until methane is 

reduced to less than 0.5%, electrical power shall be de-energized in affected 

areas, except power to monitoring equipment determined by MSHA to be 

intrinsically safe under 30 CFR part 18. Diesel equipment shall be shut off or 

immediately removed from the area and no other work shall be permitted in 

affected areas. 

If methane reaches 1.0% (20% of LEL) in the mine atmosphere, ventilation 

changes shall be made to reduce the methane. Until such changes are 

achieved--all persons other than competent persons necessary to make the 

ventilation changes shall be withdrawn from affected areas; electrical power 

shall be de-energized in affected areas, except power to monitoring equipment 

001767
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

171 

Source Industry/Personnel Citation/Reference Requirement

determined by MSHA to be intrinsically safe under 30 CFR part 18; and diesel 

equipment shall be shut off or immediately removed from the area.

If methane reaches 2.0% (40% of LEL) in the mine atmosphere, all persons 

other than competent persons necessary to make ventilation changes shall be 

withdrawn from the mine until methane is reduced to less than 0.5% (10% of 

LEL). 

Environmental 

Protection Agency 

(EPA)

Personnel activities at hazardous waste sites Standard Operating Guides,

EPA, December 1984

Less than 10% of LEL, continue investigation; 

10 to 25% of LEL, continue onsite monitoring with extreme caution as higher 

levels are encountered; 

Above 25% of LEL, explosion hazard. Withdraw from area immediately.

ANSI Confined spaces at normal atmospheric 

pressure. Not applicable to underground mining, 

tunneling, caisson work, or intentionally inert 

confined spaces

Z117.1-2003

Section 6.3.2

Entry into confined space prohibited until appropriate controls are implemented 

or appropriate personal protective equipment (PPE) is provided whenever 

atmospheric testing indicates flammable levels are greater than 10% of the

LEL/LFL.

API Personnel cleaning stationary, aboveground 

atmospheric and low pressure petroleum 

storage tanks

Standard 2015-2001

Section 8.3.3.2.

Entry into tanks is prohibited when the flammable vapor-air levels are above 

10% LEL, unless there are extraordinary circumstances requiring such entries 

and employers (owners/operators and contractors) have established and 

implemented appropriate precautions and safeguards for permit required 

confined space entry.

NFPA Vessels that carry, or burn as a fuel, flammable 

or combustible liquids and vessel that carry 

compressed gases, chemicals in bulk, or other 

products capable of creating a hazardous 

condition

Standard 306 – 2003

Section 4

Compartments where flammable vapor-air levels are less than 10% of the LEL 

are marked as “Safe for Workers” or “Safe for Hot Work”. Compartments with 

vapor-air levels that exceed 10% of the LEL are marked “Enter With 

Restrictions” and can be entered only with appropriate PPE to install ventilation 

or perform emergency rescue.

Tanks or containers operating at normal 

atmospheric pressure that contain or have 

contained flammable or combustible liquids or 

other hazardous substances and related vapors 

and residues that are to be entered or cleaned

Standard 326 – 2005

Sections 6.3.2, 6.3.8, 6.3.9

All work in and around the tank or container shall be stopped immediately when 

flammable vapors in the atmosphere exceed 10% of the LFL. Source of the 

vapors located and eliminated or controlled.

When a tank or container is tested prior to the start of hot work, any indication 

of flammable gas or vapor in excess of the established allowable limits shall 

require additional ventilation, purging, re-cleaning, or further safeguarding by 

001768
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

172 

Source Industry/Personnel Citation/Reference Requirement

one of the methods described in this standard, as specified by the qualified 

person, prior to the issuance of a hot work permit.

When testing a tank or container during hot work, any indication of flammable 

gas or vapor in excess of the established allowable limits shall require the 

immediate cancellation of the hot work permit.

Emergency/fire personnel responding to 

releases of flammable or combustible liquid, 

gas, or vapor that can migrate to a subsurface 

structure

RP 329 – 2005

Sections 5.4.5.1 – 5.4.5.3

During initial response to a reported leak, the affected area should be 

evacuated when gas or vapor concentrations are above 50% of the LFL. The 

affected area should be ventilated to remove or reduce the flammable gas or 

vapor concentration and thus reduce the fire or explosion hazard. As soon as 

the flammable gas or vapor has been reduced below 50% of the LFL, entry can 

be made to locate and eliminate the source.

Emergency/fire personnel performing rescue 

from confined spaces

Standard 1006 – 2008

Section A.7.1.1.(2)

Flammability is measured as a percentage of a material’s LEL or LFL. 

Rescuers should not enter confined spaces containing atmospheres greater 

than 10% of a material’s LEL, regardless of the PPE worn. There is no 

adequate protection for an explosion within a confined space.

NIOSH Criteria for a Recommended Standard –

Working in Confined Spaces

Publication No. 80-106 –

1987

Less than 10% of the LFL, no modification of work processes; between 10-19% 

of LFL, ventilation and protective measures; 20% of LFL or above, ventilation 

and protective measures.

International Union 

of Painters and 

Allied Trades, Joint 

Apprenticeship and 

Training Fund

Apprentice and Journeymen Painters Confined Space Entry, 

Employee Handbook and 

Facilitator Guide

(Summit Training Source, 

Inc.)

Permit Space Hazards

Flammable Gas, Vapor, or Mist

If the atmospheres contain flammable gas, vapor, or mist in excess of 10% of 

its LFL, that atmosphere is unacceptable for entry.

Pipeline 

Association for 

Public Awareness

Firefighters, law enforcement officers, 

emergency

Medical technicians and all other emergency 

Appendix B Natural Gas Escaping Inside a Building

EMERGENCY RESPONSE

001769
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

173 

Source Industry/Personnel Citation/Reference Requirement

responders responding to pipeline incidents Monitor the atmosphere, using multiple monitors where possible

Action Criteria: 0 to 10% of the LEL - Use Extreme Caution

Action Criteria: 10% of the LEL or greater - DO NOT ENTER THE 

BUILDING

TACTICAL CONSIDERATIONS

Natural gas released inside buildings presents one of the greatest 

flammable hazards to emergency responders.

Building full of natural gas should be approached only when needed with 

extreme caution and with a minimum number of personnel. CGI reading s 

in excess of 10% LEL require evacuation of the building.

Alberta Worksite or work area Handling and Storage of 

Flammable Materials at the 

Work Site (May 2007)

OHS Code, Part 10

Work is prohibited in areas greater than 20% of the LEL, except for competent 

workers responding to emergencies

British Columbia Confined Spaces Confined Space Entrance 

Reference Manual (2007)

Section 9.5, OH&SR

Workers not allowed entry into confined spaces under any circumstances when 

the flammability is greater than 20% of the LEL. Good practice to prohibit hot 

work in atmospheres providing a reading on the flammable gas meter above 

1%. Any untested confined space is considered IDLH.

Ontario Confined Spaces Confined Spaces Guideline 

(1996)

Hot work permitted if concentration of flammable or explosive gas or vapor is 

less than 5% of LEL.

Cold work permitted if concentration of flammable or explosive gas or vapor is 

less than 10% of LEL.

Inspection permitted if concentration of flammable or explosive gas or vapor is 

less than 25% of LEL.

No entry permitted if concentration of flammable or explosive gas or vapor 

exceeds 25% of LEL.

Australia Confined Spaces AS 2865 – 1995 No entry into a confined space permitted if the concentration of the flammable 

001770
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

174 

Source Industry/Personnel Citation/Reference Requirement

contaminant in the atmosphere exceeds 5% of the LEL.

When persons have entered a confined space and are using continuous 

monitoring, they may remain in the confined space at concentrations of 

flammable contaminant in the atmosphere of less than 10% of the LEL before 

evacuation of the confined space is necessary.

New Zealand Confined Spaces Safe Working in a Confined 

Space (no date)

Concentration of flammable contaminant in the atmosphere is 0% of the LEL if 

hot work is to be carried out, or 10% if cold work is to be varied out.

United Kingdom Shipping Industry IACS Confined Space Safe 

Practice

Section 6.3

April 2007

A space with an atmosphere with more than 1% of the LFL or LEL on a 

combustible gas indicator should not be entered.

001771
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

175 

APPENDIX H: APPLICABLE OSHA CONFINED SPACE STANDARDS 

H.1 OSHA General Industry Standards (29 CFR 1910) 

The CSB reviewed OSHA safety and health regulations addressing confined space requirements 

applicable to general industry as well as those for construction. The CSB determined that OSHA general 

industry standards codified at 29 CFR 1910 apply to the penstock recoating project at the Xcel Cabin 

Creek facility based on OSHA definitions of construction versus maintenance [29 CFR 1910.12(b), 29 

CFR 1926.13(a) and 1926.32(g)]. Although the contractor (RPI) was using construction practices (e.g., 

sandblasting and coating) to physically change the power plant, the penstock was existing equipment 

(constructed in 1967) that was being refurbished by removing the old coating and applying new. 

Consequently, this work activity is classified as maintenance rather than new construction and falls under 

the OSHA general industry standards. 

H.2 Electrical Power Generation (29 CFR 1910.269) 

Although the CSB found that OSHA‘s electrical power generation standards apply to the Xcel Cabin 

Creek hydroelectric power plant, these standards contain no specific regulations pertaining to penstocks, 

and the penstock does not meet the definition of an ―enclosed space‖ as outlined in this standard. As 

discussed in Section 2.1, the Xcel Cabin Creek facility is a pumped hydroelectric power plant that 

supplies electricity to residential customers during peak demand periods. As its purpose is to generate 

electrical power, the Xcel Cabin Creek facility is subject to the regulations of OSHA‘s general industry 

standard that apply only to electrical power generation, transmission, and distribution codified at 29 CFR 

1910.269. In fact, 29 CFR 1910.269(a)(i)(B)(2) specifically states that ―water and steam installations, 

such as penstocks, pipelines, and tanks providing a source of energy for electric generators‖ are subject to 

these standards. A review of the 1910.269 standard reveals that it contains no specific requirements for 

penstocks, but does contain specific requirements for ―enclosed spaces.‖ Subparagraph (e) outlines safe 

work practices, evaluation of potential hazards, atmospheric testing, ventilation, attendants, and rescue 

001772
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

176 

provisions that are applicable to ―enclosed spaces.‖ However, the definition of an ―enclosed space‖ at 29 

CFR 1910.269(x) states that these spaces are ―designed for periodic employee entry under normal 

operating conditions‖; thus, the penstock cannot be classified as an ―enclosed space‖ under the 1910.269 

standard because under normal operating conditions the penstock is filled with water and employees do 

not enter. A note beneath the ―enclosed space‖ definition states that if the space meets the criteria for a 

permit-required confined space then the provisions of 29 CFR 1910.146 apply. 

H.3 Permit-Required Confined Spaces (29 CFR 1910.146) 

See Section 10.0, ―Regulatory and Industry Standards Analysis.‖ 

001773
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

177 

APPENDIX I: CSB CONFINED SPACE INCIDENTS DATA INCLUSION 

CRITERION AND LIMITATIONS 

To determine the prevalence of confined space incidents attributable to a flammable atmosphere, the CSB 

researched and identified a number of confined space incidents from various sources.1 Incidents were 

included in the CSB database if they occurred in a confined space and resulted from a fire or explosion 

where monitoring of the atmosphere and establishing safe flammable limits could have played a role in 

preventing entry or requiring exit from the space. The CSB search included only incidents that occurred 

in what was determined to be an OSHA defined confined space. Incidents were selected if they occurred 

after April 15, 1993, and if work was being performed inside the confined space where a flammable 

atmosphere was either created by the work being conducted or present prior to entry resulted in an 

explosion or fire. 

The CSB obtained a majority of these incidents by using specific search terms to query OSHA‘s IMIS 

database where inspection records of OSHA investigations are recorded and categorized. The CSB‘s data 

search retrieved incidents containing the words ‖confined space‖ in the summary words, incident 

summary description, or title of the inspection report. If an incident occurred in a confined space, but the 

words ‖confined space‖ did not appear on that inspection report as a descriptor, it was not initially 

identified as an incident of interest. Only after subsequent queries into the IMIS system to identify 

incidents that contained a ―flammable atmosphere,‖ ―explosion,‖ or ―chemical fire,‖ among others, were

additional confined space incidents identified. For example, a few of our incidents did not contain the 

 

1

 Sources included the NIOSH Fatality Assessment and Control Evaluation (FACE) Program reports, the OSHA 

Inspection Data from OSHA‘s Integrated Management Information System (IMIS) from 1993 to the present, 

media reports and inquiry into the Agency of Toxic Substance and Disease Registry (ATSDR), and the Hazardous 

Substances Emergency Events Surveillance (HSEES) system to determine the prevalence of incidents attributed to 

a flammable atmosphere. 

001774
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

178 

words ‖confined space‖ but were retrieved under these search terms and found to contain OSHA confined 

space citations. 

Additionally, a few of the incidents included in the CSB dataset were obtained through Internet media 

searches. These incidents were then checked in the OSHA IMIS database and matched with their 

correlating OSHA inspection number. If these media incidents contained OSHA confined space citations 

under the standard 1910.146, they were included into the CSB database. However, some incidents found 

through the media search had an OSHA inspection number but not an OSHA inspection report description 

or confined space citations indicating that the incident occurred in a confined space; thus, they were not 

included in the CSB dataset. Other OSHA IMIS incidents contained OSHA confined space citations but 

no incident summary indicating that the accident occurred in a confined space and were therefore 

excluded from the dataset. Incidents were included only in the CSB dataset if the OSHA confined space 

citations were connected to the explosion or fire. As a result of incomplete or inconsistent reporting of 

confined space incidents in the OSHA IMIS system, the voluntary nature of incidents reported to NIOSH 

to generate the NIOSH Fatality Assessment and Control Evaluation (FACE) reports and the lack of 

specific confined space data in ATSDR HSEES, the CSB concluded that there is a likely undercount in 

confined space incidents that occurred in a flammable atmosphere in our data. 

Confined space incidents obtained from OSHA‘s IMIS, the NIOSH FACE reports, ATSDR, and the 

media were categorized into two subgroups. Subgroup A contained incidents that matched our inclusion 

criterion, and subgroup B contained incidents that did not fully meet our inclusion criterion. Of the 105 

incidents compiled by the CSB, 53 were subsequently categorized as A and determined to be a result of a 

flammable atmosphere in a confined space. 

001775
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

179 

APPENDIX J: SIMILAR RECENT CONFINED SPACE INCIDENTS 

INVOLVING FLAMMABLES INVESTIGATED BY THE CSB 

Since the Xcel penstock incident, the CSB has investigated two additional confined space incidents 

involving workers who were injured or fatally wounded by an explosion or fire involving flammables in a 

confined space. 

13.1.1 ConAgra Foods Processing Plant Explosion 

On February 16, 2009, a North West Metal Fabricators contractor was killed while attempting welding 

repair to a 11⁄4 by 1⁄2 inch (3.2 by 1.3 centimeters) crack on a clarifier tank at a ConAgra facility in 

Boardman, Oregon. The 23-foot (7-meter) tall, 12-foot (3.7-meter) diameter tank had an open top 

structure and cone-shaped bottom covered by a metal skirt. The tank, used in a potato-washing process for 

separating dirt and debris from waste water, was classified as a permit-required confined space. 

The CSB investigators found an accumulation of approximately 14 inches (36 centimeters) of bacteriarich debris and water under the tank‘s skirting as a result of the material leaking through the crack. 

Through sample analysis, the CSB determined that bacteria in this debris and waste water likely produced 

flammable gas. When the contractor started welding, the arc generated acted as the source of ignition, 

resulting in a confined vapor explosion. Air monitors were used to detect flammable vapors near the 

entrance of the tank but were not used in the vicinity where the hot work was conducted. 

13.1.2 TEPPCO Terminal Explosion 

Three contractors from C&C Welding, Inc. were fatally injured on May 12, 2009, in an explosion at the 

TEPPCO Partners LP McRae Terminal in Garner, Arkansas. The workers were using a cutting torch 

above the floating roof inside a 67,000-barrel (10,700 cubic meters) capacity gasoline storage tank when 

an internal explosion blew both the floating roof and the fixed roof off the tank. The contractors were 

preparing for the installation of a gauge pole, and at the time of the explosion were using an oxygen 

acetylene cutting torch to cut into the secondary roof of the internal floating roof of the tank. The 

001776
Cabin Creek Hydroelectric Plant Final Investigation Report 8/2/2010 

180 

contractors were issued both a hot work permit and confined space permit to flame-cut the roof and enter 

the tank. However, an evaluation of both the hot work and confined space entry permit and policies of 

TEPPCO Partners LP and C&C Welding Inc. reveals no maximum or minimum LEL limits for work 

within confined spaces. The flame-cutting activity most likely ignited flammable vapors inside the tank.

001777