U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

REGULATORY REPORT 

REPORT NO. 2012-03-I-CA 

MAY 2014 

CHEVRON RICHMOND REFINERY

PIPE RUPTURE AND FIRE

CHEVRON RICHMOND REFINERY #4 CRUDE UNIT

RICHMOND, CALIFORNIA

AUGUST 6, 2012 
Chevron Richmond Refinery Regulatory Report May 2014

2 
Chevron Richmond Refinery Regulatory Report May 2014

3 

Table of Contents 

Table of Contents .......................................................................................................................................... 3

Acronyms and Abbreviations ....................................................................................................................... 5

1.0 Executive Summary ......................................................................................................................... 7

1.1 Incident Summary ............................................................................................................................ 7

1.2 Interim Report .................................................................................................................................. 7

1.3 Background ...................................................................................................................................... 9

1.4 Key Findings .................................................................................................................................. 10

1.5 Regulatory Conclusions ................................................................................................................. 12

1.6 Recommendations .......................................................................................................................... 13

2.0 Introduction .................................................................................................................................... 14

3.0 The Safety Case Regulatory Regime ............................................................................................. 21

3.1 Introduction .................................................................................................................................... 21

3.2 Initial Safety Case Implementation ................................................................................................ 22

3.2.1 United Kingdom .................................................................................................................... 22

3.2.1.1 Onshore .......................................................................................................................... 22

3.2.1.2 Offshore ......................................................................................................................... 25

3.2.2 Global Analysis of Safety Case Implementation .................................................................. 27

3.2.2.1 Australia ........................................................................................................................ 27

3.2.2.1.1 Offshore ................................................................................................................. 27

3.2.2.1.2 Onshore .................................................................................................................. 28

3.2.2.2 Norway .......................................................................................................................... 29

3.2.2.3 The United States........................................................................................................... 30

3.2.2.3.1 OSHA PSM Standard ............................................................................................ 31

3.2.2.3.2 U.S. Environmental Protection Agency Risk Management Program .................... 33

3.2.2.3.3 Safety Case in the United States ............................................................................ 35

4.0 Key Features of an Effective Safety Case Regulatory Regime ...................................................... 37

4.1 Duty Holder Safety Responsibility, including a Written Case for Safety ...................................... 38

4.2 Continuous Risk Reduction to ALARP ......................................................................................... 40

4.3 Adaptability and Continuous Improvement ................................................................................... 44

4.4 Active Workforce Participation ..................................................................................................... 53

4.5 Process Safety Indicators that Drive Performance ......................................................................... 58
Chevron Richmond Refinery Regulatory Report May 2014

4 

4.6 Regulatory Assessment, Verification, and Intervention ................................................................ 61

4.7 Independent, Competent, Well-Funded Regulator ........................................................................ 66

5.0 Oversight of Petroleum Refineries in California ........................................................................... 69

5.1 Cal/OSHA ...................................................................................................................................... 69

5.1.1 Background Information ....................................................................................................... 69

5.1.2 Analysis ................................................................................................................................. 75

5.1.2.1 ALARP .......................................................................................................................... 75

5.1.2.2 Adaptability and Continuous Improvement ................................................................... 77

5.1.2.3 Process Safety Indicators ............................................................................................... 79

5.1.2.4 Inspections ..................................................................................................................... 79

5.1.2.5 Workforce Participation ................................................................................................ 80

5.1.2.6 Funding and Regulator Competency ............................................................................. 82

5.2 U.S. Environmental Protection Agency ......................................................................................... 84

5.2.1 Risk Management Plan (RMP) Program ............................................................................... 84

5.2.2 Implementation of the RMP Program ................................................................................... 85

5.3 Unified Program ............................................................................................................................ 86

5.3.1.1 Contra Costa County Hazardous Materials Programs ................................................... 86

5.3.1.1.1 CalARP .................................................................................................................. 87

5.3.1.1.2 Industrial Safety Ordinance ................................................................................... 88

5.3.1.1.3 City of Richmond Industrial Safety Ordinance ..................................................... 89

5.3.1.2 Analysis ......................................................................................................................... 89

6.0 Conclusion ..................................................................................................................................... 91

7.0 Recommendations .......................................................................................................................... 92

References ................................................................................................................................................... 95

Appendix A: Significant Petroleum Refinery Incidents in 2012 ............................................................... 98

Appendix B: Regulatory Comparison Table ............................................................................................ 103

Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regulatory Approach ... 106

Appendix D: CSB Staff Response to the Board’s Motion to Postpone issued on January 15, 2014 ....... 116
Chevron Richmond Refinery Regulatory Report May 2014

5 

Acronyms and Abbreviations 

ALARA As Low As Reasonably Achievable 

ALARP As Low As Reasonably Practicable 

ALJ Administrative Law Judge 

ANPRM Advance Notice of Proposed Rulemaking 

APA Administrative Procedure Act 

API American Petroleum Institute 

ASARP As Safe As Reasonably Practicable 

BSEE Bureau of Safety and Environmental Enforcement 

CA Competent Authority 

CAA Clean Air Act 

CAAA Clean Air Act Amendments 

CalARP California Accidental Release Prevention 

Cal/EPA California Environmental Protection Agency 

Cal/OSHA California Division of Occupational Safety and Health 

CAPA California Administrative Procedure Act 

CCHMP Contra Costa Health Services’ Hazardous Materials Program 

CCPS Center for Chemical Process Safety 

CCR California Code of Regulations 

CERCLA Comprehensive Environmental Response, Compensation, and Liability 

Act 

CFR Code of Federal Regulations 

Chevron ETC Chevron Energy Technology Company 

CIMAH Control of Industrial Major Accident Hazards 

COMAH Control of Major Accidents Hazards Regulations 

CSB U.S. Chemical Safety and Hazard Investigation Board 

CSHO Compliance Safety and Health Officer 

CUPA Certified Unified Program Agency 

DIR California Department of Industrial Relations 

DNV Det Norske Veritas

EA Environment Agency 

EPA U.S. Environmental Protection Agency 

FSA Formal Safety Assessment 

FY Fiscal Year 

GAO U.S. Government Accountability Office 

HSC California Health and Safety Code 

HSE Health and Safety Executive 

HTHA High Temperature Hydrogen Attack 

ISO Industrial Safety Ordinance 
Chevron Richmond Refinery Regulatory Report May 2014

6 

ISOM Isomerization 

LOHP Labor Occupational Health Program 

MOC Management of Change 

MOOC Management of Organizational Change 

NASA National Aeronautics and Space Administration 

NDU Naphtha Desulfurization Unit 

NEP National Emphasis Program 

NOHSC Australia National Occupational Health and Safety Commission 

NOPSEMA Australian National Offshore Petroleum Safety and Environmental 

Management Authority 

NPRM Notice of Proposed Rulemaking 

NRC U.S. Nuclear Regulatory Commission 

OERI Operational Excellence and Reliability Intelligence 

OIG Office of Inspector General 

OMB Office of Management and Budget 

OSHA U.S. Occupational Safety and Health Administration 

OSHAct Occupational Safety and Health Act 

PHA Process Hazard Analysis 

PHMSA Department of Transportation, Pipeline and Hazardous Materials Safety 

Administration 

PQV Program Quality Verification 

PSA Petroleum Safety Authority 

PSI Process Safety Information 

PSLA Petroleum Submerged Lands Act 

PSLG Process Safety Leadership Group 

PSM Process Safety Management 

QRA Quantitative Risk Assessment 

RAGAGEP Recognized and Generally Accepted Good Engineering Practices 

RFI Request for Information 

RISC Risk-Informed Safety Case 

RISO City of Richmond Industrial Safety Ordinance 

RLOP Richmond Lube Oil Plant 

RMP Risk Management Plan 

RP Recommended Practice 

SEPA Scottish Environmental Protection Agency 

SFAIRP So Far As Is Reasonably Practicable 

SOP Standard Operating Procedure 

UK United Kingdom 

USCG U.S. Coast Guard 

USW United Steelworkers Union 
Chevron Richmond Refinery Regulatory Report May 2014

7 

1.0 Executive Summary 

1.1 Incident Summary 

On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California, (“the Chevron Richmond 

Refinery”) experienced a catastrophic pipe failure in the #4 Crude Unit (“the crude unit”). The pipe, a 52-

inch long carbon steel piping component of the #4 sidecut line, ruptured and released flammable, 

hydrocarbon process fluid, which partially vaporized into a large vapor cloud that engulfed 19 Chevron 

employees and ignited. All of the employees escaped, narrowly avoiding serious injury. The ignition of 

the flammable portion of the vapor cloud and subsequent continued burning of the hydrocarbon process 

fluid resulted in a large plume of particulates and vapor traveling across the Richmond, California area. 

Approximately 15,000 people from the surrounding area sought medical treatment due to the release. 

1.2 Interim Report 

The CSB released an Interim Report on the Chevron incident in April 2013 (“the Interim Report”), which 

highlighted technical findings and safety system deficiencies. Testing conducted on the ruptured pipe 

determined that it had experienced extreme thinning near the rupture location due to sulfidation 

corrosion.1

 Sulfidation corrosion is a damage mechanism that causes thinning in iron-containing 

materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging 

from 450 °F to 800 °F.2

 This damage mechanism3 causes pipe walls to gradually thin over time, and is 

common in crude oil distillation4

 where naturally occurring sulfur and sulfur compounds found in crude 

oil feed, such as hydrogen sulfide,5

 are available to react with steel piping and equipment. The Interim 

Report stated that virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation 

corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion 

can cause thinning to the point of pipe failure when not properly monitored and controlled. 

The Interim Report noted a number of causal safety system deficiencies that highlight regulatory gaps 

relating to major accident prevention at California petroleum refineries. For example, in conducting its 

process hazard analysis6 (PHA) of the crude unit, which was required under California’s Process Safety 

 

1

 With respect to the sulfidation corrosion damage mechanism that caused the Chevron incident, carbon steel piping 

corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels, 

including stainless steel. 

2

 For an electronic copy of the CSB Chevron Interim Report see 

http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 24. 2013). 

3 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry 

that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and 

other mechanical, physical or chemical impacts). See API 570. "Piping Inspection Code: In-Service Inspection, 

Rating, Repair, and Alteration of Piping Systems." 3rd ed., Section 3.1.1.5, November 2009. 4

 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation 

column where different products boil off and are recovered at different temperatures. See 

http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013). 5

 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion. 6

 A process hazard analysis (PHA) is a hazard evaluation to identify, evaluate, and control the hazards of a process. 

Facilities that process a threshold quantity of hazardous materials, such as the Chevron Richmond refinery, are 

required to conduct a process hazard analysis per the California Code of Regulations Title 8 Section 5189, Process 
Chevron Richmond Refinery Regulatory Report May 2014

8 

Management (PSM) standard,7

 Chevron did not conduct a rigorous review of corrosion and damage 

mechanisms present in the crude unit, and did not identify sulfidation corrosion as a hazard. As such, 

Chevron did not effectively address inherent safety8

 or implement effective controls to prevent sulfidation 

corrosion, including those controls proposed by Chevron’s technical group. Although both the California 

and federal PSM standards require that hazards be identified, evaluated, and controlled, there is no further 

discussion of how far to reduce risks, and there is no requirement to address the effectiveness of controls 

or to use the hierarchy of controls.9

 Therefore, this type of analysis was not required to be conducted, and 

Chevron was never cited post-incident for failing to evaluate the effectiveness of safeguards. 

In another example, despite internal recommendations to replace the entire #4 sidecut piping with an 

inherently safer, more corrosion-resistant material of construction through the Management of Change 

(MOC) process, incident investigations, technical reports, and employee recommendations, Chevron 

repeatedly failed to implement those proposed recommendations. Chevron’s 2006 MOC analysis limited 

application of those recommendations to only a small section of the pipe. As a result, the portion of the 

pipe that failed on the August 6th incident remained in service until the incident. As there is no 

requirement to implement effective recommendations or control hazards under the MOC element, it is 

essentially an activity-based requirement. Chevron was not cited for narrowing the scope of the MOC, 

despite its disregard of internal recommendations. The CSB concluded in its Interim Report that Chevron 

did not regularly or rigorously apply inherently safer technology, which provides an opportunity for 

preventing major accidents, in its PHAs, MOCs, incident investigation recommendations, or during 

turnarounds. 

The CSB made safety recommendations in the Interim Report to a number of entities, including the 

California State Legislature, the U.S. Environmental Protection Agency, and Contra Costa County. The 

Board recommended that the California State Legislature require California petroleum refineries to 

perform damage mechanism hazard reviews, to identify and report leading and lagging process safety 

indicators, to document recognized methodologies, rationale, and conclusions used to claim that 

safeguards intended to control hazards will be effective, and to document their inherently safer systems 

analysis and the hierarchy of controls in establishing safeguards for process hazards, with the goal of 

driving risk of major accidents to as low as reasonably practicable, or ALARP. These concepts, 

introduced in the Interim Report and highlighted in the recommendations, are the basic building blocks 

for the implementation of the safety case regime, a regulatory scheme that will be discussed in great detail 

in the following report. 

The CSB concluded its Interim Report by highlighting additional issues that were still under 

investigation, including emergency planning and reporting, emergency response, safety culture, and 

regulatory oversight of petroleum refineries in California. The following report fulfills the CSB’s 

 

Safety Management of Acutely Hazardous Materials (1992). PHAs are also required by the California Accidental 

Release Prevention Program and the federal EPA Risk Management Program. 

7

 Under 8 CCR §5189 (e). https://www.dir.ca.gov/title8/5189.html (accessed September 25, 2013). 8

 According to the Center for Chemical Process Safety (CCPS), “inherently safer design solutions eliminate or 

mitigate the hazard by using materials nad process conditions that are less hazardous.” Center for Chemical Process 

Safety (CCPS). Inherently Safer Chemical Processs – A Life Cycle Approach. 2nd ed., Section 5.1.1, 2009. 9

 An effectiveness ranking of techniques used to control hazards and the risk they represent can be described as a 

hierarchy of controls. The further up the hierarchy, the more effective the risk reduction achieved. 
Chevron Richmond Refinery Regulatory Report May 2014

9 

commitment to examine whether the implementation of the safety case regulatory regime could be a more 

effective regulatory tool to achieve major accident prevention for California petroleum refineries. The 

reader will find additional issues, arguments, and counterarguments regarding the safety case regulatory 

regime addressed in Appendix C of this report. 

1.3 Background 

Although both the federal and California PSM standards, respectively, were intended to be goal-setting or 

performance-based,10,11 in practice they appear to function primarily as reactive and activity-based12

regulatory schemes that require extensive rulemaking to modify. As a result, the federal and California 

PSM standards have become static in the face of advancing best practices and technology, with the 

emphasis placed on the completion of a task or activity rather than achievement of continuous risk 

reduction.13 Many regions around the world such as the United Kingdom (UK), Australia, and Norway 

have acknowledged similar deficiencies and have implemented regulatory regimes consisting of both 

prescriptive14 and goal-setting elements that require duty holders15 to demonstrate to the regulator through 

rigorous reviews and audits that they have reduced risks to as low as reasonably practicable, or ALARP. 

This is referred to as the safety case regulatory regime.16 The safety case regulatory regime is a rigorous 

prescriptive and goal-setting regulatory approach applied globally both onshore and offshore. It is 

highlighted by its adaptability and requirements for continuous improvement in risk reduction for high 

hazard industrial facilities. A written case for safety, known as the safety case report, is generated by the 

duty holder and is generally rigorously reviewed, audited, and enforced by highly technically competent 

inspectors with skill sets familiar to those employed by the industries they oversee. Despite this global 

shift, the US has persisted in the use of a more activity-based regulatory scheme that lacks the ability to 

adapt to advancing technology and recently developed industry standards, and which has failed to 

adequately engage companies and their employees in continuous improvement and risk reduction with 

similarly-skilled inspectors. 

 

10 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria 

are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of 

acceptable risk levels. 

11 See Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. 

Section III. Summary and Explanation of the Final Rule (March 4, 1992). 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed August 

13, 2013). 

12 Activity-based standards and regulations require the mere completion of an activity and do not focus on the 

effectiveness of major accident prevention or risk reduction. 13 As will be discussed below, certain sections of the PSM standard have elements of a performance-based 

regulatory approach. 

14 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard 

abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be 

obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that 

objective. 

15 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a 

particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. 

Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; 

October 2011; p 2. These entities may include operators, contractors, and subcontractors. 

http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 16 Norway’s offshore regulatory regime is not referred to as the safety case regime, but it does contain many of the 

same elements as the safety case regime, with some differences in style, substances, and implementation. 
Chevron Richmond Refinery Regulatory Report May 2014

10 

1.4 Key Findings 

Technical

1. In the ten years prior to the incident, highly knowledgeable and experienced Chevron technical staff 

repeatedly recommended that inspectors perform 100 percent component inspections on high temperature 

carbon steel piping susceptible to sulfidation corrosion. These recommendations were not implemented 

by Chevron management.17 

2. Chevron technical staff recommended implementing inherently safer designs through the MOC 

process, incident investigations, technical reports, and past recommendations from employees. However, 

Chevron failed to implement proposed inherently safer recommendations prior to the incident. For 

example, an inspection recommendation to upgrade piping to 9-Chrome was made, but the MOC to 

implement the recommendation narrowed the scope, allowing the 52-inch component that failed to remain 

in service. 

3. In January 2007, a failure due to sulfidation corrosion caused a fire in the Chevron Richmond 

Refinery crude unit, initiating a shelter-in-place for the surrounding community. A carbon steel piping 

spool18 failed catastrophically during operation. Chevron informed Contra Costa Health Services’ 

Hazardous Materials Program19 in a letter that the crude unit piping metallurgy had been upgraded 

following this incident as an inherently safer solution. However, this upgrade was limited to only the 

immediate piping spool that had failed. The inherently safer, more corrosion resistant metallurgy was not 

implemented more broadly in the crude unit as a result of this incident. 

4. Chevron and Chevron Energy Technology Company metallurgists, materials engineers, and piping 

inspectors had expertise regarding sulfidation corrosion. However, they had limited practical influence to 

implement their recommendations. They did not participate in the most recent crude unit PHA, and they 

did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround 

process.20

5. The 2009 crude unit PHA did not identify corrosion as a potential cause of a leak or rupture in piping. 

The PHA cited non-specific, judgment-based qualitative safeguards to reduce risk, such as: utilizing 

metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing 

pipe wall corrosion allowances.21 The effectiveness of these safeguards was neither evaluated nor 

 

17 These recommendations are discussed in detail in paragraphs 44 through 51 of the Chevron Interim Report. 

18 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in 

order to provide a temporary connection or complete disconnection between two piping circuits. 

19 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor 

hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). 20 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the 

shutdown. 

21 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment 

beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra 

thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the 

equipment. 
Chevron Richmond Refinery Regulatory Report May 2014

11 

documented; instead the safeguards were merely listed in the PHA. Had the adequacy of these safeguards 

been verified, improved safeguards intended to protect against sulfidation-induced failure of carbon steel 

piping could have been recommended. 

Regulatory

6. Following the August 6th incident, California’s Division of Occupational Safety and Health 

(Cal/OSHA) inspected the Chevron facility and issued citations. Only one citation was related to PHAs; 

and it was not associated with evaluating the effectiveness of safeguards. Rather, the emphasis was that 

Chevron’s PHA did not adequately account for hazards caused by other units associated with the crude 

unit. Had the California PSM standard required documentation of the effectiveness of safeguards, 

Chevron would have been obligated to conduct this analysis. 

7. There is a significant discrepancy in the compensation between the California regulators and the 

Chevron Richmond Refinery personnel they interact with. The California regulators also lack the 

technical staff with the necessary skills, knowledge, and experience to provide sufficient direct oversight 

of petroleum refineries in California. 

8. The CSB has examined records that demonstrate a considerable problem with significant and deadly 

incidents at petroleum refineries over the last decade. The EPA has noted 234 recordable accidents at 

petroleum refineries between 2000 and 2010. This is more than any other industry despite the fact that 

the nation’s petroleum refineries make up only roughly one percent of the some 13,000 facilities covered 

by the EPA’s Risk Management Program. In 2007, OSHA stated that according to its IMIS (Integrated 

Management Information System) database, since May 1992, 36 fatality/catastrophe (FAT/CAT) 

incidents related to HHC releases in the refining industry occurred. These incidents included 52 

employee deaths and 250 employee injuries, 98 of these injuries required hospitalization. This number 

surpassed the combined total of the next three highest industries over the same period. In 2010, an OSHA 

official testified to a Congressional Subcommittee that over 20 major incidents resulting in injuries or 

fatalities across the country occurred between 2005 and 2010, including the Tesoro Anacortes explosion 

and fire in Washington. These incidents all repeated a lesson that should have already been learned by 

the industry. Finally, in 2012 alone, the CSB tracked 125 significant process safety incidents at US 

petroleum refineries. Seventeen of these took place in California. 

9. Under the existing regulatory regimes for onshore petroleum refineries in the US and California, such 

as the PSM and RMP programs, there is no requirement to reduce risks to ALARP. For example, under 

both PSM and RMP an employer must “control” hazards when conducting a process hazard analysis 

(PHA) of a covered process. However, there is no requirement to address the effectiveness of the controls 

or the hierarchy of controls. Thus, a PHA that meets the regulatory requirements may inadequately 

identify or mitigate major hazard risk. In addition, there is no requirement to submit PHAs to the 

regulator, and the regulator is not responsible for assessing the quality of the PHA or the proposed 

safeguards. 
Chevron Richmond Refinery Regulatory Report May 2014

12 

10. The PSM standard does not effectively establish goals to prevent accidents or reduce risk. Only two 

of the 14 elements (PHA and mechanical integrity) of the PSM standard contain some goal-setting 

component. 

11. In the last decade, the CSB has made a number of process-safety related recommendations to OSHA 

and EPA in its investigation reports and studies (e.g. Motiva, BP Texas City, and Reactive Hazards). 

However, none of the regulatory recommendations have been implemented, and there have been no 

substantive changes made to the PSM and RMP regulations to improve the prevention of major accidents. 

12. Available data from Norway and the United Kingdom (UK) shows a reduction in hydrocarbon 

releases offshore under the safety case regulatory regime.22 

13. Regulatory approaches similar to the safety case regulatory regime, which require risk reduction to 

ALARP or equivalent, have been implemented in the nuclear sector by the Nuclear Regulatory 

Commission (NRC) and the aerospace sector by NASA. 

14. Independent studies of the safety case regulatory regime in the UK have identified improvements to 

safety performance from the safety case and a variety of stakeholders, including major oil companies, 

have shown support of the safety case.23 

1.5 Regulatory Conclusions 

The existing regulatory regimes for onshore petroleum refineries in the US and California: 

1. Rely on a safety and environmental management system framework that is primarily activity-based 

rather than requiring goal-based risk reduction to as low as reasonably practicable (ALARP) or 

equivalent. 

2. Are static, unable to adapt to innovation and advances in the management of major hazard risks. 

3. Do not require that companies effectively manage the risks they create; nor do they require regulator 

evaluation of the effectiveness of safeguards or regulator acceptance of companies’ plans for controlling 

those risks. 

4. Do not ensure continuous improvement by effectively incorporating lessons learned from major 

accidents; nor do they require companies to address newly-identified safety issues as a result of such 

incidents. 

5. Do not effectively collect or promote industry use of major accident performance indicators to drive 

industry to reduce risks to ALARP. 

 

22 Norway’s indicator data is discussed in Section 4.5. The UK data is discussed in Appendix C. 

23 See Sections 2.0, 3.2.1.2, and 3.2.2.3. Also see FAQ 4. 
Chevron Richmond Refinery Regulatory Report May 2014

13 

6. Do not require the use or implementation of inherently safer systems analysis or hierarchy of controls. 

7. Do not effectively involve the workforce in risk reduction and prevention of major accidents. 

8. Do not provide the regulator with the authority to accept or reject a company’s hazard analysis, risk 

assessment, or proposed safeguards; and 

9. Do not employ the requisite number of staff with the technical skills, knowledge, and experience to 

provide sufficient direct safety oversight of petroleum refineries. 

1.6 Recommendations 

As a result of the findings and conclusions of this report, the CSB makes recommendations, summarized 

below, to the following recipients: 

California State Legislature, 

Governor of California 

Develop and implement a step-by-step plan to establish a more rigorous safety management regulatory 

framework for petroleum refineries in the state of California based on the principles of the “safety case” 

framework. 

____________________________________________ 

The Chemical Facility Safety and Security Working Group and the 

Occupational Safety and Health Administration 

As part of your response to Executive Order 13650, develop questions and evaluate issues raised from the 

findings and conclusions in this report concerning the safety case regime. 

_________________________________________________________________ 

Section 7.0 details the recommendations. 
Chevron Richmond Refinery Regulatory Report May 2014

14 

2.0 Introduction 

Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small fraction of the 

thousands of industrial and chemical facilities that exist in the US, the CSB has seen a great number of 

serious and deadly incidents at refineries over the last decade. 

In March 2005, the BP Texas City Refinery suffered one of the worst industrial accidents in recent US 

history, when overfill of a distillation column resulted in an explosion and fire that led to 15 fatalities, 

another 180 injuries, and the issuance of a shelter-in-place order that required 43,000 people to remain 

indoors. Houses were damaged as far as three-quarters of a mile away from the refinery. In a 2006 

statement, former CSB Chairwoman Carolyn Merritt said that while BP did make some safety 

improvements before the March 2005 explosion, “the focus of many of these initiatives was on improving 

procedural compliance and reducing occupational injury rates, while catastrophic safety risks 

remained....”24

In November 2009, an explosion at the Silver Eagle Refinery damaged over 100 homes in a nearby 

subdivision in Woods Cross, Utah. At a public meeting to discuss the incident, former CSB Chairman 

John Bresland called on refineries to improve their safety performance, stating: 

The frequency of accidents in US refineries is very troubling. These 

accidents cost lives, inflict serious injuries and can harm communities. 

They also earn scrutiny from government regulators; in the past few 

weeks a refinery in Texas drew the largest OSHA fine in history, more 

than US $80 million, for alleged process safety violations. I call on all 

refineries to redouble their commitment to safer operations and safer 

communities. The current rate of accidents in refineries is not 

sustainable and it is not acceptable.25

On the five-year anniversary of the BP Texas City explosion in March 2010, Chairman Bresland 

continued to relay his concern regarding refinery safety, noting that “refinery accidents...continue to 

occur with dismaying frequency...[and] will only stop when every refinery has made the financial and 

human commitment to sound process safety management.”26 Yet just ten days later, seven workers were 

fatally injured at the Tesoro refinery in Anacortes, Washington, following the catastrophic failure of a 

heat exchanger. Again, Chairman Bresland pointed out the alarming frequency of refinery incidents, 

stating that “if the aviation industry had the same number and types of incidents as the refining industry, I 

don’t think people would be flying too much.”27

 

24 Scrutiny Finds BP Safety Troubles. http://usatoday30.usatoday.com/money/industries/energy/2006-10-30-bpblast-findings_x.htm (accessed September 5, 2013). 25US Refineries Commitment to Safety Called Into Question. http://www.engineerlive.com/content/22354 (accessed 

September 5, 2013). 

26 http://www.csb.gov/statement-from-csb-chairman-john-bresland-on-5th-anniversary-of-fatal-bp-texas-city-2005-

explosion/?pg=18 (accessed September 5, 2013). 27Refinery Tragedies All Too Common. See 

http://seattletimes.com/html/localnews/2011518449_safetysunday04m.html (accessed September 5, 2013) 
Chevron Richmond Refinery Regulatory Report May 2014

15 

On June 10, 2010, OSHA Deputy Assistant Secretary Jordan Barab testified before the Senate Committee 

on Health, Education, Labor and Pensions’ Subcommittee on Employment and Workplace Safety 

regarding worker safety in US energy production industries. Mr. Barab noted that OSHA had counted 

over 20 major incidents resulting in injuries or fatalities across the country that had occurred within the 

last five years, including the Tesoro Anacortes explosion and fire in Washington. These incidents all 

repeated a lesson that should have already been learned by the industry.28 According to Mr. Barab, “[t]his 

cycle of workers being hurt or killed because their employers failed to implement well-known safety 

measures points out major deficiencies in chemical process safety management in the nation’s refineries 

and, quite possibly, to systemic safety and health problems in the entire petrochemical industry.”29

According to OSHA’s compliance instruction document CPL-03-00-00430 on the OSHA Petroleum 

Process Safety Management National Emphasis Program (NEP) issued in 2007, 

Since the PSM standard was promulgated by OSHA in 1992, no other 

industry sector has had as many fatal or catastrophic incidents related to 

the release of HHC [highly hazardous chemicals] as the petroleum 

refining industry []. According to OSHA's IMIS [Integrated Management 

Information System] database, since May 1992, 36 fatality/catastrophe 

(FAT/CAT) incidents related to HHC releases in the refining industry 

have occurred. These incidents included 52 employee deaths and 250 

employee injuries, 98 of these injuries required hospitalization. The 

number of refinery FAT/CAT incidents surpasses the combined total of 

the next three highest industries over the same period (SIC 2899 

Chemical Manufacturing, Not Elsewhere Classified (NEC) – 12 

FAT/CATs; SIC 2869 Industrial Organic Chemical Manufacturing, NEC 

– 12 FAT/CATs; and SIC 2892 Explosive Manufacturing – 11 

FAT/CATs).31

In 2012 alone, the CSB tracked 125 significant32 process safety incidents at US petroleum refineries, 

which are listed in Appendix A. Seventeen of these took place in California, including a major release of 

8,614 pounds of highly toxic hydrogen sulfide at the Chevron Richmond Refinery on August 2, 2012, just 

four days prior to the incident. 

Of the 15 major accidents that the CSB is currently investigating, six occurred in petroleum refineries. 

These include two separate explosions at the Silver Eagle refinery in Woods Cross, Utah, which resulted 

in injuries and offsite consequences, the heat exchanger rupture at the Tesoro refinery in Anacortes, 

Washington, which resulted in seven fatalities, and a series of equipment failures at CITGO’s refinery in 

 

28 Jordan Barab’s Congressional testimony is available at

http://www.dol.gov/ocia/congressionaltestimony/20100610_JBarab.htm (accessed January 7, 2014). 

29 Ibid. 30 OSHA Instruction CPL 03-00-004. Petroleum Refinery Process Safety Management National Emphasis Program. 

June 7, 2007. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=DIRECTIVES&p_id=3589#VIII (accessed 

January 7, 2014). 

31 Ibid at Section VIII. 32 These incidents were reported to the Department of Energy and/or the National Response Center and examined by 

the CSB’s Incident Screening Department. The CSB believes that incidents that result in disruptions to the national 

energy supply, serious injuries, or receive high media attention are all significant. 
Chevron Richmond Refinery Regulatory Report May 2014

16 

Corpus Christi, Texas, involving highly toxic hydrogen fluoride. The U.S. Environmental Protection 

Agency (EPA) has also documented 234 recordable accidents at petroleum refineries between 2000 and 

2010. Despite the fact that the nation’s petroleum refineries make up only roughly one percent of the 

some 13,000 facilities covered by the EPA’s Risk Management Program, they accounted for more 

incidents in that time period than any other industry, including the much larger sector of chemical 

manufacturing, which EPA documented as having 218 recordable accidents.33 

The CSB concludes that the continuing occurrence of refinery accidents demonstrates the pressing need to 

examine the current regulatory structure in place in the US and, in light of the Chevron incident, in the 

state of California for petroleum refineries. There have been a number of positive developments in the 

wake of the Chevron incident that demonstrate California’s prime opportunity to lead the nation in 

implementing changes to improve safety and health in the refining industry. In the Fall of 2012 following 

the Chevron incident, California Governor Jerry Brown created the California Interagency Working 

Group on Refinery Safety (“the working group”), charged with improving cooperation among agencies, 

including the EPA, Cal EPA, California’s Division of Occupational Safety and Health (Cal/OSHA), and 

Contra Costa County, with the goal of improving safety at California’s petroleum refineries and 

preventing major accidents. 

The working group began its initiative by commissioning the Labor Occupational Health Program34

(LOHP) to conduct “listening panels” throughout California, enabling community members to meet with 

working group members to discuss their concerns surrounding refineries. LOHP convened a series of 

meetings and conference calls with labor unions, community-based organizations, fire agencies, and 

environmental health groups between November 6, 2012, and March 18, 2013. Dr. Michael P. Wilson, 

the former Director of LOHP,35 documented his findings and recommendations regarding refinery safety 

in a summary report entitled Refinery Safety in California: Labor, Community and Fire Agency Views, 

which was released on June 4, 2013.36 In the report, Dr. Wilson quoted Swiss Re’s finding that the US 

has experienced financial losses from refinery incidents that are three times that of industry counterparts 

in countries within the “EU cluster,”37 a gap which continues to grow due in part to the US refining 

industry’s “pushing...mode of operation”, its “compliance-driven focus on safety”, and “a ‘detached’ 

workforce....”38 

 

33 Matthiessen, Craig. EPA Risk Management Program: An Overview of the EPA Risk Management Program and 

Inherently Safer Processes. NAS-MIC Bayer Public Meeting Power Point Presentation; May 24, 2011; p 20. 34 LOHP is a public service program for the Center for Occupational and Environmental Health at UC Berkeley’s 

School of Public Health. LOHP seeks “to reduce occupational injury, illness and death by protecting the health and 

safety of workers worldwide.” For more information, see http://www.lohp.org/ (accessed July 8, 2013). 35 Dr. Wilson now serves as Chief Scientist in the Office of the Director, California Department of Industrial 

Relations (DIR). DIR oversees state programs dedicated to protecting the health, safety, and economic security of 

California’s workers. 

36 Dr. Wilson released an initial draft of the summary report on March 27, 2013. He then released a revised copy of 

the summary report on June 4, 2013. See http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013). 37 The countries in the EU cluster are all of Europe, Singapore, South Korea, Japan, Saudi Arabia, Gulf States and 

Egypt. 

38 Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report 

for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 

2013; pp 5 and 6. Citing Zirngast, Ernst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in 

Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT-
Chevron Richmond Refinery Regulatory Report May 2014

17 

Dr. Wilson reiterated a number of the findings contained in the CSB’s Interim Report on the Chevron 

incident, including the “striking lack of attention on the part of the Richmond Chevron refinery to 

maintenance and metallurgy upgrades...,” and the Chevron Richmond Refinery’s failure to implement a 

recommended 100% component inspection program for high-risk piping. He also stated that California’s 

refineries are able to operate without demonstrating competence in health, safety, and environmental 

performance to a regulatory agency or to the public, and as such recommended that California establish a 

regulatory approach similar to that of the safety case regulatory regime, a rigorous prescriptive39 and goalsetting40 regulatory regime used widely by other regions throughout the world such as the United 

Kingdom (UK) and Australia to regulate high hazard industrial facilities. It is highlighted by its 

adaptability and requirements for continuous improvements in risk reduction, places the duty on industry 

to demonstrate its competence in health and safety to the regulator. The regime is overseen by highly 

competent, well-funded regulators that rigorously audit facilities for compliance with the written safety 

case report and good industry practice. 

On July 11, 2013, the working group released a draft report entitled Improving Public and Worker Safety 

at Oil Refineries,

41 which the CSB has recognized as an important step forward in improving petroleum 

refinery safety and environmental performance both in California and nationally. The report outlined the 

process of adopting several of the CSB‘s recommendations from its Interim Report on the Chevron 

incident, including requiring refineries to implement inherently safer systems and conduct damage 

mechanism hazard reviews. Furthermore, the report announced the creation of an Interagency Refinery 

Task Force within the California Environmental Protection Agency (Cal/EPA) by September 1, 2013, 

aimed at facilitating information sharing and improving coordination of oversight and enforcement 

activities among regulatory agencies. The CSB welcomed the report’s recommendation for California to 

study the safety case regulatory approach. 

In addition to the work being done by the working group, the California State Legislature approved a 

2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to 

charge state petroleum refineries a “fee” by March 31, 2014, to help pay for at least 15 new positions in 

Cal/OSHA’s Process Safety Unit, which enforces the California Process Safety Management (PSM) 

standard throughout the state.42 

The Chevron incident also spurred the formation of the City of Richmond’s Refinery Action 

Collaborative (“the collaborative”), which was launched on January 30, 2013. The collaborative, whose 

 

EXTRACT. Risk Engineering Services, Swiss Re. 

http://coeh.berkeley.edu/people/apers_educ/docs/LOHPRefinery%20Safety.pdf (accessed December 30, 2013). 

39 A prescriptive regulation or standard describes the specific means or activity-based actions to be taken for hazard 

abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be 

obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that 

objective. 

40 Also referred to as performance-based regulations, goal-setting regulatory requirements and acceptance criteria 

are specified and industry must document that their specific solutions meet such requirements, e.g. in terms of 

acceptable risk levels. 

41 See http://www.calepa.ca.gov/Publications/Reports/2013/Refineries.PDF (accessed September 25, 2013). 42 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

18 

members include the United Steelworkers43 (USW) Local 5, the USW International, Communities for a 

Better Environment,44 and LOHP,45 was launched after a preliminary exploratory meeting held in October 

2012. The collaborative advocates for community and worker safety, better transparency, and 

environmental health, and has already made recommendations to the working group to improve emissions 

reporting and require more thorough assessments of pipe corrosion damage at oil refineries.46 

On October 10, 2013, the collaborative formally responded in a memo to the July 2013 draft report issued 

by the Interagency Working Group on Refinery Safety (Improving Public and Worker Safety at Oil 

Refineries). In the memo, the collaborative stated its support for the working group’s findings and 

recommendations. The collaborative also issued its own recommendations and highlighted 12 principles 

as being important to the development of effective regulatory policy in California. These principles 

include linking regulatory non-compliance to an operator’s license to operate and integrating meaningful 

participation in decision-making by workers and communities.47 The collaborative also noted in the 

memo that it supported “shifting the ‘burden of proof’ of safety from public agencies to the industry, as is 

required in the ‘Safety Case’ approach....”48

The CSB noted in its Chevron Interim Report the important role of transparency between industry and the 

public in improving health and safety for the facility and the surrounding communities. Following the 

Chevron incident the collaborative, worker representatives, regulators, and governmental bodies played a 

key role in driving transparency, accountability, and improved risk reduction during the decision-making 

process related to crude unit piping repairs. The CSB recommended to the California State Legislature in 

the Interim Report to establish a multi-agency process safety regulatory program for all California 

petroleum refineries to further improve public accountability and transparency by establishing a system to 

report to the regulator methodologies, findings, conclusions, and corrective actions related to refinery 

mechanical integrity inspection and repair work arising from California petroleum refinery PHAs, 

turnarounds, and maintenance-related shutdowns.49 This system would require reporting of information 

such as damage mechanism hazard reviews, establish procedures for greater workforce and public 

participation, and provide mechanisms for federal, state, and local agency operational coordination, 

 

43 The USW is the largest industrial union in North America and has approximately 1.2 million active and retired 

members in the US, Canada, and the Caribbean. For more information see http://www.usw.org/ (accessed July 17, 

2013). 

44 Communities for a Better Environment is an “environmental justice organization[s]” in California which has the 

mission of “build[ing] people’s power in California’s communities of color and low income communities to achieve 

environmental health and justice by preventing and reducing pollution and building green, health and sustainable 

communities and environments.” See http://www.cbecal.org/about/mission-vision/ (accessed August 14, 2013). 45 Other members of the collaborative include the BlueGreen Alliance (a coalition of labor unions and 

environmental groups that advocate for a green economy and safer workplaces), the National Resources Defense 

Council, and the Asian Pacific Environmental Network. 

46 See http://richmondconfidential.org/2013/02/20/labor-and-environmental-groups-join-forces-on-refinery-issues/

(accessed July 9, 2013). 

47 Refinery Action Collaborative. Initial Response of the Collaborative to the Findings & Recommendations of The 

July 2013 Draft Report of the Interagency Working Group on Refinery Safety, Governor Jerry Brown. October 10, 

2013; p 10. 

48 Ibid at 7. 

49 Under the existing federal and California state PSM standards, this information is not currently made publicly 

available. 
Chevron Richmond Refinery Regulatory Report May 2014

19 

sharing of data, and joint accident prevention activities. California is actively working to implement this 

recommendation through the creation of the Interagency Refinery Task Force mentioned above. 

The positive and productive developments that have taken place in the wake of the Chevron incident 

strongly suggest that California has a unique opportunity to implement changes to improve safety and 

health in the refining industry that can serve as a model to the rest of the country. 

 

It is also important to note that a growing dialogue has emerged throughout the US surrounding the need 

to improve the regulation of hazardous materials and processes, to which the CSB has been an important 

contributor. The CSB first examined the safety case in its 2002 investigation report entitled Improving 

Reactive Hazard Management50 as a potentially effective alternative framework for the regulation of 

reactive hazards. The CSB noted that successful implementation of this “comprehensive” regulatory 

approach required a competent and experienced regulator. In December 2010, the CSB held a public 

hearing in Washington, DC on the Regulatory Approaches to Offshore Oil and Gas Safety, where 

internationally recognized experts in industrial safety and accident analysis provided important testimony 

on managing risks offshore.51 Much of this testimony supported the implementation of the safety case as 

a model for regulating major hazards, both onshore and off. For example, a Shell Oil Company 

representative testified that the company had been using the safety case globally since 2002, and noted 

that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major 

hazards have been managed using effective barriers52 and controls. In July 2012, the CSB held an 

additional public hearing on Safety Performance Indicators.53 A number of international regulators 

testified on the regulator’s ability under the safety case to drive continuous improvement in the oil and 

gas industry. Finally, on July 25, 2013, the CSB held a public meeting to discuss the U.S. Occupational 

Safety and Health Administration’s (OSHA’s) failure to implement a number of key CSB safety 

recommendations made to OSHA in the last decade to revise and improve its Process Safety Management 

(PSM) standard and to issue a new combustible dust standard. 

 

On January 18, 2011, President Obama issued Executive Order 13563,54 which called for improvements 

in the nation’s regulatory system to promote predictability and reduce uncertainty and to use the best, 

most innovative, and least burdensome tools for achieving regulatory ends. Specifically, it directed that 

agencies review existing and proposed standards and regulations to ensure they effectively protect “public 

health, welfare, safety, and our environment while promoting economic growth, innovation, 

competitiveness, and job creation.”55 Finally, the order emphasized that to the extent feasible, regulations 

 

50 A full copy of the report is available at http://www.csb.gov/improving-reactive-hazard-management/ (accessed 

July 10, 2013). 

51 For a copy of the transcript from the CSB Public Hearing on the Regulatory Approaches to Offshore Oil and Gas 

Safety, see http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed August 14, 

2013). 

52 A barrier is a “technical, operational and/or organizational element[] which individually or collectively reduce[s] 

opportunities for specific error, hazard or accident to occur, or which limits its harm/drawbacks.” Petroleum Safety 

Authority. Safety Status & Signals, 2012-2012; 2013; p 31. 53 For the proceedings of the CSB Public Hearing on Safety Performance Indicators see 

http://www.csb.gov/events/csb-public-hearing-safety-performance-indicators/ (accessed August 14, 2013). 54 Improving Regulation and Regulatory Review. Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). 

http://www.archives.gov/federal-register/executive-orders/2011.html (accessed July 10, 2013). 55 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

20 

and standards should specify performance objectives rather than the behavior or manner of compliance 

that regulated entities must adopt, and be adopted through a process that involves public participation. As 

a result of this Executive Order, OSHA, the Bureau of Safety and Environmental Enforcement (BSEE), 

the EPA, the Department of Transportation’s Pipeline and Hazardous Materials Safety Administration 

(PHMSA), and the U.S. Coast Guard (USCG) solicited views from the public and stakeholders regarding 

opportunities to address improving efficiency and effectiveness of safety and environmental regulations 

and standards in the oil and gas industry.56 These five agencies then convened an expert forum57 in 

September 2012 in Texas City, Texas, to explore the benefits of implementing goal or performance-based 

regulatory models such as the safety case in the oil and gas industry, and ways to advance the use of such 

models in the US. The forum included a discussion of the safety case regulatory regime as a 

performance-based regulatory model, and industrial safety and accident analysis expert Dr. Andrew 

Hopkins spoke in support of that model. 

In the wake of the April 2013 explosion and fire that occurred at a fertilizer storage and distribution 

facility in West, Texas, and resulted in fifteen fatalities and hundreds of injuries, President Obama issued 

Executive Order 1365058 on August 1, 2013. The Executive Order established the Chemical Facility 

Safety and Security Working Group, a working group of federal agencies59 tasked with, among other 

things, developing options for enhancing and modernizing policies, regulations, and standards to improve 

the safety and security of chemical facilities.60 As will be discussed in Section 4.3, the group has included 

the safety case regulatory model in a list of potential actions it may consider taking to improve chemical 

safety regulation.61 

The CSB has utilized a broad range of expert testimony and research to gain a comprehensive 

understanding of regulatory models for onshore and offshore oil and gas facilities in countries around the 

world, and, in light of this investigation, the state of California. This report highlights the significant 

attributes of the safety case regime that together result in a more effective regulatory approach to process 

safety and risk reduction. It also provides a detailed contrast of the safety case regulatory model to the 

existing regulatory structures in the US and California, and makes recommendations to improve 

California’s regulatory oversight of its petroleum refineries and to promote a broader national dialogue on 

the safety case regulatory approach. 

 

 

56 For more information see

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267

(accessed July 10, 2013). 

57 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267

(accessed August 13, 2013). 

58 Improving Chemical Facility Safety and Security. Exec. Order No. 13650, 78 Fed. Reg. 48029 (August 1, 2013). 

https://www.federalregister.gov/articles/2013/08/07/2013-19220/improving-chemical-facility-safety-and-security

(accessed January 7, 2014). 

59 The working group includes the EPA, the Department of Justice, the Department of Agriculture, the Department 

of Transportation, and the Department of Labor. 

60 See Section 6 of the Executive Order. 61 See Working Group response to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for 

Policy, Regulation, and Standards Modernization. 

https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). 
Chevron Richmond Refinery Regulatory Report May 2014

21 

3.0 The Safety Case Regulatory Regime 

3.1 Introduction 

Throughout modern history, major industrial accidents have been catalysts for significant regulatory 

reform, as countries around the world strive to mitigate risk and improve the safety of their facilities and 

processes in order to protect human health and the environment. According to industrial safety and 

accident analysis expert Dr. Andrew Hopkins, “[d]isasters...offer an unparalleled opportunity to study the 

workings of an organisation and to identify where things are going wrong.”62 Around the world, many of 

these large-scale incidents have resulted in sweeping changes to legislation surrounding industrial safety 

and health. These changes replace prescriptive, compliance-based regulations with goal-setting 

regulations supplemented by prescriptive requirements that support adaptability, require duty holders63 to 

demonstrate to the regulator that they have driven risks to as low as reasonably practicable (ALARP) or 

equivalent, and provide the regulator with the tools to drive continuous improvement among major hazard 

facilities.64 A majority of these regulatory regimes are referred to as the safety case, which Dr. Hopkins 

defines as: 

a case which the operator of a hazardous facility makes to the regulator, 

setting out how safety is to be managed. It must include details of the 

hazard identification process, the hazards which have been identified and 

the procedures which have been set in place to control them. The system 

remains self-regulatory in principle but rather than the facility being left 

to its own devices by the regulator it must convince the regulator that its 

strategy for managing safety is satisfactory [emphasis added]. Under 

any safety case regime, facility operators are expected to adopt best 

practice risk management.65 

The safety case regulatory regime is much more than a written report; it shifts risk management 

responsibility to the company and its employees and provides for rigorous review and oversight by a 

technically competent regulator to ensure effective implementation.66

 

62 Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of 

Australia, 1999; p 1. 

63 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a 

particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. 

Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; 

October 2011; p 2. These entities may include operators, contractors, and subcontractors. 

http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). 64 Major hazard facilities are workplaces that store, handle or process large quantities of hazardous material. 

Incidents at such facilities have the potential to cause serious damage to employees, people in surrounding areas, and 

the environment. See http://www.pc.gov.au/__data/assets/pdf_file/0018/82350/21-appendixd.pdf (accessed May 9, 

2013). 

65 Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University 

[Online]; p 7. 

http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%20presentati

on/Lonford%20talk.PDF (accessed May 8, 2013). 66 The CSB notes that that the burden is currently on the PSM regulator to verify compliance with existing 

regulations, which is primarily done following an incident or complaint. Rarely is this done proactively under the 
Chevron Richmond Refinery Regulatory Report May 2014

22 

The remaining portions of Section 3 will introduce major accidents that have occurred around the world 

and discuss the history behind the global development and implementation of the safety case regulatory 

approach on and offshore. Section 4.0 will then highlight major attributes of the safety case regulatory 

approach. The US regulatory model will also be introduced and discussed throughout these sections to 

allow for comparisons between the different approaches. Finally, Section 5.0 will discuss the regulation 

of petroleum refineries in California specifically, including Chevron. The report concludes with 

important recommendations focused on improving the regulatory oversight of California’s 14 refineries, 

and encouraging OSHA, industry, labor, and others to work together to improve the regulation of 

petroleum refineries throughout the US. 

3.2 Initial Safety Case Implementation 

3.2.1 United Kingdom 

3.2.1.1 Onshore 

Two major onshore incidents in the 1970s helped spark legislative reform focused on major accident 

prevention and risk reduction for onshore major hazard facilities. A large dioxin67 release in Seveso, 

Italy, in 1976, which injured hundreds of individuals, led the European Commission68 to adopt legislation 

in 1982 known as the Seveso Directive, aimed at the prevention and control of major industrial 

accidents.69 Following the 1984 toxic release in Bhopal, India, which resulted in several thousand known 

fatalities, and the Sandoz chemical plant fire near Basel, Switzerland, which injured 14 individuals and 

released nearly 30 tons of pesticides into the Rhine River, turning it red, the Seveso Directive was 

amended and replaced in 1996 with the Seveso II Directive.70 The regulation requires owners or 

operators of facilities that contain threshold quantities of listed substances to submit safety reports to a 

competent authority (CA) within a Member State of the European Commission for its review and 

acceptance.71 These reports must demonstrate to the CA that major-accident prevention policies, safety 

management systems, and internal emergency plans have been created and implemented.72 The 

 

current system. The Refinery NEP is a primary example of proactive inspections to verify compliance. It was 

discontinued in 2011. 

67 The term Dioxin refers to a family of toxic chemicals. They have been characterized by EPA as likely to be 

human carcinogens and are anticipated to increase the risk of cancer at background levels of exposure. See 

http://www.epa.gov/pbt/pubs/dioxins.htm (accessed June 17, 2013). 68 The European Commission consists of 27 Commissioners and “represents the interests of the EU [European 

Union] as a whole. It proposes new legislation to the European Parliament and the Council of the European Union, 

and it ensures that EU law is correctly applied by member countries.” http://ec.europa.eu/atwork/index_en.htm

(accessed May 6, 2013). 

69 See http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 70 The Seveso Directive was adopted in 1982 and was amended twice, in 1987 and 1988. On December 9, 1996, the 

Seveso II Directive was adopted and replaced the original Seveso Directive. The Seveso III Directive was then 

adopted on July 4, 2012, and became effective on August 13, 2012. Member States must implement Seveso III by 

June 1, 2015. http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013). 71See http://ec.europa.eu/environment/seveso/legislation.htm (accessed May 6, 2013). 72 Seveso II Directive, Article 9 (1996). Available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

23 

regulation also requires owners or operators to “prove to the competent authority...that he has taken all 

measures necessary as specified in this Directive.”73 

On June 1, 1974, the Flixborough Works of Nypro (UK) 

Limited experienced a massive cyclohexane vapor cloud 

explosion, killing 28 workers and injuring 36 workers 

and hundreds of members of the public offsite. This 

incident along with the Seveso incident led to the 

Seveso Directive in 1982, and this was converted into 

legislation in the United Kingdom (UK) via the Control 

of Industrial Major Accident Hazards (CIMAH) 1984 

Regulations. The Control of Major Accidents74 Hazards 

Regulations (COMAH) replaced CIMAH in April 1999 

to conform to the updated Seveso II Directive. The 

Health and Safety Executive75 (HSE), the Environment 

Agency76 (EA), and the Scottish Environmental 

Protection Agency77 (SEPA) are considered to be the 

UK’s CA responsible for the enforcement of these 

regulations. A key feature differentiating these two 

regulations is the increasing emphasis from the operator 

having to “describe” the safety systems in CIMAH to 

being required to “demonstrate” their adequacy in 

COMAH.78 

 

73 Seveso II Directive, Article 5, Paragraph 2 (1996). Available at 

http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 

15, 2013). 

74 The COMAH regulations define “major accident” as “an occurrence (including in particular, a major emission, 

fire or explosion) resulting from uncontrolled developments in the course of the operation of any establishment and 

leading to serious danger to human health or the environment, immediate or delayed, inside or outside the 

establishment, and involving one or more dangerous substances...” COMAH Regulations, Part 1, Regulation 2 

(2005). 

75 HSE is an independent regulator, and “act[s] in the public interest to reduce work-related death and serious injury 

across Great Britain’s workplaces.” See http://www.hse.gov.uk/aboutus/ (accessed May 7, 2013). According to the 

HSE’s Enforcement Policy Statement, the HSE’s purpose is “to protect the health, safety and welfare of people at 

work, and to safeguard others, mainly members of the public, who may be exposed to risks from the way work is 

carried out.” http://www.hse.gov.uk/pubns/hse41.pdf (accessed May 7, 2013). 76 EA is an Executive Non-departmental Public Body responsible for protecting the environment and promoting 

sustainable development. For more information see http://www.environment-agency.gov.uk/default.aspx (accessed 

July 17, 2013). 

77 SEPA is Scotland’s environmental regulator, aimed at protecting and improving the environment. For more 

information see http://www.sepa.org.uk/ (accessed July 17, 2013). 78 COMAH Regulations. Schedule 4, Part 1. Purpose of safety reports is to “1. demonstrate[e] that a major accident 

prevention policy and a safety management system for implementing it have been put into effect in accordance with 

the information set out in Schedule 2; 2. Demonstrate[e] that major accident hazards have been identified and that 

the necessary measures have been taken to prevent such accidents and to limit their consequences for persons and 

the environment; 3. Demonstrate[e] that adequate safety and reliability have been incorporated into the – (a) design 

and construction, and (b) operation and maintenance, of any installation and equipment and infrastructure connected 

with its operation which are linked to major accident hazards within the establishment....” (2005). 
Chevron Richmond Refinery Regulatory Report May 2014

24 

The COMAH regulations apply to all onshore facilities that have sufficient quantities of dangerous 

substances as listed in Schedule 179 of the regulations.80 The general duty for all duty holders of facilities 

covered under the COMAH regulations is to “take all measures necessary to prevent major accidents and 

limit their consequences to people and the environment.”81 The HSE interprets this duty as the equivalent 

of reducing risks82 to “as low as reasonably practicable,” or ALARP.83,84,85 Duty holders are required to 

prepare a safety report that “demonstrate[s] to the CA that all measures necessary for the prevention and 

mitigation of major accidents have been taken.”86 These reports must contain information for the CA to 

review and analyze, including a policy on preventing and mitigating major accidents; a management 

system for implementing that policy that complies with good practice;87 an effective method for 

identifying any major accidents that might occur; and measures to prevent and mitigate major accidents.88 

To assist operators with reducing risks to ALARP, the HSE publishes guidance documents that contain 

good practice guidelines and standards and that discuss what constitutes good practice.89 

 

79 Available at http://www.legislation.gov.uk/uksi/1999/743/schedule/1/made (accessed June 17, 2013). 80 COMAH Regulations, Part 1, Regulation 3 (2005). 

81 COMAH Regulations, Part 2, Section 4 (2005). 

82 HSE describes “risk” as “the likelihood that a hazard will actually cause its adverse effects, together with a 

measure of the effect.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 83 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed May 15, 2013). 84 The principal health and safety legislation in the UK is the Health and Safety at Work etc. Act 1974. It requires 

employers to ensure that risks to employees and others are reduced “so far as is reasonably practicable,” or SFAIRP. 

Health and Safety at Work etc. Act, Part I, Section 2 (1) and (2) (1974). HSE has interpreted that SFAIRP duties 

call for the same set of tests to be applied as duties to reduce risks “as low as reasonably practicable,” or ALARP. 

According to HSE, “”the two terms mean essentially the same thing and at their core is the concept of ‘reasonably 

practicable’;...” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 85 According to HSE, the concept of “reasonably practicable” “involves weighing a risk against the trouble, time and 

money needed to control it. Thus, ALARP describes the level to which [they] expect to see workplace risks 

controlled.” This allows HSE to “set goals for duty-holders, rather than being prescriptive; HSE’s policy is that any 

proposed regulatory action should be based on what is reasonably practicable.” According to HSE, in most 

situations, deciding whether the risks are ALARP involves a “comparison between the control measures a dutyholder has in place or is proposing and the measures [they] would normally expect to see in such circumstances i.e. 

relevant good practice. ‘Good practice’ is defined as ‘those standards for controlling risk that HSE has judged and 

recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.’... Once what 

is good practice has been determined, much of the discussion with duty-holders about whether a risk is or will be 

ALARP is likely to be concerned with the relevance of the good practice, and how appropriately it has been (or will 

be) implemented.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013). 86COMAH Regulations, Schedule 4, Part 1 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm

(accessed May 7, 2013). 

87 HSE defines “good practice” as “those standards for controlling risk that HSE has judged and recognized as 

satisfying the law, when applied to a particular relevant case, in an appropriate manner.” HSE, “Assessing 

compliance with the law in individual cases and the use of good practice,” May 2003. Available at 

http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 88 COMAH Regulations, Schedule 4, Part 2 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm

(accessed May 7, 2013). 

89 Such as HSE’s “Guidance for the topic assessment of the major accident hazard aspects of safety cases,” 

published in April 2006, and HSE’s “Assessing compliance with the law in individual cases and the use of good 

practice,” May 2003, available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

25 

3.2.1.2 Offshore 

The international offshore energy sector experienced several catastrophic incidents in the 1980s, 

including the Alexander Kielland 90 incident in Norway in 1980 which resulted in 123 fatalities, and the 

Piper Alpha91 incident in the UK in 1988, which fatally injured 167 workers. These incidents initiated 

offshore regulatory changes focused on risk reduction and control that were modeled after the CIMAH 

regulations. 

Following the Piper Alpha incident, the UK Secretary of State for the Department of Energy ordered that 

a public inquiry be held to determine the circumstances surrounding the incident.92 The Secretary 

directed Lord Cullen, a Senator of the College of Justice in Scotland, to hold the inquiry and report to the 

Secretary “the circumstances of the accident and its cause together with any observations and 

recommendations which he thinks fit to make with a view to the preservation of life and the avoidance of 

similar accidents in the future.”93 

The result was The Public Inquiry into the Piper Alpha Disaster (“the Cullen Report”), an extensive 

report released in October 1990. The report called into question the adequacy of the detailed prescriptive 

regulatory regime that existed at the time of the incident94 for offshore oil and gas operations, and listed 

106 recommendations to revamp offshore safety regulation in the UK, 57 of which the HSE was 

responsible for overseeing.95

The Cullen Report found that the operating company (Occidental Petroleum, a US company), “did not 

possess any system which ensured that such remote, but potentially disastrous, events were subjected to 

systematic scrutiny...[and] there was for major projects no comprehensive system of safety assessment 

and management did not appear to appreciate fully the contribution which it could make.”96 The report 

noted that there was a need for a formal safety assessment (FSA), “an assessment essentially equivalent to 

the Safety Case,”97 which “involves the identification and assessment of hazards over the whole life cycle 

of a project...[because]...the combinations of potential hardware and human failures are so numerous that 

a major accident hardly ever repeats itself...[and] [a] strategy for risk management must [] address the 

entire spectrum of possibilities.”98 

 

90 The Alexander Kielland was a flotel for housing workers. A total of 212 people were on board when it capsized 

near the Edda platform in the Ekofisk area of the North Sea on March 27, 1980. As a result of this incident, 123 

individuals lost their lives and only 89 survived. 

91 On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the coast of 

Scotland in the North Sea. A series of explosions and fire killed 167 workers and almost completed destroyed the 

platform. This incident became the deadliest accident in the history of the offshore industry. 

92 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p iii. 

93 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p iv. 

94Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary 

of State for Energy by Command of her Majesty; November 1990; p 27. 

95 Oil &Gas UK. Piper Alpha: Lessons Learnt; 2008; p 2. 96 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p 275. 

97 Lord Cullen describes the Safety Case as “a means by which an operator demonstrates to itself the safety of its 

activities...[and] as the basis for the regulation of major hazard activities...” Ibid at 276-277. 

98 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

26 

In his analysis, Lord Cullen noted that the current offshore regulations were prescriptive in nature rather 

than goal-setting, and that this had the effect of hampering operators’ flexibility and stifling innovation.99 

He stated that “one of the reasons for adopting the goal-setting approach was to make regulations that 

were more flexible, so that changing technology could be accommodated without the need for new 

legislation.”100 Lord Cullen pointed to the CIMAH Regulations, discussed above, as a forward-looking 

regulatory model, which required onshore major hazard installation operators to “provide HSE with a 

written report on the safety of the installation...commonly called the Safety Case.”101 Lord Cullen noted 

that the safety case “is a means by which an operator demonstrates to itself the safety of its 

activities...[and] also serves as the basis for the regulation of major hazard activities.”102

Lord Cullen concluded that an FSA “is an essential element in a modern safety regime for major hazard 

installations...that this FSA should take the form of a Safety Case...[and that] [t]he regime should have 

as its central feature demonstration of safe operation by the operator.”103 He recommended that a safety 

case regulatory regime be implemented offshore for both fixed and mobile installations as it already was 

for onshore major hazard installations, that it be complemented by other regulations dealing with specific 

features, that the safety case contain goal-setting regulations, and that it be part of a continuing dialogue 

between the operator and the regulatory body.104

Lord Cullen recommended the implementation of safety regulations requiring the owner or operator of 

every fixed and mobile installation operating in UK waters to submit a safety case to HSE. In response, 

the UK established the Offshore Installations (Safety Case) Regulations in 1992.105 The primary goal of 

these Regulations was “to reduce the risks from major accident hazards to the health and safety of the 

workforce employed on offshore installations or in connected activities.”106

Oil & Gas UK, 107 the main UK offshore oil industry trade association whose members include the major 

oil companies that operate in the Gulf of Mexico (such Shell and Exxon), has expressed strong support for 

the safety case regime. In its response to the European Commission’s published draft legislative 

proposals to modify offshore safety case regulations, Oil & Gas UK noted that those proposals would 

undermine the “proactive, flexible and responsive approach to managing risks, borne out of the lessons 

learnt from Piper Alpha as well as the evolving nature of the offshore oil and gas business itself.”108 In 

the wake of the Macondo incident in the Gulf of Mexico, the UK government directed Professor Geoffrey 

 

99 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p 339. 

100 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p 364. 

101 Ibid at 276. 102 Ibid at 276 and 277. 103 Ibid at 282. 104 Ibid at 283 and 284. 105 The 1992 Regulations have since been replaced by the Offshore Installations (Safety Case) Regulations 2005, 

which were effective as of April 6, 2006. The objective of the revisions in 2005 was “to improve the effectiveness 

of the regulations whilst at the same time reducing the burden of three yearly resubmissions.” Oil & Gas UK. Piper 

Alpha: Lessons Learnt; 2008. 106 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 

5. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013). 107 See http://www.oilandgasuk.co.uk/aboutus/aboutus.cfm (accessed December 10, 2013). 108 Oil & Gas UK. European Commission Proposed Regulation on Offshore Safety and Related Issues: Oil & Gas 

UK Position Paper. November 2011; p 1. http://www.oilandgasuk.co.uk/ProposedEURegulation.cfm (accessed 

December 10, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

27 

Maitland of Imperial College London to lead an independent review of the offshore safety case regime in 

the UK.109 In the report stemming from the review, which highlighted strengths of the safety case regime 

as well as recommendations for improvement, Professor Maitland commended the UK’s “‘goal-setting’ 

safety regime and its ability to foster innovation and continuous improvement in process integrity...”110

and noted that the UK authorities, including the HSE, are held in high regard by both the UK operators 

and international observers.111 

3.2.2 Global Analysis of Safety Case Implementation 

3.2.2.1 Australia 

3.2.2.1.1 Offshore 

Following the Piper Alpha disaster in 1988, the then Australian Commonwealth Minister for Resources at 

the time, Senator Peter Cook, formed a Consultative Committee on Safety in the Offshore Petroleum 

Industry to advise him on safety issues surrounding offshore operations in Australia. In 1991, the 

Committee released its Report of the Consultative Committee on Safety in the Offshore Petroleum 

Industry.

112 In the report, the Committee examined the circumstances, causes, and recommendations 

described in both the Cullen Report and Esso Australia’s113 investigation report on a fire that occurred on 

the Tuna platform in April 1989 in Bass Strait that injured four individuals. The Committee noted that 

while there were many differences between the two incidents, they “both demonstrated the need for 

greater attention to the management of safety in a number of areas of offshore operations.”114 They 

pointed to the safety case as an important regulatory concept that should be applied to oil and gas 

operations in Australian waters, and concluded by recommending that the safety case concept described 

by Lord Cullen and carried out onshore by the Seveso Directive and CIMAH regulations be adopted for 

Australian offshore petroleum operations.115 It would “require the operator of a facility to formally 

document how safety is to be managed within the facility, [and] [] demonstrate that the major hazards of 

the installation have been identified and appropriate controls provided...”116 The Committee also 

recommended the implementation of both prescriptive and “objective” regulations.117 At that time, 

offshore petroleum safety was the joint responsibility of the Commonwealth and the States/Northern 

Territory. Following this inquiry, new Commonwealth regulations were created: for example, Schedule 

 

109 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. 

December 2011. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875-

offshore-oil-gas-uk-ind-rev.pdf (accessed December 10, 2013). 110 Ibid at 3. 111 Ibid at 3. 112 See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 113 Esso was an oil and gas company in Australia that was sold to Mobil Oil Corporation in 1990. It is now part of 

Exxon Mobil. See http://www.exxonmobil.com/Australia-English/PA/about_who_history_esso.aspx (accessed May 

8, 2013). 

114 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 2. See 

http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 115 Ibid at 25. 116 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 3. See 

http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013). 117 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

28 

8 on “Occupational Health and Safety” was added to the Petroleum Submerged Lands Act (PSLA) in 

1992 to require safety cases to be developed for all offshore petroleum facilities. 

The Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 set out the requirements 

for the contents of offshore safety cases. The operator of an offshore petroleum facility must submit a 

safety case for review and acceptance to the Australian National Offshore Petroleum Safety and 

Environmental Management Authority (NOPSEMA), the Australian Commonwealth Statutory Agency 

charged with regulating the health and safety, structural integrity, and environmental management of all 

offshore petroleum facilities in Australian Commonwealth waters, and in coastal waters where State 

powers have been reduced. NOPSEMA accepts a safety case “if it is satisfied that the arrangements set 

out in the document demonstrate that the risks will be reduced to...ALARP.”118 

3.2.2.1.2 Onshore 

In 1998, Esso Australia’s gas plant at Longford in Victoria suffered a major release and fire caused by 

cold temperature embrittlement due to a process upset and lack of engineering support for diagnosis, 

which resulted in two fatalities, eight additional injuries, and cut the State of Victoria’s gas supply for two 

weeks causing major industrial disruption and workforce stand downs. While the safety case at this time 

was required for offshore operations in Australia, onshore facilities like the Longford plant were subject 

only to prescriptive provisions contained within the Victoria Occupational Health and Safety Act 1985. 

In its report on the incident, the Royal Commission concluded that all major hazard facilities in Victoria 

should be required to develop and submit a safety case to the appropriate regulatory authority. In 1996, 

Australia’s National Occupational Health and Safety Commission119 (NOHSC) recommended the safety 

case be adopted for all major onshore hazard facilities in Australia, and in 2002 NOHSC established a 

National Standard for the Control of Major Hazard Facilities and a National Code of Practice for the 

Control of Major Hazard Facilities.120 The Standard states that operators of major hazard facilities “shall 

provide the relevant public authority with a safety report...” that, among other things, identifies the type, 

relative likelihood and consequences of major accidents that might occur, and provides details of the 

safety management system (SMS) for that facility.121 In addition, operators of major hazard facilities 

must identify all major hazards and the risks associated with those hazards, and minimize each risk “so far 

as practicable.”122

 

118 See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July 15, 2013). 

119 In 1985 The National Occupational Health and Safety Commission (NOHSC) was established as a tripartite body 

to develop, facilitate and implement a unified national approach to occupational health and safety in Australia. On 

January 1, 2006, NOHSC was replaced by the Australian Safety and Compensation Council (ASCC). On March 31, 

2009, the ASCC was abolished and replaced with Safe Work Australia. Safe Work Australia was established by the 

Safe Work Australia Act 2008 with the authority to help develop policy to improve worker health, safety, and 

compensation across Australia. It does not regulate work health and safety laws; rather it develops national policy. 

See http://www.safeworkaustralia.gov.au/sites/swa/about/pages/about (accessed May 8, 2013). 120 National standards are documents which prescribe preventative action to avert occupational deaths, injuries and 

diseases; national codes of practice are documents prepared for the purpose of advising employers and workers of 

acceptable ways of achieving national standards. National Standard for the Control of Major Hazard Facilities 

[NOHSC: 1014(2002)], p 2. 

http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/271/NationalStandard_ControlMajo

rHazardFacilities_NOHSC_1014-2002_PDF.pdf (accessed May 8, 2013). 121 Ibid at 13. 122 Ibid at 12. 
Chevron Richmond Refinery Regulatory Report May 2014

29 

According to the Australian Safety and Compensation Council’s 2004 Annual Situation Report for the 

National Standard for the Control of Major Hazard Facilities, all Australian jurisdictions were expected 

to have the standard in place before the end of 2005, roughly three years after its inception.123 

3.2.2.2 Norway 

Following the capsizing of the Alexander Kielland in 1980, Norway moved in a direction similar to the 

European Commission and developed performance-based regulations focused on major accident 

prevention. Although the country did not adopt the safety case regulatory regime per se, the current 

regulatory approach implements many similar elements. 

Currently in Norway, the Petroleum Safety Authority124 (PSA) regulates safety for activities at onshore 

and offshore major hazard facilities, and requires the responsible party125 to reduce risk “to the extent 

possible,” and “select technical, operational and organisational solutions that reduce the probability that 

harm, errors and hazard and accident situations occur.”126 This concept is akin to ALARP whereby 

companies choose the solutions and barriers that have the greatest risk-reducing effect, provided the costs 

are not significantly disproportionate to the risk reduction achieved.127 However, unlike the UK and 

Australia, PSA regulations do not require the submission of a safety case report by the operator of a 

facility, although facilities are still expected to develop them and make them available to the regulator 

upon request for auditing purposes. Rather, PSA “supervises” industry, as explained in the following: 

Supervision involves much more than audits offshore or on land. It 

embraces the total contact between the regulator and the regulated. It 

covers everything which gives the PSA the necessary basis to determine 

whether the companies are accepting their responsibility to operate 

acceptably in all phases. Supervisory activities include investigations, 

considering consent applications and meetings with the industry.128

As will be discussed below, because the safety case regulatory approach requires the regulator to conduct 

detailed assessments of safety case reports and auditing of facilities against the safety case, its 

implementation requires substantial funding to support and maintain a sufficient number of highly 

experienced and competent staff. 

 

123Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004; p1. 

http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationReport_2004.

pdf (accessed May 8, 2013). 124 The Petroleum Safety Authority (PSA) is “the regulatory authority for technical and operational safety and for 

the working environment.” PSA was created in 2004 as a result of a government decision to split the Norwegian 

Petroleum Directorate (NPD) into two parts. See http://www.ptil.no/main-page/category9.html (accessed May 8, 

2013). 

125 PSA defines a “responsible party” as “[t]he operator and others participating in activities covered by these 

regulations, without being a licensee or owner of an onshore facility.” Regulations Relating to Health, Safety and 

the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); 

Section 6(a). Definitions. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 126 PSA. Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain 

Onshore Facilities (The Framework Regulations); Section 11, Risk Reduction Principles. 

http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013). 127 Ibid. 128 http://www.ptil.no/supervision/what-is-supervision-article8519-88.html (accessed June 3, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

30 

3.2.2.3 The United States 

Despite the international shift to the safety case regime and even though major oil companies that operate 

both onshore and offshore in the US also operate globally under safety case regimes and have shown 

support for the safety case,129 the US has persisted in the use of a more activity-based regulatory scheme 

that does not contain a specific risk reduction target and that lacks the ability to adapt to advancing 

technology and recently developed industry standards. Due to the major potential hazards present in 

onshore and offshore oil and gas operations, these sectors should have in place adaptable safety regimes 

that adequately engage companies and their employees in continuous improvement and risk reduction. 

As the CSB has devoted extensive time and resources to studying and analyzing the regulation of offshore 

oil and gas facilities in the US as a result of its Macondo incident investigation, this report will focus on 

the regulation of onshore oil and gas operations in the US and California. 

On October 23, 1989, a massive explosion and fire occurred at the Phillips 66 Company’s Houston 

Chemical Complex in Pasadena, Texas, resulting in 23 fatalities and injuring more than 130. In response, 

the U.S. Department of Labor issued a report to the President and declared, among other things, that the 

U.S. Occupational Safety and Health Administration (OSHA) would “expedite completion of its 

rulemaking requiring employers to implement comprehensive chemical process safety management plans 

for hazardous chemical processes.”130 Sparked by a number of serious accidents, including the Phillips 66 

incident and the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, 

OSHA published in the Federal Register (55 FR 29150) on July 17, 1990, a proposed standard containing 

requirements for the management of hazards associated with processes using highly hazardous 

chemicals.131 Soon after, Congress adopted the Clean Air Act (CAA) Amendments (CAAA) of 1990, 

 

129A Shell Oil Company representative testified at the CSB December 2010 public meeting on the safety case that 

the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type 

of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers and 

controls. Shell Geelong Refinery Plant Manager Huck Poh has stated, “As a Major Hazard Facility, Shell Geelong 

Refinery and Lara Terminal is required to submit a Safety Case for assessment by Safe Work Victoria. This 

document is a summary of that Safety Case and explains the potential impact of the facility on our neighbours and 

the community. We take a systematic approach to managing safety and preventing incidents that place our people, 

our neighbours, the Geelong community, the environment and our facilities at risk. This is reflected in our Safety 

Management System and the approach that has been undertaken for the development and review of the Safety Case. 

Shell is committed to achieving continuous Health, Safety, Security and Environment (HSSE) performance 

improvement. There are ongoing review and revision activities to ensure our analyses remain relevant and reflect 

the current status of operations and our risk reduction measures are consistent with latest industry practice. This 

commitment to continuous improvement is reflected in the Shell HSSE Policy and supported by our HSSE results.” 

See http://s04.static-shell.com/content/dam/shell-new/local/country/aus/downloads/geelong/safety-casesummary.pdf p3. (accessed December 10, 2013). Esso Longford Plant Manager Monte Olson has stated that “[t]he 

Safety Case is a systematic and comprehensive review of our operations and processes which includes the 

identification of potential major incidents that could occur, assesses the risks associated with these major incidents 

and demonstrates the controls we have in place to manage these risks to as low as reasonably practicable.” See

http://www.exxonmobil.com/Australia-English/PA/Files/publication_Longford_Safety_Case_2013.pdf p5. 

(accessed December 10, 2013) 

130 Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety 

and Health in the Petrochemical Industry, A Report to the President; April 1990; p ix. 

http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013). 131 Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. 

Section 1 – I. Background (March 4, 1992). See 

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1039 (accessed May 10, 

2013). 
Chevron Richmond Refinery Regulatory Report May 2014

31 

which resulted in the creation of the CSB and authorized the first federal regulations specifically designed 

to prevent major chemical accidents that threaten workers, the public, and the environment: OSHA’s 

Process Safety Management (PSM) standard and the U.S. Environmental Protection Agency’s (EPA’s) 

Risk Management Program. 

3.2.2.3.1 OSHA PSM Standard 

Section 304 of the CAAA mandated that OSHA develop “a chemical process safety standard designed to 

protect employees from hazards associated with accidental release of highly hazardous chemicals in the 

workplace.”132 OSHA responded by adopting 29 CFR §1910.119 Process Safety Management of Highly 

Hazardous Chemicals (“the PSM standard”) in 1992. The PSM standard applies to a process133 involving 

a chemical at or above the listed threshold quantity (also known as a highly hazardous chemical), or 

flammables in a quantity of 10,000 pounds or more.134 It contains 14 elements with broad requirements to 

implement management systems, identify and control hazards, and prevent “catastrophic releases of 

highly hazardous chemicals.” While the PSM standard was intended to be performance-based and does 

contain some goal-setting elements, a majority of the standard is activity-based, and there is no general 

duty requirement under the PSM standard to reduce risks to a certain extent or prevent catastrophic 

accidents. As will be discussed at length in Section 4.3, the PSM standard has essentially remained 

stagnant since its inception in 1992. According to the Center for Chemical Process Safety (CCPS), the 

PSM standard has resulted “in a minimum cost, compliance-based approach to managing process safety... 

‘If [it] isn’t a regulatory requirement, I’m not going to do it!’”135

 A key provision of the PSM standard is the process hazard analysis (PHA) of covered processes. 136 

PHA requirements include a review of the process to identify, evaluate, and control the hazards, and an 

evaluation of the consequences of failure of those controls.137,138 The PHA required by the OSHA PSM 

standard is an example of a goal-setting requirement in that it allows for a variety of hazard analysis 

methodologies to be performed to satisfy the requirement. However, the element is activity-based in that 

completing a PHA for each covered process and updating it at least every five years is satisfactory. The 

regulator is not responsible for evaluating the effectiveness of controls or safeguards, and there is no 

requirement to reduce risks to a certain extent such as ALARP. Thus, the resulting PHA that meets the 

 

132 Clean Air Act Amendments of 1990. Section 304(a). November 5, 1990. See

http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 133 The PSM standard defines “process” as “any activity involving a highly hazardous chemical including any use, 

storage, manufacturing, handling, or the on-site movement of such chemicals, or combination of these activities.” 

29 CFR §1910.119(b) (1992). 

134 29 CFR §1910.119(a)(1) (1992). This standard also applies to the manufacture of explosives and pyrotechnics in 

any quantity [29 CFR §1910.109(k)(2) & (3)]. 

135 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 136 A Process hazard analysis is a thorough, orderly, systematic approach for identifying, evaluating, and controlling 

hazards of processes involving highly hazardous chemicals. The employer must perform an initial process hazard 

analysis on all processes covered by the PSM standard and all process hazard analyses must be updated and 

revalidated, based on their completion date, every five years. See

http://www.osha.gov/doc/outreachtraining/htmlfiles/psm.html (accessed May 10, 2013). 137 29 CFR §1910.119(e) (1992). 138 The other elements of the PSM standard are process safety information, operating procedures, employee 

participation, training, contractor safety, pre-startup safety review, mechanical integrity, hot work permits, 

management of change, incident investigation, emergency planning and response, and compliance audits. The 14th

“element” is mainly a requirement that maintaining trade secrecy not interfere with an employer’s compliance with 

the other 13 elements. 
Chevron Richmond Refinery Regulatory Report May 2014

32 

regulatory requirements of “controlling” hazards may actually inadequately identify or mitigate the 

hazards. In addition, there is no requirement for employers to submit their PHAs to the regulator for 

review. In most cases, this means the regulator will not review these PHAs until there is a significant 

process accident, a complaint, or a (rare) planned inspection. 

Another key element of the PSM standard, the Management of Change (MOC) provision, requires the 

development of written procedures “to manage changes to process chemicals, technology, equipment, and 

procedures...”139 The procedures must consider, among other things, the technical basis for a proposed 

change and its potential impact on safety and health.140 Historically, the MOC requirement has been 

treated and enforced as an activity-based requirement as well. For example, when the BP Texas City 

refinery explosion and fire occurred on March 23, 2005, all 15 fatalities and many of the 180 injuries 

occurred in or around nine contractor trailers that were sited near process areas and as close as 121 feet to 

the isomerization (ISOM) unit where the incident occurred. The refinery had been using trailers as 

temporary office spaces for several years. The refinery addressed facility siting for trailers during its 

2004 MOC for an upcoming 2005 turnaround. The MOC form indicated that a double-wide mobile office 

trailer would be temporarily sited in the open area between the ISOM and naphtha desulfurization units 

(NDU) for use during the upcoming turnaround, to be removed at the end of April 2005. However, the 

MOC did not analyze siting hazards; rather the MOC team attached a drawing showing the proposed 

interior configuration of the trailer and measured its location from the catalyst warehouse.141 In early 

2005, eight other trailers were sited between the ISOM and NDU without even conducting an MOC. The 

CSB pointed out in its Urgent Recommendations stemming from the Texas City incident that these 

trailers could have been easily relocated to less hazardous sites, and BP did so following the incident.142 

Despite this fact, BP’s siting policy considered that utilizing trailers in this way posed little or no danger 

to occupants, which conformed with the American Petroleum Institute’s (API) Recommended Practice 

(RP) 752, Management of Hazards Associated with Location of Process Plant Buildings. 

Although the MOC failed to identify or analyze hazards stemming from siting trailers so close to process 

areas, OSHA did not cite BP for conducting a poor MOC following the incident, as merely completing 

the MOC satisfied the requirements of the PSM standard. As it would have been very practical to move 

the trailers to a safer location, a regulator under the safety case regulatory regime would have the ability 

to require BP to do just that to reduce risks to ALARP. 

The OSHA PSM standard includes requirements for two of its 14 elements – mechanical integrity and 

process safety information (PSI) – to comply with recognized and generally accepted good engineering 

practices, or RAGAGEP.143 RAGAGEPs are technologically focused, with no emphasis on 

 

139 29 CFR §1910.119(l)(1) (1992). 140 Id at (l)(2)(i) and (ii) (1992). 141 To learn more about the PHA and MOC processes relating to the BP Texas City Refinery, see the CSB BP Texas 

City Final Investigation Report at http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 24. 

2013). 

142 See CSB Urgent Trailer Siting Recommendations at http://www.csb.gov/assets/1/19/BP_Recs_2.pdf (accessed 

October 24. 2013). 

143 RAGAGEPs “are engineering, operation, or maintenance activities based on established codes, standards, 

published technical reports or recommended practices (RP) or a similar document. RAGAGEPs detail generally 

approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating a 
Chevron Richmond Refinery Regulatory Report May 2014

33 

organizational, human factors, or culture-based measures. OSHA developed the mechanical integrity 

RAGAGEP requirement to “make sure that process equipment is inspected and tested properly, and that 

the inspections and tests are performed in accordance with appropriate codes and standards.”144 OSHA 

has recognized a number of practices, guidelines, and standards as RAGAGEPs, including the American 

Society of Civil Engineers, Design of Blast Resistant Buildings in Petrochemical Facilities, the 

Department of Defense, TMS-1300 Structures to Resist the Effects of Accidental Explosions, and the 

American Petroleum Institute (API) Recommended Practice (RP) 520: Sizing, Selection, and Installation 

of Pressure-Relieving Devices in Refineries.145 Unlike other regulators such as the HSE, OSHA has not 

compiled a comprehensive list of good practices, or RAGAGEPs, for companies to utilize during 

operations, and the CSB has only identified two OSHA Letters of Interpretation regarding 

implementation of RAGAGEP in PSM. According to CCPS, “[o]rganizations lack a thorough 

understanding of recognized and generally accepted good engineering practices and are inconsistent in 

interpreting and applying them.”146 In addition, key PSM elements such as PHA, incident investigation, 

and MOC do not reference RAGAGEP, and have not kept up to date with good practice guidelines, 

including CCPS’ Guidelines for Risk Based Process Safety, which addresses 20 PSM elements for 

process safety, including human factors, workforce involvement, and safety culture. 

Historically, OSHA has primarily enforced147 RAGAGEP reactively, and may cite companies for 

violations of RAGAGEPs following an incident. For example, following the BP Texas City Refinery 

incident, OSHA issued BP hundreds of citations, some of which covered BP’s willful violations of API 

520 and the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, both 

considered by OSHA to be RAGAGEPs. Following the Chevron incident, California’s Division of 

Occupational Safety and Health (Cal/OSHA) issued Chevron two willful citations for allegedly not 

complying with API RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil 

Refineries and Chevron’s own internal corrosion mitigation plan as RAGAGEPs (this will be discussed in 

greater detail in Section 5.1.2.2). 

3.2.2.3.2 U.S. Environmental Protection Agency Risk Management Program 

Section 301(r) of the CAAA called for EPA to develop regulations related to the prevention and detection 

of accidental releases for regulated substances, including requiring owners or operators of stationary 

sources that have regulated substances present to prepare and implement a “risk management plan to 

 

vessel, inspecting a storage tank, or servicing a relief valve.” OSHA Instruction CPL 03-00-004. June 7, 2007. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed August 

13, 2013). 

144 OSHA. Preamble to 29 CFR Part 1910, Process Safety Management of Highly Hazardous Chemicals, Section 3, 

Title III. Summary and Explanation of the Final Rule, 1992. Available at 

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed June 6, 

2013). 

145 All three are cited in OSHA Letter of Interpretation. Applicability of the PSM standard’s mechanical integrity 

requirements to refinery structures, February 1, 2010. 

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=27443 (accessed 

June 6, 2013). 

146 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2. 147 An exception to this would be OSHA’s NEP that was implemented from 2007 to 2011, where OSHA inspectors 

cited to RAGAGEP following NEP audits. 
Chevron Richmond Refinery Regulatory Report May 2014

34 

detect and prevent or minimize accidental releases of such substances from the stationary source....”148 

The risk management plan would require a “hazard assessment to assess the potential effects of an 

accidental release of any regulated substance.”149 In 1996, EPA promulgated the Risk Management 

Program regulations at 40 CFR Part 68, which went into effect in 1999. 

The EPA’s Risk Management Program requires facilities that contain more than the threshold quantity of 

any of the 77 listed toxic chemicals or 63 flammable substances150 to prepare and submit to the regulating 

agency emergency contact information, descriptions of processes and hazardous chemicals onsite, an 

accident history, and worst-case release scenarios.151 The regulation defines three different Program 

levels (Program 1, 2, or 3) based on a process unit’s potential for impact to the public and the 

requirements to prevent accidents.152 Program 3 processes are subject to additional, more stringent 

requirements to prevent accidents similar to those of the OSHA PSM standard. Program 3 facilities must 

implement elements of a prevention program, including: process safety information (PSI), PHA, standard 

operating procedures (SOPs), training, mechanical integrity, compliance audits, incident investigations, 

MOC, pre-startup reviews, employee participation, and hot work permits. These prevention program 

elements are based primarily on the OSHA PSM standard, and much of the language contained in each 

element is identical to the PSM standard. As such, the Risk Management Program regulations contain the 

same RAGAGEP requirements for mechanical integrity and PSI as the OSHA PSM standard for covered 

facilities. For example, 40 CFR §68.48 requires an owner or operator to “ensure that the process is 

designed in compliance with recognized and generally accepted good engineering practices 

[RAGAGEP].”153 Like OSHA, the EPA is able to cite facilities for failure to comply with RAGAGEP 

following an incident, but does not maintain a list of RAGAGEPs for reference. 

Finally, each covered facility must submit a risk management plan (RMP) to EPA for all covered 

processes154 and update and resubmit these plans at least once every five years, or whenever a major 

accident occurs or the emergency contact information changes. Completing and submitting the RMP 

satisfies the regulatory requirement; again, the effectiveness of the RMP in risk reduction is not assessed 

by the EPA, rendering this another activity-based requirement for a covered facility. There is no approval 

of the RMP by the EPA, and there is no additional duty on the facility to implement what it says it is 

doing in the RMP, unlike the safety case regulatory regime. 

Any facility with one or more covered processes must include in its RMP an executive summary; the 

registration for the facility; the certification statement; a worst-case scenario for each process involving 

flammables or toxics; the five-year accident history for each process; information concerning emergency 

 

148 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii). November 5, 1990. See

http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 

149 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii)(I). November 5, 1990. See

http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013). 150According to 40 CFR §68.10(a), “[a]n owner or operator of a stationary source that has more than a threshold 

quantity of a regulated substance in a process, as determined under §68.115, shall comply with the requirements of 

this part no later than the latest of the following dates...” 

151 See 40 CFR §68.12. General Requirements. 152 See 40 CFR §68.10. Applicability. 153 40 CFR §68.48(b) (1999). Additionally see 40 CFR §68.56 (d) which requires the owner or operator‘s inspection 

and testing procedures to “follow recognized and generally accepted good engineering practices.” 154 40 CFR §68.150 (1999). 
Chevron Richmond Refinery Regulatory Report May 2014

35 

response at the facility; at least one alternative release scenario analysis for each regulated toxic substance 

or flammable; a summary of the prevention program for each Program 2 process; and a summary of the 

prevention program for each Program 3 process.155 

The CSB found in its BP Texas City Investigation Report that as of March 2007, the RMP regulation had 

focused primarily on reviewing the submitted RMPs and required updates by covered facilities. The EPA 

Office of Inspector General (OIG) concluded in 2009 that over half of the RMP-covered facilities 

identified in the US as high-risk156 had never received an on-site inspection or audit, and over 65 percent 

of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP 

program in 1999.157 The EPA OIG also noted that of the 296 uninspected high-risk facilities regulated by 

the EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario.158 

3.2.2.3.3 Safety Case in the United States 

In contrast to its mainly activity-based regulation of hazardous 

chemicals, including oil and gas operations, the US has adopted a 

more goal-based regulatory approach for its nuclear and 

aeronautics and space science sectors. The U.S. Nuclear 

Regulatory Commission (NRC) was an early adopter of goal or 

performance-based regulation, which it defines as “[a] regulatory 

approach that focuses on desired, measureable outcomes, rather 

than prescriptive processes, techniques, or procedures...[and] leads 

to defined results without specific direction regarding how those 

results are to be obtained.”159 According to the NRC, 

performance-based regulations permit licensees to “have flexibility 

to determine how to meet the established performance criteria in ways that encourage and reward 

improved outcomes.”160 The NRC’s Reactor Oversight Process, the means by which it achieves its 

mission of public health and safety in commercial nuclear power plant operations, is its primary 

 

155 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for 

Chemical Accident Prevention (40 CFR Part 68); March 2009; pp 9-1 and 9-2. See

http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 156 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office 

of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 

people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have 

had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector 

General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” 

March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed 

June 11, 2013). 

157 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for 

Airborne Chemical Releases; February 10, 2009; p 15. 158 Ibid. 

159 See NRC Glossary, available at http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-basedregulation.html (accessed June 10, 2013). 160 US NRC NUREG/BR-0303. Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/readingrm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

36 

performance-based regulation.161 It uses seven “cornerstones,” such as mitigating systems and barrier 

integrity, to monitor three performance areas (reactor safety, radiation safety, and security safeguards).162 

Licensee performance data, inspection plans, quarterly assessments, and assessment and inspection 

responses are tied to each performance area and several cross-cutting objectives, such as worker 

involvement and human performance.163 Licensees are permitted to choose the precise methods they use 

to meet overarching performance goals, which are guided by their duty to reduce risks to as low as 

reasonably achievable, or ALARA.164,165 The NRC has stated that this flexibility is one of the main 

reasons that its regulatory philosophy encourages continuous improvement.166 

The National Aeronautics and Space Administration (NASA) has the goal of implementing a safety 

system that is “as safe as reasonably practicable,” or ASARP,167 which it considers to be closely related to 

ALARP. NASA relies on a risk-informed safety case, or RISC,168 to ensure that the system’s safety 

objectives, goals, and thresholds have been achieved, and that safety risk is as low as possible within 

reasonable impacts on cost, schedule, and performance.169

 

161 http://www.nrc.gov/about-nrc/regulatory/risk-informed/concept/performance.html#example (accessed June 13, 

2013). 

162 NRC Reactor Oversight Process publication (2006), available at 

http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 163 NRC Reactor Oversight Process publication (2006), available at 

http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013). 164 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/readingrm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013). 165 ALARA “means making every reasonable effort to maintain exposures to radiation as far below the dose limits 

in this part as is practical consistent with the purpose for which the licensed activity is undertaken, taking into 

account the state of technology, the economics of improvements in relation to state of technology, the economics of 

improvements in relation to benefits to the public health and safety, and other societal and socioeconomic 

considerations, and in relation to utilization of nuclear energy and licensed materials in the public interest.” 10 CFR 

§20.1003 (2007). 

166 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/readingrm/doc-collections/nuregs/brochures/br0303/br0303.pdf

167 NASA defines ASARP as “a fundamental principle of adequate safety. A determination that a system is ASARP 

entails weighing its safety performance against the sacrifice needed to further improve it. The system is ASARP if 

an incremental improvement in safety would require a disproportionate deterioration of system performance in other 

areas.” NASA/SP-2010-580, NASA System Safety Handbook, Volume 1, System Safety Framework and Concepts 

for Implementation; November 2011; p 5. 

http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20120003291_2012003429.pdf (accessed June 10, 2013). 168 NASA defines RISC as “a structured argument, supported by a body of evidence that provides a compelling, 

comprehensive and valid case that a system is or will be adequately safe for a given application in a given 

environment. This is accomplished by addressing each of the operational safety objectives that have been negotiated 

for the system, including articulation of a roadmap for the achievement of safety objectives that are applicable to 

later phases of the system life cycle. The term ‘risk-informed’ is used to emphasize that a determination of adequate 

safety is the result of a deliberative decision making process that necessarily entails an assessment of risks and tries 

to achieve a balance between the system’s safety performance and its performance in other areas.” Ibid at 13. 

169 Ibid at xiii. 
Chevron Richmond Refinery Regulatory Report May 2014

37 

4.0 Key Features of an Effective Safety Case Regulatory Regime 

Following the Macondo disaster, the National Commission on the Macondo Oil Spill and Offshore 

Drilling170 made a recommendation in its Report to the President171 for the US to “develop a proactive, 

risk-based performance approach specific to individual facilities, operations and environments, similar to 

the ‘safety case’ approach in North Sea.”172 Despite the major potential hazards that are present in both 

onshore and offshore oil and gas operations, the safety case regime has not been implemented in the US 

for either sector. The US has instead implemented for major hazards at onshore facilities a more activitybased approach, resulting in static regulations such as the PSM and RMP regulations that have not seen 

significant improvements173 since their inception, despite advances in technology and good industry 

practice. 

According to Dr. Hopkins and other renowned experts in the field, it is essential for an effective major 

accident prevention safety regime to take the form of a safety case, with adaptable goal-setting regulations 

that facilitate innovation and sustainability, and that drive industry to continuously improve and reduce 

risks to ALARP. To accomplish this, the regime must utilize sufficient numbers of highly competent 

personnel to effectively collect or promote industry use of process safety indicators174 and to provide 

knowledgeable oversight of industry operations. 

The CSB has determined that there are several key features of an effective major accident prevention 

regulatory approach such as the safety case regime: 

 Duty Holder Safety Responsibility, including a Written Case for Safety 

 Continuous Risk Reduction to ALARP 

 Adaptability and Continuous Improvement 

 Active Workforce Participation 

 Process Safety Indicators that Drive Performance 

 Regulatory Assessment, Verification, and Intervention; and an 

 Independent, Competent, Well-Funded Regulator 

As will be discussed in Section 5, California’s patchwork of regulations does not effectively implement 

these features, which are also illustrated in the figure below. Section 4 provides a detailed discussion of 

these features. 

 

170 President Barack Obama established the National Commission on the BP Macondo Oil Spill and Offshore 

Drilling through Executive Order 13543 on May 21, 2010, to examine the facts and circumstances concerning the 

root causes of the Macondo explosion and fire. For more information see 

http://www.oilspillcommission.gov/page/about-commission (accessed June 17, 2013). 171 Available at http://www.oilspillcommission.gov/final-report (accessed June 17, 2013). 172 National Commission on the BP Macondo Oil Spill and Offshore Drilling. Report to the President: Deep Water, 

The Gulf Oil Disaster and the Future of Offshore Drilling; January 2011; 252. 173 OSHA did implement changes to 29 CFR §1910.106, creating a new Hazard Communication Standard. 

However, no changes have been made that impact the management of process safety under PSM. See 

https://www.osha.gov/dsg/hazcom/ (accessed August 6, 2013). 174 Process safety indicators are also referred to as performance indicators, metrics, key process indicators (KPI), 

performance measures, indicators, etc. 
Chevron Richmond Refinery Regulatory Report May 2014

38 

Figure 1. Safety Case Attributes. 

4.1 Duty Holder Safety Responsibility, including a Written Case for 

Safety 

Under the safety case regulatory regime, each individual company is responsible for the safety of each 

hazardous facility. The onus is on the duty holder175 to prove to the regulator that the company’s 

processes, methodologies used to assess risks, and reasoning for choosing one control over another have 

substantially reduced risks to as low as reasonably practicable (ALARP), or equivalent. The duty holder 

 

175 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a 

particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. 

Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety;

October 2011; p 2. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013). These entities 

may include operators, contractors, and subcontractors. According to NOPSEMA, the idea is that those who create 

the risk must manage it. See http://www.nopsema.gov.au/safety/safety-case/what-is-a-safety-case/ (accessed July15, 

2013). 
Chevron Richmond Refinery Regulatory Report May 2014

39 

is required to prepare a written case for safety176 (“safety case report”) that identifies the hazards and risks 

and describes how they will be reduced to ALARP. The HSE has noted that the safety case report 

“demonstrates that the duty holder has arrangements in place which, if implemented, are capable of 

achieving compliance with legal objectives set out in other [] regulations...[and] provides a 

comprehensive core document that can be used as a check by both the duty holder and HSE that the 

accepted risk control measures and the health and safety management systems are in place and operate as 

they should.”177 The HSE has also stated: 

[t]he principal matters to be demonstrated in a safety case are that: a) the 

management system is adequate to ensure compliance with statutory 

health and safety requirements; and for management of arrangements 

with contractors and sub-contractors, b) that adequate arrangements have 

been made for audit and for audit reporting, [and] c) that all hazards with 

the potential to cause a major accident have been identified, their risks 

evaluated, and measures have been, or will be, taken to control those 

risks to ensure that the relevant statutory provisions will be complied 

with.178 

The safety case report must also demonstrate “how inherently 

safer design concepts have been applied in the design decisions 

taken.”179 This principle applies to all stages of the 

installation’s life cycle, and includes materials selection and 

managing corrosion in the design. 

It is also important to note that safety case reports are meant to 

be evergreen documents that reflect continuous improvement in 

risk reduction. For onshore operations in the UK, the duty 

holder is required to review the safety case report during the 

construction of a new facility, whenever new facts or technical 

knowledge about safety matters become known, or whenever 

the operator makes a change to the safety management system that could have significant impacts on the 

prevention of major accidents.180 The duty holder must revise the safety report to ensure that it “remains 

up to date and continues to provide an accurate representation of the major accident hazards...and the 

 

176 The HSE defines “safety case” as “a document that gives confidence to both the duty holder and HSE that the 

duty holder has the ability and means to control major accident risks effectively. It provides an extra level of 

regulatory control on top of regulations such as the Offshore Installations (Prevention of Fire and Explosion, and 

Emergency Response) Regulations 1995 (PFEER) and the Offshore Installations and Wells (Design and 

Construction, etc) Regulations 1996 (DCR), justified by the major accident potential of the offshore activities within 

scope.” HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 

2006; p 6. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed January 13, 2014). 177 Ibid at 6. 178 HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006; p 7. 

http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013). 

179 Ibid at 16. 180 COMAH Regulations, Part 3, Regulation 8 (1) (a)(b) and (c) (1999). 
Chevron Richmond Refinery Regulatory Report May 2014

40 

measures in place to control them.”181 According to HSE guidance on the offshore Safety Case 

Regulations, safety case reports are “intended to be living documents, kept up to date and revised as 

necessary during the operational life of the installation.”182 

In order for the facility to begin operation or remain in operation, the regulator must “accept” 183 the 

facility’s safety case report; however, the regulator’s acceptance of a safety case does not license the 

facility or installation as “fit,”184 nor does it shift the duty of risk control and reduction away from the 

facility owner or operator and onto the regulator; rather, the duty of major accident prevention and risk 

reduction to ALARP remains with the duty holder throughout the life of the facility. Following the 

regulator’s acceptance of the safety case report, the duty holder must ensure that the installation is 

operated in conformity with the management system and other provisions described in the safety case.185 

In the US, facilities commence operation before they are inspected or evaluated for complying with PSM 

or RMP regulations. In fact, the CSB has investigated incidents where the employer disputed that its 

process was covered by the PSM standard or RMP regulations. Regulators do not evaluate and approve 

PHAs or other hazard reviews and do not have the authority to license specific facilities for operation, 

based on the adequacy of their process safety programs. If an operating facility contains processes 

covered by the PSM standard, the facility must complete primarily activity-based regulatory requirements 

at least once every five years. The employer has no general duty to continually reduce risk. RMPcovered facilities must submit fairly high-level information exhibiting compliance with RMP 

requirements at least once every five years. While the regulator ensures the RMP has been filed and 

contains the required sections, there is no analysis of the effectiveness of controls identified in the RMP to 

mitigate hazards. 

4.2 Continuous Risk Reduction to ALARP 

As discussed above, a majority of the safety case regimes implemented globally impose a duty on owners 

or operators of covered facilities on and offshore to reduce risks to ALARP or equivalent. The Center for 

Chemical Process Safety (CCPS) defines ALARP as “a risk reduction goal, where risk reduction efforts 

are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the 

level of additional risk reduction.”186 This principle provides the regulator with the main foundation on 

 

181 The Competent Authority. Revised guidance for operators of top tier COMAH establishments. Review and 

revision of COMAH safety reports. December 2009; p 5. http://www.hse.gov.uk/comah/report-review.pdf

(accessed November 26, 2013). 

182 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 

7. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013). 183 “Acceptance requires satisfaction with the duty holder’s approach to identifying and meeting health and safety 

needs...HSE ‘accepts’ the validity of the described approach as being capable, if implemented as described, of 

achieving the necessary degree of risk control, but HSE does not confirm the outcomes of that approach.” 

Therefore, “HSE will accept a safety case or a revision...when duty holders demonstrate and describe specified 

matters to HSE’s satisfaction. Acceptance will be based on HSE’s judgment that the arrangements and measures 

described in the safety case taken as a whole are likely to achieve compliance if implemented as described. To give 

acceptance HSE does not need to be satisfied that compliance will be achieved....” Ibid at 6. 184 TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned 

Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996; p 8. 185 Ibid at 7. 186 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2nd

ed., 2009; p 46. 
Chevron Richmond Refinery Regulatory Report May 2014

41 

which to accept or reject a safety case report. In essence, the regulator ultimately determines whether 

ALARP has been achieved through the authority to accept or reject the safety case report. An advantage 

of ALARP as opposed to a prescriptive or activity-based approach is that ALARP results in the 

continuous reduction of risk to keep up-to-date with advancing technology and industry best practices.187 

Although two of the 14 PSM elements (PHA and mechanical integrity) contain performance-based or 

goal-setting requirements, 188 the PSM standard does not provide a specific risk reduction target such as 

ALARP. 

In reviewing the safety case report, the regulator may accept 

the application of relevant good practice as a sufficient 

demonstration of ALARP.189 As the HSE notes, “the 

measures in place to prevent or limit major accidents should 

be described in the safety report and be at least to ‘relevant 

good practice.’”190 According to Dr. Hopkins, the duty of 

ALARP “provides leverage for the regulator...[i]f an 

operator wishes to adopt a procedure or a standard that falls 

short of good or best practice, the regulator can reject it on 

the grounds that it does not reduce the risk as low as 

reasonably practicable.”191 As noted above, regulators such 

as HSE provide guidance on what is considered good 

practice, and publish documents containing good practice 

standards to assist operators with applying this concept. 

However, the duty holder must make the case for the standard or practice being utilized, and the regulator 

may determine that applying good practice alone is not sufficient to demonstrate that risks have been 

reduced to ALARP. In addition, if there is no directly applicable rule or standard, operators still have a 

duty to manage risk, and they therefore must maintain a reasonable level of risk awareness that goes 

beyond mere compliance.192 This raises a safety case regime above the compliance mentality of a more 

activity-based regime, such as PSM, and requires the duty-holder and the regulator to continuously ask 

whether there are other measures that would be effective in further reducing risks. 

The UK HSE provides ample guidance on determining what is considered to be ALARP, and many 

British courts have interpreted the concept as well. In the 1949 case Edwards v. National Coal Board,

decided by the Court of Appeal, Judge Asquith wrote: 

‘Reasonably practicable’ is a narrower term than ‘physically possible’ 

and seems to me to imply that a computation must be made by the 

 

187 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed December 9, 2013). 188 29 CFR §1910.119(e)(1) requires the employer to “identify, evaluate, and control the hazards involved in the 

process.” 29 CFR §1910.119(j)(5) states that “[t]he employer shall correct deficiencies in equipment that are 

outside acceptable limits (defined by the process safety information in paragraph (d) of this section) before further 

use or in a safe and timely manner when necessary means are taken to assure safe operation.” 

189 HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. 

http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013). 

190HSE. Guidance on ALARP Decisions in COMAH. 

http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed November 26, 2013). 

191 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 

192 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6. 
Chevron Richmond Refinery Regulatory Report May 2014

42 

owner, in which the quantum of risk is placed on one scale and the 

sacrifice involved in the measures necessary for averting the risk 

(whether in money, time or trouble) is placed in the other; and that if it 

be shown that there is a gross disproportion between them – the risk 

being insignificant in relation to the sacrifice – the defendants discharge 

the onus on them.193

While some critics in the US have argued that the determination of ALARP is strictly a quantitative risk 

assessment (QRA) calculation that is not sufficiently protective, the CSB has found that the HSE allows 

reliance upon qualitative assessments, QRA, and semi-quantitative risk assessments to determine 

ALARP.194 According to the HSE, essential considerations for determining whether a duty holder has 

reduced risks to ALARP include “the adoption of inherently safer designs...”195 and “[i]dentification of 

possible further measures that could be applied to lower the risk.”196 The HSE also notes that the 

guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to 

reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, 

control, mitigation).”197 In Norway, the PSA requires companies to “select technical, operational and 

organisational solutions that reduce the probability that harm, errors and hazard and accident situations 

occur.”198 PSA regulations require companies to choose the solutions that offer the best results, provided 

the costs are not significantly disproportionate to the risk reduction achieved.199 In Australia, the 

NOPSEMA enforces the Offshore Petroleum and Greenhouse Gas Storage Act 2006 and its regulations, 

which imposes a duty of care on the operator of a facility to “take all reasonably practicable steps” to 

ensure the facility is safe and all work and other activities are “carried out in a manner that is safe and 

 

193 Edwards, [1949] 1 K.B. at 704. 

194 Center for Chemical Process Safety (CCPS) guidance on risk assessment implies that as the predicted 

consequence of potential hazard scenarios increases, the level of analytical detail should also increase. Risk 

assessment approaches range in order of increasing analytical detail from qualitative, to semi-quantitative, to 

quantitative. Qualitative risk assessment is the simplest approach where judgments about consequence, likelihood, 

and the tolerability of risk are made on a subjective basis using the knowledge and experience of team members and 

may not be consistently applied within an organization. Semi-quantitative risk assessment is the second level of 

analytical detail, where organizations develop and provide to team members predetermined risk matrices and 

guidance for establishing numerical consequence and frequency levels. This approach is of greater value to team 

members as based upon their collective experience; the team typically has a sense of how frequently an event might 

occur and how great the potential consequence may be within the predetermined ranges. Layer of protection 

analysis (LOPA) is a semi-quantitative form of risk assessment, using order of magnitude categories for evaluating 

frequency, consequence, and adequacy of safeguards. Quantitative risk assessment involves the highest level of 

analytical detail and typically involves specialized expertise to perform. Complex models are commonly developed 

to evaluate frequency, consequence, and the effectiveness of safeguards in a quantitative risk assessment. Such 

approaches are typically standardized to minimize result variability within an organization and even between 

organizations in countries where a quantitative risk assessment is mandated by regulatory authorities. Center for 

Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009. 

195 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-

15.pdf (accessed October 30, 2013). 

196 Ibid at 8. 

197 Ibid at 8. 

198 Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore 

Facilities (The Framework Regulations). Section 11, Risk Reduction Principles. http://www.ptil.no/frameworkhse/category403.html (accessed November 26, 2013). 

199 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

43 

without risk to the health of any person at or near the facility.”200 NOPSEMA explains that to achieve 

ALARP, the company “has to show, through reasoned and supported arguments, that there are no other 

practical measures that could reasonably be taken to reduce risks further.”201 

In the US, the NRC has “gradually revised its original scheme, giving an increasing importance to the 

‘economic and social factors’, in particular the involvement of all ‘stakeholders’ (authorities, 

management, staff, public) in the ALARA process.”202 For the regulator, the focus for whether ALARA 

has been achieved is on “processes, procedures, and judgments.”203 The duty holder must ensure that 

choices made to achieve ALARA are “fully documented together with the criteria which have brought to 

those choices. When the criteria are qualitative, it is more likely that subjective judgments play a large 

role, but those judgments must be equally recorded.”204

There is no corresponding duty to reduce risks to ALARP in the PSM standard or RMP program. Rather, 

these regulations require that facilities “control” identified hazards, with no further dialogue on how far 

the operator must go to control those hazards. Neither the facility nor the regulator is required to 

determine whether more could be done to control hazards or reduce risks to comply with these 

regulations, and this may result in the implementation of insufficient controls relating to a hazard. 

While OSHA and the EPA do rely on general duty standards when implementing the PSM standard and 

the RMP program, these duties do not drive onshore companies toward reducing the risks of their 

activities to ALARP, and instead are utilized as enforcement tools typically after an incident has occurred, 

meant to cover those activities not specifically regulated. These standards may also be used by OSHA or 

EPA to cite a company for not following a specific RAGAGEP for 2 of the 14 process safety elements - 

mechanical integrity and PSI. 

OSHA enforces section 5(a) of the Occupational Safety and Health Act (OSHAct), which states the 

following: 

 (a) Each employer – 

(1) shall furnish to each of his employees employment and a place of 

employment which are free from recognized hazards that are causing or 

are likely to cause death or serious physical harm to his employees; 

(2) shall comply with occupational safety and health standards 

promulgated under this act...205

Section 5(a)(1), also known as OSHA’s General Duty Clause, has been described as a “catch-all” 

provision meant to fill gaps in OSHA law for recognized unregulated hazards.206,207 In order for OSHA to 

 

200 Offshore Petroleum and Greenhouse Storage Act 2006, Volume 3, Schedule 3, Clause 9. 

http://www.comlaw.gov.au/Details/C2012C00148/Html/Volume_3#_Toc315688204 (accessed October 30, 2013). 201 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at 

http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013). 202 Fasso, Alberto, and Rokni, S. Operational Radiation Protection in High Energy Physics Accelerators. 

Implementation of ALARA in Design and Operation of Accelerators. May 2009; p 6. 203 Ibid at 6. 204 Ibid at 6 and 7. 205 29 U.S.C. §654(a)(1) and (2) (2004). 206 Morrison, Kyle W. The General Duty Clause: What is it, how does OSHA use it and what should employers 

know? Safety + Health [Online]; May 1, 2011. 
Chevron Richmond Refinery Regulatory Report May 2014

44 

issue a General Duty Clause violation, the hazard must be recognized, the employer must have failed to 

keep the workplace free of the hazard to which his or her employees were exposed, a practical method 

must be available to correct the hazard, and the hazard must be causing or likely to cause death or serious 

injury.208 This duty would thus only apply if the absence or failure of one control in a series of controls 

makes an accident likely to occur (emphasis added). 

On the other hand, in a safety case regulatory regime, the regulator proactively reviews identified hazards 

and risk reduction strategies proposed by the operator to ensure that risks are being reduced to ALARP. 

The regulator may require the installation of an absent control if such a control is considered good 

industry practice, or if it goes further in reducing risks to ALARP. This is a key feature of the safety case 

approach in preventing major accidents. 

Under the CAA, the General Duty Clause requires owners and operators “to identify hazards which may 

result from such releases using appropriate hazard assessment techniques, to design and maintain a safe 

facility taking such steps as are necessary to prevent releases, and to minimize the consequences of 

accidental releases which do occur.”209 Similar to OSHA, the EPA can use its General Duty Clause 

enforcement authority to create legally binding requirements or enforce actions for hazards that have not 

been specifically regulated. The EPA can use this authority proactively (before an incident) or reactively 

(following an incident), and can enforce the clause where it finds the possibility of imminent and 

substantial endangerment.210 

According to EPA guidance on the RMP program, because it is the owner or operator’s duty to “prevent 

accidents and ensure safety at [their] source...” this may require steps to be taken “beyond those specified 

in the risk management program rule.”211 While this principle appears to be similar to ALARP 

requirements of the safety case, in practice whether this is done is not subject to regulation or review. In 

addition, it is permissive in that it uses the word “may.” Nothing additional, such as ALARP, is required. 

This will be addressed below in more detail in the discussion of implementation of the EPA RMP 

program in California. 

4.3 Adaptability and Continuous Improvement 

A key strength of the safety case regulatory regime is that it provides the regulator with the tools to drive 

continuous improvement among facilities and ensure risks have been reduced to ALARP or equivalent, 

rather than focusing on compliance with activity-based regulatory requirements. Although complying 

with good practice may achieve ALARP, the regulator also has the ability under this regime to require 

facilities to go above and beyond good practices and standards to achieve ALARP without requiring 

 

http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 

2013). 

207 According to the National Safety Council, General Duty Clause violations make up only about 1.5 percent of 

total violations issued annually by OSHA. Available at 

http://www.nsc.org/safetyhealth/Pages/5%2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 

2013). 

208 Ibid. 

209 42 U.S.C. §7412(r)(1) (1990). 210 42 U.S.C. §7412(r)(9) (1990). 211 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for 

Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. 

http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

45 

rulemaking. The Baker Panel212 noted in its 2007 report (“the Baker Report”) on BP and its process 

safety performance following the 2005 BP Texas City disaster that an effective process safety 

management system builds upon an “improvement cycle” that “should include, in practice, continuous 

reduction of process risk and improvements in safety performance according to some measurable 

criteria.”213 

The Baker Panel defined “continuous improvement” as 

 improving controls for process hazards, including process safety knowledge 

and competence of workers;

 improving process safety leadership of supervisors;

 improving process engineering to identify and then design to remove or 

mitigate the effects of process hazards;

 going beyond legal compliance to best practices to reduce risks;

 going beyond mere compliance with internal standards, but learning from 

operating experiences, incident and near miss investigations, hazard studies, 

audits, and other assessments to improve those internal standards; and

 identifying and implementing not only those external standards that must be 

observed, but also those that represent best practices that can lead to process 

safety excellence.214

An independent review conducted of the Australian offshore safety case regime in 2000 echoes the 

importance of continuous improvement in process safety management, stating that “critical to the 

successful implementation of a safety case regime is the achievement of a qualitative shift in industry and 

regulatory safety cultures from the minimalist compliance of the prescriptive regime to the philosophy of 

best practice and continuous improvement.”215 Recently, Lord Cullen addressed the importance of 

adaptability as well, when he spoke at the 2013 Oil & Gas UK Piper 25 offshore safety conference in 

Aberdeen, Scotland.216 In his keynote speech, Lord Cullen quoted the Maitland panel, which examined 

the UK offshore safety regime after the Macondo incident, noting that “safety cases should be living 

documents [emphasis added] central to the way facilities are operated, with contents widely 

understood.”217 

 

212 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an 

independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety 

culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings 

and recommendations see 

http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak

er_panel_report.pdf (accessed August 13, 2013). 213 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 214 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166. 215 Department of Industry, Science and Resources; Offshore Safety and Security, Petroleum and Electricity 

Division. Australian Offshore Petroleum Safety Case Review: Report of the Independent Review Team. 2000; p 33. 216 In June 2013, Oil & Gas UK held a large offshore safety conference in Aberdeen, which marked the 25th

anniversary of the Piper Alpha disaster. For more information see 

http://www.oilandgasuk.co.uk/events/Piper25.cfm?frmAlias=/Piper25/ (accessed September 16, 2013). 217 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. 

http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as

px (accessed September 16, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

46 

As changes to regulatory requirements necessitate an extensive, lengthy rulemaking process in the US,218

process safety-related regulations can remain static for decades, while industry standards (many of which 

are voluntary under the current US system), technologies, and improved procedures and practices 

continue to change and advance, and new chemicals come into production. In light of major accidents 

that have occurred, such as the BP Texas City explosion and fire which resulted in 15 fatalities, and the 

Motiva Enterprises sulfuric acid tank explosion, which fatally injured one worker and injured eight others, 

the CSB has made a number of key recommendations to OSHA and the EPA to revise the PSM and RMP 

regulations, respectively. However, agencies have failed to implement these recommendations and these 

regulations have remained static despite the important lessons learned from these incidents. In addition, 

the OSHA PSM standard’s Appendix A, which contains a list of toxic and reactive highly hazardous 

chemicals and the threshold quantity for each, was originally created using a number of older sources, 

including the EPA’s “Extremely Hazardous Substance List,” the 1982 Seveso Directive, the 1984 

CIMAH regulations, and others. A number of these sources have been revised, updated, and amended 

throughout the years, while Appendix A has not. In fact, no chemicals have been added to either the PSM 

or the RMP programs since the rules were initially adopted in the 1990s, even as numerous serious 

process incidents have occurred involving chemicals that were not listed. 

The U.S. Government Accountability Office (GAO) published a 2012 report on OSHA’s standard setting 

abilities, and noted that between 1981 and 2010, OSHA took anywhere from 15 months to 19 years to 

develop and issue 58 significant safety and health standards (averaging seven years).219 According to the 

report, OSHA reasoned that it must evaluate technological and economic feasibility of a potential 

standard using data gathered by visiting worksites in industries that will be affected, on an industry-byindustry basis.220 This was described as “an enormous undertaking because, for example, it requires visits 

to multiple worksites.”221 In addition, Executive Order 12866222 requires that federal agencies, including 

OSHA, provide an assessment of the potential overall costs and benefits for significant rules to the Office 

of Management and Budget (OMB). OSHA will typically be required under the Small Business 

Regulatory Enforcement Fairness Act of 1996223 to initiate a panel process to receive and consider input 

 

218 5 U.S.C. Chapter 5, sections 511-599, also known as the Administrative Procedure Act, or APA, requires that 

federal agencies seeking to promulgate a rule or regulation submit to a lengthy notice and comment rulemaking 

process that includes publishing the proposed rule making in the Federal Register; providing the public with at least 

30 days to participate in the rulemaking process by submitting written comments or data, and then discussing the 

public comments and providing a rationale for accepting or rejecting them. The OSHAct Section 6(b) specifies the 

procedures OSHA must use to promulgate, modify, or revoke its standards (29 U.S.C. §655(b)). These procedures 

include publishing the proposed rule in the Federal Register, providing interested persons an opportunity comment, 

and holding a public hearing upon request. 

219 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 

5. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013). 220 Ibid at 6. The Supreme Court has held that the OSHAct requires that standards be both technologically and 

economically feasible. Am. Textile Mfrs. Inst. V. Donovan, 452 U.S. 490, 513 n. 31 (1981). Also see United 

Steelworkers v. Marshall, 647 F. 2d 1189, 1301 (D.C. Cir. 1980), quoted in AFL-CIO v. OSHA, 955 F. 2d 962, 980 

(11th Cir. 1992). Assessing feasibility on an industry-by-industry basis requires that the agency research all 

applications of the hazard being regulated, as well as the expected cost for mitigating exposure to that hazard, in 

every industry. 

221 Ibid at 6. 222 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). 

http://www.whitehouse.gov/sites/default/files/omb/inforeg/eo12866/eo12866_10041993.pdf (accessed June 12, 

2013). 

223 5 U.S.C. §609(b), (d) (1996). 
Chevron Richmond Refinery Regulatory Report May 2014

47 

from representatives of affected small businesses, which could take eight months or more.224 Only 

OSHA, the EPA, and the Consumer Financial Protection Bureau are subject to this requirement.225 

Finally, the OSHAct directs courts to review OSHA’s standards using a more stringent legal standard 

than the Administrative Procedure Act’s (APA’s) “arbitrary and capricious” test226 when reviewing 

OSHA’s standards;227 an OSHA standard may only be upheld if it is supported by “substantial evidence in 

the record considered as a whole.”228 According to the GAO report, OSHA officials claim this more 

stringent standard (known as the “substantial evidence” standard) requires a higher level of scrutiny by 

the courts and as a result, OSHA staff must conduct a large volume of detailed research in order to 

understand all industrial processes involved in the hazard being regulated, and to ensure that a given 

hazard control would be feasible for each process.229 The GAO also found that although OSHA has the 

ability to address urgent hazards by issuing emergency temporary standards, the agency has not used this 

authority since 1983 because of the difficult hurdles the agency faces in presenting the evidence necessary 

to meet the statutory requirements.230 In summary, all of these extensive rulemaking constraints have 

resulted in OSHA’s inability to undertake many standard revisions or improvements. 

In Spring 2013, OSHA announced its new regulatory agenda, which stated that one of the things OSHA 

plans to consider is revising the PSM standard to “address gaps in safety coverage.”231 Potential revisions 

include “expanding coverage and requirements for reactivity hazards,” which the CSB addressed in its 

2002 report entitled “Improving Reactive Hazard Management,”232 and “expanding the scope of 

 

224 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 

6. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013). 225 5 U.S.C. §609(d) (1996). 226 Pursuant to the APA, agency decisions may be set aside only if “arbitrary, capricious, an abuse of discretion, or 

otherwise not in accordance with law.” 5 U.S.C. §706(2)(A). There is abundant case law that discusses this 

standard. Courts have held that a court “may reverse under the arbitrary and capricious standard only if the agency 

has relied on factors that Congress has not intended it to consider, entirely failed to consider an important aspect of 

the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so 

implausible that it could not be ascribed to a difference in view or the product of agency expertise. See Greater 

Yellowstone Coalition v. Lewis, 638 F. 3d 1143, 1148 (9th Cir. 2010) (as amended) (relaying on The Lands Council 

v. McNair, 537 F.3d 981, 987 (9th Cir. 2008) (en banc), overruled on other grounds by Winter v. Natural Res. Def. 

Council, 555 U.S. 7 (2008)). 227 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 

9. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013). 228 29 U.S.C. §655(f). 

229 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 

9. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013). 230 OSHA must demonstrate that workers are exposed to grave danger and establish that an emergency temporary 

standard is necessary to protect workers from that grave danger. OSHA is also required to replace an emergency 

temporary standard with a permanent standard within six months using the requirements laid out in OSHAct 6(b). 

Ibid at 11. 231 See OSHA’s rulemaking abstract at 

http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 

2013). 

232 In this report, the CSB recommended to OSHA that it amend the PSM standard “to achieve more comprehensive 

control of reactive hazards that could have catastrophic consequences.” The report is available at 

http://www.csb.gov/assets/1/19/ReactiveHazardInvestigationReport.pdf (accessed September 17, 2013). The 

recommendations start on page 89 of the report. 
Chevron Richmond Refinery Regulatory Report May 2014

48 

paragraph (j) to cover the mechanical integrity of any safety-critical equipment....”233 However, OSHA 

has proposed changes to the PSM standard before, with no action ultimately being taken. On April 27, 

1998, OSHA announced that it was considering issuing an Advance Notice of Proposed Rulemaking234

(ANPRM) “to address issues related to reactive chemicals raised by the explosion of a chemical plant in 

Lodi, New Jersey in 1995.”235,236 On May 14, 2001, OSHA clarified its intent to publish an ANPRM “to 

address the need to add reactive chemicals that are not currently covered by PSM...”237 On December 3, 

2001, however, the entry on reactives was withdrawn from the rulemaking agenda.238 Following the 

devastating ammonium nitrate explosion on April 17, 2013, in West, Texas, which resulted in at least 14 

fatalities and mass destruction in the town of West, CSB Chairperson Moure-Eraso urged both OSHA and 

the EPA to expand their standards to include reactive chemicals and hazards such as ammonium nitrate.239 

On July 25, 2013, the CSB held a public meeting in Washington, DC to discuss the status of key open 

recommendations the CSB has made to OSHA over the last decade to revise its PSM standard and create 

a new combustible dust standard. These recommendations, which include revising the PSM standard to 

require MOC reviews for organizational changes such as mergers and acquisitions that may impact 

process safety, and ensuring PSM coverage for atmospheric storage tanks that could be involved in a 

potential catastrophic release, have stemmed from major CSB investigations including its BP Texas City, 

Motiva, ConAgra, Kleen, Imperial Sugar, and Hoeganaes investigations, as well as its Combustible Dust 

Study.240 OSHA’s failure to implement these recommendations, which can be attributed to its lack of 

rulemaking activities over the last decade, led the CSB to reclassify seven key open recommendations as 

“Open-Unacceptable.” The CSB also adopted the OSHA Combustible Dust Standard recommendation as 

a CSB “Most Wanted Chemical Safety Improvement.” OSHA formally responded and cited to the GAO 

report discussed above, noting that on average, it takes OSHA seven years to issue a standard, a process 

 

233 See OSHA’s rulemaking abstract at 

http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 

2013). 

234 Most federal agencies develop rules through “informal rulemaking.” Under the Administrative Procedure Act, or 

APA, informal rulemaking requires a publication of a “Notice of Proposed Rulemaking” (NPRM) in the Federal 

Register; opportunity for public participation by submission of written comments; consideration by the agency of the 

public comments and other relevant material; and publication of a final rule not less than 30 days before its effective 

date, with a statement explaining the purpose of the rule. Under the APA, an agency may publish an Advance 

Notice of Proposed Rulemaking (ANPRM) when the agency wants to test out a proposal or solicit ideas before it 

drafts its NPRM. For more information see http://www.foreffectivegov.org/node/226 (accessed September 17, 

2013). 

235 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13792

(accessed September 17, 2013). 

236 This incident took place on Friday, April 21, 1995, at a chemical facility occupied by Napp Technologies. The 

explosion and fire resulted in five fatalities. 

237 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16776

(accessed September 17, 2013). 

238 See https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946

(accessed September 17, 2013). 

239 In a 2002 study entitled Improving Reactive Hazard Management, the CSB made recommendations to OSHA 

and the EPA to expand their regulations to include reactive chemicals and hazards. To date, neither agency has 

acted on the recommendations. See http://www.csb.gov/in-safety-message-csb-chairperson-rafael-moure-erasocalls-for-regulatory-coverage-of-reactive-chemicals-following-the-west-fertilizer-explosion-and-fire-/ (accessed 

September 23, 2013). 

240 For more information on this meeting, see http://www.csb.gov/events/csb-public-meeting-to-vote-on-key-safetyrecommendations-and-initiate-most-wanted-program/ (accessed July 29, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

49 

that is only getting longer. Hence, OSHA reserves rulemaking for “widespread and serious hazards.” 

Needed petroleum refinery and chemical process safety improvements may never fall under this category. 

OSHA noted at the meeting that it would be utilizing a Request for Information241 (RFI) to aid in the 

revision of its PSM standard, aimed at addressing a number of issues that have developed in the 21 years 

since the PSM standard was promulgated in 1992. On December 9, 2013, OSHA published its RFI in the 

Federal Register.242 The RFI requests comment on potential revisions to OSHA’s PSM standard, among 

other regulations. The RFI identifies seventeen topics for potential rulemaking and enforcement changes, 

including clarifying the PSM exemption for atmospheric storage tanks and expanding PSM coverage and 

requirements for reactive hazards. The RFI also cites a number of CSB investigation reports and 

recommendations, including the CSB Reactive Hazard Study entitled Improving Reactive Hazard 

Management, the BP Texas City Investigation Report, and the Donaldson Enterprises, Inc., Investigation 

Report.243 Although the RFI is an important opportunity to enhance the dialogue on implementation of 

the safety case regulatory approach to enhance process safety management and risk reduction in the US, it 

does not specifically mention the safety case approach.244 

On January 3, 2014, OSHA released a response to Section 6(a) of Executive Order 13650,245 which tasked 

the Chemical Facility Safety and Security Working Group, created by the Order and consisting of federal 

agencies such as OSHA, the EPA, and PHMSA,246 with considering options to improve chemical safety 

regulation. The document provides separate responses from each member agency of the group, and notes 

that the group is seeking public input on potential areas where standards could be improved. According 

to the document, three agencies – OSHA, the EPA, and PHMSA – have all included “[e]valuating the 

implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to reduce 

 

241 An RFI is a tool used by a federal agency to help develop a proposed rule. Federal agencies generally use RFIs 

when they want public input on whether a new rule or changes to an existing rule are needed, and comments on 

what course the agency should take should it decide to move forward. More information available at 

http://www.dol.gov/regulations/participate.htm (accessed July 29, 2013). 242 78 Fed. Reg. 73756 (2013). 243 A full copy of the OSHA RFI is available at https://www.federalregister.gov/articles/2013/12/09/2013-

29197/process-safety-management-and-prevention-of-major-chemical-accidents (accessed January 7, 2014). 244 OSHA has released on its website a separate document responding to Executive Order 13650, Section 6(a) – 

Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. OSHA states in this 

document that it is seeking public input on potential areas where it could improve its standards, and includes 

“[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to 

reduce risk in complex industrial processes” as an area to consider. 

https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014). 

However, the safety case regulatory model is not mentioned in the RFI that was released for public comment. 

245 This document is available at https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html

(accessed January 7, 2014). 

246 The Chemical Facility Safety and Security Working Group is co-chaired by the Secretary of Homeland Security, 

the Administrator of the EPA, and the Secretary of Labor. The Working Group must consist of the head or a 

designated representative of the Department of Justice, Department of Agriculture, and the Department of 

Transportation. The Working Group must also consult with representatives from the Council on Environmental 

Quality; the National Security Staff; the Domestic Policy Council; the Office of Science and Technology Policy; the 

Office of Management and Budget; the White House Office of Cabinet Affairs; and other agencies designated by the 

President. http://www.whitehouse.gov/the-press-office/2013/08/01/executive-order-improving-chemical-facilitysafety-and-security (accessed January 13, 2014). 
Chevron Richmond Refinery Regulatory Report May 2014

50 

risk in complex industrial processes” in a preliminary list of options to consider for improving chemical 

facility and safety.247 

OSHA’s ability to adapt to process safety-related new or revised codes, standards, technology, and 

lessons learned is mainly limited to RAGAGEP requirements, which OSHA included in the mechanical 

integrity and PSI elements of its PSM standard in part to “provide flexibility for the employer to choose 

the frequency which would provide the best assurance of equipment integrity.”248 OSHA meant for 

RAGAGEP to include “both appropriate internal standards and applicable codes and standards....”249 

However, the concept of RAGAGEP only applies to 2 of the 14 PSM standard elements (mechanical 

integrity and PSI),250 only addresses equipment and mechanical integrity, and is usually utilized by OSHA 

as a mechanism to issue citations to companies post-incident. 

In addition, OSHA has had difficulty enforcing RAGAGEP citations. In a recent OSHA Review 

Commission proceeding, Secretary of Labor v BP Products North America, Inc., & BP-Husky Refining, 

LLC,251 and United Steelworkers Local 1-346, the Administrative Law Judge (ALJ) vacated OSHA 

RAGAGEP citations issued to BP for violations of 29 CFR §1910.119(d)(3)(ii)252 for failure to comply 

with a specific RAGAGEP, holding that OSHA impermissibly adopted a specific RAGAGEP, thereby 

diminishing the performance aspect of the RAGAGEP requirements contained within the OSHA PSM 

standard. The ALJ concluded that by citing to only one specific RAGAGEP, OSHA impermissibly 

adopted a prescriptive standard; in the ALJ’s view, OSHA should have acknowledged other possible 

RAGAGEPs for BP to comply with, including BP’s own internal standards. If upheld, this ruling may 

limit OSHA’s ability to utilize RAGAGEP as a means of requiring companies to implement industry 

good practices in the future.253

The cumbersome rulemaking process and lack of flexibility that has resulted in stagnant and static OSHA 

standards can be contrasted with the structure of the safety case regulatory regime, which facilitates 

adaptability and enables the regulator to improve industry safety performance and practices without 

requiring a major rule change. The safety case essentially provides the regulator with the tools to 

recognize more rigorous standards and practices that exist and drive a company to implement those 

practices to further reduce risks, as well as work with industry to improve existing standards and practices 

if necessary. It also enables companies to implement new, more efficient or safer technologies that do not 

necessarily meet strict prescriptive regulations, but that drive risk reduction. 

This adaptability is illustrated by the HSE’s recommendations following the 2004 Buncefield incident. 

On December 11, 2005, a number of explosions occurred at Buncefield Oil Storage Depot in Hemel 

Hemptstead, Hertfordshire, England following the overfilling of a gasoline tank. Over 40 people were 

injured and there was significant offsite damage to homes and businesses. An independently chaired 

Major Incident Investigation Board led by Lord Newton of Braintree was set up to investigate the 

incident. Between 2006 and 2008 the Board issued a number of reports and recommendations. In the 

 

247 Ibid. 248 57 Fed. Reg. 6390-6391 (1992). 

249 Ibid at 6390-6391. 250 29 CFR §§1910.119(d)(3)(ii) and (j)(4)(ii) and (iii). 251 BP Products North America, Inc. operates a refinery in Oregon, Ohio. BP-Husky is a joint venture with a 

business interest in the refinery. 

252 29 CFR 1910.119(d)(3)(ii) requires the employer to document that equipment complies with RAGAGEP. 253The Occupational Safety and Health Review Commission is scheduled to review the decision. 
Chevron Richmond Refinery Regulatory Report May 2014

51 

report issued in March 2007 entitled “Recommendations on the design and operation of fuel storage 

sites,” the Board highlighted the adaptability of the existing regulatory regime by noting that the 

recommendations to improve standards and revise guidance should not require actual changes to the law, 

because the existing legal framework was “sufficient to ensure that necessary improvements are put in 

place.”254 The Board followed by making its first recommendation of the report to the COMAH CA and 

operators of Buncefield-type sites to develop and agree on a methodology to determine safety integrity 

level requirements for overfill prevention systems, which takes account of, among other things, nearby 

resources or populations.255 The Board also recommended that the sector “develop guidance to 

incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if 

loss occurs.”256 Another key recommendation was made to the CA to “ensure that safety reports 

submitted under the COMAH Regulations contain information to demonstrate that good practice in 

human and organisational design, operation, maintenance and testing is implemented as rigorously as for 

control and environmental protection engineering systems.”257 Finally, the Board recommended in this 

report that the “sector agree with the Competent Authority on a system of leading258 and lagging259

performance indicators for process safety performance...” based on HSE’s guidance on Developing 

process safety indicators.260

Spurred by recommendations made surrounding the Buncefield incident, the BP Texas City incident, and 

the BP Grangemouth incident,261 the COMAH CA developed an Operational Delivery Guide entitled 

“COMAH Competent Authority Workstream 2e: Process safety performance indicators,”262 which was 

“designed to continue the promotion and development of site level process safety performance indicators 

(PSPIs) as part of the monitoring arrangements for an effective process safety management system at 

major hazard sites.”263 The guide states that by the end of March 2013 all “Buncefield-type” sites would 

“have effective monitoring of process safety performance in place and that site specific leading and 

lagging performance indicators have been developed...”264 and that by the end of 2015 “all major hazard 

establishments and duty holders will measure their performance on the control of major hazard risks by 

way of key leading and lagging performance indicators.”265 It lays out in detail a six-step process for 

implementing a process safety measurement system; how inspectors will assess a duty holder’s 

 

254 Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage 

sites; March 2007; p 3. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf (accessed May 21, 

2013). 

255 Ibid at 8. 256 Ibid at 15. 257 Ibid at 19. 258 Leading indicators are measurements that predict future performance to ensure that safety protection layers and 

operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment 

selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical 

Process Safety (CCPS), Guidelines for Process Safety Metrics; October 2009; p 20. 

259 Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of 

severity and should be reported as part of the process safety metric. Ibid at 20. 260 Ibid at 13. 261 Between May 29 and June 10, 2000, three incidents occurred at the BP Grangemouth Petrochemical Complex in 

Scotland, which is one of the largest of the 950 COMAH sites in the UK. 262 Available at http://www.hse.gov.uk/comah/guidance/process-safety-performance-indicators.pdf (accessed May 

21, 2013). 

263 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 3. 264 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 6. 265 Ibid at 3. 
Chevron Richmond Refinery Regulatory Report May 2014

52 

performance; and adds that full implementation of this program could take between 18 months and two 

and a half years from when the initial introduction takes place – all without requiring any fundamental 

changes to the COMAH regulations themselves. 

The COMAH CA Investigation Team noted in its publication summarizing the conclusions of the 

Buncefield investigation that following the incident, the CA, industry, and trade unions worked together 

to “drive forward high standards at fuel storage sites...[which] has resulted in agreement on improved 

standards of safety and environmental protection for all UK sites storing large volumes of gasoline and to 

systematically upgrade sites to meet these standards....”266 

In another example following the Buncefield incident, the Board recommended significantly higher 

standards than were generally in place in the sector. For example, the Board recommended that fuel 

storage tanks be fitted with automatic overfill protection equipment that would cut off supply if an overfill 

event occurs, rather than continuing to rely on operators to interrupt flow manually in the case of an 

event. In response, the UK Petroleum Industry Association and the Tank Storage Association adopted the 

recommendation, and the British government announced that it would require all sites to move to fully 

automatic shutdown systems on tanks storing gasoline. The Process Safety Leadership Group (PSLG) 

was formed to help develop the details of the new rule, and to “meet the need for an effective framework 

for interaction between industry, trade unions and the COMAH Competent Authority (CA)....”267 As 

will be discussed in the next section, workforce involvement is a key element of an effective safety case 

regulatory regime. In 2009, HSE published the PSLG’s work in a document entitled Safety and 

Environmental Standards for Fuel Storage Sites. The document lays out precisely which tanks must 

utilize automatic overfill protection equipment, and also allows for duty holders to demonstrate technical 

reasons as to why automatic overfill protection would not be appropriate by “prepar[ing] a robust 

demonstration that alternative measures are capable of achieving an equivalent ALARP outcome to an 

overfill protection system that is automatic...”268 This document in essence was developed as an industry 

good practice, and compliance with its requirements would likely ensure that the duty holder is complying 

with the law and reducing risks to ALARP.269 

This can be contrasted with an even larger release of gasoline and a subsequent explosion that occurred in 

the 2009 tank overfill at the Caribbean Petroleum Corporation near San Juan, Puerto Rico. This incident 

severely damaged surrounding buildings and impacted moving vehicles. However, the incident has not 

resulted in any re-evaluation of safety rules by the EPA or OSHA, despite the fact that tank terminals 

largely fall outside the PSM and RMP program regulations, (let alone the more rigorous requirements of a 

major hazard safety case regulatory regime, as practiced in the UK). 

These post-Buncefield examples highlight one of the most important attributes of the safety case 

regulatory approach: it is a regulatory framework that implements a balance of goal-setting and 

prescriptive elements which enable the regulator to drive facilities to continuously improve practices 

 

266 The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at 

the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; February 2011; p 3. 

http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013). 267 Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 2009; p 7. 

http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013). 268 Ibid at 29. 

269 For a detailed discussion of rule-compliance and the safety case, see Hopkins, Andrew. Risk-management and 

rule-compliance: Decision-making in hazardous industries; Safety Science 49 (1011) 110-120. 
Chevron Richmond Refinery Regulatory Report May 2014

53 

aimed at reducing risks to ALARP, without having to adhere to the extensive and time-consuming 

rulemaking requirements that exist in the US. This flexibility and adaptability encourages facilities to 

focus on improving practices and technology rather than on completing activity-based requirements, 

which can have the effect of stifling innovation and technological advancement. 

Critics argue that because there have been significant industry problems with the maintenance of safety 

critical equipment and aging equipment in the UK, 270 the safety case regime is not operating effectively. 

Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at 

many facilities due to company deferral of maintenance, insufficient testing of safety-critical elements, 

and a continuing industry culture of responding to disasters. However, the HSE has worked to make 

improvements to these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of 

aging equipment offshore and the operation of installations beyond their design life.271 The same year, 

the HSE published a report intended to inform industry and aid in the prevention of major accidents 

entitled Managing Ageing Plant: A Summary Guide,272 which provides an overview of ageing plant 

mechanisms and their management. This document presents analysis and findings for loss of containment 

incidents to demonstrate how aging plant equipment may be a factor. The HSE has been able to take this 

type of programmatic proactive approach in the UK thanks to the safety case regime’s adaptive nature, 

which is lacking in the US both on and offshore. This is positive evidence of a competent and effective 

regulator with the tools under the safety case regime to identify and proactively address industry gaps in 

safety performance. 

4.4 Active Workforce Participation 

As the CSB noted in its Interim Report on the Chevron incident, workforce participation is a key element 

of process safety and effective major accident prevention. In one of its publications, the Center for 

Chemical Process Safety (CCPS) lists workforce involvement as one of 20 essential management 

components necessary to reduce process safety risks and prevent chemical accidents.273 According to 

CCPS, 

...workers are potentially the most knowledgeable people with respect to 

the day-to-day details of operating the process and maintaining the 

equipment and facilities and may be the sole source for some types of 

knowledge gained through their unique experiences. Workforce 

involvement provides management a mechanism for tapping into this 

valuable expertise.274

This CCPS publication discusses general areas of workforce involvement in risk assessments, inspections, 

audits, and performance reviews, and notes that participation leads to empowerment, management 

 

270 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme 

carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See

http://www.hse.gov.uk/offshore/kp3.pdf, (accessed August 28, 2013). 271 The UK launches Key Programmes to address poor performance in specific areas. Access the report entitled Key 

Programme 4 (KP$): Ageing and life extension at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf

(accessed November 1, 2013). 

272 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013). 273 CCPS. Guidelines for Risk Based Process Safety; March 2007; p liv. 274 Ibid at 124. 
Chevron Richmond Refinery Regulatory Report May 2014

54 

responsiveness, and process safety performance improvement. 275 The OSHA PSM standard requires 

employers to consult with employees and their representatives on the conduct and development of PHAs 

and on the development of the 13 remaining PSM elements, and to develop a written plan of action 

regarding the implementation of the employee participation required under this section.276 During facility 

inspections, OSHA inspectors must request and evaluate these written plans of action regarding the 

implementation of employee participation as well as interview employees and their representatives to 

verify that the employer is satisfying the requirements.277 

In previous investigation reports, the CSB has identified that workers and their representatives play a very 

important role in major incident prevention. For example, as will be discussed in the next section on 

performance indicators, the CSB recommended in its BP Texas City Final Investigation Report that BP 

and the United Steelworkers Union (USW) establish a joint program to report incidents and near misses, 

and to ensure that recommendations made during investigations were implemented. The CSB also 

recommended that API and the USW work together to develop a safety standard addressing leading and 

lagging process safety indicators.278 However, representatives from the USW have stated to the CSB that 

it is a constant struggle for workers and their representatives to have a voice or play a role in the 

management of safety in US petroleum refineries. 

The law in the UK also requires employers to consult with their employees or their safety representatives 

on health and safety matters. The Safety Representatives and Safety Committees Regulations 1977 and 

the Health and Safety (Consultation with Employees) Regulations 1996 set out the legal framework for 

such consultation and worker involvement at both unionized and non-unionized onshore facilities.279 

However, these regulations go further than the OSHA PSM standard in that they provide for the election 

of safety representatives by the workers to serve many health and safety-related functions, including 

investigating complaints and accidents and carrying out inspections. In his keynote speech at the Oil and 

Gas UK Piper 25 conference, Lord Cullen stated that the safety representative positions have “important 

functions, such as the power to carry out investigations and reporting safety concerns to management, 

without fear of recrimination,” noting that they “help[] reinforce the principle that each employee is 

responsible for his own safety.”280 The regulations also require employers to establish a safety committee 

when one is requested by at least two health and safety representatives. The 1996 regulations require 

employers to consult with employees not represented by safety representatives under the 1977 

 

275 Ibid at 125. 276 29 CFR §1910.119(c) (2012). 277 See OSHA CPL 02-02-045. Process Safety Management of Highly Hazardous Chemicals – Compliance 

Guidelines and Enforcement Procedures. September 13, 1994. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=1558&p_table=directives (accessed September 

6, 2013). 

278 Process safety indicators are also referred to as safety performance indicators, metrics, key process indicators, 

performance measures, indicators, etc... 

279 The 1977 regulations apply to workplaces where the employer recognizes trade unions and trade unions are 

recognized for collective bargaining purposes. Regulations available at 

http://www.legislation.gov.uk/uksi/1977/500/contents/made (accessed September 4, 2013). The 1996 regulations 

apply to workplaces where employees are not in a trade union and/or the employer does not recognize the trade 

union, or the trade union does not represent those employees not in the trade union. Regulations available at 

http://www.legislation.gov.uk/uksi/1996/1513/contents/made (accessed September 4, 2013). 280 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. 

http://www.findingpetroleum.com/n/Review_Lord_Cullen_what_have_we_learned_from_Piper_Alpha/044b5113.as

px (accessed September 16, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

55 

Regulations on a number of health and safety-related matters, such as the introduction of any measure 

which may substantially affect their health and safety at work, the planning and organization of health and 

safety training, and the health and safety consequences of introducing new technology.281 The law in the 

UK protects employees from being penalized for taking part in health and safety consultation.282 

The UK’s existing regulations and policies regarding worker involvement offshore were developed and 

strengthened as a result of the Piper Alpha incident. In the Piper Alpha Report, Lord Cullen emphasized 

the importance of workforce involvement in safe operations, and noted that a safety committee system is 

“the most visible instrument for the involvement of the workforce in safety.”283 He concluded by 

recommending that “the regulatory body, operators and contractors should support and encourage the 

involvement of the offshore workforce in safety.”284 The HSE developed guidance in response to Lord 

Cullen’s recommendations entitled Play your part! How offshore workers can help improve health and 

safety, intended to encourage workforce participation offshore.285 The most current version of this 

guidance document, which was prepared by the Workforce Involvement Group,286 located within the 

HSE’s Offshore Industry Advisory Committee,287 utilizes good practice and examples of successful 

workforce involvement in improving health and safety with the goal of assisting operators, contractors, 

safety representatives, and others in effectively utilizing workforce involvement in their workplaces. It 

encourages companies to facilitate workforce involvement by providing information, improving 

communication at all levels, good training, and ensuring that all workers are represented in the decisions 

that affect them.288 

The Piper Alpha incident also resulted in the swift development of the SI971 Offshore Regulations 

(Safety Representatives and Safety Committees) Regulations 1989 (“the SI971 Regulations”), which 

provide for the nomination and election of safety representatives and require offshore installations to 

establish safety committees.289290 The HSE has published a guidance document entitled A guide to the 

 

281 See HSE. Consulting employees on health and safety: A brief guide to the law. 2013. 

http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 4, 2013). 282 See Employment Rights Act 1996. Section 44. Health and safety cases. 

http://www.legislation.gov.uk/ukpga/1996/18/section/44 (accessed September 4, 2013). 283 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p 301. 

284 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990; p 392. 

285 See HSE. Play your part! How offshore workers can help improve health and safety; 2013. 

http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 286 The Workforce Involvement Group’s mission is to improve safety “by stimulating lateral learning and best 

practice across the offshore industry through involvement of the whole workforce.” It looks at ways to increase 

worker involvement in health and safety matters offshore and is chaired by HSE. For more information see 

http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/wig.htm (accessed June 17, 2013). 287 The Offshore Industry Advisory Committee is a tripartite committee that includes members representing 

employers, employees, unions, trade associations and other government departments. It is focused solely on the 

offshore sector. More information is available at 

http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/information.htm (accessed June 17, 2013). 288 HSE. Play your part! How offshore workers can help improve health and safety; 2013; p 4. 

http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 

289 Under Regulation 16, safety representatives are responsible for investigating potential hazards and incidents, 

examining causes of accidents, investigating complaints by any member of his or her constituency relating to 

occupational health and safety, representing members of the workforce in consultations on the offshore installation 

with inspectors, and consulting constituency members on any matters arising out of the Regulation. Under 

Regulation 17, a safety representative may inspect any part of the offshore installation or its equipment either on a 
Chevron Richmond Refinery Regulatory Report May 2014

56 

Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989291 designed to 

assist duty holders, employers, installation managers, safety representatives, safety committee members 

and all members of the workforce in the offshore industry with what the regulations require and what 

must be done to comply with them. The document explains that although the primary responsibility for 

health and safety resides with the duty holder, “all members of the workforce must play their part if risks 

are to be eliminated or minimized.”292 It also emphasizes the importance of training of safety 

representatives, which enables them to effectively represent workers and fulfill their responsibilities and 

functions under these Regulations. 

In April 2010, the HSE launched an inspection project to examine the effectiveness of the SI971 

Regulations and the effectiveness of those regulations, as well as to collect examples of best practice to 

present to the offshore industry.293 Forty-one inspections were completed in a six-month period on 

offshore installations operated by 25 different duty holders. The project helped focus on the power of 

safety representatives and how to strengthen their ability to effectively perform their duties. It also was 

well-received by the safety representatives, as it gave them encouragement and recognition, and sent a 

message to management on the importance of SI971 and the key role of 

safety representatives and committees in workplace health and safety. 

The HSE has placed great emphasis and importance on the role of 

worker involvement and consultation in improving workplace health 

and safety and reducing major accidents on and offshore. In June 2009, 

HSE launched a new strategy entitled Be part of the solution, which 

lists workforce involvement as one of its main priorities, and the 

agency has published a significant amount of guidance on worker 

involvement and consultation on its website.294 

The Norwegian Working Environment Act addresses the rights and 

duties of safety representatives and committees in Norway. It applies 

to nearly all workers in Norway, including onshore and offshore oil 

workers. The Act provides for the election of government recognized safety representatives whose duty 

is to “safeguard the interests or employees in matters of the working environment.”295 These 

 

regular basis or following an incident. According to HSE, “this can be of great benefit to the duty holder because it 

brings an independent look at health and safety factors from the workforce viewpoint. Workers are in the front line 

and are often well placed to see problems and put forward practical suggestions.” HSE. A guide to the Offshore 

Installations (Safety Representatives and Safety Committees) Regulations 1989; 2012; p 20. 

http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013). 

290 Under Regulation 22, safety committees are responsible for reviewing the system of constituencies so as to 

ensure adequate representation of the workforce on health and safety matters, reviewing training of safety 

representatives, reviewing the frequency of safety committee meetings and the circumstances under which they may 

be called, and considering causes of accidents and making recommendations to the installation manager. 

291Third edition published in 2012. Available at http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 

4, 2013). 

292 Ibid at 7. 

293 See HSE. Offshore workforce involvement and consultation: Compliance Inspection Project. Available at 

http://www.hse.gov.uk/offshore/si971.pdf (accessed September 4, 2013). 

294 See http://www.hse.gov.uk/involvement/hsrepresentatives.htm (accessed September 4, 2013). 

295 Act Relating to Working Environment, Working Hours and Employment Protection, Etc. (Working Environment 

Act). December 2012. Section 6-1. Obligation to elect safety representatives. 
Chevron Richmond Refinery Regulatory Report May 2014

57 

representatives have the right to information, consultation, and participation in inspections.296 Unlike in 

the UK currently, they also have the legal authority to halt unsafe work until the regulator decides when 

the work may continue.297

A fundamental element in effective safety management for major accident prevention is active and equal 

participation from the regulator, industry, and labor. Each entity provides unique and essential insights, 

and removing the participation of these entities removes a critical voice in health and safety matters. In 

the UK and Norway, tripartite systems consisting of industry, the regulator, and the workforce have been 

established to deal with safety and health issues at the highest levels beyond just site workforce 

representation. 

The CSB investigation staff has had extensive discussions with worker representatives who have voiced 

their opinions on their systems to the CSB. Roy Furre, a Representative from the Norwegian Union of 

Energy Workers, spoke at the CSB’s 2010 public hearing on the Regulatory Approaches to Offshore Oil 

and Gas Safety, and stated that the Norwegian working environment and the accompanying petroleum 

regulations empower unions and safety delegates in all phases of the petroleum activities.298 He also 

noted that the Norwegian petroleum regulations require that all necessary information about risks and 

decisions be given to the workers’ representatives.299 During the CSB’s public hearing on Safety 

Performance Indicators in July 2012, Jake Molloy, the Regional Organizer for the National Union of Rail, 

Maritime and Transport Workers in the UK, stated that the input of workers is “crucial” in major accident 

prevention and that “if the people operating these systems and delivering these results are unable for any 

reason to tell you what the true picture is, everything else is worthless.”300 When speaking at a “Step 

Change for Safety” Conference in Aberdeen, Scotland, on September 5, 2012, Mr. Molloy noted that 

attending the public hearing in Houston was “eye opening” and that hearing about the US system was like 

a “walk back in time.”301

 

296 Ibid at Section 6-2. Duties of safety representatives. 

297 Ibid at Section 6-3. The safety representative’s right to halt dangerous work. See also the Regulations Relating 

to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework 

Regulations) Section 35. It states that “[t]he responsible safety delegate can, pursuant to Section 6-3 of the Working 

Environment Act, demand that a work operation or work process be halted by the person responsible for the 

operation or process. The operation or work shall stop immediately if the safety delegate does not accept the 

implementation of alternative measures.” 

http://www.ptil.no/framework-hse/category403.html#_Toc357595266 (accessed April 14, 2014). 

298 CSB. Public Hearing: Regulatory Approaches to Offshore Oil and Gas Safety. December 15, 2010; p 300. 

http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed December 10, 2013). 

299 Ibid at 300. 300 CSB. Public Hearing: Safety Performance Indicators. July 23, 2013; p 143. 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed December 10, 2013). 301 http://www.youtube.com/watch?v=-xDzb4x8t_c (accessed December 10, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

58 

4.5 Process Safety Indicators that Drive Performance 

As the CSB noted in both its July 2012 public hearing on Safety 

Performance Indicators and its Chevron Interim Report, leading and 

lagging process safety indicators help drive continuous process safety 

improvement, as long as regulators utilize these indicators to focus 

inspections, audits, and investigations, and organizations focus attention 

on them in a way that makes a difference. Process safety indicators are a 

significant element of process safety management systems. They 

measure the strengths and weaknesses of these systems to achieve and 

maintain safe and reliable operations302 and, if properly defined, collected 

and used, can identify the successes and flaws of the system.303 

Lagging indicators are a “form of reactive monitoring”304 that includes 

events such as major spills, fires, or gas releases. Leading indicators, on 

the other hand, are a “form of active monitoring,”305 and are described as events that do not result in 

severe consequences and usually address safety system performance, such as deviations from safe 

operating limits or timely maintenance on safety critical equipment.306 Leading indicators “can be 

considered as measures of process or inputs essential to deliver the desired safety outcome.”307 The 

general thinking globally is that if companies rely primarily on lagging indicator data, which is 

retrospective, they are not effectively managing process safety to ensure major accidents are prevented. 

According to the HSE, “[t]oo many organizations rely heavily on failure data to monitor performance, so 

improvements or changes are only determined after something has gone wrong. Discovering weaknesses 

in control systems by having a major incident is too late and too costly.”308 Rather, facilities must 

identify critical controls to monitor and set leading indicators against each one to show that the system is 

operating as intended. 

The HSE was one of the earliest regulators to adopt process safety indicators regulations. In 1995, the 

agency began requiring companies to report health and safety data, and then published annual reports 

based on those statistics. In 2006, the HSE developed a step-by-step guidance document entitled 

Developing process safety indicators309 to assist industry. The guide establishes and discusses in detail 

six main steps necessary to implement a process safety measurement system, including developing 

leading and lagging indicators. It also defines leading and lagging indicators for each of the controls in 

 

302 CCPS. Guidelines for Process Safety Metrics; October 2009; p 109. 303 Ibid. 304 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries;

2006; p 7. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 305 Ibid. 306 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico 

Blowout; CCH Australia Limited, 2012; p 83. 307 HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard industries;

2006; p 7. http://www.hse.gov.uk/pubns/priced/hsg254.pdf (accessed October 30, 2013). 308 Ibid at 1. 

309 Full title is Developing process safety indicators: A step-by-step guide for chemical and major hazard 

industries; first published in 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

59 

the risk control system. According to Jake Molloy, “[i]t is our firm belief that the most influential and 

effective schemes using indicators to measure improvements and major accident prevention are those 

initiatives generated by our regulator, the Health and Safety Executive [HSE].”310

As discussed in the previous section, a number of large incidents, including BP Texas City and BP 

Grangemouth, have highlighted the need for the chemical and other major hazard sectors to demonstrate 

that risks are being adequately controlled. In response to recommendations stemming from such 

incidents, the COMAH CA developed an Operational Delivery Guide in 2010 on process safety 

performance indicators setting out four stages to aid facilities in the development of process safety 

indicators. The document sets out a goal that by the end of 2015 major hazard establishments and duty 

holders will measure their safety performance and control of risk by way of key leading and lagging 

performance indicators. 

Following the 2005 BP Texas City incident, BP developed company-wide process safety indicators, and 

now includes process safety metrics in performance contracts for its US refinery managers.311 However, 

existing guidance in the US pertaining to safety performance indicators does not adequately aid 

companies in managing major hazards onshore. The CSB has noted that in virtually every incident it 

investigates in the US, process safety indicators are either not used at all or not used effectively.312 

Millions of workplaces around the US primarily measure their safety performance using OSHA 

recordable injury and illness rates, which include slips, trips, and falls. While collecting this type of data 

is also necessary in hazardous operations, it is not sufficient. Injury rates do not depict the effectiveness 

of a high hazard facility’s process safety management program.313 For example, the CSB noted in its BP 

Texas City investigation that BP’s personal injury metrics were described as being at the best level on 

record; yet, around this same time, in March 2005, BP Texas City experienced the devastating 15-fatality 

incident, which resulted from a progressive erosion of process safety performance that was not reflected 

in injury statistics. 

Following the BP Texas City incident, a number of key recommendations were made to strengthen 

guidance on indicators in the US. For example, the Baker Panel314 issued the Baker report, which 

recommended the incorporation of safety indicators to measure safety performance, and stated: 

The Panel believes that relying exclusively or predominantly on lagging 

indicators to assess process safety performance is ill-advised. ... BP’s 

reliance on lagging, after-the-fact indicators of process safety 

performance rather than leading, predictive measures...impaired BP’s 

ability to measure, monitor and detect deteriorating or degraded process 

safety conditions and performance... This failure to use a set of effective 

 

310 Molloy Testimony. CSB Indicators Public Hearing Transcript; July 24, 2012; p 139. 311 Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico 

Blowout; CCH Australia Limited, 2012; p 84. 312 Donald Holmstrom. CSB Indicators Public Hearing Transcript; July 24, 2012; p 13. 313 Ibid. 314 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an 

independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety 

culture, safety management systems, and corporate safety oversight at its US refineries. For a copy of their findings 

and recommendations see 

http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak

er_panel_report.pdf (accessed August 13, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

60 

performance metrics that includes leading indicators increased the 

likelihood that the organisation would identify the need for 

improvements or additional controls only after something had gone 

wrong.315

The Baker Panel also noted that it was not enough just to develop process indicators: these indicators 

needed to be meaningful to the company. As such, the Baker Panel also recommended that “a significant 

proportion of total compensation of refining line managers and supervisors [be] contingent on 

satisfactorily meeting process safety performance goals...”316

In its final investigation report on the incident, the CSB made a recommendation to API and the USW to 

jointly lead development of a consensus standard for leading and lagging process safety indicators to 

drive performance improvements in the prevention of major incidents. API responded by issuing RP 754,

Process Safety Performance Indicators for the Refining and Petrochemical Industries. However, this 

voluntary standard, which defines a framework of four tiered indicators that incorporate the concepts of 

lagging to leading measures, has significant shortcomings, as the CSB described in a two-day public 

hearing on Safety Performance Indicators that was held in July 2012. The CSB analysis found that the 

ability of RP 754 to drive performance improvement and inform key stakeholders will be hampered by 

 lagging indicators with insufficient statistical rigor needed to allow for trending or incremental 

performance improvements; 

 the lack of well-defined standardized and normalized leading indicators that are needed for 

comparison among sites, corporations, or to national averages; 

 weak employee protection requirements; public reporting requirements that will be ineffective to 

adequately inform stakeholders; and 

 the lack of broadly based consensus in the standard’s development process.317 

As a result, in 2012 the CSB Board designated the response to the CSB’s recommendation as “openacceptable,”318 meaning that the recommendations recipient is moving in the right direction, but more 

remains to be done. 

The CSB also noted in the Chevron Interim Report the important role the public plays in monitoring 

safety management systems, and referenced CCPS as promoting the sharing of process safety indicators 

with the public: 

Sharing performance metrics and results broadly can engage the public 

as a partner in holding the organization accountable for process safety 

performance. Making metrics and performance public can be an 

especially powerful way of maintaining upper management commitment 

since it will likely be the CEO or other senior managers who will be 

called to account by the public if goals are not met or performance 

declines. Communicating process safety successes also demonstrates to 

 

315 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 194. 316 Ibid at 251. 317 CSB Public Hearing: Safety Performance Indicators. July 23-24, 2012; p 26. http://www.csb.gov/events/csbpublic-hearing-safety-performance-indicators/ (accessed August 14, 2013). 318 For more information on recommendations status designations, see http://www.csb.gov/recommendations/faq/#5

(accessed June 21, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

61 

employees and the public that positive change can be, and are being, 

made within an organization.319

The Petroleum Safety Authority (PSA) in Norway provides annual reports to the public on its website 

assessing indicators it has collected directly from offshore and onshore major hazard facilities since 2000 

and 2006, respectively. The PSA utilizes the indicators data found in these reports to identify critical 

safety areas that must be targeted for improvement in order to prevent near misses and accidents.320 The 

onshore report, Risk level in the petroleum industry, Onshore facilities,

321, 322 includes a description and 

explanation of the indicators collected and analysis of these data. In this report the PSA notes a 

decreasing trend in the number of reported hydrocarbon leaks on offshore production facilities between 

2007 and 2010.323 However, it is too soon for PSA to assess trends in the onshore indicators data, 

because the time period for onshore data collection has been relatively short and there are fewer data 

points with only eight facilities onshore. The PSA also indicated that it will take time for the onshore 

data to improve as indicators are refined, but recognized that the same approach has already yielded 

good results in the offshore sector.324 Additional information on data and trends based on safety case 

regime implementation are provided in Appendix C. 

4.6 Regulatory Assessment, Verification, and Intervention 

To effectively oversee covered facilities and enforce safety case regulations, technically competent 

regulators review and assess325 safety case reports and utilize preventative inspections and audits to 

effectively intervene before high-risk activities commence. According to the HSE, “[t]he assessment 

process is only a part of the COMAH regime and examines at face value the factual information and 

examines arguments and demonstrations contained in the report against the requirements of the 

regulations.”326 The HSE places great emphasis during the assessment phase on the adoption of 

inherently safer designs327 and notes that “[m]ajor accident hazards should be avoided or reduced at 

source through the application of principles of inherent safety.”328 Conclusions on the adequacy of the 

safety case report are developed at the end of the assessment process, and, if deficiencies are found, an 

 

319 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics. 2010; p 109. 320 PSA. Trends in Risk Level: Summary Report 2012 – Norwegian Continental Shelf. 2012; p 1. 321 See http://www.ptil.no/publications/category175.html?ptil_md_art_list-select_group=Category-233. The CSB 

had the 2010 version of the onshore report translated into English. 

http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 

2013. (accessed September 17, 2013). 

322 The corresponding report discussing offshore indicator data is entitled Trends in Risk Level. 

http://www.ptil.no/getfile.php/PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 

2013. 

323 PSA. Risk level in the petroleum industry, Onshore facilities. 2010; p 80. 324 Ibid. 325 According to the HSE, the “assessment reviews the documentary evidence in the report and further 

documentation, as appropriate, which is referred to in the report or requested by the assessor.” HSE. The Safety 

Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 

2013). 

326 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 9. http://www.hse.gov.uk/comah/sram/s8-

15.pdf (accessed October 30, 2013). 327 Ibid at 30. 328 HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf

(November 26, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

62 

intervention strategy for the facility is developed to addresses those deficient measures. According to the 

HSE, assessment of a safety case report or document “is not a discrete activity but leads to further action 

under the intervention plan for the operator at that establishment.”329 Intervention by the regulator 

ensures that the facility and its operations are consistent with information provided in the safety case 

report, and that there are robust systems in place to “reduce the likelihood of hazards and to mitigate their 

consequences until the associated risks are ALARP.”330,331 Under the safety case regulatory regime, the 

regulator has the authority to accept the safety case report or reject it and require additional measures to 

further reduce risks. 

Preventative inspections and audits by a technically competent regulator can also result in deep challenges 

to industry, which does not typically happen under the PSM or RMP regulations. In the UK, the 

COMAH regulations authorize the CA to 

organize an adequate system of inspections of establishments or other 

measures of control appropriate to the type of establishment 

concerned...[that are] sufficient for a planned and systematic 

examination of the systems being employed at the establishment, 

whether of a technical, organisational or managerial nature, so as to 

ensure...(a) that the operator can demonstrate that he has taken 

appropriate measures to prevent major accidents; (b) that the operator 

can demonstrate that he has provided appropriate means for limiting the 

consequences of major accidents both inside and outside the 

establishment; (c) that the information contained in any report sent to the 

competent authority by the operator of the establishment adequately 

reflects the conditions in the establishment...332

The CSB noted in its BP Texas City Final Investigation Report that in the UK, HSE inspectors thoroughly 

inspect high hazard facilities annually, and all COMAHcovered facilities are inspected every five years. For the 

approximately ten petroleum refineries in the UK, detailed 

planned inspections (ranging from 80 to 150 days) are 

conducted annually for each refinery by a multidisciplinary 

team (regulatory inspectors, process safety, mechanical 

engineering, electrical and instrumentation, and human 

factors specialists).333 

The HSE lists its offshore priorities as safety case 

assessment;334 verification;335 inspection; investigation; and 

 

329 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 4. http://www.hse.gov.uk/comah/sram/s8-

15.pdf (accessed October 30, 2013). 330 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-

15.pdf (accessed October 30, 2013). 331 According to HSE, essential considerations to ensure ALARP are “the scope of hazard elimination, the adoption 

of inherently safer designs, whether good practice has been, or is to be adopted, [and] the application of riskreducing measures where relevant good practice is not yet established.” Ibid at 30 and 31. 332 COMAH Regulations 1999 Part 6, Regulation 19(1) and (2). 333 The CSB. Investigation Report: BP Texas City Refinery Explosion and Fire. March 2007; p 205. 

http://www.csb.gov/assets/1/19/CSBFinalReportBP.pdf (accessed October 29, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

63 

enforcement.336 In its business plan for 2012-2015, the HSE set out a goal of assessing 72 safety cases 

onshore and 100 safety cases offshore for 2013 and 2014.337 The work required to assess a safety case 

report both on and offshore is very resource-intensive (a typical new offshore safety case assessment 

requires anywhere from 100 to 300 hours of work), and demands that the regulator hire and retain 

individuals with significant oil and gas experience, specifically in areas such as process safety, human 

factors, engineering, and organizational performance. 

In Australia, the Offshore Petroleum and Greenhouse Gas Storage Act 2006 authorizes NOPSEMA to 

conduct planned inspections of offshore installations to ensure compliance with the Act.338 NOPSEMA 

notes that planned inspections “are a critical examination of aspects of a facility, its systems and 

operations with information obtained from the facility safety case.”339 Subjects of planned inspections 

include risk control measures related to either a Major Accident Event340 or Occupational Health and 

Safety controls, or both. NOPSEMA states that it conducts at least two per year for each normally 

manned offshore installation.341 NOPSEMA distinguishes between two types of planned inspections: 

field-based inspections, which focus on implementation of control measures described in a facility’s 

safety case, and themed audits, which deal with inspection of organizational issues by following a 

common theme to direct lines of questioning.342 

In a 1992 compliance directive,343 OSHA stated that the primary enforcement model for the PSM 

standard would be planned, comprehensive, and resource-intensive Program Quality Verification (PQV) 

inspections.344 These inspections consist of three parts: determining if the elements of a PSM program 

are in place; evaluating if the programs comply with the requirements of the standard; and verifying 

compliance with the standard through interviews, data sampling, and field observations. However, 

OSHA does not make planned inspections, which have the most opportunity for prevention, a high 

 334 An owner or operator (i.e. the duty holder) is required to submit a safety case to HSE for each offshore 

installation. HSE then assesses the safety case using both regulations and HSE’s “Assessment Principles for 

Offshore Safety Cases (APOSC) and must accept it before an installation can operate. See 

http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed July 31, 2013). 335 Duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to put in place and 

keep under continual review a verification scheme by which assurance is obtained from an independent competent 

person (ICP) that safety critical elements and the PFEER (Offshore Installations (Prevention of Fire and Explosion, 

and Emergency Response) specified plant are suitable and remain suitable for the life of the installation. For more 

information see http://www.hse.gov.uk/offshore/verification.htm (accessed July 31, 2013). 336 See http://www.hse.gov.uk/offshore/priorities.htm (accessed July 15, 2013). 337 HSE. HSE Business Plan 2012-15; June 2012; p 14. 

http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). 338 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Sections 600 and 601. See 

http://www.comlaw.gov.au/Series/C2006A00014 (accessed July 15, 2013). 

339 NOPSEMA. Inspection Policy; p 2. http://www.nopsema.gov.au/assets/document/N-02000-PL0025-

Inspection.pdf (accessed July 15, 2013). 340 Australia’s Offshore Petroleum and Greenhouse Gas Storage Regulations 2009 define a Major Accident Event as 

“an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of 

person at or near the facility.” Chapter 1.5. See 

http://www.comlaw.gov.au/Details/F2009L04578/Html/Text#param5 (accessed July 15, 2013). 341 For more information, see http://www.nopsema.gov.au/safety/inspections/ (accessed July 15, 2013). 342 For more information, see http://www.nopsema.gov.au/assets/document/N-02000-PL0025-Inspection.pdf

(accessed July 15, 2013). 

343 Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and 

compliance expectations to their Compliance Safety and Health Officers (CSHOs) for enforcing a new regulation. 344 OSHA Instruction CPL 02-02-045 (1994). 
Chevron Richmond Refinery Regulatory Report May 2014

64 

priority. Rather, OSHA lists its inspection priorities as 1) imminent danger situations; 2) fatalities and 

catastrophes; 3) complaints; 4) referrals; 5) follow-ups; and 6) planned inspections.345 

The CSB noted in its BP Texas City Final Investigation Report that for the 10-year period prior to the 

Texas City incident, federal OSHA had conducted no planned PQV inspections in oil refineries. As a 

result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA 

Process Safety Management (PSM) standard by developing more highly trained and experienced 

inspectors to conduct more comprehensive inspections, such as the PQV audits envisioned in the 1992 

directive, at facilities presenting the greatest risk of a catastrophic accident. The intent of the 

recommendation was to establish a permanent, ongoing planned comprehensive inspections program. 

Spurred in part by the CSB’s recommendations, OSHA issued the Petroleum Refinery Process Safety 

Management National Emphasis Program (NEP) on June 7, 2007.346 The NEP was a federal program that 

established guidelines for inspecting petroleum refineries to assure compliance with the PSM standard. 

Unlike the PQV approach to inspections, which “employs a broad, open-ended inspection strategy and 

uses a more global approach to identify compliance deficiencies...,” the NEP “provide[d] a specific tool 

to evaluate compliance with the [PSM] standard...[which] identifies a particular set of requirements from 

the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, 

interview employees, and verify implementation for specific processes, equipment, and procedures.”347 

The NEP inspections were meant to be more targeted and efficient than PQV inspections. However, the 

inspections being conducted pursuant to the NEP were ended in 2011 partly because they were very timeconsuming and resource-intensive.348 OSHA has publicly stated349 that NEP inspection hours were 

roughly 40 times greater than average OSHA inspection hours. OSHA described the NEP as its most 

effective emphasis program in its history, citing a disturbing number of issues and subsequent citations. 

In 1999, EPA established an audit350 program to help ensure compliance with the RMP program. The 

audits were intended to provide an independent verification of the information in the RMP and include 

 

345 “OSHA Fact Sheet: OSHA Inspections,” available at 

http://www.osha.gov/OshDoc/data_General_Facts/factsheet-inspections.pdf (accessed on May 20, 2013). 346 Originally Directive Number CPL 03-00-004. Extended August 18, 2099 as Directive Number CPL 03-00-010 

to allow more time to complete NEP inspections under the original CPL 03-00-004. 

347 CPL 03-00-004, Section X(D)(1). 2007. 348 Jordan Barab, Deputy Assistant Secretary of Labor for Occupational Safety and Health, stated the following 

during a symposium at the Mary K O’Connor Process Safety Center: “As our refinery NEP comes to an end, we are 

engaged in a process of trying to figure out how we will address refinery PSM issues in the future. Clearly OSHA's 

past practice of targeting inspection according to injury and illness numbers is not adequate. However, because of 

resource limitations, we are also unable to commit to a full-time NEP.” “Saving Lives and Transforming 

Workplaces: OSHA and Process Safety.” Remarks for Jordan Barab, Deputy Assistant Secretary of Labor for 

Occupational Safety and Health. Mary Kay O’Connor Process Safety Center International Symposium. Texas 

A&M University, College Station, Texas. Wednesday, October 27, 2010. 

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=SPEECHES&p_id=2311 (accessed January 

13, 2014). 

349 See Barab, Jordan. OSHA’s Refinery & Chemical National Emphasis Programs. Power Point presentation 

made at CSB Public Hearing on Process Safety Indicators; July 20, 2012. 

http://www.csb.gov/UserFiles/file/Barab%20%28OSHA%29%20PowerPoint.pdf (accessed August 14, 2013). Also 

see Transcript of CSB Public Hearing on Safety Performance Indicators; p 52. 

http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed August 14, 2013). 350 Within Part 68, the term “audit” refers to the process that implementing agencies may use to verify the quality of 

the RMP submitted to EPA and require revisions when necessary to ensure compliance. RMP audits will generally 

involve on-site verification of a facility’s underlying risk management program. Section 68.220 of the RMP rule 
Chevron Richmond Refinery Regulatory Report May 2014

65 

on-site inspections. Under these requirements, the implementing agency (EPA or a correlating state 

agency) must “periodically audit” RMPs to review their adequacy and require revisions when necessary 

to ensure compliance. 351 

Between fiscal years (FYs) 2010 and 2012, each EPA Region responsible for implementing the RMP 

program was mandated by EPA to perform inspections352 at five percent of the total number of regulated 

facilities in the regions, and a certain percentage of these facilities were required to be high-risk.353 In FY 

2010, regions were to conduct 10 percent of the inspections at high-risk facilities, and in FYs 2011 and 

2012, 25 percent at high-risk facilities.354 

Although EPA has acknowledged that “full compliance with the Risk Management Program regulations 

cannot be determined without on-site or independent verification of all or part of the information 

submitted in an RMP[,]”355 the EPA has not effectively implemented the audit and inspection elements of 

the Risk Management Program. As mentioned above in Section 3.2.2.3.2, the EPA Office of Inspector 

General (OIG) concluded in 2009 that over half of the RMP-covered facilities identified in the US as 

high-risk356 had never received an on-site inspection or audit, and over 65 percent of all active RMP 

facilities had not received an on-site inspection or audit since inception of the RMP program in 1999.357 

The EPA OIG also noted that of the 296 uninspected high-risk facilities managed by EPA, 151 of these 

could each impact 100,000 people or more in a worst-case accident scenario.358 

 

requires implementing agencies to select facilities for audits based on specific criteria, and to follow a specific 

process for resolving audit findings prior to any enforcement action. See EPA. Guidance for Conducting Risk 

Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. Available at 

http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 351 40 CFR §68.220 (1999). 352 RMP inspections “are different from audits in that facilities are not necessarily selected for inspection based on 

Part 68 regulatory criteria, and inspections can lead directly to implementing agency enforcement actions for 

regulatory violations. Also, RMP inspections always involve on-site verification activities.” See EPA, “Guidance 

for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r).” January 2011; page 4. 

Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 353 Criteria used to determine high-risk includes the number of people in the footprint (if it is more than 100,000); 

accidental releases reported in the RMP; the hazard index (percentage of chemical quantity above threshold and 

number of chemicals onsite); and the number of Program Levels 2 or 3. US EPA Region 9 Emergency Prevention 

and Preparedness Program; Stanislaus County Powerpoint; March 2013. See http://www.condorearth.com/files/08-

Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14, 2013). 354 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections;

March 21, 2013; p 7. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013). 355 EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); 

January 2011; p 4. http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013). 356 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office 

of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 

people; 2) Any RMP Program facility with a hazard index greater than or equal to 25; and/or 3) Facilities that have 

had one or more significant accidental releases within the previous five years. See “EPA Office of Inspector 

General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” 

March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed 

June 11, 2013). 

357 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for 

Airborne Chemical Releases; February 10, 2009; p 15. 358 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

66 

4.7 Independent, Competent, Well-Funded Regulator 

As noted by NOPSEMA, a safety regulator “provides ‘independent’ assurance to society, governments 

and industry that companies have identified the risks to health and safety and have put appropriate 

measures in place to control these risks.”359 To ensure that companies are managing risks and employing 

the best available standards and technologies, the regulator must be independent,360 well-resourced, and 

retain a sufficient number of technically competent, experienced, and well-trained staff that can critically 

assess companies’ safety case reports and performance. Without independent and competent 

examinations, the safety case report becomes a meaningless document in terms of controlling risk and 

preventing major accidents. Offshore regulators in the UK and Australia also utilize independent third 

party specialist safety companies recognized by the regulator. Third party inspectors review important 

aspects of the safety case, such as safety critical elements361 and performance standards.362 Third party 

inspections, however, do not take the place of rigorous inspections by the regulator. 

As of June 2012, the HSE employed roughly 3,300 staff, of which 1,381were front-line inspectors,363

whose responsibilities include conducting preventative inspections of roughly 950 COMAH facilities 

throughout the UK. The HSE employs roughly 105 inspectors to inspect approximately 300 offshore 

installations, in effect a one to three ratio. As such, the HSE, with a budget of roughly $472 million,364

has the authority to offer higher specialist salaries to attract and retain more experienced, competent 

personnel. According to information obtained from the HSE, in 2011 and 2012 their onshore specialist 

inspector pay ranged from $85,806 to $102,344, and their offshore inspector pay ranged from $134,387 to 

$148,423 at the highest grade and $116,288 to $131,499 at the next highest grade.365 

A safety case regime requires regulators to conduct preventative facility inspections and audits against the 

safety case to ensure that specified controls are functioning as intended. Regulators must be capable of 

interacting as equals with company risk managers when conducting these inspections. Former HSE staff 

 

359 See http://www.nopsema.gov.au/safety/safety-case/safety-case-approach/ (accessed May 31, 2013). 360 You will find a more detailed discussion of regulator independence in the CSB’s upcoming investigation report 

on the Macondo incident. 

361 The UK HSE requires offshore installations to define “safety critical elements,” which are the technical barriers 

in place for the prevention, detection, control, and mitigation of major accident risks. Lauder, Bob. Major Hazard 

(Asset Integrity) Key Performance Indicators in use in the UK Offshore Oil and Gas Industry. Paper at the CSB 

Indicators Public Hearing. July 24, 2012. 

362 In the UK, duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to “put in 

place and keep under continual review a verification scheme by means of which assurance is obtained from an 

independent competent person (ICP) that safety critical elements and PFEER [Offshore Installations ) Prevention of 

Fire and Explosion, and Emergency Response] specified plant are suitable and remain suitable for the lifetime of the 

installation.” See http://www.hse.gov.uk/offshore/verification.htm (accessed November 14, 2013). 363 HSE. The Health and Safety Executive Annual Report and Accounts 2011/12; July 2012; p 30. 

http://www.hse.gov.uk/aboutus/reports/1112/ar1112.pdf (accessed June 3, 2013). 364 For 2013/2014, HSE’s budget is listed as 308.1 £million. HSE recovers approximately 40 percent of its costs 

through income mainly in the nuclear, offshore, and chemical sectors, and the remainder is funded from Grant-inAid pursuant to the Health and Safety at Work etc. Act 1974, and fee for intervention (FFI).364 See HSE, “HSE 

Business Plan 2012-15,” July 2012; page 17. Available at 

http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). Conversion 

of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021-forex.html

(accessed June 4, 2013). 

365 Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public/page/2_3021-

forex.html (accessed June 4, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

67 

have communicated to the CSB that the HSE seeks new employees with good communication skills in 

addition to education and experience, as the job of a safety case regulator requires encouraging companies 

to aspire to make safety improvements that they may not want to make. One message that current and 

former HSE staff have repeated is that the industry believes having competent regulatory staff adds 

significant value to their business.366 In any country, competent offshore regulatory staff can persuade 

companies to manage risks in a rigorous manner, knowing that if not done properly, their risk 

management practices will be challenged.367 This competence is also essential for companies’ confidence 

in the accuracy of the regulatory staff’s advice, inspections, and citations. According to a literature 

review on the safety case in the UK, “[s]ome companies see as positive the requirement to have ‘someone 

external to the company keeping you on your toes by regularly asking if you have done all you can,’ and 

that it ‘forces you to convince yourself’ that you have covered all the risks.”368

In the US, the federal government has used extensive resources to retain the best available talent to focus 

on health and safety oversight of US commercial and defense nuclear facilities.369 For instance, many 

nonsupervisory technical staff at the US Nuclear Regulatory Commission370 (NRC) and the Defense 

Nuclear Facilities Safety Board are paid at the top of the General Schedule pay schedule.371 Virtually all 

technical staff at the Defense Nuclear Facilities Safety Board hold technical master’s degrees and 

approximately 25 percent hold doctoral degrees.372 

The federal government has a unique category of non-executive positions that involve high-level research 

and development in the physical, biological, medical, or engineering sciences, or a closely-related field.373 

These are known as “Scientific or Professional” positions, and they are classified above the highest 

general schedule pay level.374 These special salary authorizations contribute to the technical agencies’ 

ability to compete with private industry to recruit and retain highly competent staff. The NRC also has a 

type of funding mechanism that ensures that the agency’s budget adequately covers its regulator 

activities, as the NRC is required by law to recover at least 90 percent of its budget through licensing and 

inspection fees.375

 

366 Based on conversations between the CSB staff and Magne Ognedal (Norway PSA), Ian Whewell (the UK HSE), 

Peter Wilkinson (Australia NOPSA [forerunner of NOPSEMA]), and John Clegg (inaugural CEO of NOPSA). 

367 Peter Wilkinson, Manager Review Implementation Team, Offshore Safety Section, Australia Department of 

Industry, Tourism and Resources and “architect” of NOPSA. Presentation to the National Research Centre for 

Occupational Health and Safety, ANU (May 15, 2002). 

368 Vectra Group Limited. Literature Review on the Perceived Benefits and Disadvantages of UK Safety Case 

Regimes; 2003; p 40. 

369 DNFSB FY2013 Budget Justification at p. 100 

http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN

AL.PDF (accessed May 15, 2013). 370 Presentation by NRC Executive Director Bill Borchardt, January 2011. 371 $123,758 to $155,500 per year in 2012 in Washington, DC. See https://www.opm.gov/oca/12tables/html/dcb.asp

(accessed May 15, 2013). 

372 DNFSB FY2013 Budget Justification at p. 100 

http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN

AL.PDF (accessed May 15, 2013). 373 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 374 http://www.opm.gov/ses/recruitment/stpositions.asp (accessed May 15, 2013). 375 Section 6101 “NRC User Fees and Annual Charges,” Omnibus Budget Reconciliation Act, Pub. L. 103-66. 107 

Stat. 312 (Aug. 10, 1993). 
Chevron Richmond Refinery Regulatory Report May 2014

68 

Another method by which the NRC is able to attract and retain competent technical staff is its extensive 

training programs. For new inspection staff, the NRC requires a series of courses, assessments, and 

simulation, all of which takes approximately two years to complete.376 Inspectors must have a bachelor’s 

degree in engineering or a degree in a relevant scientific field and Professional Engineer certification.377 

The agency operates a technical training center in Chattanooga, Tennessee, with various control room 

simulators that mirror licensees’ facilities. The NRC staff is expected to sufficiently understand this 

equipment so that they are able to conduct sufficient audits and investigations.378 Before he or she is fully 

qualified to conduct inspections, inspector candidates must be recommended by the NRC inspector 

qualification board and certified by the regional administrator or division director.379 

As will be discussed in greater detail under Section 5.0, at the time of the Chevron incident, a majority of 

the regulators responsible for oversight of Chevron and other petroleum refineries in California did not 

have sufficient, sustainable funding or staffing to oversee major accident prevention activities. An 

effective safety case regulatory system would necessitate that the California industry regulator be wellresourced and retain a sufficient number of competent, well-trained and experienced staff to critically 

assess a company’s safety case. The overall knowledge and expertise of the regulator must at a minimum 

match that of industry in order for the regulator to successfully assess a company’s safety case with the 

ultimate goal of preventing major accidents. 

 

 

376 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) at 4, available at 

http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed May 28, 2013). 377 NRC Reactor Inspector Job Posting No. R-I/DRS-2013-0001 378 See, e.g., http://www.iaea.org/ns/tutorials/regcontrol/regbody/reg2124.htm (accessed May 28, 2013). 

379 NRC Inspection Manual, Qualification Program for Operating Reactor Programs (Ch. 1245) available at 

http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf 
Chevron Richmond Refinery Regulatory Report May 2014

69 

5.0 Oversight of Petroleum Refineries in California 

In California, there currently exists a patchwork of primarily activity-based federal, state, and local laws 

and regulations aimed at preventing harmful releases of hazardous materials at facilities such as 

petroleum refineries. This regulatory framework does not foster continuous improvement by driving 

companies to reduce risks of their hazardous activities to ALARP, nor does it have the requisite number 

of regulatory staff with the skills, knowledge, and experience to provide sufficient oversight. 

5.1 Cal/OSHA 

5.1.1 Background Information 

Section 18 of the OSHAct380 encourages states to develop and implement their own job safety and health 

programs. Twenty-five states (including California), Puerto Rico and the Virgin Islands currently 

implement OSHA-approved State Plans.381 States must set job safety and health standards that are “at 

least as effective as” comparable federal standards; most adopt standards that are identical to the federal 

standards.382

California was certified as an OSHA State Plan state on August 12, 1977.383 California’s Division of 

Occupational Safety and Health (Cal/OSHA) administers the California Occupational Safety and Health 

Program. A PSM District Office384 within Cal/OSHA enforces California’s PSM standard, which is 

established under Title 8, Section 5189 of the California Code of Regulations (CCR) and entitled Process 

Safety Management of Acutely Hazardous Materials.

385,386 The PSM District Office is comprised of 

seven inspectors, known as Associate Safety Engineers, and one District Manager to regulate nearly 1,700 

PSM-covered facilities in California, including 14 petroleum refineries. Only one of these individuals has 

a technical background, with a degree in Chemical Engineering. Appendix B of this report summarizes 

the key differences between the federal and California PSM standards and the safety case regulatory 

regime. A more detailed analysis of those differences will be provided in the remainder of Section 5.1. 

The CSB in its Interim Report identified a number of weaknesses of Chevron’s process safety 

performance. In many of these causal issues, Chevron was not required to perform at a more effective 

level by the existing California PSM regulations. In Table 1 below, the CSB identifies the causal issues 

or findings, which highlight the gaps in the California and federal PSM regulations, and how each issue is 

more effectively managed in the safety case regulatory regime. In this section of the report, some of these 

examples will be examined in relation to key features of an effective regulatory approach such as the 

 

380 29 U.S.C. §667 (2004). 381 These are referred to informally as OSHA State Plans. OSHA approves and monitors State plans and provides up 

to 50 percent of an approved plan's operating costs 

382 29 U.S.C. §667 (c)(2) (2004). Also see http://www.osha.gov/dcsp/osp/faq.html (accessed May 13, 2013). 383 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed June 17, 2013). 384 The California PSM District Offices were established in 2001 after the February 1999 Tosco refinery incident in 

which four workers were fatally injured following the ignition of a highly flammable material during a turnaround 

operation. In January 2012 the two district offices were combined into one PSM District Office. 385 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed May 13, 2013). 386 8 CCR §5189 (2012). 
Chevron Richmond Refinery Regulatory Report May 2014

70 

safety case. More information on these causal findings can also be found in the CSB Chevron Interim 

Report. 

Process Safety 

Element Causal Finding California PSM Regulation The Safety Case 

Regulatory Regime**

MOC 

Inspection recommendation 

to upgrade pipe to 9-

Chrome not implemented. 

The MOC to implement the 

recommendation narrowed 

the scope allowing the 52-

inch component that failed 

to remain in service. 

Implementation of 9-

Chrome could have 

prevented the incident.387

MOC element requires 

implementation of written 

procedures to manage 

changes that shall address 

the impact of the change on 

health and safety; however 

the element is activity 

based and there is no 

requirement to implement 

effective recommendations 

or control hazards. There is 

no requirement in the MOC 

element to consider 

inherent safety. Cal/OSHA 

did not cite Chevron for 

this issue. 

Duty holder is required to 

drive risk to ALARP. 

Description of MOC 

procedures and 

demonstration of their 

effectiveness in managing 

major accident hazard 

risk are a key requirement 

of the safety case. 

Implementation of the 

concept of inherent safety 

is required.388 

 



 Unless otherwise noted, California and federal PSM requirements are nearly identical. ** Regulatory regimes such as offshore in Norway have many attributes of the safety case regulatory regime but are 

not called the safety case regulatory regime. 

387 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 41 

and 42. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 

2013). 

388 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to 

ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, 

Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also 

notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures 

necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, 

prevention, control, mitigation).” Ibid at 8. 
Chevron Richmond Refinery Regulatory Report May 2014

71 

Process Safety 

Element Causal Finding California PSM Regulation The Safety Case 

Regulatory Regime**

MOC 

Chevron conducted MOCs 

to evaluate proposed 

changes to crude feed that 

introduced higher sulfur 

concentration. However, 

Chevron failed to 

thoroughly evaluate the 

change of increasing sulfur 

weight percentage in crude 

oil feed and to assess how it 

might affect corrosion rates 

within the 4-sidecut piping 

circuit. Cal/OSHA did not 

issue any citations for 

failing to consider the 

impact of corrosion in the 

MOC process when sulfur 

composition in the crude oil 

feed was increased.389

MOC element is activitybased rather than 

performance based and 

requirements in RAGAGEP 

such as API 570390 do not 

apply to the MOC element 

of PSM. Cal/OSHA did not 

cite Chevron for this issue. 

Duty holder is required to 

drive risk to ALARP. 

Duty holder must identify 

in the safety case report 

the standards that they are 

using to reduce risk such 

as API 570. The 

implementation of those 

standards can be enforced 

by the regulator to 

achieve ALARP. 

PHA 

In its 2009 crude unit PHA, 

Chevron simply cited nonspecific, judgment-based 

qualitative safeguards such 

as: utilizing metallurgy to 

minimize corrosion, having 

effective maintenance and 

inspection programs, and 

providing pipe wall 

corrosion allowances. The 

effectiveness of these 

safeguards was neither 

evaluated nor documented; 

instead the safeguards were 

merely listed in the PHA. 

While the PHA element 

requires addressing the 

control of hazards, it does 

not require addressing the 

effectiveness of the controls 

or using the hierarchy of 

controls. For example, the 

standard would not require 

the use of improved 

metallurgy or inherent 

safety to mitigate corrosion 

hazards. Cal/OSHA did not 

cite Chevron for this issue. 

Requires the use of the 

most effective practical 

safeguards to achieve 

ALARP. The safety case 

requires the use of 

inherently safer design 

and the hierarchy of 

controls.391 

 

389 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 34, 35 

and 36. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 

2013). 

390 API 570. Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems. 

November 2009. 

391 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to 

ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, 

Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also 

notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures 

necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, 

prevention, control, mitigation).” Ibid at 8. 
Chevron Richmond Refinery Regulatory Report May 2014

72 

Process Safety 

Element Causal Finding California PSM Regulation The Safety Case 

Regulatory Regime**

PHA 

The 4-sidecut line was 

analyzed in the most recent 

crude unit PHA. Corrosion 

was not identified as a 

potential cause of a 

leak/rupture in the piping. 

Damage mechanism hazard 

reviews are not required by 

the PSM regulation. The 

process hazard analysis 

element does not require 

consideration of 

RAGAGEP such as API RP 

571, Damage Mechanisms 

Affecting Fixed Equipment 

in the Refining Industry.

Cal/OSHA did not cite 

Chevron for this issue. 

For example in the UK 

the HSE has worked with 

the industry to develop 

guidance on damage 

mechanism hazard 

reviews in the UK's 

offshore petrochemical 

industry. The 

implementation of best 

practice standards 

referenced by a duty 

holder’s safety case report 

may be enforced by the 

regulator to achieve 

ALARP. 

Incident 

Investigations 

Chevron made 

recommendations following 

its investigation of 

sulfidation incidents at 

Richmond, Salt Lake City 

and Pascagoula refineries 

requiring 100 percent 

component inspection in 

high risk piping systems. 

These recommendations 

were not implemented in 

the Richmond refinery 

crude unit prior to the 

incident. In 2007 Chevron 

identified the inherently 

safer solution of improved 

metallurgy to prevent 

sulfidation corrosion but 

only applied it to the crude 

unit small spool piece that 

failed. 

Neither California nor 

federal PSM regulations 

require root cause 

investigations or 

recommendations to be 

developed as the result of 

incident investigations. 

While California does 

require taking action to 

prevent reoccurrence, (goes 

beyond federal OSHA) it 

does not drive risk to 

ALARP. Cal/OSHA did 

not cite Chevron for this 

issue. Federal PSM does 

not require the development 

of recommendations or the 

prevention of future 

incidents. 

Investigation of incidents 

is required to demonstrate 

legal compliance with 

framework legislation. 

ALARP requirement 

would require remedial 

action including crosscompany learning from 

incident investigations. 

HSE can require safety 

case duty holder 

compliance with 

investigation report 

recommendations (e.g. 

Buncefield Report-

“determine SIL level 

requirements for overfill 

protection”). 
Chevron Richmond Refinery Regulatory Report May 2014

73 

Process Safety 

Element Causal Finding California PSM Regulation The Safety Case 

Regulatory Regime**

Mechanical 

Integrity 

Chevron was instrumental 

in the development of API 

RP 939-C, which suggests 

("should") but does not 

require ("shall") that 100 

percent component 

inspection be performed. 

API states that the use of 

"shall" denotes minimum 

requirements in the use of 

the standard - API RP 939-

C has no minimum 

requirements (no 

substantive "shalls" are 

used in the recommended 

practice). 

The mechanical integrity 

element of PSM requires 

that for inspection and 

testing procedures, 

employers follow 

RAGAGEP. However, API 

RP 939-C has no minimum 

requirements. Nonetheless, 

Cal/OSHA cited Chevron 

for failure to follow API RP 

939-C under this 

mechanical integrity 

provision. In the federal 

regulatory context, this 

approach has been called 

into question by the recent 

administrative law judge 

decision in BP Products. 

This case is scheduled for 

review by the full 

commission. 

In a safety case regime, 

the regulator can reject 

the use of weak and 

inadequate standards 

referenced in a safety case 

report (by rejecting the 

report) and can require 

more rigorous 

performance to achieve 

ALARP. 
Chevron Richmond Refinery Regulatory Report May 2014

74 

Process Safety 

Element Causal Finding California PSM Regulation The Safety Case 

Regulatory Regime**

Inherent 

Safety 

Chevron employees have 

recommended 

implementing inherently 

safer designs through the 

MOC process, incident 

investigations, technical 

reports, and past employee 

recommendations. 

However, the CSB has not 

identified any documented, 

thorough analysis of the 

proposed inherently safer 

solutions. In addition, 

Chevron has repeatedly 

failed to implement 

proposed inherently safer 

recommendations. Had 

Chevron implemented these 

recommendations, the 

incident could have been 

prevented. 

Neither California nor 

federal PSM regulations 

require the use or 

implementation of inherent 

safety. Cal/OSHA did not 

cite Chevron for this issue. 

In its Interim Report, the 

CSB made a 

recommendation to the 

California legislature and 

the Governor of California 

to use inherently safer 

systems analysis and the 

hierarchy of controls to the 

greatest extent feasible in 

establishing safeguards for 

identified process hazards. 

Safety case requires the 

implementation of 

inherently safer systems 

analysis.392 

Regulator 

Enforcement 

Despite numerous safety 

system deficiencies the 

Cal/OSHA regulator failed 

to identify these issues prior 

to the incident. Cal/OSHA 

conducted three planned 

inspections prior to the 

incident that resulted in no 

citations or fines. 

The CSB determined 

Cal/OSHA lacked sufficient 

resources and numbers of 

highly qualified inspectors. 

California is adding 15 

additional inspectors to its 

PSM unit. The Governor's 

Interagency Task Force on 

Refinery Safety will be 

proposing to implement 

additional 

recommendations from 

their draft report. 

A key feature of the 

safety case is a rigorous 

review of the safety case 

report that may be 

accepted or rejected by 

the regulator. 

Preventative audits of 

covered facilities are 

regularly performed by 

technically competent, 

well resourced regulators. 

 

392 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to 

ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, 

Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also 

notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures 

necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, 

prevention, control, mitigation).” Ibid at 8. 
Chevron Richmond Refinery Regulatory Report May 2014

75 

Process Safety 

Element Causal Finding California PSM Regulation The Safety Case 

Regulatory Regime**

Workforce 

Involvement 

The workers in previous 

loss of containment 

incidents raised concerns 

about the level of corrosion 

in the Crude and RLOP 

incidents, but their concerns 

were not effectively 

addressed prior to the 

August 6, 2012, incident. 

The workforce participation 

element requires an 

employer to develop a 

written plan to "ensure 

employee participation in 

process safety 

management...” including 

"consultation with 

employees and their 

representatives on the 

conduct and development 

of the elements of process 

safety management...” 

However, development of a 

written plan to satisfy the 

regulatory requirements 

does not ensure that 

workers and their 

representatives in practice 

are able to effectively 

participate in a company's 

safety management system 

such as PHAs, MOCs, and 

investigation activities. 

Safety case sets out a 

legal framework for the 

participation of 

employees on health and 

safety-related matters, the 

election of safety 

representatives, and the 

establishment of safety 

committees to serve 

health and safety related 

functions. Workforce 

participation practices are 

documented by the duty 

holder and submitted to 

the regulator. 

Table 1. CSB Causal Findings. 

5.1.2 Analysis 

5.1.2.1 ALARP 

Unlike the OSHAct, the California Occupational Safety and Health Act does not have a General Duty 

Clause. Rather, Section 5189 was established to “eliminate to a substantial degree, the risks to which 

employees are exposed in petroleum refineries, chemical plants and other facilities.”393 By focusing on 

the significant reduction of risk, this language supports the principle of ALARP, which requires a 

showing by the company that “there are no other practical measures that could reasonably be taken to 

reduce risks further.”394 However, this section, which lays out the “scope and purpose” of the regulation, 

is not an enforceable element of the regulation that is subject to citations, and the remaining PSM 

regulation elements do not lead in practice to that result. Rather, California’s PSM standard has remained 

activity-based, with many activity-based elements almost identical to the federal PSM standard. For 

example, an employer must “perform a hazard analysis [PHA] appropriate to the complexity of the 

 

393 8 CCR §5189 (a) (2012). 

394 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at 

http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

76 

process for identifying, evaluating, and controlling hazards involved in the process....”395 The PHA must 

address hazards of the process; engineering and administrative controls applicable to the hazards and their 

relationships; consequences of failure of these controls; facility siting; human factors; a qualitative 

evaluation of a range of the possible safety and health effects of the failure of controls on facility 

employees; and the identification of any previous incident which had a likely potential for catastrophic 

consequences in the workplace.”396 This language does not support the principle of ALARP, and makes 

no mention of risk or continuous improvement in any way. As a result, PHAs satisfy the California PSM 

regulatory requirement by merely listing safeguards; there is no requirement to evaluate or document the 

effectiveness of these safeguards, or to show that the safeguards in place are effectively reducing risks. 

As discussed in the CSB’s Interim Report on the Chevron incident, Chevron cited in its 2009 crude unit 

PHA non-specific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize 

corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion 

allowances.397 The effectiveness of these safeguards was neither evaluated nor documented. Had the 

adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidationinduced failure of carbon steel piping could have been recommended. In addition, while the 4-sidecut 

line was analyzed in this PHA, corrosion was not identified as a potential cause of a leak/rupture in the 

piping (emphasis added). A corrosion review, also referred to as a damage mechanism hazard review, 

analyzes hazards presented by all process failure mechanisms such as corrosion and cracking. This type 

of review, while considered to be good practice,398 is not required by the PSM regulations either federally 

or in California, and as such the CSB made a recommendation in its Interim Report to require these in 

future California PHAs. Under a safety case regulatory regime, the regulator has the ability to drive 

industry to adapt new technologies and safer practices as soon as they are developed; new rulemaking is 

not required for immediate improvements, because companies are obligated to continually work toward 

specified performance goals such as reducing risks to ALARP. Therefore, under a safety case regulatory 

regime the regulator could require these types of reviews to be conducted to reduce risk without requiring 

additional legislation. 

Cal/OSHA does not typically review a company’s PHA as part of its routine oversight of process safety 

management unless there is a specific complaint, accident, or targeted inspection. Nor does it “accept” a 

company’s PHA and proposed hazard mitigations. Therefore, prior to the August 2012 incident, 

Cal/OSHA inspectors did not require any additional information or analysis to be provided in the Chevron 

crude unit PHA. Highlighting the reactive nature of the PSM standard, Cal/OSHA inspected the Chevron 

facility post-incident and issued 17 citations related to the incident and eight additional citations, with a 

total proposed fine of nearly $1 million. Only one citation related to PHAs, and it was not associated with 

evaluating the effectiveness of safeguards or failure to control the 4-sidecut corrosion hazard. Rather, the 

emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units 

 

395 8 CCR §5189 (e)(1) (2012). 

396 8 CCR §5189 (e)(2) (A) through (G) (2012). 

397 Corrosion allowance refers to extra wall thickness added as a safety factor to the design of a piece of equipment 

beyond that needed solely for mechanical considerations such as design temperature and pressure. This extra 

thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the 

equipment. 

398 API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, describes common 

process failure mechanism and is considered to be good practice for analyzing risks presented by process failure 

mechanisms such as corrosion and cracking. 
Chevron Richmond Refinery Regulatory Report May 2014

77 

associated with the crude unit. This again highlights the lack of a requirement for Chevron to 

demonstrate that risks have been reduced to ALARP, or for Chevron to provide this type of analysis to 

Cal/OSHA to review. 

5.1.2.2 Adaptability and Continuous Improvement 

Of the 25 Cal/OSHA citations mentioned above, two were issued to Chevron for its failure to follow API 

RP 939-C, Guidelines for Avoiding Sulfidation (Sulfidic) Corrosion Failures in Oil Refineries as 

RAGAGEP. This voluntary API standard will be discussed in greater detail in the CSB’s Final 

Investigation Report on the Chevron incident. However, it is important to note for purposes of this report 

that API RP 939-C is a permissive and voluntary standard merely intended to provide guidance to 

industry personnel on how to address sulfidation corrosion in petroleum refining operations. Existing 

safety guidelines use words “shall” and “should” to denote either requirements or recommendations. API 

RP 939-C does not use the word “shall”; as such, it contains no requirements for industry. While the 

regulator in a safety case regulatory regime has the authority to analyze and challenge the requirements of 

API RP 939-C with the goal of driving continuous improvement and risk reduction (note the Buncefield 

examples discussed in Section 4.3), in the present case Cal/OSHA utilized the voluntary practice as an 

opportunity to issue a citation to Chevron post-incident. Cal/OSHA did not analyze API RP 939-C to 

determine whether its provisions are sufficient to reduce risks and manage hazards. It also remains to be 

seen whether this citation will be upheld considering the permissive language contained within the 

standard. 

Chevron has investigated a number of sulfidation incidents at its refineries over the years, including 

Richmond, Salt Lake City, and Pascagoula. Figure 2 shows a timeline of Chevron’s key sulfidation 

events. In January 2007, a failure due to sulfidation corrosion caused a serious fire in the Chevron 

Richmond Refinery crude unit resulting in a CWS Level 3 alert, injuring one worker and initiating a 

shelter-in-place for the surrounding community. As a result of these investigations, Chevron made 

internal recommendations to require 100 percent component inspections in high-risk piping systems. 

However, these recommendations were not implemented in the Richmond Refinery crude unit prior to the 

incident, highlighting a lack of learning from previous incidents by Chevron. 
Chevron Richmond Refinery Regulatory Report May 2014

78 

Figure 2. Chevron's key sulfidation events between 1974 and 2013. 

In addition, as a result of the January 2007 incident, Chevron informed Contra Costa Health Services’ 

Hazardous Materials Program399 (CCHMP) in a letter that the crude unit piping metallurgy had been 

upgraded following this incident as an inherently safer solution. However, the CSB learned that this 

upgrade was limited to only the immediate piping spool400 that failed. Cal/OSHA also did not require 

Chevron to update the crude unit PHA to address the findings from this incident. Under a safety case 

regulatory regime, the regulator would work with the company to improve its practices following such an 

incident. The company would also be required to update its safety case report to address these corrosion 

hazards and demonstrate how the company has reduced risks to ALARP. 

 

The CSB also noted in its Chevron Interim Report that despite internal recommendations to replace the 

entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction, 

Chevron’s 2006 Management of Change (MOC) analysis limited the application of those 

recommendations. Instead of replacing the entire piping segment identified by the original 

recommendation, the 2006 MOC considered only the replacement of a small section. Although the 

recommendation was intended to more broadly apply inherently safer materials of construction, the final 

implementation under the 2006 MOC limited the application of this more corrosion resistant 

 

399 Contra Costa Health Services’ Hazardous Materials program is designed to respond to emergencies and monitor 

hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). 

CCHSHMP also implements the CalARP and ISO programs, which will be discussed in greater detail later on. 400 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in 

order to provide a temporary connection or complete disconnection between two piping circuits. 
Chevron Richmond Refinery Regulatory Report May 2014

79 

metallurgy.401 As the mere completion of an MOC and the implementation of any action item satisfy the 

California PSM standard requirements, regardless of its adequacy or effectiveness, Cal/OSHA did not 

evaluate the MOC or cite Chevron for narrowing the scope of the MOC, despite its disregard of internal 

recommendations. Neither the California nor the federal PSM standards allow citations for inadequate 

MOCs. In addition, RAGAGEP does not apply to the MOC PSM element. 

This can be contrasted with the safety case regulatory regime in the UK, where the HSE includes the 

adoption of inherently safer designs as an essential consideration for determining whether a duty holder 

has reduced risks to ALARP.402 The HSE also notes that the guidance to COMAH Regulation 4, (the 

COMAH General Duty provision) “describes the application of all measures necessary to reduce risk of a 

major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, 

mitigation).”403 

5.1.2.3 Process Safety Indicators 

As the CSB has noted in its BP Texas City Investigation Report, Chevron Interim Report, and Section 4.5 

of this report, process safety indicators are a significant element of process safety management systems 

and are critical for reducing process safety incidents. A major goal of process safety indicators is to drive 

continuous process safety improvement. Regulators can utilize these indicators to focus inspections, 

audits, and investigations. 

Federally and in the state of California, neither the PSM standard nor the RMP rule require companies to 

utilize or report process safety indicators. Chevron voluntarily utilizes both leading and lagging 

indicators internally in its US petroleum refineries, in a system called Operational Excellence and 

Reliability Intelligence (OERI), which tracks 26 different process safety indicators. OERI was 

implemented in May 2009. However, Chevron is not required to report the status of its indicators to 

California regulators. Nor is Chevron held accountable to use the indicators to drive performance or 

continuous improvement. As a result, the CSB made a recommendation in its Chevron Interim Report to 

the California State Legislature to identify and require the reporting of leading and lagging process safety 

indicators to state and local regulatory agencies, with the goal of improving mechanical integrity and 

process hazard analysis performance at all California petroleum refineries, and preventing major chemical 

incidents. 

5.1.2.4 Inspections 

As noted in Section 4.6, safety case regulators utilize preventative inspections and audits to monitor 

compliance with legislation and to ensure that the facility and its operations are consistent with 

information provided in the safety case. However, like federal OSHA, California regulations require 

Cal/OSHA to prioritize accident, complaint, and referral-based inspections over planned inspections. As 

such, Cal/OSHA’s inspection program of the nearly 1,700 PSM-regulated facilities in California, 

 

401 As discussed in the Interim Report, only the section of piping downstream of the pumps was replaced with 9-

Chrome. 

402 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-

15.pdf (accessed October 30, 2013). 403 Ibid at 8. 
Chevron Richmond Refinery Regulatory Report May 2014

80 

including 14 petroleum refineries, 404 has been reactive in nature rather than proactive to maximize 

prevention. 

OSHA State Plan states405 were strongly encouraged but not required to implement the federal Petroleum 

Refinery NEP. Cal/OSHA did not adopt the NEP “because of its dedicated PSM Unit.”406 Between 2006 

and August 6, 2012, the Cal/OSHA PSM District Office conducted only three planned inspections of the 

Chevron Richmond facility, totaling only 150 inspector hours of effort. Cal/OSHA has acknowledged 

that these were not PQV inspections, as envisioned in its mission statement and in the federal PSM 

compliance directive. None of these inspections resulted in citations or fines. According to statistics 

provided by OSHA, federal NEP refinery inspections conducted between 2007 and the end of 2011 

required roughly 1,000 inspector hours each and resulted in an average of 11.2 violations and $76,821 in 

penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspection were 

40 times greater than the average OSHA inspection. These numbers indicate a major disparity in 

thoroughness and comprehensiveness between the planned inspections conducted by Cal/OSHA and the 

NEP inspections conducted by OSHA and other OSHA State Plan States. The federal NEP, which 

represented a more robust and intensive inspection program, ended in 2011 due to the stated great demand 

on OSHA resources. 

5.1.2.5 Workforce Participation 

Like the federal PSM standard, California’s PSM standard provides for workforce participation in a 

company’s process safety management program. 8 CCR §5189 (p) requires an employer to develop a 

written plan to “ensure employee participation in process safety management” including “consultation 

with employees and their representatives on the conduct and development of the elements of process 

safety management...”407 However, developing a written plan to satisfy the regulatory requirements does 

not ensure that workers and their representatives in practice are able to effectively participate in a 

company’s process safety management systems. 

In its investigation of the Chevron incident, the CSB noted that the Chevron Richmond Refinery 

workforce and its representatives, the United Steelworkers (USW), had expressed concerns regarding 

sulfidation corrosion and broader workplace safety issues, but were not consistently listened to by 

Chevron managers, and their concerns regarding corrosion were not adequately acted upon. In November 

2011, Cal/OSHA investigated a complaint of unsafe working conditions during the fourth quarter 

Richmond Lube Oil Plant (RLOP) turnaround at the Richmond Refinery. The RLOP receives feedstock 

from the crude unit where the August 6th incident occurred and has similar sulfidation corrosion concerns. 

During the shutdown of the RLOP, a fire occurred at one of the RLOP furnaces. According to 

Cal/OSHA’s inspection report, Chevron employees told Cal/OSHA that “OPERATORS GET 

IGNORED.” Many of the employees were concerned about increased corrosion they were finding during 

the turnaround, and believed that increased temperatures and throughput rates had an adverse effect on 

 

404 Also see the California Labor Code Sections 6309 to 6315 (The California Occupational Safety and Health Act of 

1973). 

405 Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their 

own job safety and health programs, referred to informally as an OSHA State Plan. OSHA approves and monitors 

State plans and provides up to 50 percent of an approved plan's operating costs. 406 Department of Industrial Relations, Division of Occupational Safety and Health, California, Process Safety 

Management District Office. Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012. 407 8 CCR §5189(p)(1) (2012). 
Chevron Richmond Refinery Regulatory Report May 2014

81 

equipment integrity. According to the interview notes, many operators had raised issues of corrosion in 

the RLOP to higher level supervisors to no avail; according to one, if you raise an issue a couple of times, 

“you get labeled a ‘pest.’” The CSB has not identified evidence indicating that Cal/OSHA took further 

action to respond to these concerns, and Cal/OSHA did not issue any citations as a result of its 

investigation.408 Post-incident, significant sulfidation corrosion was found in the RLOP and piping and 

equipment were replaced. 

The CSB found other significant evidence that increased workforce participation could have reduced the 

likelihood that unchecked corrosion would lead to the August 2012 incident. As discussed in the CSB’s 

Interim Report on the Chevron incident, Chevron technical staff has considerable knowledge and 

expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by 

differing silicon concentration in carbon steel piping. Chevron employees have authored industry papers 

on sulfidation corrosion and had significant influence in the development of the industry sulfidation 

corrosion recommended practice, API RP 939-C. In 2009, Chevron Energy Technology Company 

(Chevron ETC)409 created an internal document on the subject of sulfidation corrosion. Chevron ETC 

metallurgists released a formal report dated September 30, 2009 (nearly 3 years prior to the incident) to 

Chevron refinery-based reliability managers and chief inspectors entitled Updated Inspection Strategies 

for Preventing Sulfidation Corrosion Failures in Chevron Refineries. 

Sulfidation experts explained in the Chevron ETC report that, “[u]ntil now, Chevron has not directly 

addressed the risk of low Si[licon] carbon steel...”410 and that the report introduced a program that “seeks 

to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that 

Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic 

failure from sulfidation corrosion and calls out Chevron’s need for action. 

The Chevron ETC report specifically recommended that inspectors perform 100 percent component 

inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. However, this 

100 percent component inspection program was not implemented at the Richmond refinery prior to the 

August 6, 2012, incident. The Chevron ETC report defined a priority ranking system to help focus the 

inspection implementation efforts. The process conditions of the 4-sidecut pipe placed it in the highest 

priority for inspection. 

Chevron ETC technical experts issued a corporate newsletter in 2010 that again warned of the potential 

consequence of sulfidation failures. In this newsletter, the 100 percent component inspection 

recommendation from the 2009 report was reiterated for piping systems such as the crude unit 4-sidecut 

piping. The newsletter stated: 

Sulfidation corrosion failures ... are of great concern because of the 

comparatively high likelihood of ‘blowout’ or catastrophic failure. This 

typically happens because corrosion occurs at a relatively uniform rate 

over a broad area, so a pipe can get progressively thinner until it actually 

bursts rather than leaking at a pit or local thin area. In addition, the 

 

408 Post-incident, there were significant mechanical integrity improvements and piping replaced in the RLOP unit. 

409 The Chevron Energy Technology Company is a separate business unit within the Chevron Corporation that 

provides technology solutions and technical expertise for Chevron operations worldwide. See 

http://richmond.chevron.com/home/aboutchevronrichmond.aspx (accessed April 4, 2013). 410 A 2003 corporate technical newsletter recommended 100 percent component inspection of carbon steel piping 

susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident. 
Chevron Richmond Refinery Regulatory Report May 2014

82 

process fluid is often above its auto ignition temperature. The 

combination of these factors means that sulfidation corrosion failures 

frequently result in large fires. Chevron and the industry have 

experienced numerous failures from this mechanism and recent incidents 

have reinforced the need for revised inspection strategies and a robust 

PMI (Positive Materials Identification) program. 

The Chevron ETC 100 percent component inspection recommendation for high risk piping systems, 

established in 2009, was not implemented at Richmond, and the thin-walled low silicon 4-sidecut piping 

component remained in service until it catastrophically failed on August 6, 2012. 

Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise 

regarding sulfidation corrosion. They educated personnel and advocated for identification and control of 

damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to 

implement their recommendations. These individuals did not participate in the crude unit PHA and did 

not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround 

process.411 

Despite the history of sulfidation corrosion incidents and the recommendations by Chevron’s workforce 

to implement better inspection methodologies, Cal/OSHA did not evaluate these recommendations or 

determine whether Chevron management ensured that the hazards of this damage mechanism were 

addressed and mitigated in Chevron’s PHAs. In addition, Cal/OSHA issued no citations to Chevron postincident regarding the failure to address sulfidation corrosion in its crude unit PHA. Finally, when 

Chevron employees raised concerns, Cal/OSHA did not effectively address them. The examples 

highlighted in this section speak to the need for California to develop more effective regulation similar to 

the UK legislation discussed in Section 4.4, to ensure strong workforce involvement in health and safety 

matters at petroleum refineries. This will not only help prevent incidents such as the one that occurred at 

Chevron, but it will also help improve communication and ensure that workers are represented in the 

decisions that affect them. 

5.1.2.6 Funding and Regulator Competency 

Cal/OSHA has not received sufficient funding to employ a well-staffed, multi-disciplinary team capable 

of conducting thorough inspections of PSM-covered facilities in California. This is apparent when 

examining the lack of preventative, planned inspections of petroleum refineries being conducted by the 

PSM team in the state. In order for a safety regulatory regime to successfully regulate with the goal of 

major accident prevention, there must be a technically competent, well-resourced regulator in place to 

sufficiently review, scrutinize, and challenge the hazard identification and evaluation that has been 

conducted and controls that have been put in place to reduce risk, to help drive continuous improvement 

and ensure that risks are being controlled. It is not an acceptable outcome for society that petroleum 

refineries with the potential for catastrophic accidents be inspected only after an accident occurs or a 

complaint is filed. 

 

411 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the 

shutdown. 
Chevron Richmond Refinery Regulatory Report May 2014

83 

Compensation is one important factor for recruiting and retaining technically competent personnel. The 

CSB found that California regulators are significantly less compensated when compared to their industry 

counterparts. Based on information Chevron provided to the CSB, the average annual salary of refinery 

personnel who would interact with a California regulator performing an audit or safety inspection is 

$187,630. Table 2 below provides the 2012 salaries of California regulatory personnel that the CSB 

determined would likely perform a safety inspection or a hypothetical safety case assessment. These 

figures indicate a substantial compensation gap between the regulator and the regulated. A Cal/OSHA 

PSM team of associate safety engineers receive an average annual salary that is 46 percent lower than the 

refinery employees they would likely interface with during an inspection. EPA RMP inspectors receive 

an annual salary that is 33 percent lower than their facility counterparts and Contra Costa County 

accidental release prevention engineers and their supervisor are paid 48 percent less than these industry 

personnel.412 

Entity Average Annual Salary 

Refinery Personnel $187,630 

Cal/OSHA $100,536 

Contra Costa County $96,875 

EPA $125,000 

Table 2. Average 2012 salary for individuals selected by the CSB as representative of the 

professional staff within each California regulator and of the refinery professional staff who interface 

with the regulators regarding audits or safety inspections at the Chevron Richmond Refinery. 

As noted in the introduction of this report, the California State Legislature approved a 2013-2014 state 

budget bill (AP 110) that allows the California Department of Industrial Relations to charge state 

petroleum refineries a fee by March 31, 2014, to support an increase in funding and to pay for at least 15 

new positions in Cal/OSHA’s PSM Unit.413 The CSB considers this to be a positive step towards 

improving process safety management in the state of California, as it will provide the team the 

opportunity to conduct more thorough inspections. However, it is imperative that these additional 

inspectors have the skills, knowledge, and experience to provide sufficient direct oversight over PSMcovered facilities. Despite the additional funding, there remains a longstanding salary cap on associate 

safety engineers within Cal/OSHA. This will continue to make it difficult for Cal/OSHA to consistently 

attract or retain the necessary talent and expertise to effectively oversee these facilities. 

 

412 Compensation information is based on salary only. It does not take into account non-salary information such as 

bonuses, retirement programs, or benefit programs. 

413 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

84 

5.2 U.S. Environmental Protection Agency 

According to the EPA OIG, as of May 2012, only eight states and five local agencies had accepted full or 

partial RMP program delegation from EPA.414 As such, EPA regions directly implement the RMP 

program in most states. As no state agency has requested or received delegation to implement the RMP 

program within EPA Region 9, the federal EPA regional office is responsible for RMP program 

implementation for California as well as Arizona, Nevada, Hawaii, the Pacific Islands, and 148 Tribal 

Nations. 

5.2.1 Risk Management Plan (RMP) Program 

As of March 2013, there were 1,137 RMP-covered facilities in Region 9: 957 in California; 118 in 

Arizona; 42 in Nevada; 16 in Hawaii; and four in Guam.415 The Chevron Richmond Refinery has many 

processes covered by the RMP rule, including Program 3 processes, 416 such as the crude unit. As such, 

Chevron is required to submit an RMP every five years to EPA Region 9, and EPA is expected to audit 

the facility against this RMP to ensure compliance. According to Chevron’s most recent RMP submitted 

to EPA Region 9 in October 2011, its crude unit contained 400,000 pounds of a flammable mixture of 

propane, pentane, butane, ethane, and methane, well above the 10,000-pound threshold quantity for 

flammables.417 

EPA Region 9 employs four full-time and two part-time RMP inspectors to implement the RMP program 

for the roughly 1,100 RMP-covered facilities in the entire region. Region 9 staff informed the EPA OIG 

that to most effectively utilize their resources, they “place an additional focus on facilities in States, such 

as Arizona, that do not have their own risk management or accident prevention programs.418 The EPA’s 

mandates to conduct a certain number of inspections at high-risk facilities plus a lack of resources and 

staffing prevent the inspectors from fully auditing many of the petroleum refineries in each state; thus, the 

inspectors aim to visit each refinery every three years, where they pick one process to evaluate for two to 

three days. These inspectors target their inspections towards a specific industry issue during these visits. 

For example, when they last inspected Chevron in 2010, the inspectors focused on the issue of high 

temperature hydrogen attack (HTHA) due to the Tesoro incident that occurred in April 2010.419 

 

414 EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections;

March 21, 2013; p 2. 

415 US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint; March 

2013. See http://www.condorearth.com/files/08-Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14, 

2013). 

416 Processes not eligible for Program 1 and either subject to OSHA’s PSM standard or classified in one of ten 

specified North American Industrial Classification System (NAICS) codes are placed in Program 3, which imposes 

OSHA’s PSM standard as the prevention program as well as additional hazard assessment, management, and 

emergency response requirements. 

417 EPA List of Regulated Chemicals and Threshold Quantities for RMP program available at 

http://www.epa.gov/R5Super/cepps/pdfs/rmp-listed-chemicals-200708.pdf (accessed May 17, 2013). 418 California has its own RMP program, called CalARP. See EPA OIG. Evaluation Report: EPA Can Improve 

Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 23. 

419 On April 2, 2010, a heat exchanger ruptured due to high temperature hydrogen attack, resulting in seven worker 

fatalities at the Tesoro Anacortes Refinery in Anacortes, Washington. The CSB is set to release its investigation 

report on this incident near the end of January 2014. 
Chevron Richmond Refinery Regulatory Report May 2014

85 

5.2.2 Implementation of the RMP Program 

In order for a safety regime to function well, there must be a competent, well-resourced regulator in place 

to implement the regime. However, the EPA Region 9 RMP group is extremely understaffed and underresourced, as there are only six full-time inspectors to cover over 1,100 facilities across many states. 

Instead of fully inspecting or auditing petroleum refineries, the group is able to inspect one process at 

each refinery for two to three days every three years, which makes fully inspecting these facilities or 

auditing against the RMPs submitted by these facilities impossible. In addition, this group has other 

responsibilities beyond the RMP program, including the management of contracts, emergency prevention 

and preparedness training and outreach, and reporting violations under the Comprehensive Environmental 

Response, Compensation, and Liability Act (CERCLA). The CSB has learned that because this group 

has such limited resources, it hopes to delegate RMP inspection authority to other agencies throughout the 

region, as long as it maintains power to enforce violations. 

Like the federal and California PSM standards, the RMP regulations provide for workforce 

participation420 and require facilities to prepare a written plan of action regarding employee participation. 

It is the RMP program’s policy to invite employee representatives to participate in all parts of onsite 

inspections. EPA Region 9 RMP staff told the CSB, however, that the limited amount of time they were 

able to spend onsite at refineries made speaking with facility inspectors and operators a difficult task. 

They expressed that a lesson learned from the Chevron incident was that EPA RMP inspectors should 

commit more time onsite during facility inspections and audits, which will allow them more time to speak 

with workers to gain a better insight into how any issues within the facility are being addressed and 

resolved.421 

As mentioned above, EPA guidance on the RMP program states that the owner or operator’s duty to 

“prevent accidents and ensure safety at [their] source...” may require steps to be taken “beyond those 

specified in the risk management program rule.”422 While this principle appears to be similar to ALARP 

requirements of the safety case, in practice this is not required, and whether this is done is not subject to 

regulation or review. Similar to the PSM standard, RMP regulations require each facility with Program 3 

processes to conduct a PHA as part of its prevention program that is “appropriate to the complexity of the 

process...and[] identify, evaluate, and control the hazards involved in the process.”423 However, these 

regulations do not require facilities to include these analyses in the RMPs they submit to EPA. Rather, 

facilities with Program 2 or 3 processes are only required to include in the RMP very high-level, 

simplified information on their prevention programs and their PHAs. The Chevron Richmond Refinery’s 

most recent RMP submission from October 2011 included the following information on the PHAs for 

each relevant process: the date of the last PHA for that process; what technique was used; what major 

hazards were identified; what process controls were in use (i.e. automatic shutoffs, interlocks, alarms, 

emergency power); what mitigation systems were in use (i.e. dikes, fire walls, water curtain); what 

monitoring/detection systems were in use (i.e. process area detectors); date of the most recent review or 

 

420 See 40 CFR §68.83 (2000). 421 This need for greater interface with worker is a professional opinion by EPA staff, but has not resulted in EPA 

policy modifications to ensure effective worker input in future inspections. 

422 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for 

Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. See

http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013). 423 40 CFR §68.67(a) (1998). 
Chevron Richmond Refinery Regulatory Report May 2014

86 

revision of training programs; and maintenance. Chevron included one paragraph entitled “E.5. General 

Accidental Release Prevention Program,” which stated that PSM is applied to the entire refinery, and the 

PSM program is documented in Refinery Instruction (RI)-360, “Richmond Refinery PSM Policy.” No 

additional information or analysis could be located concerning the identification or control of hazards, or 

risk reduction, as, unlike the safety case model, there is no requirement for the company to demonstrate to 

the regulator that it is effectively ensuring that the safety systems are functioning as intended. 

Under the EPA RMP program, there is no regulatory requirement to reduce risks to ALARP. In addition, 

there is no requirement to submit to the regulator detailed information relating to risk reduction or hazard 

assessments. Finally, the Region 9 EPA RMP inspection team does not have the resources to fully audit 

petroleum refineries and other high hazard facilities subject to the RMP program. As a result, the EPA 

RMP program is not comprehensive or rigorous enough to control major accident hazards and reduce 

risks. Instead, facilities submit high-level summary information providing evidence that the activitybased requirements contained within the RMP regulations have been completed by the facility. 

5.3 Unified Program 

Chevron’s Richmond refinery was also subject to process safety regulatory requirements at the county 

and city level. The facility had to adhere to additional requirements above the PSM and RMP regulations, 

but these requirements were not sufficient to prevent the Chevron incident. The following sections will 

discuss those county and city requirements. 

In 1993, Chapter 418, Statutes of 1993 (Senate Bill 1082) established Chapter 6.11 of the California 

Health and Safety Code (HSC), which required the Secretary of the California Environmental Protection 

Agency (Cal/EPA) to adopt regulations creating a “unified hazardous waste and hazardous materials 

management” regulatory program, or Unified Program, by January 1, 1996, to consolidate and make 

consistent six existing hazardous materials and hazardous waste programs within the state.424 The 

Secretary of Cal/EPA was charged with ensuring that the Unified Program was established and 

implemented by a Certified Unified Program Agency, or CUPA, in all counties in California. Cal/EPA 

adopted the Unified Program regulations under Title 27, Division 1 of the California Code of Regulations, 

which integrated six existing programs: the Hazardous Waste Generator and Onsite Hazardous Waste 

Treatment programs; the Aboveground Storage Tank program; the Underground Storage Tank program; 

the Hazardous Materials Release Response Plans and Inventory program; the California Accidental 

Release Prevention (CalARP) program; and the California Uniform Fire Code.425 The CalARP program, 

which was created through Assembly Bill AB1889 with the goal of major accident prevention, will be 

discussed at greater length below. There are currently 83 CUPAs in the state of California that implement 

the Unified Program at a local level.426 

5.3.1.1 Contra Costa County Hazardous Materials Programs 

The Chevron Richmond Refinery is located in the City of Richmond, within Contra Costa County. The 

local CUPA responsible for implementing the Unified Program in all areas of the country is the Contra 

 

424 California Health and Safety Code §25404(b) (1993). Also see 

http://www.calepa.ca.gov/cupa/Reports/2002/ReimbAcct.pdf (accessed May 16, 2013). 425 27 CCR §15100 (a)(1) through (6) (1994). 426 See http://www.calepa.ca.gov/cupa/Documents/2012/FactSheet.pdf (accessed May 16, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

87 

Costa Health Services’ Hazardous Materials Programs (CCHMP).427 CCHMP is responsible for 

implementing the Unified Program in all areas of Contra Costa County. 

CCHMP implements two programs that are relevant to this investigation: the CalARP program and the 

City of Richmond Industrial Safety Ordinance (RISO). CCHMP also implements the county’s own 

Industrial Safety Ordinance (ISO), which covers seven facilities. CCHMP has five full-time engineers, 

known as accidental release prevention engineers, who are responsible for implementing these programs 

for the county. While all have technical degrees in engineering, only two of these engineers have past 

refinery experience. 

5.3.1.1.1 CalARP 

The California Health and Safety Code Article 2 (Chapter 6.95, Sections 25531 – 25543.3) was amended 

effective January 1, 1997, to implement EPA’s RMP program at the state level through the creation of the 

CalARP program regulations. Modeled after EPA’s RMP program and California’s Risk Management 

and Prevention Plan, which was enacted in 1986, the CalARP regulations (Title 19, Chapter 4.5 of the 

CCR) were implemented with the goal of preventing accidental releases of substances that can cause 

serious harm to the public and the environment, minimizing damage caused by a release, and to satisfy 

community right-to-know laws.428 California is one of at least three states that implement a state RMP 

program without delegation of the federal program from EPA.429 

The CalARP regulations, including PHA requirements, are essentially duplicative in nature to EPA’s 

RMP program, with a few exceptions: the list of toxic chemicals covered is 276 instead of 77; the 

threshold quantities of some chemicals are smaller; CalARP requires a seismic analysis; and there is more 

interaction with the public and other agencies.430 The CalARP regulations require that businesses that 

produce, handle, process, distribute, or store certain chemicals over a certain threshold quantity develop a 

Risk Management Plan (RMP) and submit the RMP to a local CUPA for review. Like the EPA RMP 

program, facilities with a Program 3 process must develop a management system that includes a PHA and 

emergency response program.431 State oversight authority and responsibility for the CalARP program is 

with the California Emergency Management Agency.432

The CalARP regulations apply to roughly 45 facilities in Contra Costa County, including the Chevron 

refinery in Richmond. Each covered facility is required to submit an updated RMP to CCHMP at least 

once every five years.433 The group of CCHMP engineers reviews these plans and is required to 

 

427 Contra Costa County’s Hazardous Materials program is responsible for responding to emergencies and 

monitoring hazardous materials in Contra Costa County. It is the duty of CCC to safeguard the Contra Costa 

County ecosystem from the release of hazardous materials and other pollutants. For more information see

http://cchealth.org/hazmat/ (accessed May 21, 2013). 428 Information available at http://www.calema.ca.gov/HazardousMaterials/Pages/Accidental-Release-Prevention-

(CalARP).aspx (accessed May 16, 2013). 

429EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne 

Chemical Releases; February 10, 2009; p 20. 430 Information on differences between EPA’s RMP program and CalARP available at 

http://cchealth.org/hazmat/differences-rmp-calarp-iso.php (accessed May 16, 2013). 431 22 CCR §2735.5(f) (2004). 432The California Emergency Management Agency is responsible for the coordination of overall state agency 

response to major disasters in support of local government. For more information see 

http://www.calema.ca.gov/Pages/default.aspx (accessed May 21, 2013). 433 22 CCR §2745.10(a)(1) (2004). 
Chevron Richmond Refinery Regulatory Report May 2014

88 

“periodically audit RMPs”434 against the regulations to ensure compliance. This group has told the CSB 

that it audits each facility at least once every three years. It last audited Chevron in February 2011, and 

has been conducting another audit in October and November 2013. 

Although CCHMP is authorized to issue enforcement actions for violations uncovered during facility 

audits, in practice CCHMP engineers issue “ensure” action items that list the deficiencies and recommend 

improvements. They then work with the facility to make sure that these action items are implemented. 

CCHMP has rarely issued fines or citations to facilities for violations. If the engineers identify other gaps 

or areas for improvement that are not actual regulatory violations, they can issue “consider” action items, 

which are essentially suggestions to the facility for improvements that are not technically required to be 

implemented by the regulation. Whether these types of action items are issued is dependent upon the 

knowledge and experience of the engineer conducting the audit. Once CCHMP engineers have 

completed the audit, CCHMP issues a final audit report on the facility, which they also supply to 

Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group. 

5.3.1.1.2 Industrial Safety Ordinance 

The Contra Costa County Industrial Safety Ordinance (ISO) became effective January 15, 1999. Adopted 

as County Ordinance Chapter 450-8, the ISO expands on the CalARP program in Contra Costa County 

for facilities meeting the following criteria: 1) the facility is within an unincorporated area of the County; 

2) the facility is either a petroleum refinery or chemical plant; 3) the facility is required to submit a Risk 

Management Plan (RMP) to the EPA and the Contra Costa County Health Service; and 4) the facility has 

at least one Program 3 process.435 Seven of the 45 CalARP facilities in the county are currently required 

to comply with the ISO requirements. 

The ISO was adopted to improve industrial safety by, among other things, requiring more comprehensive 

coverage of the whole facility rather than only certain processes; providing review, inspection, auditing 

and safety requirements more stringent than are currently in effect; requiring the development and 

implementation of a human factors program; and preventing and reducing the number, frequency and 

severity of accidental releases in Contra Costa County.436

Facilities subject to the ISO are essentially required to treat every process as subject to the CalARP 

Program 3 prevention program requirements. Covered facilities have additional requirements as well, 

including developing and implementing a human factors program, considering inherently safer 

technologies and systems for new and existing facilities or processes, submitting a safety plan to 

CCHMP, and conducting a Management of Organizational Change (MOOC) prior to changes in 

permanent staffing levels or reorganization in operations, maintenance, health and safety, or emergency 

response.437

 

434 22 CCR §2775.2(a) (2004). 435 See http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014). 436 County Ordinance Chapter 450-8.004(a)(1) through (10) (2006). 

http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014). 437 Information available at http://cchealth.org/groups/hazmat/industrial_safety_ordinance_risk_management.php

(accessed May 22, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

89 

5.3.1.1.3 City of Richmond Industrial Safety Ordinance 

On December 18, 2001, the City of Richmond adopted an Industrial Safety Ordinance (RISO) under 

Municipal Code Chapter 6.43 that was almost identical to the ISO. In February 2013, the City of 

Richmond Council amended the RISO to make it equivalent to the ISO. Chevron is one of two facilities 

subject to RISO requirements. Pursuant to an agreement with the City of Richmond, CCHMP 

implements and enforces the RISO within the city. 

Like the ISO, the RISO requires that a covered facility submit a safety plan to CCHMP that includes 

safety elements such as process safety information (PSI), operating procedures, mechanical integrity, 

employee participation, and management of change (MOC).438 CCHMP has posted a Safety Plan 

Guidance Document on its website to assist facilities in developing these plans. Each facility is also 

required to comply with safety requirements including performing PHAs, and must include a description 

of the manner of compliance with these in the safety plan.439 In performing a PHA, facilities are required 

to address the hazards of the process, identify any previous incident, identify controls applicable to the 

hazards, and identify consequences of failure of those controls, human factors, and a qualitative 

evaluation of a range of possible safety and health effects of failure of controls.440

The CCHMP engineers are required to review each facility’s safety plan as well as audit each facility to 

determine compliance with ISO or RISO. CCHMP engineers conduct the CalARP and ISO/RISO audits 

concurrently at each covered facility. CCHMP generally audits each facility once every three years. To 

aid in the auditing process, CCHMP engineers have entered all the CalARP program requirements into a 

database. They have taken each of these requirements and turned them into questions. When the 

engineers go onsite, they perform three main functions: 1) they identify and review any policy statement 

that directs how people should handle a particular piece of equipment; 2) they identify and review records 

of procedures, such as MOCs and permits; and 3) they randomly select and interview individuals about 

their familiarity with various aspects of different programs. If the engineers find a regulatory deficiency, 

they issue an ensure action item to the facility. 

Once the engineers have completed their facility audit, they issue a preliminary determination to the 

facility. The facility has 90 days to review the draft and provide a proposed remedy with specifics on 

how they will fix each deficiency, and the timeline. Once the report is finalized it goes out for public 

comment. Following public comment, it is issued to the facility and provided to Cal/OSHA’s PSM 

District Office and the EPA Region 9 RMP group. 

5.3.1.2 Analysis 

Chevron submitted its most updated safety plan to CCHMP on February 25, 2013. Section 3.12 of the 

plan discusses PHAs and Action Items. Under this section, Chevron lists eight objectives of its PHAs, 

including identifying possible failures or releases, evaluating potential consequences, and proposing 

recommendations that would reduce the risks. Chevron also discusses its possible justifications for 

declining recommendations from PHAs, including the fact that an alternative measure would be 

sufficient, and that the recommendation may be infeasible. There was no additional information or 

 

438 Richmond Municipal Code Section 6.43.090 (a) (2013). 

439 Ibid at Sections (a) through (e) (2013). 440 Ibid at (d) (2013). 
Chevron Richmond Refinery Regulatory Report May 2014

90 

analysis contained in this section concerning the identification or control of hazards, or risk reduction, as 

there is no requirement to do so. 

The RISO and CalARP regulations require that PHAs list controls and possible consequences of failure of 

those controls, but there is no specific requirement to include evaluations of the safeguards and controls in 

the PHA. As CCHMP engineers are only required to audit against the regulatory requirements, they 

would only examine the evaluation of safeguards if such an evaluation were performed and documented 

in the facility’s PHAs. As noted previously, Chevron’s most recent crude unit PHA ineffectively listed 

qualitative safeguards for corrosion and mechanical integrity. 

While CCHMP engineers are able to issue “consider” action items to the facility recommending actions 

above and beyond regulatory requirements, CCHMP engineers did not do this regarding Chevron’s Crude 

Unit PHA or its evaluation of safeguards. After reviewing CCHMP’s most recent audit of Chevron, the 

CSB could find nothing referring to sulfidation corrosion, reduction of risk, or safeguard evaluation. 

While CCHMP is able to utilize these “consider” action items to encourage facilities to go above and 

beyond regulatory requirements to reduce risk, CCHMP engineers have stated to the CSB that they do not 

make sufficient use of this mechanism. Rather, they tend to audit against the existing regulatory 

requirements to ensure compliance. 

Unlike the safety case regulatory approach, which requires a reduction of risk to ALARP or equivalent, 

facilities covered by RISO or ISO are only required to “consider [emphasis added] the use of inherently 

safer systems in the development and analysis of mitigation items resulting from a process hazard 

analysis [PHA] and in the design and review of new processes and facilities.”441 Despite multiple internal 

recommendations to replace its piping due to the risk of sulfidation corrosion, Chevron failed to replace 

the piping prior to the incident with an inherently safer material. Again, the CSB has not found evidence 

that CCHMP effectively encouraged Chevron to go above and beyond regulatory requirements by 

utilizing inherently safer systems to reduce risk. 

As emphasized repeatedly in this report, a regulatory regime is only as strong as its regulators, and must 

employ individuals with the requisite skills, knowledge, and experience to provide sufficient oversight 

over facilities. In the case of CCHMP, there are only five engineers for nearly 45 facilities in the county, 

and only two have previous refinery experience.442 In addition, while the CCHMP is funded mostly 

through CUPA fees, ISO fees, and other means of cost recovery, the engineers are part of a bargaining 

unit and their salaries are paid through the county’s general fund, which has experienced annual budget 

reductions in the millions.443 This has unnecessarily resulted in a decrease in the CCHMP engineers’ 

salaries and has made it extremely difficult for CCHMP to fill a current position that has been open over 

three years because of its inability to offer competitive salaries to attract its engineers. Overall, CCHMP 

suffers from a lack of resources and funding, limiting its ability to hire additional highly qualified staff to 

oversee the petroleum refineries in Contra Costa County. 

 

441 City of Richmond Municipal Code §6.43.050(g) (February 5, 2013). 442 Two of the other engineers have chemical plant experience and have led or participated in refinery compliance 

audits in the past ten years. 
Chevron Richmond Refinery Regulatory Report May 2014

91 

6.0 Conclusion 

This report has focused on several aspects of the safety case regulatory approach that the CSB believes 

differentiate it from existing US and California process safety regulations: safety responsibility on the 

part of the facility, including a written case for safety; continuous risk reduction to ALARP; adaptability 

and continuous improvement; active workforce participation; the effective use of process safety indicators 

that drive performance; regulatory assessment, verification, and intervention; and an independent, 

competent, well-funded regulator. These attributes together enable industry and the regulator to ensure 

that facilities are developing and implementing comprehensive, robust safety management systems to 

prevent major accidents. 

Implementation of the safety case regulatory regime in California for petroleum refineries will require a 

commitment of extensive resources to fund a regulator that has the requisite skills, knowledge, and 

experience to ensure petroleum refineries in the state continually assess their practices and reduce risks to 

ALARP. However, the CSB believes that effective implementation of this regulatory approach will 

achieve greater major accident prevention in California and, in the process, provide greater protection for 

its workers and the public. 

The safety case provides the adaptability necessary to keep current with improving standards and 

advancing technology, without requiring lengthy and often unproductive rulemaking on the part of the 

regulator. With the safety case regulatory regime in place, a competent regulator will independently 

ensure that California refineries have taken all practical measures that can be reasonably taken to reduce 

risks. For example, the regulator would have the ability to work with these facilities to implement 

recommendations and lessons learned from significant petroleum refinery incidents throughout the world 

without requiring extensive rulemaking or legislation, as regulators have done post-incident in the UK, 

Norway, and Australia. If questions remain regarding the safety case regulatory regime after reading this 

report, see Appendix C for additional information and discussion. 

The safety case regulatory regime will require a full commitment and extensive effort by the California 

legislature, regulators, and California petroleum refineries. However, the CSB believes that this effort is 

necessary to ensure that California, like other regions around the world, is effectively managing process 

safety and risk, and in the process, preventing major accidents such as the August 6, 2012, Chevron pipe 

rupture and hydrocarbon release. 
Chevron Richmond Refinery Regulatory Report May 2014

92 

7.0 Recommendations 

Pursuant to its authority under 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer 

operations at California petroleum refineries and protecting workers and communities from future 

accidents, the CSB makes the following safety recommendations: 

California State Legislature, 

Governor of California 

2012-03-I-CA-R21 

Develop and implement a step-by-step plan to supplement the existing process safety management 

regulatory framework for petroleum refineries in the state of California with a more rigorous safety 

management regulatory framework based on the principles of the “safety case” type regulatory regime in 

use in countries such as the United Kingdom, Australia, and Norway, and as described in this report, with 

the following minimum components: 

a. A case for safety written by the duty holder that includes a systematic analysis and 

documentation of all major hazards and effective control methods implemented to reduce those 

risks as low as reasonably practicable (ALARP); 

b. A thorough review of the safety case report by technically competent regulatory personnel that 

requires modifications and improvements to the document as necessary prior to acceptance; 

c. Audits and preventative inspections by the regulator to verify effective implementation of 

safety case elements; 

d. A risk management approach that requires analysis and effective implementation of 

safeguards, using the hierarchy of controls, to protect people and the environment from major 

accident hazards. The effectiveness of the safeguards will be demonstrated through the use of 

leading and lagging process safety indicators; 

e. Ability to adapt and implement safety requirements in response to newly identified hazards, 

advances in technology, lessons learned from major accidents, and improved safety codes without 

the need for new rule-making; 

f. Determines when new or improved industry standards and practices are needed and initiates 

programs and other activities such as forums to prompt the timely development and 

implementation of such standards and practices; 

g. Uses a tripartite model where the regulator, the company, and workers and their 

representatives play an equal and essential role in the direction of preventing major accidents; 

h. A regulatory model and accompanying guidance based on the UK’s The Safety 

Representatives and Safety Committees Regulations 1977 and the Health and Safety 

(Consultation with Employees) Regulations 1996, which set out the legal framework for the 

rights and responsibilities of workers and their representatives on health and safety-related 

matters, and the election of safety representatives and establishment of safety committees to serve 

health and safety-related functions. The elected representatives should have a legally recognized 
Chevron Richmond Refinery Regulatory Report May 2014

93 

role that goes beyond consultation in activities such as the development of the safety case report, 

process hazard analysis, management of change, incident investigation, audits, and identification 

and effective control of hazards. The representatives should also have the authority to stop work 

that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to 

address the safety concern.444 Workforce participation practices should be documented by the 

duty holder and submitted to the regulator; 

i. Requires reporting of information to the public to the greatest extent feasible such as a 

summary of the safety case report, the process hazard analysis, a list of safeguards implemented 

and standards utilized to reduce risk, and process safety indicators that demonstrate the 

effectiveness of the safeguards and management systems;445 

j. An independent, well-funded, well-staffed, technically competent regulator; and 

k. A compensation system to ensure the safety case regulator has the ability to attract and retain a 

sufficient number of employees with the necessary skills and experience to ensure regulator 

technical competency. Periodically conduct a market analysis and benchmarking review to 

ensure the compensation system remains competitive with California petroleum refineries. 

2012-03-I-CA-R22 

Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the 

state of California to develop and implement a system that collects, tracks, and analyzes process safety 

leading and lagging indicators from operators and contractors to promote continuous safety 

improvements. At a minimum, this program shall: 

a. Require the use of leading and lagging process safety indicators to actively monitor the 

effectiveness of process safety management systems and safeguards for major accident 

prevention. Include leading and lagging indicators that are measureable, actionable, and 

standardized. Require that the reported data be used for continuous process safety improvement 

and accident prevention; 

b. Analyze data to identify trends and poor performers and publish annual reports with the data at 

facility and corporate levels; 

c. Require companies to publicly report required indicators annually at facility and corporate 

levels; 

d. Use process safety indicators (1) to drive continuous improvement for major accident 

prevention by using the data to identify industry and facility safety trends and deficiencies and (2) 

to determine appropriate allocation of regulator resources and inspections; and 

e. Be periodically updated to incorporate new learning from world-wide industry improvements 

in order to drive continuous major accident safety improvements in California. 

 

444 See Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain 

Onshore Facilities (The Framework Regulations) Section 35. http://www.ptil.no/frameworkhse/category403.html#_Toc357595266 (accessed April 14, 2014). 445 Certain information such as the process hazard analysis may contain trade secret or confidential business 

information that would have to be identified and protected from public disclosure. 
Chevron Richmond Refinery Regulatory Report May 2014

94 

The Chemical Facility Safety and Security Working Group and the 

Occupational Safety and Health Administration 

2012-03-I-CA-R23 

This report highlights significant advantages of the safety case regime over the existing Process Safety 

Management standard to prevent potentially catastrophic chemical accidents that are relevant to OSHA’s 

response to Executive Order (EO) 13650. In the development of the OSHA EO response, incorporate a 

written plan that includes the evaluation of issues raised from the findings, conclusions and 

recommendations in this report concerning the safety case regime. 
Chevron Richmond Refinery Regulatory Report May 2014

95 

References 

Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004. 

http://www.safeworkaustralia.gov.au/sites/SWA/about/Publications/Documents/475/MHFAnSituationRe

port_2004.pdf (accessed May 8, 2013). 

Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007. 

Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel 

storage sites; March 2007. http://www.buncefieldinvestigation.gov.uk/reports/recommendations.pdf

(accessed May 21, 2013). 

Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria;

August 2009. 

Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics; October 2009. 

Center for Chemical Process Safety (CCPS). Guidelines for Risk Based Process Safety; March 2007. 

Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle 

Approach; 2nd ed., December 2008. 

Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the 

Secretary of State for Energy by Command of her Majesty; November 1990. 

Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for 

Safety and Health in the Petrochemical Industry, A Report to the President; April 1990. 

http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013). 

EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for 

Airborne Chemical Releases; February 10, 2009. 

EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program 

Inspections; March 21, 2013. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed 

June 11, 2013). 

GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 

2012. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013). 

Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico 

Blowout; CCH Australia Limited, 2012. 

Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University 

[Online]. 
Chevron Richmond Refinery Regulatory Report May 2014

96 

http://www.sirfrt.com.au/Meetings/IMRt/Southeast/IMRt%20East%2000Nov30/Andrew%20Hopkins%2

0presentation/Lonford%20talk.PDF (accessed May 8, 2013). 

Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National 

Library of Australia, 1999;. 

Hopkins, Andrew. The Meaning of “Safety Cas”e; February 2013. 

HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations;

2006. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013). 

HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006. 

http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013). 

HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. 

http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013). 

HSE. Developing process safety indicators: A step-by-step guide for chemical and major hazard 

industries; 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013). 

HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about 

health and safety; October 2011. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 

2013). 

HSE. Play your part! How offshore workers can help improve health and safety; 2013. 

http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013). 

Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. 

Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 

2009. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013). 

Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 

2009. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013). 

TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or 

Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 

1996. 

The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and 

fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005; 

February 2011. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 

2013). 
Chevron Richmond Refinery Regulatory Report May 2014

97 

Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary 

Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, 

Revised June 4, 2013. Citing Zimgast, Erst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss 

Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. 

Technical report-DRAFT-EXTRACT. Risk Engineering Services, Swiss Re. 

http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

98 

Appendix A: Significant Petroleum Refinery Incidents in 2012 

1. Tank failure at the ExxonMobil refinery in Beaumont, Texas on 11 January 

2. Vessel pressure excursion at the Flint Hills refinery in St. Paul, Minnesota on 22 January 

3. Hydrogen Sulfide release from mechanical integrity failure at the Northern Tier Energy 

refinery in St. Paul, Minnesota on 26 January 

4. Sulfuric acid release from a mechanical integrity failure at the ConocoPhillips refinery in 

Wood River, Illinois on 27 January 

5. Hydrogen Sulfide release from mechanical integrity failure at the Marathon refinery in 

Garyville, Louisiana on 31 January 

6. Hydrocarbon and hydrogen fluoride release from a mechanical integrity failure at the Flint 

Hills refinery in Corpus Christi, Texas on 31 January 

7. Sulfur dioxide and hydrogen sulfide release following a vessel pressure excursion at the 

Alon refinery in Big Spring, Texas on 1 February 

8. Hydrocarbon release from a vessel pressure excursion at the ConocoPhillips refinery in 

Belle Chasse, Louisiana on 1 February 

9. Benzene release from a mechanical integrity failure at the Husky refinery in Lima, Ohio on 

16 February 

10. Fire at the Tesoro refinery in Salt Lake City, Utah on 17 February 

11. Fire at the BP refinery in Cherry Point, Washington on 17 February 

12. Tank failure at the Shell refinery in Deer Park, Texas on 22 February 

13. Tank failure at the Paulsboro refinery in Paulsboro, New Jersey on 23 February 

14. Fire at the Citgo refinery in Corpus Christi, Texas on 24 February 

15. Hydrogen Sulfide release from a mechanical integrity failure at the Flint Hills refinery in 

Rosemount, Minnesota on 28 February 

16. Vessel pressure excursion at the Motiva refinery in St. Charles, Louisiana on 28 February 

17. Benzene release from a mechanical integrity failure at the Chalmette refinery in Chalmette, 

Louisiana on 28 February 

18. Crude oil release from a mechanical integrity failure at the Flint Hills refinery in North 

Pole, Alaska on 4 March 

19. Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in 

Corpus Christi, Texas on 6 March 

20. 1 worker was fatally injured and 2 other workers were burned at the Valero refinery in 

Memphis, Tennessee on 6 March 

21. Fire during a hot work activity at the Tesoro refinery in Martinez, California on 7 March 

22. Benzene release from a mechanical integrity failure at the Chevron refinery in Pascagoula, 

Mississippi on 8 March 

23. Heavy oil release from a mechanical integrity failure at the Chevron refinery in Pascagoula, 

Mississippi on 13 March 

24. Benzene release from a mechanical integrity failure at the Marathon refinery in Texas City, 

Texas on 14 March 

25. Fire at the PBF Energy refinery in Delaware City, Delaware on 16 March 

26. Hydrocarbon release from a mechanical integrity failure at the Chevron refinery in 

Pascagoula, Mississippi on 19 March 
Chevron Richmond Refinery Regulatory Report May 2014

99 

27. Hydrocarbon release from a mechanical integrity failure at the Tesoro refinery in 

Anacortes, Washington on 23 March 

28. Hydrocarbon release from a mechanical integrity failure at the ExxonMobil refinery in 

Baytown, Texas on 24 March 

29. Fire at the ExxonMobil refinery in Billings, Montana on 25 March 

30. Hydrogen fluoride release from a mechanical integrity failure at the BP refinery in Texas 

City, Texas on 27 March 

31. Hydrocarbon release from a mechanical integrity failure at the Total refinery in Port 

Arthur, Texas on 11 April 

32. Fire at the ConocoPhillips refinery in Rodeo, California on 13 April 

33. Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in 

Corpus Christi, Texas on 16 April 

34. Crane fell over and damaged utility piping at the Citgo refinery in Lemont, Illinois on 17 

April 

35. Hydrocarbon release from a mechanical integrity failure at the Flint Hills refinery in 

Corpus Christi, Texas on 19 April 

36. Fire at BP refinery in Texas City, Texas on 20 April 

37. Hydrocarbon release from a mechanical integrity failure at the ConocoPhillips refinery in 

Sweeny, Texas on 24 April 

38. Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 8 May 

39. 4 workers injured in fire at the Sinclair refinery in Sinclair, Wyoming on 8 May 

40. Hydrocarbon release from a mechanical integrity failure at the LyondellBasell refinery in 

Houston, Texas on 8 May 

41. Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 9 May 

42. Fire at the Motiva refinery in Port Arthur, Texas on 12 May 

43. Hydrogen sulfide release from a mechanical integrity failure at the CVR Energy refinery in 

Wynnewood, Oklahoma on 11 May 

44. Hydrogen fluoride release from a mechanical integrity failure at the Citgo refinery in 

Corpus Christi, Texas on 15 May 

45. Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in Deer 

Park, Texas on 17 May 

46. Benzene and hydrogen sulfide release from a mechanical integrity failure at the Flint Hills 

refinery in Corpus Christi, Texas on 21 May 

47. Fire at the Montana Refining Company refinery in Great Falls, Montana on 24 May 

48. Hydrocarbon release from a mechanical integrity failure at the Valero refinery in Memphis, 

Tennessee on 25 May 

49. 2 workers injured from a fire at the Sinclair refinery in Sinclair, Wyoming on 28 May 

50. Propylene release from overpressure event at the PBF Energy refinery in Delaware City, 

Delaware on 29 May 

51. Hydrocarbon release from a mechanical integrity failure at the Valery refinery in Houston, 

Texas on 31 May 

52. Hydrogen and hydrocarbon release due to loss of containment event at the Shell refinery in 

Deer Park, Texas on 7 June 
Chevron Richmond Refinery Regulatory Report May 2014

100 

53. Hydrogen sulfide and hydrocarbon release due to flare failure at the Motiva refinery in 

Norco, Louisiana on 7 June 

54. Fire at the Motiva refinery in Port Arthur, Texas on 9 June 

55. Hydrocarbon release due to a mechanical integrity failure at the BP refinery in Texas City, 

Texas on 9 June 

56. Fire at the ExxonMobil refinery in Torrance, California on 11 June 

57. Fire at the Total refinery in Port Arthur, Texas on 13 June 

58. Hydrogen sulfide release from a tank failure at the ConocoPhillips refinery in Rodeo, 

California on 15 June 

59. Hydrocarbon release at the Shell refinery in Deer Park, Texas on 20 June 

60. Fire at the BP refinery in Whiting, Indiana on 21 June 

61. Hydrocarbon release due to a mechanical integrity failure at the Valero refinery in Corpus 

Christi, Texas on 23 June 

62. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton 

Rouge, Louisiana on 25 June 

63. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in 

Baytown, Texas on 28 June 

64. Propane release due to a mechanical integrity failure at the Valero refinery in McKee, 

Texas on 28 June 

65. Sulfuric acid release due to a mechanical integrity failure at the Chevron refinery in El 

Segundo, California on 2 July 

66. Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in 

Westlake, Louisiana on 14 July 

67. Fire at the Citgo refinery in Corpus Christi, Texas on 16 July 

68. Fire at the Valero refinery in Meraux, Louisiana on 22 July 

69. Sulfuric acid release due to a mechanical integrity failure at the Sunoco Point Breeze 

refinery in Philadelphia, Pennsylvania on 22 July 

70. Fire at the BP refinery in Whiting, Indiana on 23 July 

71. Hydrocarbon and hydrogen fluoride release due to a mechanical integrity failure at the Flint 

Hills refinery in Corpus Christi, Texas on 24 July 

72. Fire at the HollyFrontier refinery in Tulsa, Oklahoma on 2 August 

73. 8,614 lbs of hydrogen sulfide were released to the atmosphere due to a mechanical integrity 

failure on a compressor suction line at the Chevron refinery in Richmond, California on 2 

August. 

74. Hydrogen sulfide release from an overpressure event at the Valero refinery in Texas City, 

Texas on 5 August 

75. Fire at the Sinclair refinery in Sinclair, Wyoming on 5 August 

76. Fire at the Chevron refinery in Richmond, California on 6 August 

77. Fire at the Shell refinery in Martinez, California on 13 August 

78. Hydrogen sulfide release from a mechanical integrity failure at the Shell refinery in 

Martinez, California on 14 August 

79. 2 workers injured from a fire at the BP refinery in Whiting, Indiana on 14 August 

80. Hydrogen sulfide release due to a mechanical integrity failure at the Phillips 66 refinery in 

Wood River, Illinois on 22 August 
Chevron Richmond Refinery Regulatory Report May 2014

101 

81. Fire at the Sinclair refinery in Sinclair, Wyoming on 24 August 

82. Hydrocarbon release due to a mechanical integrity failure at the LyondellBasell refinery in 

Houston, Texas on 25 August 

83. Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in 

Corpus Christi, Texas on 26 August 

84. Hydrogen sulfide and propylene release due to a mechanical integrity failure at the 

ExxonMobil refinery in Beaumont, Texas on 29 August 

85. Fire at the Phillips 66 refinery in Rodeo, California on 29 August 

86. A high pressure excursion in a vessel resulted in a hydrocarbon release with offsite 

consequences at the Holly refinery in Woods Cross, Utah on 30 August 

87. Worker injured following a fire at the Marathon refinery in Detroit, Michigan on 5 

September 

88. Chemical release with offsite consequences at the Marathon refinery in Detroit, Michigan 

on 8 September 

89. Sulfuric acid release due to a mechanical integrity failure at the Tesoro refinery in 

Martinez, California on 10 September 

90. Carbon monoxide and hydrogen sulfide release due to a mechanical integrity failure at the 

ExxonMobil refinery in Baytown, Texas on 11 September 

91. Hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in 

Garyville, Louisiana on 11 September 

92. Hydrocarbon release due to a mechanical integrity failure at the Chevron refinery in 

Pascagoula, Mississippi on 14 September 

93. Unspecified leak at the Tesoro refinery in Martinez, California on 15 September 

94. Hydrocarbon release due to a mechanical integrity failure at the PBF Energy refinery in 

Delaware City, Delaware on 21 September 

95. Hydrogen sulfide release due to a mechanical integrity failure at the Motiva refinery in 

Norco, Louisiana on 24 September 

96. 1 worker killed and another worker injured from an explosion at the CVR Energy refinery 

in Wynnewood, Oklahoma on 28 September 

97. Fire at the Motiva refinery in Convent, Louisiana on 1 October 

98. Hydrogen fluoride release at the Placid refinery in Port Allen, Louisiana on 1 October 

99. Hydrogen sulfide release from a high pressure excursion at the Valero refinery in Port 

Arthur, Texas on 1 October 

100. Fire at the ExxonMobil refinery in Baytown, Texas on 3 October 

101. Vapor cloud release at the Hess refinery in Port Reading, New Jersey on 3 October 

102. Hydrocarbon release due to a mechanical integrity failure at the Phillips 66 refinery in 

Rodeo, California on 8 October 

103. Fire at the Citgo refinery in Corpus Christi, Texas on 9 October 

104. Vapor cloud release with offsite impact from the Kern Oil refinery in Bakersfield, 

California on 17 October 

105. Hydrocarbon and hydrogen sulfide release from a pressure excursion at the ExxonMobil 

refinery in Joliet, Illinois on 19 October 

106. Hydrocarbon release due to a mechanical integrity failure at the Citgo refinery in Sulfur, 

Louisiana on 22 October 
Chevron Richmond Refinery Regulatory Report May 2014

102 

107. Hydrogen sulfide release at the Chalmette refinery in Chalmette, Louisiana on 23 October 

108. Fire at the Tesoro refinery in Martinez, California on 21 October 

109. Fire at the BP refinery in Texas City, Texas on 30 October 

110. Fire at the Valero refinery in Port Arthur, Texas on 3 November 

111. Benzene release due to a mechanical integrity failure at the Shell refinery in Deer Park, 

Texas on 8 November 

112. Vapor release at the Tesoro refinery in Martinez, California on 8 November 

113. Hydrogen sulfide release due to a mechanical integrity failure or a high pressure excursion 

at the Shell refinery in Martinez, California on 24 November 

114. Hydrogen sulfide and hydrocarbon release at the Northern Tier Energy refinery in St. Paul 

Park, Minnesota on 27 November 

115. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton 

Rouge, Louisiana on 1 December 

116. Hydrogen fluoride release that killed one worker, injured 2 other workers and 7 emergency 

responders at the Valero refinery in Memphis, Tennessee on 3 December 

117. Hydrocarbon release due to a mechanical integrity failure at the Flint Hills refinery in 

Corpus Christi, Texas on 5 December 

118. Hydrogen sulfide release at the Phillips 66 refinery in Wood River, Illinois on 8 December 

119. Fire at the Motiva refinery in Port Arthur, Texas on 11 December 

120. Benzene release due to a mechanical integrity failure at the Alon refinery in Big Spring, 

Texas on 11 December 

121. Hydrocarbon release due to a mechanical integrity failure at the Shell refinery in Deer Park, 

Texas on 11 December 

122. Hydrocarbon release at the Shell refinery in Anacortes, Washington on 12 December 

123. Hydrogen sulfide release due to a pressure excursion at the PBF Energy refinery in 

Paulsboro, New Jersey on 14 December 

124. Hydrocarbon and hydrogen sulfide release due to a mechanical integrity failure at the 

Marathon refinery in Garyville, Louisiana on 15 December 

125. Fire at the Motiva refinery in Port Arthur, Texas on 17 December 

Note -Incidents of hydrocarbon leaks into a cooling tower or releases to a flare system are not included in 

the above list. 
Chevron Richmond Refinery Regulatory Report May 2014

103 

Appendix B: Regulatory Comparison Table 

OSHA PSM Standard California PSM Standard The Safety Case Regulatory 

Regime 

Scope Covered processes excluding 

oil and gas well drilling and 

servicing 

Covered processes 

excluding oil and gas well 

drilling and servicing 

Applies to offshore and onshore 

oil and gas operations 

Specific PSM/ 

Major Accident Focus 

Yes Yes Yes 

ALARP or Equivalent No No Yes 

Adaptability to New or 

Revised Codes, 

Standards, Technology, 

Hazard Information, 

Lessons Learned, etc. 

Limited to RAGAGEP –only 

addresses equipment and 

mechanical integrity (2 of 14 

elements); RAGAGEP not 

defined in the standard or a 

referenced list, only a handful 

of standards referenced as 

RAGAGEP in OSHA 

interpretation letters 

Limited to RAGAGEP –

only addresses equipment 

and mechanical integrity; 

RAGAGEP not defined in 

the standard or a referenced 

list, only a handful of 

standards referenced as 

RAGAGEP in OSHA 

interpretation letters 

Yes via safety case and 

supporting framework 

legislation 

PSM Indicators Req. No No Yes for Companies 

Competent Regulator 

50% or more 

Engineers/PSM 

OSHA-some progress but no Cal/OSHA – some progress 

but no 

Yes 

Sufficient Funding for 

Competent Regulatory 

staff 

OSHA-No California is increasing 

funding to support 

additional staff on 

Cal/OSHA PSM team 

Yes 

Hazard Analysis Required – “shall identify, 

evaluate, and control the 

hazards involved in the 

process.” 

Required – “appropriate to 

the complexity of the 

process for identifying, 

evaluating, and controlling 

hazards involved in the 

process.” 

Is a specific aspect of SC and 

supporting framework 

regulation and is required for 

all onshore and offshore 

facilities. To meet legislative 

goal-setting requirements, a 

structured risk assessment 

including HA as appropriate is 

required from all “employers.” 
Chevron Richmond Refinery Regulatory Report May 2014

104 

Incident Investigation Requires a report but activitybased; requires including 

“any recommendations 

resulting from the 

investigations” (what if there 

are none?); system required 

to “resolve the incident 

report findings and 

recommendation; no explicit 

requirement to prevent a 

similar occurrence or 

controlling hazards. 

Requires a report including 

“any recommendations 

resulting from the 

investigation.” System 

required to “establish a 

system to promptly address 

and resolve the report 

findings and 

recommendations 

and...implement the report 

recommendations in a 

timely manner, or take 

action to prevent a 

reoccurrence.” 

Investigation of incidents 

required to demonstrate legal 

compliance with framework 

legislation. ‘Reasonably 

practicable’ requirement would 

require remedial action and 

cross company learning from 

incident investigations. HSE 

can require SC duty holder 

compliance with investigation 

report recommendations (e.g. 

Buncefield Report-“determine 

SIL level requirements for 

overfill protection”) 

Management of Change Activity-based; the employer 

“shall establish and 

implement written procedures 

to manage changes;” “the 

procedures shall assure the 

following considerations are 

addressed...impact of change 

on safety and health;” no 

formal hazard analysis 

required; no requirement that 

the identified safety impacts 

or hazards be controlled. 

Activity-based: the 

employer “shall establish 

and implement written 

procedures to manage 

changes...;” “the 

procedures shall assure that 

the following are addressed 

prior to any 

change...technical basis for 

proposed change; impact of 

change on safety and 

health;” no formal hazard 

analysis required; no 

requirement that the 

identified safety impacts or 

hazards be controlled. 

Description of MOC 

procedures and demonstrations 

of their effectiveness in 

managing major accident 

hazard risk are a key 

requirement of the safety case. 

Workforce 

Participation 

“Employers shall develop a 

written plan of action 

regarding the implementation 

of the employee 

participation;” Employers 

shall consult with employees 

and their representatives on 

the conduct and development 

of PHAs and the other 

elements of PSM in this 

standard.” 

“Employer shall develop a 

written plan of action to 

ensure employee 

participation in process 

safety management;” 

includes employer 

consultation with 

employees and their 

representatives on the 

conduct and development 

of the elements of process 

safety management 

required by this section; 

and providing employees 

and their representatives 

with access to all 

information required to be 

developed by this 

section...” 

Provides for the election of 

protected safety representative 

positions and safety 

committees. 
Chevron Richmond Refinery Regulatory Report May 2014

105 

Inherent Safety No No Yes 
Chevron Richmond Refinery Regulatory Report May 2014

106 

Appendix C: Frequently Asked Questions (FAQs) Regarding the 

Safety Case Regulatory Approach 

1. Is it true that the safety case regulatory approach leads to self-regulation by industry? 

Critics of the safety case regulatory approach have noted that this type of regulatory regime is likely to 

result in mere industry self-regulation.446 Critics have also noted that this is at least partly due to the fact 

that there is no will in the US to ensure that regulators have the tools, resources, and competence to 

effectively regulate workplaces. The CSB and those with experience in developing and implementing the 

safety case regulatory regime have repeatedly stated that the purpose of the safety case regulatory 

approach is to ensure that all hazards have been identified, evaluated, and controlled so that risks are 

reduced to as low as reasonably practicable, or ALARP. In simple terms, the safety case report is a series 

of claims as to how an installation is being safety operated. The real strength of the safety case regulatory 

regime is testing the validity of those claims through strategic intervention by competent, well-funded 

regulators. Advanced performance-based regulatory regimes in the United Kingdom (UK) and Norway, 

for example,447 incorporate a list of regulator-accepted standards and good practices that provide 

companies with the minimum performance that is expected. Companies must demonstrate that they meet 

or exceed those standards. Therefore, companies are aware of minimum performance expectations they 

must meet as they work to reduce risks to ALARP. If a competent regulator is not in place, then the 

safety case report equates to nothing more than a lifeless document sitting on a shelf, and the criticism of 

self-regulation becomes valid. 

It is also important to point out that in a letter from the USW Local 5 to the CSB dated November 22, 

2013, it was stated that “[t]he current system is truly a self regulated system, with the industry setting the 

rules, changing the rules, and monitoring themselves.” Individuals are noting that the current system in 

place has actually led to self-regulation despite the intent of the PSM standard and RMP program to be 

performance-based. 

Critics have also argued that there is a lack of transparency with the safety case regime. However, under 

the existing PSM standard, none of the PSM elements are made public by the company or the regulator, 

including the process hazard analyses and management of change documents. To improve transparency, 

many safety case regimes collect and report indicator data, and companies are required make safety case 

report summaries publicly available. These are high level documents that are published online and 

summarize safety assessments, hazardous materials, hazards and control measures, potential major 

incidents, emergency response, and safety management systems. 

Rather than accepting the inevitability of catastrophic events, we should act to prevent them from 

happening. As discussed in this report, there is a movement in California to improve oversight of 

 

446 See e.g. Rena Steinzor. Lessons from the North Sea: Should “Safety Cases” Come to America? Vol. 38: 417; 

2011; p 439. Available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1735537 (accessed September 4, 

2013). 

447 Norway requires many similar aspects of a safety case regime offshore but there are differences in 

implementation and style and content of the regulations. The UK implements a safety case regime both onshore and 

offshore. 
Chevron Richmond Refinery Regulatory Report May 2014

107 

petroleum refineries. There has also been increased dialogue in the US in recent years surrounding the 

regulation of the oil and gas industry and how to make improvements. As such, the support exists to not 

only shift the current activity-based regulatory structure to a more goal-based safety case regulatory 

regime, but to also ensure that competent, well-funded regulators are in place to implement and enforce 

such a regime. 

2. How does the safety case regulatory regime in the US allow for changes to be made without requiring 

rulemaking under the Administrative Procedure Act? 

The Administrative Procedure Act, or APA, was passed in 1947, and lays out the basic framework under 

which federal rulemaking is conducted. It defines “rule” as “the whole or a part of an agency statement of 

general or particular applicability and future effect designed to implement, interpret, or prescribe law or 

policy or describing the organization, procedure, or practice requirements of an agency...”448 

“Rulemaking” is defined as the “agency process for formulating, amending, or repealing a rule.”449 

Federal agencies often impact their specific area of jurisdiction by publishing rules promulgated through 

notice and comment rulemaking, or informal rulemaking, under the APA. Unfortunately, as this report 

discusses at length, the rulemaking process in the US is cumbersome and some federal agencies, such as 

OSHA and the EPA, are subject to additional requirements and more stringent review standards that go 

above and beyond those contained in the APA. To avoid these additional burdens, many agencies provide 

further guidance to regulated parties through more informal means, such as answering questions and 

issuing policy statements, guidance, or opinion letters. Another way to lessen the burden on regulating 

agencies and their regulated entities is to adopt performance or goal-based regulations rather than 

prescriptive regulations. Performance-based standards state the objective or outcome to be achieved, such 

as risk reduction, without describing the specific means of obtaining that objective. This provides the 

regulated entities with the freedom and flexibility to work to achieve a stated goal, such as reducing risks 

to as low as reasonably practicable, or ALARP, through their chosen and preferred means.450 

Performance-based standards also provide flexibility to the regulator; for example, in a safety case 

regulatory regime, should the regulator determine through assessment of the safety case report and/or 

inspection that the facility has not reduced risks to ALARP with regard to a specific hazard, he or she may 

require that the facility take additional steps to further reduce risk without needing to propose and adopt a 

new rule or regulation to address it. The regulator must accept the safety case report in order for the 

facility to operate. 

The Regulatory Flexibility Act was passed in 1980 during the Carter Administration. It requires agencies 

to prepare and make available for public comment regulatory flexibility analyses of proposed rulemaking, 

and also encourages agencies to consider alternatives to rulemaking, including “the use of performance 

rather than design standards...”451 Executive Order 13272 then directed federal agencies to establish 

procedures and policies to comply with the Act.452 Federal agencies have been encouraged to adopt 

 

448 5 U.S.C. §551(4) (2011). 

449 5 U.S.C. §551(5) (2011). 450 Such as reliance upon qualitative assessments, quantitative assessments, semi-quantitative risk assessments, and 

good practice guidance. 

451 5 U.S.C. §603(3) (2010). 452 Exec. Order No. 13272, 67 Fed. Reg. 159 (August 13, 2002). http://www.gpo.gov/fdsys/pkg/FR-2002-08-

16/pdf/02-21056.pdf (accessed September 24, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

108 

performance-based standards in the US for decades. Recognizing the inefficient process of federal 

rulemaking in the US, President Clinton signed Executive Order 12866 in September of 1993, which, 

among other things, directed federal agencies to “identify and assess alternative forms of 

regulation...[and] specify performance objectives, rather than specifying the behavior or manner of 

compliance that regulated entities must adopt.”453 Executive Order 13563, entitled Improving Regulation 

and Regulatory Review, supplemented and reaffirmed Executive Order 12866 by ordering agencies to 

“identify and consider regulatory approaches that reduce burdens and maintain flexibility and freedom of 

choice for the public.”454 Its stated goal was to “protect public health, welfare, safety, and our 

environment while promoting economic growth, innovation, competitiveness, and job creation.”455 Its 

seven guiding principles are as follows: 

 Increase predictability and reduce uncertainty; 

 Use and rely on best available science; 

 Ensure public participation and open exchange of ideas; 

 Use the most innovative and least burdensome tools; 

 Consider cost benefit analysis (quantitative and qualitative); 

 Ensure regulations are publicly available, consistent, written in plain language and easy to 

understand; and 

 Measure results and seek to improve actual results.456

The safety case regime aims to satisfy all of these principles. 

California has adopted its own version of the APA, known as the California Administrative Procedure 

Act (CAPA) (California Government Code §11340 et seq.).457 Among its many requirements for 

California state agencies that adopt regulations, CAPA directs them to consider the substitution of 

performance standards for prescriptive standards.458 CAPA defines “performance standard” as “a 

regulation that describes an objective with the criteria stated for achieving the objective.”459

Federal agencies that are engaged in and responsible for regulating high hazards, such as NASA and the 

Nuclear Regulatory Commission (NRC), have adopted goal or performance-based standards that require 

risks to be reduced to “as safe as reasonably practicable” (ASARP) and “as low as reasonably 

achievable,” (ALARA), respectively. The OSHA Process Safety Management (PSM) standard also 

contains performance-based elements to some extent; for example, it provides regulated entities with 

flexibility in how to perform a process hazard analysis (PHA). However, it contains no risk reduction 

goals such as ALARP. This has resulted in an activity-based regulatory scheme that emphasizes 

completing activities, such as a PHA or a Management of Change (MOC) analysis, rather than actual risk 

reduction. Without a risk reduction goal such as ALARP in place, the PSM standard will not have the 

 

453 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.archives.gov/federalregister/executive-orders/pdf/12866.pdf (accessed September 24, 2013). 454 Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.gpo.gov/fdsys/pkg/FR-2011-01-

21/pdf/2011-1385.pdf (accessed September 24, 2013). 455 Ibid. 456 Ibid. 457 Available at http://www.oal.ca.gov/administrative_procedure_act.htm (accessed September 18, 2013). 458 California Government Code, §11340.1(a) (1995). 

459 California Government Code, §11342.570 (1995). 
Chevron Richmond Refinery Regulatory Report May 2014

109 

ability to successfully drive continuous improvement and adaptation of industry safety management 

advances. 

3. Can the safety case regulatory approach work in the US when workforce involvement is emphasized 

less than other regions and unionization rates are lower than other countries? 

A majority of the workforce in California petroleum refineries is unionized, as the unionization rate for 

the 14 petroleum refineries in California is actually 73 percent,460 which is significantly higher than the 

2012 rates for the US as a whole (11.1 percent), Australia (17.9 percent), the UK (25.8 percent), and 

Norway (54.7 percent).461 Despite a declining unionization rate in the UK, the region has developed 

strong onshore and offshore regulations that provide for the creation of protected safety representative 

positions and safety committees for unionized and non-unionized facilities. These positions are meant to 

create a healthier and safer workplace, and result in better decision-making regarding health and safety, 

increased productivity, higher workforce motivation, a stronger commitment to implementing decisions 

or actions (as employees have been actively involved in reaching these decisions), and greater 

cooperation and trust.462 The HSE has devoted extensive time and resources to ensuring employers are 

complying with these regulations and understand the importance and benefits of involving workers in 

health and safety-related matters. 

The UK also has a standard establishing the minimum level of training that elected safety representatives 

offshore should receive to enable them to fully perform their functions as defined in the Safety 

Representatives and Safety Committees Regulations – SI 1989/971. This training standard, entitled the 

OPITO Approved Standard, was developed by an industry workgroup facilitated by OPITO.463 In June 

2013, Det Norske Veritas (DNV)464 became accredited by OPITO to offer newly developed training 

courses to more than 2,000 elected safety representatives in the offshore industry. The training, which 

has been driven and supported by HSE, Oil and Gas UK, and the Offshore Industry Advisory 

Committee’s Workforce Involvement Group, consists of four separate Modules run over the course of 

eight days.465 The training covers topics such as Understanding and Identifying Major Accident Hazards 

and Investigating Incidents and Applying Root Cause Analysis. 

The CSB recognizes the HSE’s effort to improve workforce involvement through regulations, protected 

positions, and training, and has recommended in this report that California develop regulations and 

guidelines to establish similar protected safety positions to ensure effective workforce participation. The 

 

460 In September 2013, the USW provided the CSB with a list of California petroleum refinery locations as of 

October 2012 and the existing unionization representation at those refineries. Of the 15 petroleum refineries 

operating in California as of October 2012, 11 of those were unionized, with USW providing the union 

representation at all 11 facilities. 

461 For complete statistics on trade union density for countries around the world see 

http://stats.oecd.org/Index.aspx?QueryId=20167 (accessed September 5, 2013). 462 HSE. Consulting employees on health and safety: A brief guide to the law. 2013; p 2. 

http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 5, 2013). 463 OPITO is an industry-owned non-profit that serves the needs of the oil and gas industry in the UK and around the 

world. See http://www.opito.com/ (accessed September 10, 2013). 464 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk 

around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 465 http://www.marinelink.com/news/launches-offshore355749.aspx (accessed September 10, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

110 

CSB believes the HSE model can also be effective in the US as these regulations require effective safety 

representation regardless of unionization rates. 

4. Has the safety case regulatory approach resulted in fewer major accidents? 

The CSB has identified a small number of independent studies conducted on the impact of the safety case 

regulatory approach on safety performance onshore and offshore. In 1999, a report commissioned by the 

HSE (“the Aberdeen Report”) which evaluated the impact of the offshore Safety Case Regulations on 

offshore safety was published.466 One of the purposes of the study was to review published safety data for 

trends in offshore accidents and incidents from 1990 until 1997.467 Upon this review, it was determined 

there had been a decrease in accidents since the implementation of the offshore safety case regulations in 

the UK, but cautioned it was difficult to distinguish the effect of the safety case regulations from other 

industry activities such as the level and type of exploration and production activity, oil prices, and 

industry-led initiatives.468 The Aberdeen Report also cautioned about the difficulties in analyzing 

offshore data that also hold true for the more current data presented in Figure 3. The total number of 

accidents and incidents recorded can be affected by industry attitudes toward reporting, changes in how 

and what data is reported, and the decrease or increase in offshore activity. As stated in the Aberdeen 

Report, “[d]espite these cautions, accident statistics play an important role in the analysis of the state of 

safety in any industry, since accidents represent the ‘bottom line’ in safety. It is therefore important to 

analyze the trends, but to also take the drawbacks into consideration.”469 As discussed in this report, the 

reporting and analyzing leading process safety indicators is important to gain a better understanding of 

how safety management systems are functioning, and thus a better idea of how well the various regimes 

are managing hazards and mitigating risk. 

Statistics from the seven years covered by the Aberdeen Report indicated an overall decrease in reported 

accident rates in the UK and Norwegian databases up until 1994. From 1994 to 1997, both the UK and 

Norway reported a slight increase in the number of reported accidents.470 Norway did report a drop in 

1997 from 1996. The decrease reported up until 1994 for the UK appeared to be independent of the 

offshore production activities as those levels had been on the increase during the same time period. 

Drilling in the UK decreased during the same time frame, making the cause for the decrease in reported 

drilling accidents unclear. 

More recent reviews of accident data indicate decreasing trends in accident statistics. The Presidential Oil 

Spill Commission noted the following in its report to the President on the Macondo disaster: 

[f]rom 2004 to 2009, fatalities in the offshore oil and gas industry were 

more than four times higher per person-hours worked in U.S. waters than 

in European waters, even though many of the same companies work in 

both venues. This striking statistical discrepancy reinforces the view that 

the problem is not an inherent trait of the business itself, but rather 

 

466 Evaluation of the Offshore Safety Legislative Regime—A study undertaken by AUPEC Ltd. For the Safety Policy 

Division, Health & Safety Executive, Ref: 8938/3714, June 1999. 

467 Ibid at Ch 7. 468 Ibid at Ch 7, p 7-1. 

469 Ibid at Ch. 7, p 7-11. 470 This was based on the number of accidents per million man hours for the two Continental Shelves (Ibid, Figure 

7.8) 
Chevron Richmond Refinery Regulatory Report May 2014

111 

depends on the differing cultures and regulatory systems under which 

members of the industry operate.471 

In September 2013, Det Norske Veritas (DNV)472 released a position paper discussing necessary 

improvements to reduce risk of major offshore accidents, and noted in the report that “there are no good 

globally accepted metrics for major accident hazards...”473 However, DNV was able to point to UK 

HSE’s Hydrocarbon Releases Database System (HCR)474 in the North Sea to provide an example of 

improving safety performance trends.475 The HRC contains detailed voluntary information of over 4,000 

hydrocarbon releases offshore from close to 300 installations since 1992. The HRC data, plotted in 

Figure 3, show the total number of releases to be on the decline. Classifying the severity of a release is 

based on agreed-upon criteria with the offshore industry.476 The UK has defined significant events to be 

those that, if ignited, have the potential to cause a major accident where multiple casualties could occur. 

The occurrence of any hydrocarbon release is undesirable because of the potential to escalate, and so 

reporting data from minor incidents has also been included in Figure 3 below. 

Figure 3. Hydrocarbon releases in the North Sea reported to UK HSE as dangerous occurrences under the 

Reporting of Injuries, Diseases and Dangerous Occurrences Regulations.477

 

471 National Commission on the BP Deepwater Horizon Oil Spill. Deep Water: The Gulf Oil Disaster and the 

Future of Offshore Drilling. Report to the President; January 2011; Ch 8 p 225. 472 DNV is an independent foundation headquartered in Oslo, Norway, that provides services for managing risk 

around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013). 473 DNV. Enhancing offshore safety and environmental performance: Key levers to further reduce the risk of major 

offshore accidents. 2013; p 5. http://www.dnv.com/industry/oil_gas/services_solutions/offshore_safety.asp

(accessed September 10, 2013). 

474 https://www.hse.gov.uk/hcr3/ (accessed January 13, 2014). 475 In its position paper, DNV cited data from 1996, but UK HSE has noted that the criteria for severity classification 

was refined in 1999 so data since that date is presented here. 

476 Hydrocarbon Releases System Internet Help File, https://www.hse.gov.uk/hcr3/help/help_public.asp (accessed 

September 10, 2013). 

477 RIDDOR – Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 became effective 

offshore on April 1, 1996, http://www.hse.gov.uk/riddor/ (accessed September 10, 2013) 

0

50

100

150

200

250

Reported Releases

Financial Year (April‐March)

2000/01 to 2012/13

Minor

Significant

Major

Total
Chevron Richmond Refinery Regulatory Report May 2014

112 

It is important to note that major accidents are low-probability, high-consequence events, and as such they 

are difficult to measure. According to Dr. Andrew Hopkins, major accidents are more difficult to define 

than, say, a car accident, and they are rare, making it difficult to estimate the number of major accidents 

prevented.478 In addition, based on the data in existence, there is a continued need for improved data 

collection; key leading performance indicators development and implementation on a global scale would 

provide an improved glimpse into how safety is being managed for major accident prevention. 

A team of three independent safety experts was asked to conduct an independent evaluation of the 

operational effectiveness of the National Offshore Petroleum Safety Authority (NOPSA), which was 

established in January 2005 to regulate offshore health and safety in Australia (it was superseded by 

NOPSEMA in January 2012). The 2008 report released as a result of the evaluation noted that the team 

of experts received submissions identifying issues surrounding the safety case regime from twelve 

stakeholders, including the Australian Workers Union, the Maritime Union of Australia, and the 

International Association of Drilling Contractors. The report states that a majority of the submissions 

expressed that the safety case regime had “generally been a success...” and “had led to improvements and 

already brought forth better consistency in many areas....”479 The report noted that there was general 

stakeholder agreement “that the regulatory processes have been improved.”480 

As mentioned in Section 3.2.1.2 of the report, following the Macondo incident in April 2010, an 

independent review of the offshore safety case regime in the UK was conducted by a panel consisting of 

three independent appointees, including Professor Geoffrey Maitland at Imperial College London. A 

report was published discussing the review in December 2011, and it noted that, while not perfect, the 

offshore safety case regime was “robust and effective at identifying risks and appropriate measures for 

mitigation and response....”481 The report stated the following: 

From its analysis of the existing UK framework and the information it 

gleaned from its discussion with those directly involved in the sector 

from both an operational and regulatory perspective, the Review 

Panel was reassured that the UK regime already incorporates a 

number of positive, key features which were not present in the US at 

the time of the Macondo incident. At a high level, the Panel notes and 

commends in particular: 

• the UK’s “goal-setting” safety regime and its ability to foster 

innovation and continuous improvement in process integrity, 

 

478 Hopkins, Andrew. The Cost-Benefit Hurdle for Safety Case Regulation: A discussion paper prepared for the US 

Chemical Safety Board. Add Date, Page, and Link. 

479 Ognedal, Magne; Griffiths, Derek; and Lake, Bruce. Review of the National Offshore Petroleum Safety Authority 

Operational Activities. February-March 2008; p 14. 480 Ibid at 28. 481 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. 

December 2011; p 4. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875-

offshore-oil-gas-uk-ind-rev.pdf (accessed January 13, 2014). 
Chevron Richmond Refinery Regulatory Report May 2014

113 

• the strength of the mechanisms in place for independent, third party 

verification in the crucial areas of well design and integrity of safety 

critical equipment, 

• the rigour with which the potential environmental impacts of the 

industry are examined and of the controls and procedures in place to 

mitigate them, 

• the detailed and comprehensive emergency response framework 

which exists for managing the consequences of incidents should they 

occur, 

• the high regard in which the UK authorities, in the form of DECC, 

HSE and MCA, are held both by UK operators and international 

observers, 

• the fact that the events in the Gulf of Mexico have clearly acted as a 

catalyst for UK operators, working in concert with the regulators and 

other stakeholders, to redouble their efforts to improve safety and to 

strengthen response capabilities.482 

5. The UK HSE has published reports483 showing significant industry problems with maintenance of 

safety critical equipment, poor understanding of the potential impact of degrading plant and utility 

systems on safety critical elements, and lack of understanding of the role of asset integrity and the concept 

of barriers in major hazard risk control. Don’t these reports developed by the UK regulator demonstrate 

that the safety case is not effective and is not working? 

The CSB recognizes that there have been critiques of the safety case regime and its implementation. The 

CSB acknowledges that the safety case is not perfect and that no regulatory system will be perfect in its 

implementation. Some have noted the issue of aging equipment due to many issues, including the harsh 

conditions that exist in the North Sea. Regulators and commissions in the UK have found degradation of 

pipes, valves, and other equipment at many facilities due to company deferrals of maintenance, 

insufficient testing of safety-critical elements, and a continuing industry culture of responding to 

disasters, rather than anticipating worst-case scenarios. However, the safety case regime’s adaptive 

nature has been able to address these concerns. The HSE has recognized asset integrity management and 

the issue of ageing equipment as key issues to address in its inspection programs, and has developed 

internal processes and priorities for these areas. 

In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the 

operation of installations beyond their design life.484 The same year, the HSE published a report intended 

 

482 Ibid at 3. 

483 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme 

carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See

http://www.hse.gov.uk/offshore/kp3.pdf (accessed August 28, 2013). 484 The report is available at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 

2013). 
Chevron Richmond Refinery Regulatory Report May 2014

114 

to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A 

Summary Guide,485 which provides an overview of ageing plant mechanisms and their management and 

presents the findings of an analysis of loss of containment incidents to indicate the extent to which ageing 

plant equipment may be a factor. This type of programmatic proactive approach and information 

dissemination is lacking in the US both on and offshore. 

6. How have other countries implemented the safety case regime? What challenges do the countries face 

when transitioning to a safety case approach? 

From the international safety case community, the CSB has found that when transitioning to a safety case 

regime there are many obstacles that may hinder the transition, such as: 

 Major stakeholders not being committed to the process, unconvinced of the need; 

 Lack of understanding that the safety case regime is a “process” to be undertaken by the duty 

holder and the workforce to improve understanding of the hazards, risks, and their controls, and 

to put in place measures for continuous improvement, rather than just creation of a “document”; 

 Lack of sufficient funding by government and industry; and 

 Lack of the necessary legislative timetable. 

The transition to a safety case regime has significant challenges for both the duty holder and the regulator, 

including: 

 The safety case report could be treated as a check-the-box exercise; 

 Documented safety management system does not reflect reality; 

 Poor identification of hazards and risks; 

 Poor understanding of the performance of control systems; 

 Attempting to justify existing controls rather than to seek opportunity to improve; 

 Insufficient workforce involvement in the process; 

 The safety case process is under-resourced; 

 The safety case report is “inaccessible” so the report simply lives on the shelf; 

 The regulator does not use the safety case report to inform the inspection or audit; 

 Limited requirement for the reporting of accidents, dangerous occurrences and precursors 

resulting in lack of comprehensive performance data; and 

 The regulator is under-resourced, technically challenged, poorly trained, has poor systems and 

procedures, and is inconsistent. 

In implementing the safety case regime, there should be regard for the regulatory principles and 

frameworks which represent best practice. The underlying principles are: 

 The legislation and regulation should be fit for purpose, not simply superimposed on existing 

prescriptive regulation; 

 

485 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013). 
Chevron Richmond Refinery Regulatory Report May 2014

115 

 Regulation should be effective and efficient; and 

 Industry should move away from a culture of compliance with detailed prescriptive regulation to 

one of involving the workforce in understanding the hazards. 

Some significant points worth noting from international experience in setting up the regulation are: 

 Staff should be recruited against detailed job descriptions and should cover the full range of 

technical, management and regulatory requirements; 

 Pay rates and terms and conditions should be sufficient to attract highly qualified staff; 

 A competency framework needs to be developed reflecting the required knowledge, skills, and 

experience required to undertake; 

 Appropriate training programs must be in place; 

 An electronic dedicated safety case assessment procedure which captures the detail of the process 

to be followed and records the background to the decision-making process will be needed. This 

helps ensure good quality, consistent, and transparent assessment and provides a database of 

information which is used for future validation/topic facility inspections. It also provides a 

comprehensive record of the process which can be used in the event of an appeal against an 

assessment decision; 

 An accident and dangerous occurrence data base will be needed to store knowledge and data to 

provide reference information and the capacity to analyze trends; and 

 An emergency reporting and response process is necessary to ensure all significant events are 

properly logged and dealt with. 
Chevron Richmond Refinery Regulatory Report May 2014

116

Appendix D: CSB Staff Response to the Board’s Motion to 

Postpone issued on January 15, 2014

Background

On January 15, 2014, the CSB held a public meeting in Richmond, California, to present the draft 

Chevron Regulatory Report for a vote by the Board. In the first CSB Chevron Report (the Chevron 

Interim Report), which was approved by the Board on April 19, 2013, the CSB staff committed to 

investigating additional issues which would be presented in a final report on the incident. These issues 

included the regulatory oversight of petroleum refineries in California. Due to deployments to West, 

Texas, and Geismar, Louisiana, the CSB Chevron investigation team produced a second interim draft 

report focused solely on the regulation of petroleum refineries. At the Richmond public meeting, the 

Board moved to postpone a vote on the draft regulatory report in order for the CSB investigation staff to 

address additional issues raised concerning regulatory oversight of petroleum refineries and the proposed 

safety case regime. The CSB staff was given 120 days from the date of the public meeting to respond to 

the motion. The following document contains the CSB staff’s response.

I.

1. Does Cal/OSHA have sufficient authority to require timely abatement of hazards associated 

with serious and willful violations? 

CSB Investigations Staff Response: 

Following the August 6th incident at the Chevron Richmond Refinery, Cal/OSHA cited Chevron for, 

among other things, failing to replace pipe clamps at the refinery, and ordered Chevron to replace those 

pipe clamps by a certain date. The CSB Chevron Interim Report states that Chevron has a history of 

frequently using leak repair clams to externally stop process fluid leaks, and that following discovery of 

the leak on the 4-sidecut piping prior to the incident, “Chevron hoped to forestall a shutdown by installing 

a leak repair clamp.”486 The CSB determined that Chevron had more than 100 clamps on hydrocarbon 

and other piping components containing hazardous flammable process fluids at the Richmond refinery 

and that reliance on such clamps to mitigate leaks “identifies serious questions about its mechanical 

integrity program.”487 The interim report, which was approved by the Board on April 19, 2013, 

committed to evaluating the Chevron Richmond Refinery’s use of clamps and its mechanical integrity 

program as they relate to the refinery’s process safety culture in the final CSB report on the Chevron 

incident. 

A letter written by California Representative George Miller dated January 15, 2014, which was delivered 

to Chevron investigators at the January 15th public meeting, discussed Chevron’s use of clamps and 

expressed concern that some of the clamps have not been replaced, and will not be replaced until late 

 

486 CSB. Chevron Interim Report. April 19, 2013; p 62. 

487 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

117

2014. The letter stated that under the California Labor Code, an employer is not obligated to correct a 

Cal/OSHA safety violation if they appeal. According to Representative Miller, Chevron appealed its 

Cal/OSHA citations on February 19, 2013. In the letter Rep. Miller requested that given these facts, the 

CSB investigators should assess the issue of timely abatement, and consider making recommendations to 

the Legislature and Governor on this matter. 

The first question raised by the Board in its motion to postpone is the same as the first issue raised in 

Representative Miller’s letter. The CSB staff notes that while it has already committed to evaluating the 

use of clamps at the Chevron Richmond Refinery as it relates to mechanical integrity and process safety 

culture, we are not aware of a causal connection between the refinery’s use of the clamps to mitigate leaks 

and the August 6th incident. Regulatory bodies often cite companies for deficiencies following an 

incident that are not related to that incident. However, the CSB is directed under the Clean Air Act to 

“investigate (or cause to be investigated), determine and report to the public in writing the facts, 

conditions, and circumstances and the cause or probable cause” of an accidental release.488 (emphasis 

added). The CSB’s Board Order 040, Procedure G: Causal Analysis, discusses requirements of formal 

analysis tools that identify the multiple causes of an incident, including technical, organizational, and 

societal causes. Thus, while the CSB staff committed to analyzing the issue of clamps at the refinery as it 

pertains to safety culture, the staff did not analyze the usage of clamps and abatement in its regulatory 

report, as it was not determined to be causal and was therefore not within the scope of the regulatory 

investigation. 

2. Should Contra Costa County Health Services have direct enforcement authority under the 

Industrial Safety Ordinance?

CSB Investigations Staff Response: 

This question mirrors the second issue Representative Miller raises in his letter – that enforcement under 

the Industrial Safety Ordinance (ISO) is through the District Attorney, while Contra Costa County has the 

authority to enforce the California Accidental Release Program (CalArp) regulations because CalArp is 

considered to be a CUPA program, while the ISO is not. 

The CSB staff looked into this matter further, including interviewing key personnel, and determined that 

while having enforcement power is generally beneficial, a CSB recommendation on the issue is not 

warranted in this case, as Contra Costa County’s lack of enforcement authority under the ISO is not 

causal to the August 6th incident. According to Contra Costa County officials, the inspectors have never 

gone to the District Attorney to enforce the ISO. In addition, these officials have stated to the CSB that 

the Chevron Richmond Refinery has cooperated fully with past recommendations and has addressed any 

violations issued as a result of any audit conducted by Contra Costa County inspectors. While the CSB 

agrees that having enforcement power provides the regulator with another tool to ensure compliance with

regulations, there is no causal connection to the August 6th incident and therefore no additional 

recommendation regarding this issue is warranted. 

 

488 42 U.S.C. §7412 (r)(6)(C)(i) (1990). 
Chevron Richmond Refinery Regulatory Report May 2014

118

3. Does Contra Costa County Health Services have sufficient resources to conduct 

comprehensive inspections and retain technically qualified personnel?

CSB Investigations Staff Response: 

This question mirrors the third issue brought up in Representative Miller’s letter – he would like to see 

additional resources allocated to the Contra Costa Hazardous Materials Program to allow for additional 

hiring of qualified inspectors. The draft report discusses on the bottom of page 90 the lack of resources 

and funding within the Contra Costa Hazardous Materials Program, which has limited its ability to hire 

additional highly qualified staff to oversee the petroleum refineries in Contra Costa County. The 

engineers are part of a bargaining unit and their salaries are paid through the county’s general fund, which 

has experienced annual budget reductions in the millions. Again, the CSB did not find that this lack of 

funding was necessarily causal to the incident. However, the CSB staff proposes to produce the following 

additional recommendations in the draft regulatory report for additional funding:

Mayor and City Council,

City of Richmond, California

2012-03-I-CA-R21

Implement or cause to be implemented a compensation system to ensure the regulator has the ability to 

attract and retain a sufficient number of employees with the necessary skills and experience to ensure 

regulator technical competency. Periodically conduct a market analysis and benchmarking review to 

ensure the compensation system remains competitive with California petroleum refineries. 

Board of Supervisors

Contra Costa County, California

2012-03-I-CA-R22

Implement a compensation system to ensure the regulator has the ability to attract and retain a sufficient 

number of employees with the necessary skills and experience to ensure regulator technical competency. 

Periodically conduct a market analysis and benchmarking review to ensure the compensation system 

remains competitive with California petroleum refineries. 

4. Does Contra Costa County Health Services have sufficient authority to require facilities to 

undertake feasible risk reduction measures, such as best practices, which go beyond minimum 

regulatory requirements? 

CSB Investigations Staff Response: 

This last question mirrors the fourth and final issue discussed by Representative Miller in his letter – the 

need to authorize Contra Costa regulators to require risk reduction measures that go beyond regulations. 

He requests that the CSB make recommendations to strengthen the ISO by authorizing the Contra Costa 
Chevron Richmond Refinery Regulatory Report May 2014

119

County Hazardous Materials Program officials to require refineries to adopt best industry practices or 

standards as part of its tool kit. 

The draft report discusses on page 89 that Contra Costa engineers conduct CalArp and ISO/RISO audits 

concurrently at each covered facility generally once every three years. The engineers are only able to 

audit against the regulatory requirements, and while they can issue “consider” action items to the facility 

recommending actions above and beyond regulatory requirements, they do this very infrequently. 

The Chevron Interim Report addressed ISO regulatory deficiencies, including the fact that there is no 

required implementation of inherent safety (unlike in the safety case). The Interim Report issues 

recommendations R3, R4 and R6 and R7, which request the City of Richmond and Contra Costa County 

to revise the ISO to require damage mechanism hazard reviews and the documented use of inherently 

safer systems analysis and the hierarchy of controls “to the greatest extent feasible” in establishing 

safeguards for identified process hazards. The recommendations note that the goal shall be to drive the 

risk of major accidents to As Low As Reasonably Practicable, or ALARP. 

The ISO is currently being revised to implement these recommendations, and should be finalized as early 

as June 2014. The revised regulatory language would require facilities to reduce risk to “the greatest 

extent feasible,” which is a concept that is very similar to ALARP. Contra Costa County will have the 

ability to issue guidance that elaborates on what will be required to achieve that standard. 

The CSB staff believes that these recommendations cover the issue raised in this question, and no 

additional recommendations are warranted. 

II.

Note: CSB staff members Don Holmstrom, Cheryl MacKenzie, and Amanda Johnson traveled to the 

United Kingdom (UK) with Board Member Mark Griffon March 4th through the 14th to gather additional 

information on how the safety case is implemented and enforced in the UK for both the onshore and 

offshore oil and gas industry. The information gathered was produced in a notes document that was sent 

via email to CSB employees and Board members on March 31, 2014, and discussed with all agency staff 

and the Board on April 15, 2014. The information gathered by the CSB staff is also reflected in the 

responses to Part II of the Board Motion. 

The CSB staff shall convene a multidisciplinary expert panel (selected by the full Board), similar to 

the Baker Panel established after the BP Texas City incident, to provide the agency with an 

assessment of the following topics regarding regulating process safety in refineries in California:

1. To address questions raised in the comments received by the CSB, the panel shall assess the 

available process safety performance data to evaluate the effectiveness of the safety case regulatory 

model for refineries.

CSB Investigations Staff Response: 
Chevron Richmond Refinery Regulatory Report May 2014

120

It is necessary first to address the issue of convening a panel. Creating a panel similar to the Baker Panel, 

which cost roughly $30 million (funds that were fully covered by BP), would require a considerable 

amount of time, money, and resources that the CSB cannot afford. In addition, there are a number of 

procedural steps that must be met in order to establish this type of panel, known as a Federal Advisory 

Committee Act, or FACA, committee -- drafting and approval of a charter (including publication in the 

Federal Register), selection of Panel Members, financial conflict checks for Panel Members, need to 

maintain Panel membership balance, public meeting notices, etc. An advisory committee under the 

FACA can be created only when it is essential to the performance of a duty or responsibility conveyed 

upon the executive branch by law or Presidential Directive. Finally, Executive Order 12838 issued by 

President Clinton ordered executive departments and agencies to refrain from creating or sponsoring a 

new advisory committee subject to FACA “unless the committee is required by statute or the agency head 

(a) finds that compelling considerations necessitate creation of such a committee, and (b) receives the 

approval of the Director of the Office of Management and Budget.489” The CSB staff advises that 

creating a panel in this instance is neither compelling nor feasible. 

To address Question 1, it is important to note that the Chevron Regulatory Report Draft FAQ 4 addressed 

the data surrounding the safety case and the occurrence of accidents. The FAQ stated that UK Health and 

Safety Executive’s (HSE’s) Hydrocarbon Releases Database System (HCR)490 in the North Sea, which 

contains detailed voluntary information of over 4,000 hydrocarbon releases offshore from installations 

since 1992, shows the total number of hydrocarbon releases offshore to be on the decline. The draft 

report also stated on pages 57 and 58 that the Petroleum Safety Authority (PSA) in Norway conducts 

analysis of indicator data as well and produces results on its website. Its analysis showed a decreasing 

trend in the number of reported hydrocarbon leaks offshore between 2007 and 2010. According to the 

data the Oil & Gas UK is collecting, the number of hydrocarbon releases has decreased over the last three 

years (roughly cut in half), but now they are going back up again, and they working to determine why. 

This highlights the usefulness in the collection and publication of indicator data, and it helps the industry 

to work towards continuous improvement. 

While in the UK, the CSB staff spoke with Peter Davidson of the UK Petroleum Industry Association 

(UKPIA), a trade association that represents 9 member companies in the downstream oil and gas industry. 

This includes seven onshore petroleum refineries and roughly 30 terminals in the UK.491 The CSB staff 

learned that API 754 was adopted by UKPIA for onshore facilities in the UK, except that it was improved 

by adding criteria for root causes, and a tier 3 for small fire was created. UKPIA collects indicator data 

annually from all facilities within the onshore downstream oil and gas sector, analyzes the data, and 

produces an external report that is published and shared with the companies and with the public on their 

website. A more detailed analysis is published internally, and it drives UKPIA’s agenda. The UKPIA’s 

most recent annual Statistical Review (2013 Statistical Review), which is currently available on the 

UKPIA website,492 includes a section entitled Process Safety, which UKPIA states was produced as one 

of the key objectives of the UKPIA’s commitment to process safety, and in response to improvements 

 

489 Termination and Limitation of Federal Advisory Committees. Exec. Order No. 12838, 58 Fed. Reg. 28 (February 

12, 1993). http://www.archives.gov/federal-register/executive-orders/pdf/12838.pdf (accessed April 3, 2014). 

490 https://www.hse.gov.uk/hcr3/ (accessed April 3, 2014). 

491 See http://www.ukpia.com/home.aspx for more information. 

492 See http://www.ukpia.com/files/pdf/statsreview2013.pdf (accessed April 3, 2014). 
Chevron Richmond Refinery Regulatory Report May 2014

121

being made post-Buncefield regarding the reporting of key process safety performance indicators. This 

section provides data based on the indicators gathered that are classified as Tier 1, Tier 2, and Tier 3. 

According to the published data, the number of Tier 1 and Tier 2 events at refineries has decreased 

between 2010 and 2012 as well as the number of Tier 1 fires or explosions by consequence and the 

number of Tier 2 events by consequence.493 They want more sharing and learning from incidents, and 

want to improve searchability of data on their website. 

2. Assess the challenges of making safety case operational and effective with regard to the following 

topics:

a. What is the role of transparency and community involvement under this regime? Are 

safety case reports made public?

CSB Investigations Staff Response: 

In Australia, a summary of the safety case report is made public. In the UK, the CSB staff has learned 

that prior to 9/11 a similar summary was made publicly available. However, due to security reasons post9/11, the UK ceased to make that summary available under a Secretary of State order. A redacted version 

is available through the FOIA process in the UK. For example, the Elgin installation safety case was 

made available through a FOIA request following the 2012 Elgin blowout incident. Seveso III, the EU 

directive that will be effective as of June 2015, will broaden the availability of information. Seveso III 

“strengthens a number of areas such as public access to information and standards of inspection....”494 As 

the Chevron Regulatory Report Draft notes, the Seveso II Directive is currently implemented in the UK 

through the Control of Major Accident Hazards (COMAH) Regulations. Seveso III will be implemented 

through new COMAH Regulations as of June 1, 2015. 

According to the HSE, the European Commission updated the Seveso Directive in accordance with the 

Aarhus Convention on public information, public participation in decision-making, and access to justice 

on environmental matters. The changes will mean that “the level and quality of information for the public 

will need to be improved...[and] the information will need to be available electronically and kept up to 

date.”495 In addition, “[r]equests from the public to see a safety report will be considered on a case-bycase basis as the current Secretary of State Direction will no longer apply.”496

 The HSE told the CSB that 

Seveso III also calls for public reports which show how the performance of industry has improved or 

worsened. 

In addition, as mentioned above, the UKPIA publishes numerous documents, including statistical reviews 

containing data analysis on its website to aid in transparency and community awareness. The HSE told 

the CSB staff that there is also transparency in the way the HSE does its work. For example, the HSE 

enforcement decision processes for the safety case are available to the public online. The decision 

 

493 Ibid at 44 – 46. 

494 See http://www.hse.gov.uk/seveso/introduction.htm (accessed April 3, 2014). 

495 See http://www.hse.gov.uk/seveso/public.htm (accessed April 3, 2014).

496 Ibid. 
Chevron Richmond Refinery Regulatory Report May 2014

122

process for accepting or rejecting a safety case is also public. Oil & Gas UK stated to the CSB staff that 

they publish a list of incidents on their website that includes the name of the operator, the type of release, 

and the quantity. They also have data on safety critical backlog and other metrics on their website. 

The level of transparency the team saw in the UK is much greater than in the US – the regulator’s

activities, standards, data, and other information is made available online to the public and is part of how 

these groups are continuously working in the UK to improve process safety. The potential 

recommendation to California in the Chevron Regulatory Report Draft addresses the importance of 

transparency and community involvement, as it includes a provision to require “reporting of information 

to the public to the greatest extent feasible such as a summary of the safety report, the process hazard 

analysis, a list of safeguards implemented and standards utilized to reduce risk, and process safety 

indicators that demonstrate the effectiveness of the safeguards and management systems....”

b. How are workers empowered as part of the tripartite model? Have there been 

retaliatory actions taken against workers for their involvement, and what protective measures are 

in place?

CSB Investigations Staff Response: 

The CSB staff spent one of its days in the UK at a launch of a workforce initiative of great importance 

called the Workforce Engagement Support Team, or WEST. WEST is a workforce-led organization with 

tripartite membership from industry, the workforce, unions, and the regulator with the goal of creating a 

single consistent workforce agenda. This event brought together hundreds of individuals from the 

offshore oil and gas industry, including safety representatives, unions, and the HSE. The CSB staff set up 

a booth at the event and held 30-minute sessions where we engaged in an open dialogue with attendees 

discussing workforce engagement and involvement issues offshore. The CSB staff heard a lot from 

workers and safety representatives about the various levels of workforce involvement. One individual 

stated that best practice was introduced by the safety case, and this does not exist with compliance-based 

regulation. Another person stated that if a safety case is deficient, that means there was likely a lack of 

workforce involvement. We heard that there is safety representative involvement in ALARP, bowtie 

development and review, hazard analysis, and other safety activities. We also heard that the level of 

involvement may depend on the culture of the installation. It was really a defining moment to experience 

this kind of open dialogue between different groups that have come together to work to improve safety 

offshore. The CSB staff has never seen this kind of communication or collaboration in the US.

In addition, two years ago Step Change launched the workforce engagement tool – a survey meant to 

measure workforce involvement and organizational culture of each offshore manned facility. Over 

10,000 workers have taken the survey and the results are currently being analyzed. Workers at the WEST 

launch told the CSB that the surveys are helpful and allow each installation to drive forward and improve. 

The potential recommendation in the Chevron Regulatory Report Draft reflects the importance of 

workforce involvement, as it proposes that California “[u]se[] a tripartite model where the regulator, the 

company, and the workers and their representatives play an equal and essential role in the direction of 

preventing major accidents.” The CSB has also noted that while workers do not have stop work authority 
Chevron Richmond Refinery Regulatory Report May 2014

123

in the UK, they do in Norway. Unions in the UK, such as Jake Molloy with RMT, have argued for stop 

work authority for UK offshore workers. The CSB staff included language in its potential safety case 

recommendation to California reflecting the importance of this type of authority. The potential 

recommendation currently states: “The representatives should also have the authority to stop work that is 

perceived to be unsafe or that presents a serious hazard until the regulator intervenes to address the safety 

concern.” 

c. Are safety committees mandatory or optional in non-union workplaces? How are safety 

committee members selected, and under what authority?

CSB Investigations Staff Response: 

The Chevron Regulatory Report Draft discusses on page 54 the fact that the law in the UK provides for 

consultation with employees or their safety representatives on health and safety matters at both unionized 

and non-unionized onshore facilities under the Safety Representatives and Safety Committees 

Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996. It is 

important to note, however, that all onshore oil and gas facilities in the UK are unionized. These 

regulations go further than the OSHA PSM standard in that they provide for the election of safety 

representatives by workers to serve many health and safety-related functions, including investigating 

complaints and accidents, and carrying out inspections. The regulations also require employers to 

establish a safety committee when one is requested by at least two health and safety representatives. 

According to the HSE offshore division, it is up to the companies to decide how much they involve 

workers. Safety representatives have the legal right to initiate their own investigations, conduct 

inspections, resolve hazard complaints, and participate in risk management reviews and the development 

of safety case reports. The HSE also stated that an issue has been the competency and sufficiency of 

training of the safety representatives, and as such, the HSE is initiating more training to improve the 

involvement of safety representatives. 

The Chevron Regulatory Report Draft proposes that California develop a regulatory model and 

accompanying guidance based on these UK regulations, and that the elected representatives should have a 

legally recognized role that goes beyond consultation in activities such as the development of the safety 

report, process hazard analysis, management of change, incident investigation, audits and identification 

and effective control of hazards. Workforce participation practices should be documented by the 

company and submitted to the regulator. 

d. Is there a public data base of incident and near miss reporting? How are process safety 

performance indicators developed and used? Are these made public?

CSB Investigations Staff Response: 

As discussed above, UKPIA collects Tier 1, Tier 2, and Tier 3 indicator data annually from all facilities 

within the onshore downstream oil and gas sector, analyzes the data, and produces an external report that 
Chevron Richmond Refinery Regulatory Report May 2014

124

is published online and shared with the companies and with the public on their website. A more detailed 

analysis is published internally, and it drives UKPIA’s agenda. According to the COMAH Process safety 

performance indicators Operational Delivery Guide, by the end of 2015 all COMAH sites will measure 

their performance using “key leading and lagging performance indicators.”497 The expectation for 

COMAH sites as noted in this document is as follows:

– Have a programme for PSPIs [process safety performance indicators] – as one of the main ways the 

adequacy and performance of PS risk is managed, 

– PSPI’s are linked to effective Process Safety Leadership and should be used to inform high level 

decision making, 

– KPIs should be set according to risk profile of the activities undertaken 

– Adopt both Outcome (lagging) and Activity (leading) indicators, 

– Use the findings from the KPI programme to drive improvements on site, and 

– share sector performance data with the CA as part of a dialogue about performance.498

Inspectors are expected to monitor progress made towards the development of these indicators every 12 

months and ensure it is “based on sound decisions/information.”499

Offshore, the HSE collects major accident data, hydrocarbon releases, and dangerous occurrence data. 

The offshore industry also collects a number of indicators and voluntarily provides them to Oil & Gas UK 

for annual industry data analysis. This data includes hydrocarbon releases, safety critical maintenance 

backlog, the number of failure identified by third party verification, the number of operational risk 

assessments in place, and employee involvement (scores of each facility based on safety culture survey). 

During the regulator’s inspection process, also known as the intervention, the HSE can ask for 

information on the company’s indicator’s system and for all of this industry-wide key performance 

indicators (KPI) data. The Oil & Gas UK is looking at what else could be usefully collected, and they are 

working on sharing more information. They want more sharing and learning from incidents, and want to 

improve searchability of data on their website. According to the data the Oil & Gas UK is collecting, the 

number of hydrocarbon releases has decreased over the last three years (roughly cut in half), but now they 

are going back up again, and they working to determine why. This highlights the usefulness in the 

collection and publication of indicator data, and it helps the industry to work towards continuous 

improvement. 

e. How are standards for minimum levels of risk set (ALARP presumably goes beyond 

minimum levels)?

CSB Investigations Staff Response: 

 

497 COMAH Competent Authority Workstream 2e, Process safety performance indicators (Operational Delivery 

Guide); p 3. http://www.hse.gov.uk/comah/guidance/process-safety-performance-indicators.pdf (accessed April 14, 

2014). 

498 Ibid. 

499 Ibid.
Chevron Richmond Refinery Regulatory Report May 2014

125

For both the onshore and offshore safety case regime, a majority of the time ALARP is determined by 

existing best practices or standards. The regulator does have the ability to require a company to go above 

and beyond best practice to reduce risk. According to the HSE onshore division, ALARP is an active 

process and dialogue between inspectors and the duty holder. It is not simply a paper exercise; there is 

rigorous back and forth. The initial calculation of ALARP by the duty holder onshore is quantitative. 

Then the question becomes, “can I/you do more to reduce risk?” There is a risk carrot posted on the HSE 

website that illustrates the goal of moving risk down toward the bottom of the carrot. The aim is to get to 

the broadly acceptable risk level, which usually involves both quantitative and qualitative analysis tools. 

According to Peter Davidson of UKPIA, there has been increased focus onshore on ALARP since the 

2005 Buncefield incident. If a new standard does come into existence, an existing facility must do a 

quantitative and qualitative gap analysis to demonstrate whether they can effectively mitigate risk without 

following the new standard. 

A lead inspector with HSE onshore told the CSB staff that he has an initial safety report rejection rate of 

almost 100 percent, and that there is an ongoing dialogue/negotiation that occurs between the regulator 

and the duty holder as to reduction of risk. This ongoing dialogue of risk assessment and reduction was 

said to be more valuable than the safety report itself. As such, the credibility, persuasiveness, and 

personal communication are key attributes of HSE inspectors. 

f. What are the enforcement methods used by regulators under the safety case?

CSB Investigations Staff Response: 

Post-Buncefield, the HSE onshore stated to the CSB that they greatly emphasize interventions, or 

inspections, to ensure that companies are fulfilling their safety reports. Roughly 70 percent of an HSE 

onshore inspector’s time is spent inspecting. They greatly emphasized to the CSB staff importance of the 

inspections and dialogue between the inspector and the duty holder rather than the safety report document 

itself. They stated that the rest of an inspector’s time is spent on safety report assessment, investigation, 

and enforcement. 

To begin the safety report review process, the HSE initially assesses ALARP and the risks/hazards. They 

screen to see what they have and where, onsite and offsite, worst case scenarios, ALARP 

demonstration/analysis. Next the inspector(s) look at the measures and controls in place. This is done by 

discipline – process safety, human factors, etc. Inspectors use the Safety Report Assessment Manual 

(SRAM) as a guide during an assessment. This guide is also provided to duty holders. Next, the 

inspectors come back together after they have assessed the report for a conclusions meeting. They 

discuss whether there are any “serious deficiencies” in the report. A mechanical integrity issue is often a 

serious deficiency. If there are serious issues, the HSE will issue a formal improvement notice for the 

company to address any deficiencies. Issuing such a notice requires “clear evidence.” 

If the HSE issues a COMAH prohibition notice, this stops a process in its tracks based on a serious 

deficiency. This results in the shutdown of the site. HSE issues three or four of these each year. Few 

regulators in the US have this direct power (Cal/OSHA does). 
Chevron Richmond Refinery Regulatory Report May 2014

126

The initial safety report assessment helps form the HSE’s intervention plan for the facility. The HSE 

inspector uses this plan during the verification and inspection of the facility on site. Here, the HSE 

inspector can tell whether the company is actually doing what they say they are in their safety report. As 

discussed above, roughly 70 percent of an HSE inspector’s time is spent on inspections. Most inspections 

are planned, because inspectors review complex issues that require site specialists to be present during the 

inspections. 

Each site visit has a detailed agenda and is provided to the facility roughly four weeks in advance of the 

visit. The HSE conducts 10 to 15 inspections per refinery per year; this results in an inspection report.

The Goal is to inspect every COMAH facility once every three years; high hazard profile sites once per 

year, and refineries are visited monthly due to the regulator’s assessment of higher risk at refineries. 

Offshore, the HSE can issue a prohibition notice if there is an immediate risk and “potential” for injury. 

During an appeal, this notice remains in effect. The HSE can also issue improvement notices that give the 

duty holder a period of time to make specific improvements. If they fail to make those improvements, the 

operation is stopped. Notices are placed on a public database once any appeal of a notice is resolved. 

g. What are the key transition issues that were addressed with facilities in operation at the 

time the safety case was adopted? 

CSB Investigations Staff Response: 

The Chevron Regulatory Report Draft discusses key transition issues in FAQ 6 on pages 114-115. Major 

issues include lack of sufficient funding, lack of stakeholder commitment to the process, under resourcing 

of the safety case process, the regulator is poorly trained or technically challenged, and insufficient 

workforce involvement in the process. 

It is also important to note that the CSB staff learned a lot of positives about the onshore COMAH and 

safety report process in the UK. For example, the staff learned that as a result of the Buncefield incident 

there has been an increased focus on inspections, there was a Process Safety Leadership Group formed 

that works to improve safety and share lessons learned, and there is more focus on ALARP. In addition, 

the staff learned from industry representatives that HSE onshore has a better reputation than HSE offshore 

in terms of inspections and challenging from the inspectors. HSE onshore is said to have a more robust, 

structured, inspection program, whereas HSE offshore needs to improve in that area. Overall, the CSB 

staff came away with a very positive view of the HSE onshore regime and COMAH. The amount of 

work that is put into continuous improvement, transparency, and workforce involvement is incomparable 

to what currently exists in the US. 

As a result of the Board’s motion and expressed concerns regarding the proposed recommendation, 

the CSB staff proposes the following restructured proposed recommendations for the state of 

California. 

California State Legislature,
Chevron Richmond Refinery Regulatory Report May 2014

127

Governor of California

2012-03-I-CA-R23

Based on the findings in this report, which detail effective features of chemical accident prevention 

regimes in other parts of the world, augment your existing process safety management regulations with a 

more rigorous regime that contains the following features:

a. A comprehensive process safety report written by the company that includes a systematic analysis and 

documentation of all major hazards and effective control methods implemented to reduce those risks to as 

low as reasonably practicable (ALARP);

b. A thorough review of the process safety report by technically competent regulatory personnel that 

requires modifications and improvements to the document as necessary prior to acceptance;

c. Audits and preventative inspections by the regulator to verify effective implementation of risk 

reduction measures;

d. A risk management approach that requires analysis and effective implementation of safeguards, using 

the hierarchy of controls, to protect people and the environment from major accident hazards. The 

effectiveness of the safeguards will be demonstrated through the use of leading and lagging process safety 

indicators;

e. Ability to adapt and implement safety requirements in response to newly identified hazards, advances 

in technology, lessons learned from major accidents, and improved safety codes without the need for new 

rule-making;

f. Determines when new or improved industry standards and practices are needed and initiates programs 

and other activities such as forums to prompt the timely development and implementation of such 

standards and practices;

g. Uses a tripartite model where the regulator, the company, and workers and their representatives play 

an equal and essential role in the direction of preventing major accidents;

h. A regulatory model and accompanying guidance based on the findings contained within this report on 

workforce engagement, which set out the legal framework for the rights and responsibilities of workers 

and their representatives on health and safety-related matters, and the election of safety representatives 

and establishment of safety committees (with equal representation between management and labor) to 

serve health and safety-related functions. The elected representatives should have a legally recognized 

role that goes beyond consultation in activities such as the development of the process safety report, 

process hazard analysis, management of change, incident investigation, audits, and identification and 

effective control of hazards. The representatives should also have the authority to stop work that is 

perceived to be unsafe or that presents a serious hazard until the regulator intervenes to resolve the safety 

concern. Workforce participation practices should be documented by the company to the regulator;
Chevron Richmond Refinery Regulatory Report May 2014

128

i. Requires reporting of information to the public to the greatest extent feasible such as a summary of the 

process safety report, the process hazard analyses, a list of safeguards implemented and standards utilized 

to reduce risk, and process safety indicators that demonstrate the effectiveness of the safeguards and 

management systems;

j. An independent, well-funded, well-staffed, technically competent regulator; and

k. A compensation system to ensure the regulator has the ability to attract and retain a sufficient number 

of employees with the necessary skills and experience to ensure regulator technical competency. 

Periodically conduct a market analysis and benchmarking review to ensure the compensation system 

remains competitive with California petroleum refineries. 

2012-03-I-CA-R24

To further implementation of the rigorous process safety scheme referenced in Recommendation 23, 

study or cause to be studied and implement the findings addressing issues and obstacles of 

implementation of a more rigorous regime such as transition, resources, funding, and methods to enhance 

transparency, community involvement, effective worker participation, and protecting workers from 

retaliatory action. 

2012-03-I-CA-R25

Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the 

state of California to develop and implement a system that collects, tracks, and analyzes process safety 

leading and lagging indicators from operators and contractors to promote continuous safety 

improvements. At a minimum, this program shall:

a. Require the use of leading and lagging process safety indicators to actively monitor the effectiveness 

of process safety management systems and safeguards for major accident prevention. Include leading and 

lagging indicators that are measureable, actionable, and standardized. Require that the reported data be 

used for continuous process safety improvement and accident prevention;

b. Analyze data to identify trends and poor performers and publish annual reports with the data at facility 

and corporate levels;

c. Require companies to publicly report required indicators annually at facility and corporate levels;

d. Use process safety indicators (1) to drive continuous improvement for major accident prevention by 

using the data to identify industry and facility safety trends and deficiencies and (2) to determine 

appropriate allocation of regulator resources and inspections; and
Chevron Richmond Refinery Regulatory Report May 2014

129

e. Be periodically updated to incorporate new learning from world-wide industry improvements in order 

to drive continuous major accident safety improvements in California.