United States of America

OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION

1120 20th Street, N.W., Ninth Floor

Washington, DC 20036-3457

ON BRIEFS:

Allison Graham Kramer, Attorney; Heather R. Phillips, Counsel for Appellate Litigation; Joseph 

M. Woodward, Associate Solicitor; M. Patricia Smith, Solicitor; U.S. Department of Labor, 

Washington, DC

For the Complainant

Gregory Dillard, Esq.; Christopher Bacon, Esq.; Tara Porterfield, Esq.; Vinson & Elkins, LLP, 

Houston, TX

For Respondent BP Products North America, Inc.

Felix C. Wade, Esq.; Angela M. Courtwright, Esq.; J. David Campbell, Esq.; Ice Miller, LLP, 

Columbus, OH 

For Respondent BP-Husky Refining, LLC

Kim Nibarger, USW H&S Specialist; United Steelworkers International Union, Pittsburgh, PA

For the Authorized Employee Representative

Mark S. Dreux, Esq.; Valerie N. Butera, Esq.; Arent Fox, LLP, Washington, DC 

For Amicus Curiae American Petroleum Institute 

Jonathan L. Snare, Esq.; Alana F. Genderson, Esq.; Morgan, Lewis & Bockius LLP, Washington, 

DC

For Amici Curiae American Chemistry Council and American Fuel & Petrochemical 

Manufacturers

SECRETARY OF LABOR,

BP PRODUCTS NORTH AMERICA, INC., and

BP-HUSKY REFINING, LLC,

Complainant,

Respondents,

v.

OSHRC Docket No. 10-0637

UNITED STEELWORKERS LOCAL 1-346,

Authorized Employee Representative.
2

DECISION

Before: MACDOUGALL, Chairman; ATTWOOD and SULLIVAN, Commissioners.

BY THE COMMISSION:

BP Products North America, Inc. operates a petroleum refinery in Oregon, Ohio. The 

refinery is owned by BP-Husky Refining, LLC. As part of its Refinery National Emphasis 

Program, a team of compliance officers and industrial hygienists from the Occupational Safety 

and Health Administration inspected the refinery from September 10 through December 18, 

2009. On March 8, 2010, OSHA issued three citations to Respondents (referred to collectively 

as “BP”) under the Occupational Safety and Health Act of 1970, 29 U.S.C. §§ 651-678, two of 

which were settled in their entirety prior to the hearing in this matter. The proceedings before 

Administrative Law Judge Sharon D. Calhoun concerned sixty-five items in Willful Citation 2, 

all of which allege violations of OSHA’s process safety management of highly hazardous 

chemicals (“PSM”) standard, 29 C.F.R. § 1910.119.1 This standard “contains requirements for 

preventing or minimizing the consequences of catastrophic release of toxic, reactive, flammable, 

or explosive chemicals. These releases may result in toxic, fire or explosion hazards.” 29 C.F.R. 

§ 1910.119(a).

For the alleged violations, the Secretary proposed a total penalty of $2,870,000. 

Following a nineteen-day hearing, the judge vacated all but five of these items, each of which 

she affirmed as serious and for which she assessed a total penalty of $35,000. Fifty-six of the 

Willful Citation 2 items are on review before the Commission.2 These items concern various 

aspects of pressure relief equipment, cross-connections between systems in the refinery, and the 

siting of various buildings and facilities. For the reasons that follow, all but two of the items are 

vacated as a result of the Secretary’s failure to prove a prima facie case.

3

 The two affirmed 

 

1 Before the judge, the Secretary withdrew Items 2b, 3b, and 42 of Willful Citation 2.

2 Nine of the items vacated by the judge—Items 13, 14b, 16b, 17b, 18b, 28, 29, 30, and 41—are 

not challenged by the Secretary on review.

3 To establish a violation of an OSHA standard, the Secretary must prove that: (1) the cited 

standard applies; (2) its terms were violated; (3) employees were exposed to the violative 

condition; and (4) the employer knew or could have known of the violative condition with the 

exercise of reasonable diligence. See Briones Util. Co., 26 BNA OSHC 1218, 1219 (No. 10-

1372, 2016).
3

items—Items 31a and 31b that concern cross-connections—are grouped as serious and assessed

a single penalty of $7,000.

I. Items 2a through 12a, and 4b through 12b

Background on RAGAGEP

The PSM standard took effect in May 1992 as a performance standard. Process Safety 

Management of Highly Hazardous Chemicals, 57 Fed. Reg. 6356, 6356, 6360 (Feb. 24, 1992). 

One significant aspect of the PSM standard is the requirement that employers compile 

information about their process equipment and use this information to self-assess the equipment 

for hazards, and then, if necessary, to implement corrective safeguards. 29 C.F.R. § 

1910.119(d), (e), (j). Here, the PSM provision cited in Items 2a through 12a requires an 

employer to “document that equipment complies with recognized and generally accepted good 

engineering practices” as part of its process safety information under § 1910.119(d); and the 

provision cited in Items 4b through 12b requires the employer to “correct deficiencies in 

equipment that are outside acceptable limits (defined by the process safety information in 

paragraph (d) . . . ) before further use or in a safe and timely manner when necessary means are 

taken to assure safe operation.” 29 C.F.R. § 1910.119(d)(3)(ii), (j)(5).

Items 2a through 12a, and 4b through 12b involve a concept, central to an employer’s 

compliance responsibilities under the PSM standard, that the Commission has not previously 

addressed: “[R]ecognized and generally accepted good engineering practices” (“RAGAGEP”). 

This concept is referenced in two paragraphs of the standard, § 1910.119(d)(3)(ii) and (j)(4)(ii), 

the former of which is at issue on review here, and it is also discussed in the PSM standard’s 

non-mandatory Appendix C. RAGAGEP is not defined in either the text of the PSM standard, 

its preamble, or the non-mandatory appendix.

4 However, non-mandatory Appendix C provides 

 

4

It was not until 2013 (and thus after the inspection and issuance of the instant citation) that 

OSHA offered a definition of the phrase RAGAGEP when it published a request for information 

(“RFI”) pursuant to an Executive Order. Process Safety Management and Prevention of Major 

Chemical Accidents, 78 Fed. Reg. 73,756 (Dec. 9, 2013) (RFI issued in response to Improving 

Chemical Facility Safety and Security, Exec. Order No. 13,650, 78 Fed. Reg. 48,029 (Aug. 1, 

2013)). OSHA’s RFI requested comments on ways to modernize its PSM standard, and it cited 

to a source definition for RAGAGEP from the Center for Chemical Process Safety (“CCPS”), 

which OSHA recognized as “an example of a safety organization that recommends additional 

management-system elements”:
4

some examples of what could be used to “establish” RAGAGEP, such as: requirements 

contained in published consensus standards and codes and “technically recognized report[s]” 

from engineering societies. 29 C.F.R. § 1910.119, App. C.3. At issue in this case is whether the 

Secretary has met his burden to establish that BP was obligated under the PSM standard to 

comply with the specific engineering practice that he asserts is RAGAGEP.

Background on Inlet Pressure Drop

BP’s refinery uses numerous pressure vessels in its refining process. Pressure relief 

valves are needed to protect against excessive pressure in many of these vessels. Each relief 

valve referenced in Items 2a through 12a, and Items 4b through 12b, is attached to a pipe (known 

as an “inlet line”) that connects the relief valve to a vessel. The allegations in these citation 

items relate to an aspect of pressure relief known as “inlet pressure drop” or “IPd.” IPd is the

amount of pressure loss that results from friction that is created when material flows through an

inlet line and into an open pressure relief valve.

A relief valve opens when pressure in the vessel protected by the valve exceeds the “set 

pressure,” which is normally the vessel’s maximum allowable working pressure. The valve then 

closes once the pressure at the valve decreases to the “reseat” pressure, which is fixed below the 

set pressure to ensure that the valve closes properly. The difference between the set pressure and 

reseat pressure is called the “blowdown.” The IPd exceeds the blowdown when a loss in 

pressure between the vessel and the valve (due to friction) is greater than the difference between 

the set and reseat pressures. An IPd that exceeds the blowdown may cause the valve to 

“chatter”—meaning that it rapidly opens and closes—potentially resulting in a failure of the 

relief installation and a catastrophic release of material, in this case hydrocarbons. Thus, IPd is 

 

Recognized And Generally Accepted Good Engineering Practices . . . are the 

basis for engineering, operation, or maintenance activities and are themselves 

based on established codes, standards, published technical reports or 

recommended practices (RP) or similar documents. RAGAGEPs detail generally 

approved ways to perform specific engineering, inspection or mechanical integrity 

activities, such as fabricating a vessel, inspecting a storage tank, or servicing a 

relief valve. 

Id. at 73,761. OSHA noted that while CCPS’s definition of RAGAGEP “is not an official 

OSHA definition, it is consistent with OSHA’s intent when it promulgated the [PSM] standard.” 

Id. 
5

one of the stability factors in relief installations. The limits of IPd and its relationship with 

RAGAGEP are at issue in Items 2a through 12a and Items 4b through 12b.

Admissibility of Middough Reports

As a preliminary matter, we must address the admissibility of certain documents prepared 

by Middough, Inc., a safety consulting firm retained by BP to “revalidate” all of the refinery’s 

pressure relief valves; these documents are known in this case as the “Middough reports.” The

revalidation project undertaken by BP and Middough began in 2008 and was continuing at the 

time of the OSHA inspection. As part of this $6 million, multi-year revalidation project, 

Middough was required to perform calculations and analyses on a valve-by-valve basis—on IPd

as well as other stability factors—for the 1,800 pressure relief valves at the refinery.

Middough issued several draft reports as the project progressed. There is no dispute that 

the calculations concerning the IPd, as used by the Secretary for each of the relief installations at 

issue in Items 2 through 12, come exclusively from the Middough reports. BP argues that

pursuant to an OSHA policy concerning voluntary self-audits, it was impermissible for OSHA to 

base any of the alleged violations on information included in the Middough reports. However, 

given the specific circumstances present here, we conclude that BP’s concern is unfounded. 

Before the judge, BP asserted that the “revalidation project was intended to update the 

[process safety information] for its relief valves” as required under § 1910.119(d). Thus, the 

reports BP received as a result of this project are not voluntary self-audits.5 In addition, we note 

 

5 Chairman MacDougall and Commissioner Sullivan note that if these reports were voluntary 

self-audits, the Secretary’s reliance on them to prove a violation of the OSH Act would be 

troubling because, if an employer risks OSHA’s use of them to establish allegations of violative 

conduct, such use would discourage self-audits. The purpose of OSHA’s policy regarding such 

audits is “to provide appropriate, positive treatment that is in accord with the value voluntary 

self-audits have for employers’ safety and health compliance efforts . . . .” Final Policy 

Concerning the Occupational Safety and Health Administration’s Treatment of Voluntary 

Employer Safety and Health Self-Audits, 65 Fed. Reg. 46,498, 46,502 (July 28, 2000). “OSHA 

will not routinely request voluntary self-audit reports when initiating an inspection, and . . . the 

Agency will not use voluntary self-audit reports as a means of identifying hazards upon which to 

focus during an inspection.” Id. at 46,501. Additionally, “OSHA will refrain from issuing a 

citation for a violative condition that an employer has discovered through a voluntary self-audit 

and has corrected prior to the initiation of an inspection . . . .” Id. In other words, employers 

should not be penalized for conducting self-audits that are not specifically required by OSHA’s 

standards as “part of a planned effort to prevent, identify, and correct workplace safety and 

health hazards.” Id. Rather, voluntary self-audits should be viewed “as strong evidence of the 
6

that BP itself submitted the Middough reports concerning the valves at issue into evidence, and 

did not object when the Secretary submitted into evidence a summary report from Middough

(which was based on the valve-specific reports submitted by BP). Thus, BP cannot now object 

to the Secretary’s use of the Middough reports as evidence. FED. R. EVID. 103(a) (“A party may 

claim error in a ruling to admit . . . evidence only if the error affects a substantial right of the 

party and . . . a party, on the record: (A) timely objects or moves to strike; and (B) states the 

specific ground, unless it was apparent from the context[.]” (emphasis added)); see Commission 

Rule 71, 29 C.F.R. § 2200.71 (“The Federal Rules of Evidence are applicable.”). We, therefore,

find the Middough reports admissible.

Analysis

As to Items 2a through 12a, and 4b through 12b, compliance is the only element of the 

Secretary’s prima facie case at issue on review. Under the “a” citation items, the Secretary 

alleges that BP failed to document that each of the identified pressure relief valves6and 

associated inlet lines (collectively referred to as “relief installations”) complied with RAGAGEP 

because each had an IPd greater than 3%. Under the “b” citation items, the Secretary alleges that 

BP failed to ensure that these relief installations had an IPd of not more than 3%. The Secretary 

asserts that a 3% IPd limit is the only engineering practice that meets the RAGAGEP criteria for 

IPd within relief valve installations. In other words, the Secretary’s position is that an IPd 

measuring above 3% did not comply with paragraph (d)(3)(ii)’s documentation requirement; and

BP’s continued use of these relief installations—with IPds “outside acceptable limits” (anything

above 3%)—did not comply with paragraph (j)(5)’s requirement to correct equipment 

deficiencies. 

 

employer’s good faith with respect to the matters addressed.” Id.; see Solis v. Grede Wis. 

Subsidiaries, LLC, 24 BNA OSHC 1061, 1063, No. 13-cv-017-wmc, 2013 WL 3899768, at *2 

(W.D. Wis. 2013) (“[I]t is irrelevant whether one calls this guidance a ‘rule’ or merely a ‘final 

policy,’ or even whether it is legally binding on the agency for purposes outside of the exercise 

of its agency subpoena power. What is important is that it creates a reasonable expectation of 

privacy that businesses rely on in conducting internal safety audits; in turn, this expectation 

serves OSHA’s paramount goal of promoting safety in the workplace.”).

6 For the types of pressure relief valves at issue here, it was presumed at the time of the alleged 

violative conduct that the valve manufacturer preset the reseat pressure to allow for a blowdown 

that was 7% below the set pressure.
7

The Middough reports show that at the time of OSHA’s inspection, the IPd for each relief 

installation identified in Items 4 through 12 was above 3%.

7

 Therefore, according to the

Secretary, none of these relief installations were RAGAGEP-compliant with respect to IPd. BP 

argues that it established RAGAGEP based on its own engineering knowledge and industry 

experience and that the Secretary’s 3% IPd limit is too restrictive. Resolution of these citation 

items, thus, turns on whether the Secretary has proven that a 3% IPd limit is—exclusively—

RAGAGEP for the relief installations at issue. 

Throughout these proceedings, the Secretary has consistently asserted that an IPd limit of 

3% was the only RAGAGEP available to BP—indeed, the only “recognized” and “generally 

accepted” practice for any oil refining company in the United States.

8

 To support his argument,

 

7 The IPd measurements set forth in Items 2a and 3a were subsequently recalculated by 

Middough at less than 3%. In addition, unlike the valves at issue in the other IPd items, the one 

referenced in Item 2a, originally misidentified as a conventional valve, was later found to be a 

pilot valve, which is subject to different IPd requirements under both BP’s policy and pertinent 

consensus standards. 

8 Our dissenting colleague argues that BP implicitly tried the issue of IPd limits above 3% being 

RAGAGEP-compliant. This, however, ignores the Secretary’s repeated assertions that a 3% IPd 

limit was the only RAGAGEP available to BP under the circumstances. The Secretary’s 

argument throughout this litigation has been laser-focused on—and has never strayed from—this 

proposition. (See, e.g., Sec’y Post-Hr’g Br. at 91 (heading that states, “The 3% IP[d] Rule Is the 

Only RAGAGEP”); Sec’y Br. at 43 (“The ALJ . . . erred in rejecting the 3% limit as the 

applicable RAGAGEP for valve IPd.”), 52 (“[T]he ALJ’s holding on this point ignores the fact 

[that] at this time industry consensus is that the 3% limit is the only relevant RAGAGEP.”); 

Sec’y Reply Br. at 1 (heading that states, “The 3% Limit is the Only Applicable RAGAGEP”).) 

Indeed, at the hearing, counsel for the Secretary concluded his opening statement with the 

following assertion: “[T]he evidence will show that . . . BP was put on notice that the Secretary 

considered that 3% was RAGAGEP. And so we believe that the evidence will show that there 

were very clearly violations and RAGAGEP has clearly been 3%.”

This view of the Secretary’s argument is consistent with how he alleges the violations in the 

citation. Specifically, the “a” items state:

The employer does not document that [an identified relief valve] providing 

protection to [an identified pressure vessel] complies with recognized and 

generally accepted good engineering practices, in that, it has an inlet pressure 

drop greater than 3%. [The identified relief valve] was determined to have an 

inlet pressure drop of [a calculated value exceeding 3%].

And the “b” items state:
8

the Secretary points to a variety of sources, including valve manufacturers’ manuals, consensus 

standards from the American Petroleum Institute (“API”) and the American Society of 

Mechanical Engineers (“ASME”), and Ohio state law. As the PSM standard is a performanceoriented standard, however, the most relevant source of RAGAGEP is the one on which the 

employer relied—in this case, the applicable standard from API in effect at the time of the 

alleged violation.

9

 Section 4.2.2 of API Recommended Practice 520, Part II (“API 520”)10 states 

that “[w]hen a pressure-relief valve is installed on a line directly connected to a vessel, the total 

 

The employer does not ensure [that the relief valve identified in the corresponding 

“a” item], located in [an identified unit of the refinery], has an inlet pressure drop 

of not more than 3%. [The identified relief valve] was determined to have an inlet 

pressure drop of [a calculated value exceeding 3%].

Our colleague asserts that “the language of the citation itself apprised BP that what constitutes 

RAGAGEP” is “in controversy.” But the citation items each say—very explicitly—that an IPd 

greater than 3% is not RAGAGEP. If anything, this language deprived BP of notice that an IPd 

limit, other than 3%, could be at issue. 

9

In the PSM standard’s final rule preamble, OSHA revised the proposed rule to include the 

phrase, “recognized and generally accepted good engineering practices,” to assure that the 

mechanical integrity requirements were truly performance-oriented:

Several rulemaking participants . . . suggested that if this provision is to be truly 

performance-oriented, employers should have the flexibility to follow internal 

standards and manufacturers’ recommendations as well as applicable codes and 

standards.

OSHA agrees with these rulemaking participants. Since the phrase “recognized 

and generally accepted good engineering practices” would include both 

appropriate internal standards and applicable codes and standards, the Agency has 

decided to use this phrase in this provision of the final rule. 

Process Safety Management of Highly Hazardous Chemicals, 57 Fed. Reg. at 6390-91. The 

preamble, thus, makes clear that RAGAGEP may “include appropriate internal standards of a 

facility.” As discussed below, however, while certain parts of BP’s internal IPd policy could be 

characterized as internal, the aspect of that policy at issue here is expressly based on API’s 

consensus standard.

10 This version of the consensus standard had been in place since 2003 and was reaffirmed in 

2011. Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries Part II –

Installation, API Recommended Practice 520 (5th ed. Aug. 2003, reaffirmed Feb. 2011). We 

note that after the submission of briefs in this case, API 520 was revised and the sixth edition of 

the standard was published in March 2015. Therefore, what API’s standard indicated was 

RAGAGEP in 2009 is not necessarily RAGAGEP today, at least to the extent that API’s 

consensus standard is used by an employer to establish compliance with RAGAGEP.
9

non-recoverable pressure loss between the protected equipment and the pressure-relief valve”—

in other words, the IPd—“should not exceed 3 percent of the set pressure of the valve . . . .” 

However, API’s standard further states that, as an alternative to this limit, “[a]n engineering 

analysis of the valve performance at higher inlet losses may permit increasing the allowable 

pressure loss above 3 percent.” (Emphasis added.)

BP’s corporate-wide IPd policy relied on the “engineering analysis” option of this 

consensus standard to allow for an IPd limit above 3% for existing relief installations.11

Specifically, the IPd policy BP had in place at the start of OSHA’s inspection stated as follows:

For existing installations involving pressure relief valves, an inlet line pressure 

loss should not exceed the lower of a) the blowdown pressure12 or b) 7% of the set 

pressure (gauge units). If the pressure does not decrease to below the reseat 

pressure, then experience has shown that the valve will remain open. This 

constitutes the engineering analysis required by [API 520, § 4.2.2] to allow higher 

inlet line pressure losses.

BP’s policy was in the process of being revised at that time, and the IPd limit was officially 

lowered to 5% six weeks later. 

There is no dispute that § 4.2.2 of API 520 is recognized and generally accepted for 

purposes of the PSM standard and that following its requirements would constitute a good 

engineering practice. Indeed, in its discussion of how to document process safety information, 

 

11 Before OSHA’s inspection commenced, BP had engineering guidelines in place for its relief 

systems. BP’s expert witness, Dr. Georges Melhem, testified that those guidelines addressed the 

broad range of factors that impact relief system stability, including (but not limited to) IPd. 

According to BP, internal guidelines are necessary because most consensus standards, including 

API 520, expressly state that they do not replace operators’ engineering judgment and

experience. In this regard, the “Special Notes” to the version of API 520 in place at the time of 

the alleged violations stated as follows:

API standards are published to facilitate the broad availability of proven, sound 

engineering and operating practices. These standards are not intended to obviate 

the need for applying sound engineering judgment regarding when and where 

these standards should be utilized. The formulation and publication of API 

standards is not intended in any way to inhibit anyone from using any other 

practices. 

12 In contrast to API 520, BP’s policy requires an even lower IPd if the blowdown is less than 7% 

(or 5%, after the IPd limit for existing relief installations was revised). The blowdown setting for 

each of the valves at issue, however, was presumed at the time of OSHA’s inspection to be 7%. 

This part of BP’s policy, therefore, is not relevant to the circumstances of this case.
10

non-mandatory Appendix C to the PSM standard recognizes that “codes and standards . . . 

published by such organizations as the . . . American Petroleum Institute” are one type of 

resource that employers may rely on “to establish good engineering practices.”13 This particular

version of API 520 was current at the time of the alleged violations (see footnote 10 supra) and 

was reaffirmed without amendment two years later in 2011. See Process Safety Management of 

Highly Hazardous Chemicals, 57 Fed. Reg. at 6375, 6390 (revising rule to require RAGAGEP—

rather than reference codes and standards—in response to comments that, among other things, 

“some of these standards may be outdated and no longer represent a consensus of ‘good 

engineering practices’ ”).

The Secretary argues that no refinery, including BP, could have used the engineering 

analysis option of API 520 because API did not explain in its standard (or elsewhere) how to 

perform such an analysis. The Secretary reasons, therefore, that API’s 3% IPd limit is the only 

RAGAGEP since, without an acceptable methodology for conducting an engineering analysis, 

no circumstance existed that would have permitted an IPd limit above 3%. This reasoning 

ignores that API 520 on its face does not provide that the engineering analysis must follow a 

specific, consensus methodology. The applicable section simply requires “[a]n engineering 

analysis of the valve performance at higher inlet losses . . . .” In addition, if the Secretary is

correct, it would have been pointless for API to adopt the engineering analysis option in 1994, 

and then reaffirm this requirement in 2003 and 2011. Given the language and history of API 

520, we conclude that the Secretary has failed to prove that RAGAGEP under the specific 

circumstances of this case was confined to a 3% IPd limit. For these reasons, we find that while 

a 3% IPd limit, when used by a refinery for its relief installations (both new and existing), 

 

13 This view persists in OSHA’s most recent enforcement policy concerning RAGAGEP:

There may be multiple RAGAGEP that apply to a specific process. For example, 

American Petroleum Institute (API), RP 520 Sizing, Selection, and Installation of 

Pressure-Relieving Devices in Refineries Part II - Installation, and International 

Standards Organization, Standard No. 4126-9, Application and installation of 

safety devices, are both RAGAGEP for relief valve installation and contain 

similar but not identical requirements. Both documents are protective and either 

is acceptable to OSHA.

RAGAGEP in Process Safety Management Enforcement, Director Thomas M. Galassi, 

Directorate of Enforcement Programs, to Regional Administrators (May 11, 2016). 
11

constitutes RAGAGEP, it is not necessarily the only RAGAGEP—in other words, the outer 

limit—for existing relief installations, such as the ones at issue here.

Although there is evidence in the record concerning BP’s IPd policies, which relied on 

API’s engineering analysis option to allow for an IPd above 3%, the parties were clearly 

litigating whether a 3% IPd limit is, in fact, the only RAGAGEP for existing relief installations.14 

None of the allegations at issue in Willful Citation 2, Items 2 through 12 state that an IPd limit 

other than 3% is in controversy and the citation language comports with the Secretary’s position 

throughout these proceedings. 29 U.S.C. § 658(a) (citations must “describe with particularity the 

nature of the violation”); see L & L Painting Co., 22 BNA OSHC 1346, 1349 (No. 05-0050, 

2008) (citation omitted) (citation must be drafted “ ‘with sufficient particularity to inform the 

employer of what he did wrong, i.e., to apprise reasonably the employer of the issues in 

controversy’ ”). From opening argument through his two briefs to the Commission, the 

Secretary has maintained that a 3% IPd limit is the only possible RAGAGEP for the relief 

installations at issue. See footnote 8 supra. Moreover, the Secretary never sought to amend the 

citation—either before the judge or the Commission on review—and has not argued that the 

judge should have sua sponte amended the pleadings to change the legal theory underlying the 

citation.15

 

14 Given the Secretary’s claim that an engineering analysis could not be conducted pursuant to 

API’s consensus standard, BP’s attempt to establish that an engineering analysis could be 

conducted and, in fact, had been conducted by BP, was directly responsive to the Secretary’s 

specific allegation. 

Our dissenting colleague argues that “[l]ike the Secretary, BP has litigated the broader issue of 

what constitutes RAGAGEP.” She bases this conclusion on the fact that BP relied on its 

engineering analysis to support IPd limits over 3% as being RAGAGEP-compliant. What she 

fails to acknowledge, however, is the Secretary’s steadfast position that, at the time of the 

citation, there was no methodology available for conducting such an engineering analysis under 

API 520 that would have allowed for an IPd limit above 3% and that BP’s engineering analysis, 

therefore, was incapable of producing an acceptable alternative. The sole allegation to which BP 

is responding in this litigation is, thus, whether a 3% IPd limit is the only acceptable RAGAGEP.

15 Even after the judge expressly found that the Secretary’s theory was limited to whether any 

IPd in excess of 3% violated the cited PSM provisions, the Secretary made no attempt to amend 

the citation to include anything other than this very specific view of what constitutes 

RAGAGEP. See generally McWilliams Forge Co., 11 BNA OSHC 2128, 2129 (No. 80-5868, 

1984) (stating that amendment under Federal Rule of Procedure 15(b)(2) “is proper only if two 

findings can be made—that the parties tried an unpleaded issue and that they consented to do 
12

Accordingly, given that an IPd limit higher than 3% could constitute RAGAGEP under 

the circumstances of this case, the Secretary has not established the violative conduct alleged in

Items 2a through 12a, and 4b through 12b.16 These items are, therefore, vacated.

 

so”); Envision Waste Servs., LLC, 27 BNA OSHC 1001, 1007 (No. 12-1600, 2018) (“Under 

Federal Rule of Civil Procedure 15(b)(2), ‘[w]hen issues not raised by the pleadings are tried by 

express or implied consent of the parties, they shall be treated in all respects as if they had been 

raised in the pleadings.’ Trial by consent exists ‘only when the parties knew, that is, squarely 

recognized, that they were trying an unpleaded issue.’ ” (cited case omitted)); compare 

Lancaster Enter., Inc., 19 BNA OSHC 1033, 1036 n.13 (No. 97-0771, 2000) (holding sua sponte 

amendment appropriate where parties tried different provision by consent).

Further, we find that BP would be prejudiced by any such amendment at this point. Our 

determination in this regard is relevant to whether BP had a fair opportunity to defend against the 

Secretary’s evidentiary case and whether it could have offered any additional evidence if the case 

had been tried under a different legal theory. See Yellow Freight Sys., Inc. v. Martin, 954 F.2d 

353, 358 (6th Cir. 1992) (introduction of evidence relevant to issue already in case may not be 

used to show consent to trial of new issue absent clear indication that party who introduced 

evidence was attempting to raise new issue). Had BP known that the Secretary was claiming it 

had violated the cited provisions on the ground that it failed to comply with specific IPd levels in 

excess of 3% (such as BP’s internal standards of 7% and 5%), it would have understood the need 

to offer evidence addressing those particular IPd levels. Instead, given the Secretary’s steadfast 

insistence that 3% is the only IPd limit that constitutes RAGAGEP, BP’s defense could 

appropriately be limited to defending that one theory, which could include the positions that the 

Secretary was seeking to impose a prescriptive rule into a performance standard by pursuing a 

3% IPd limit, or that a basis could exist for RAGAGEP exceeding this limit. Id. We therefore 

decline to reach whether the Secretary established a violation of the cited provisions on the basis 

that an IPd limit other than 3% was RAGAGEP and was breached.

16 This is not to say that the IPds calculated by Middough for the relief installations at issue were, 

or were not, RAGAGEP. Our decision today is focused on what the Secretary has explicitly 

pleaded and argued—that a 3% IPd limit is the only possible RAGAGEP for the relief 

installations at issue. As such, other IPd limits need not be considered with respect to these 

citation items. Nonetheless, there is evidence in the record concerning BP’s engineering analysis 

under API 520 that tends to show that having a safety margin between the blowdown and IPd is 

necessary to promote valve stability. This evidence—including testimony from BP’s own expert 

witness, Dr. Melhem—suggests that where the blowdown is 7% (as was presumed, based on the 

manufacturers’ settings, for the valves at issue), an IPd of 5% or less provides an appropriate 

safety margin. 

Any discussion in this decision concerning RAGAGEP, however, is specific to the circumstances 

of this case. RAGAGEP is a performance-oriented concept that changes based on, for example, 

advances in technology and revisions to methodologies. Although the evidence in this case may 

tend to show that, in 2009, an IPd limit above 5% could not have constituted a “good engineering 

practice,” and therefore was not RAGAGEP, what constitutes a good engineering practice in 

2018, even for an identical process, may no longer be the same. Indeed, given the very nature of 
13

II. Items 13a, 14a, 16a, 17a, and 18a

Items 13a, 14a, 16a, 17a, and 18a involve five pressure relief valves that the Secretary 

alleges were not RAGAGEP-compliant: the valves addressed in Items 13 and 14 were 

undersized, and the valves addressed in Items 16, 17, and 18 had excessive backpressure. Only 

the “a” citation items, which allege violations of § 1910.119(d)(3)(ii) and which require the 

employer to “document that equipment complies with [RAGAGEP],” are at issue on review. 

Under the “b” citation items, which the judge vacated, the Secretary alleged violations of 

§ 1910.119(j)(5), which requires the employer to “correct deficiencies [in other words, nonRAGAGEP conditions] before further use or in a safe and timely manner when necessary means 

[referred to as ‘interim measures’] are taken to assure safe operation.” The Secretary did not 

petition for review of the “b” items. Before the judge, BP did not argue that the company had 

documented RAGAGEP compliance for these valves; rather, BP asserted that it was not required 

to have done so because the company instituted interim measures, as permitted under (j)(5), 

pending replacement of the valves at issue. In affirming the “a” items, the judge concluded that 

because BP conceded these valves were deficient, the Secretary established that BP violated the 

(d)(3)(ii) documentation requirement.

BP’s argument on review is one of regulatory interpretation. The company contends that 

because (j)(5) expressly authorizes an employer to continue operating non-RAGAGEP 

equipment if interim measures are taken to ensure safe operation, (d)(3)(ii) cannot be read to 

require immediate compliance with RAGAGEP in such circumstances. In response, the 

Secretary appears to concede the effectiveness of BP’s interim measures as to the valves in 

question, but he asserts that (d)(3)(ii) nevertheless requires equipment to always be RAGAGEPcompliant. According to the Secretary, (j)(5)’s interim measures clause prescribes “stopgap 

measures” that are additional duties when an employer is in violation of (d)(3)(ii). Specifically, 

he claims that having non-RAGAGEP equipment violates (d)(3)(ii) and that violation triggers the 

additional duty to either correct the deficiency immediately or in a safe and timely manner when 

 

RAGAGEP, multiple RAGAGEPs could exist for a single matter, either through consensus 

standards that take diverging approaches, or through an internal standard that, although different 

from a consensus standard’s requirements, still constitutes RAGAGEP. Thus, our holding today, 

as noted above, does not set forth what constitutes RAGAGEP as we decline to find that issue is 

before us.
14

interim measures are taken. Consequently, the Secretary contends that there is no inconsistency

in violating (d)(3)(ii) while complying with (j)(5).

When determining the meaning of a standard, we must first look to its text and structure. 

Superior Masonry Builders, Inc., 20 BNA OSHC 1182, 1184 (No. 96-1043, 2003). “If the 

meaning of [regulatory] language is ‘sufficiently clear,’ the inquiry ends there.” Beverly 

Healthcare-Hillview, 21 BNA OSHC 1684, 1685 (No. 04-1091, 2006) (consolidated), aff’d in 

relevant part, 541 F.3d 193 (3d Cir. 2008). “[I]n situations in which the meaning of regulatory 

language is not free from doubt,” however, the provision is considered ambiguous. Martin v. 

OSHRC (CF&I), 499 U.S. 144, 150-51 (1991) (brackets omitted); see Exelon Generation Co. v. 

Local 15, 676 F.3d 566, 570 (7th Cir. 2012) (“A regulation is ambiguous as applied to a 

particular dispute or circumstance when more than one interpretation is plausible and the text 

alone does not permit a more definitive reading.”).

Both BP and the Secretary argue that the plain language of the PSM standard compels 

their respective positions. BP points out that (d)(3)(ii) is part of the PSM standard’s information 

gathering procedure (given that paragraph (d) governs “process safety information”) and 

therefore, by its own terms, is solely a documentation requirement, not a substantive one. 

Substantive requirements, BP notes, are found in paragraph (j), addressing “mechanical 

integrity,” and (j)(5) expressly authorizes an employer to continue operations when equipment is 

deficient by taking interim measures to assure safe operation. BP argues that under the 

Secretary’s reading, (j)(5) would be rendered a nullity because (d)(3)(ii) would preclude an 

employer from making use of (j)(5)’s interim measures option when faced with deficient 

equipment—in other words, the only way an employer could remain in full compliance would be 

to either immediately correct the deficiency or shut down the process until the equipment was 

made fully compliant with RAGAGEP. The Secretary counters that the text of (d)(3)(ii) does not 

include an exception to the documentation requirement for use of interim measures.

The language of (d)(3)(ii) does not clearly resolve this question. On the one hand, the 

Secretary’s reliance on the absence of an explicit interim measures exception in (d)(3)(ii) is 

misplaced because the obligation to document RAGAGEP compliance is not continual. 

Paragraph (d)(3)(ii), using the verb form of “document,” directs the employer to take an action 

that naturally takes place at a particular point in time. That point in time is specified in 

paragraph (d), which contains the cited requirement as a subsidiary provision, specifically stating 
15

that written process safety information is to be completed “[i]n accordance with the schedule set 

forth in paragraph (e)(1)”—that is, every five years.17 29 C.F.R. § 1910.119(d), (e)(1), (e)(6). 

Therefore, on its face, the requirement to document compliance with RAGAGEP applies only 

every five years. On the other hand, (d)(3)(ii) does not make clear to what extent the employer 

must ensure RAGAGEP compliance between the five-year documentation cycles. Thus, we find 

the language of (d)(3)(ii) ambiguous.

In the context of the PSM standard’s other provisions, we conclude that the Secretary’s 

interpretation of (d)(3)(ii) is unreasonable. See FDA v. Brown & Williamson Tobacco Corp., 529 

U.S. 120, 132 (2000) (“The meaning—or ambiguity—of certain words or phrases may only 

become evident when placed in context.”); Otis Elevator Co., 24 BNA OSHC 1081, 1087 n.10 

(No. 09-1278, 2013) (reviewing language of cited provision, “along with the structure and 

context of the standard,” to determine scope), aff’d, 762 F.3d 116 (D.C. Cir. 2014). Paragraph (j) 

of the PSM standard expressly addresses an employer’s duty to maintain mechanical integrity, 

and (j)(4)(iii) requires process equipment to be inspected as frequently as is “consistent with 

applicable manufacturers’ recommendations and good engineering practices, and more 

frequently if determined to be necessary by prior operating experience.” 29 C.F.R. 

§ 1910.119(j)(4)(iii). Here, the Secretary has neither asserted nor shown that a manufacturer’s 

recommendation, good engineering practice, or prior operating experience necessitated BP’s 

continual monitoring for RAGAGEP compliance. Absent such a showing, and because the duty 

imposed by the standard to discover non-RAGAGEP conditions is not continual, the duty to 

ensure RAGAGEP compliance must also not be continual. Indeed, under the Secretary’s 

interpretation of (d)(3)(ii), the inspection requirement under (j)(4)(iii) would become superfluous 

because, to ensure compliance with (d)(3)(ii), the employer would have to continually inspect for 

the equipment’s compliance with RAGAGEP. See Ryder Truck Lines, Inc., 1 BNA OSHC 1326, 

1328 (No. 391, 1973) (refusing to construe one part of standard in a way that would “render 

[another] meaningless or superfluous,” because “[b]y so doing we would act in contravention of 

well settled principles of statutory construction”).

 

17 Paragraph (e)(1) sets the initial assessment schedule and requires this initial assessment to be 

updated and revalidated in accordance with the every-five-years schedule in (e)(6).
16

The unreasonableness of the Secretary’s (d)(3)(ii) interpretation is also borne out by 

(j)(5)’s regulatory history. The proposed version of (j)(5) (originally designated (j)(4)) lacked 

the interim measures option and in explaining this proposed provision, OSHA made clear that 

equipment deficiencies that are “outside acceptable limits” must be corrected “before further 

use.” Process Safety Management of Highly Hazardous Chemicals, 55 Fed. Reg. 29,150, 

29,156, 29,165 (Jul. 17, 1990). When the final rule was issued, however, OSHA stated that it 

had received “some excellent comments” asserting “that the phrase ‘before further use’ would 

mean that the process would have to be shutdown, and that shutdown has its own inherent 

hazards,” and is not always necessary. 57 Fed. Reg. at 6391. In response, OSHA chose to add 

the interim measures option, stating that “[t]he comments have convinced [the agency] that there 

may be situations where it may not be necessary that the deficiencies be corrected ‘before 

further use’ as long as the deficiencies are corrected in a safe and timely manner when necessary 

means are taken to assure safe operation.” Id. (emphasis added). In other words, OSHA decided 

that instead of requiring an employer to shut down a process, it would allow continued operation 

of non-RAGAGEP equipment when interim measures are in place. This fundamentally 

undermines the Secretary’s argument that (j)(5) only supplements (d)(3)(ii) because it directly 

contradicts his claim that the interim measures option is insufficient as compared to 

RAGAGEP.18 See Phelps Dodge Corp., 11 BNA OSHC 1441, 1444 (No. 80-3203, 1983) 

(“Inasmuch as the language of the standard is susceptible of different meanings, the preamble is 

the best and most authoritative statement of the Secretary’s legislative intent.”), aff’d, 725 F.2d 

1237 (9th Cir. 1984); see also Tops Markets, Inc., 17 BNA OSHC 1935, 1936 (No. 94-2527, 

1997) (relying on preamble to lockout/tagout (LOTO) standard to interpret ambiguous 

provision), aff’d, 132 F.3d 1482 (D.C. Cir. 1997) (unpublished).

 

18 The Secretary’s interpretation of (d)(3)(ii) would give PSM-covered facilities, such as BP, two 

options: either immediately implement permanent corrective measures for all mechanical 

equipment deficiencies or shut down affected equipment. However, because permanent 

corrections at large, complex facilities often take significant time, and come with their own risk, 

these facilities would have only one choice—to shut down without conducting a risk assessment 

to determine how best to mitigate the associated risks.

In fact, in unrefuted testimony, BP technical manager Timothy Smith and BP’s expert, Dr.

Melhem, both stated that it is less risky in some circumstances to continue to operate until the 

next scheduled shutdown or “turnaround,” and then make a permanent fix. The next scheduled 

shutdown at the refinery was to have taken place later in 2012.
17

In sum, the only reasonable interpretation of (d)(3)(ii) is that (j)(5)’s interim measures 

option dictates the timing for when non-RAGAGEP equipment must be documented as 

RAGAGEP-compliant. In other words, if interim measures have been implemented and the 

deficiency is corrected “in a safe and timely manner,” an employer need not document that such 

equipment conforms to RAGAGEP until the deficiency has been corrected. Because the 

Secretary does not contend on review that BP’s interim measures were insufficient or that the 

deficiencies were not corrected “in a safe and timely manner,” the cited provision’s 

documentation requirement did not apply here. Accordingly, we vacate Items 13a, 14a, 16a, 17a, 

and 18a.

III. Items 15a and 15b

Items 15a and 15b address a valve that provides pressure relief to the “Second Stage 

Butane Treater Drum” in the refinery’s Alky 1 Unit and allege violations of the same PSM 

provisions discussed above. Specifically, the Secretary claims that the valve in question was 

undersized and that BP failed to document that it complied with RAGAGEP, in violation of 

§ 1910.119(d)(3)(ii) (Item 15a), and BP failed to correct the deficient valve “before further use 

or in a safe and timely manner,” in violation of § 1910.119(j)(5) (Item 15b). The judge agreed 

that the valve was undersized and that the company failed to document compliance with 

RAGAGEP, but she vacated both citation items based on her finding that BP’s employees were 

not exposed to the hazards associated with the drum at issue because testimony from BP 

technical manager Timothy Smith established that it had been taken out of service four months 

before the OSHA inspection began.19 See Briones Util. Co., 26 BNA OSHC 1218, 1219 (No. 

10-1372, 2016) (“To establish a violation of an OSHA standard, the Secretary must prove that . . 

. employees were exposed to the violative condition.”). On review, the Secretary contends that 

the judge ignored conflicting testimony on this issue and the weight of the record evidence 

shows that the drum was not taken out of service until after the start of the OSHA inspection.

While we agree that the judge failed to address the conflicting testimony of David 

Hasselbach, the refinery’s technical authority, regarding the timeframe in which the drum was 

 

19 The citation in this case was issued on March 8, 2010, six months after OSHA began its 

inspection on September 10, 2009. Thus, the relevant time-period for any violation coincides 

with the start of the inspection. See 29 U.S.C. § 658(c) (“No citation may be issued under this 

section after the expiration of six months following the occurrence of any violation.”).
18

taken out of service,20 upon consideration of the entire record, we find that the Secretary has 

failed to establish that the drum was in service at the time of the inspection. See Dover Elevator 

Co., 16 BNA OSHC 1281, 1283 n.3 (No. 91-0862, 1993) (“The Commission . . . is empowered 

to review the evidence independently and make its own factual findings.”); Little Beaver Creek 

Ranches, Inc., 10 BNA OSHC 1806, 1810 (No. 77-2096, 1982) (“[T]he Commission’s review 

authority includes the authority to decide all issues it could have decided as the initial decision 

maker.”). Three operator log entries show that the drum was taken out of service several months 

before the start of OSHA’s inspection in September 2009. A log entry dated May 20, 2009, 

states:

The [Butane Treater Drum] is being mothballed. The caustic is out and waiting 

on [BP’s oil movement and storage group] to be able to push the butane out. 

Need to blow out to and from them, then [LOTO] their valves with our locks so 

they do not open by mistake.

Additionally, two log entries from June 1, 2009, state that the drum was “off line (circulating 

pump off),” and that the “[c]austic injection pump stroke to [the drum]” was “[n]ot needed” 

because the “[t]reater is empty.” These contemporaneous log entries—showing that the drum 

was “being mothballed” at the end of May and was “off line” and “empty” eleven days later—

align with Smith’s testimony and rebut that of Hasselbach.21

 

20 Specifically, Hasselbach testified that the drum was drained, vented, and taken out of service 

during OSHA’s inspection, and that BP did an “MOC” (an apparent reference to a “management 

of change” procedure, see 29 C.F.R. § 1910.119(l)) to take the drum out of service. The judge 

never mentioned Hasselbach’s testimony and did not provide any reason for crediting Smith’s 

account over his. See, e.g., L.E. Myers Co., 16 BNA OSHC 1037, 1046-47 n.17 (No. 90-0945, 

1993) (“Not only did the judge fail to give any reason for rejecting this evidence, but, in his 

decision, the judge appears to have totally ignored [contrary] testimony,” and so “the judge’s 

finding cannot be considered a credibility determination to which the Commission must defer.”);

Caterpillar Logistics Servs., Inc. v. Solis, 674 F.3d 705, 709 (7th Cir. 2012) (“The 

adjudicator . . . must take account of competing evidence and inferences . . . [in order to] show 

why the agency credited one witness rather than another.”).

21 The Secretary contends that even if the June 1 log entries establish that the drum was 

completely drained, they do not establish “that BP had fully mitigated the hazard” by locking out 

the vessel. The Secretary, however, did not cite BP under the LOTO standard. See 29 C.F.R. 

§ 1910.147(a)(1)(i) (“cover[ing] the servicing and maintenance of machines and equipment in 

which the unexpected energization or start up of the machines or equipment, or release of stored 

energy, could harm employees”).
19

The remaining record evidence is, at best, too ambiguous to support the Secretary’s case. 

Rich Rothbard, the refinery’s operations coordinator, testified that the drum was taken out of 

service in 2007; while this conflicts with the May and June 2009 log entries, his testimony

provides no support for the Secretary’s position that the drum was in service during the OSHA 

inspection. The Secretary also points to the Middough reports and an internal tracking sheet 

prepared by the refinery’s “PSV Evaluation Team,” both of which, he contends, show that the 

valve in question was evaluated as if it were in service. However, Smith testified that the 

revalidation study treated the drum as if it would potentially be put back into service at some 

future time, thereby preserving that option for the refinery, and Dr. Melhem testified that it was 

not unusual for a refinery conducting a revalidation to treat out-of-service equipment as though it 

might be put back into service in the future.

Under these circumstances, we conclude that the record is insufficient to show the Butane 

Treater Drum was in service at the time of the inspection; therefore, the Secretary has not proven 

the employee exposure element of his prima facie case.22 See Kaspar Wire Works, Inc., 18 BNA 

OSHC 2178, 2195 (No. 90-2775, 2000) (“The Secretary bears the burden of proving employee 

exposure to cited hazards, which requires [him] to show that it is reasonably 

predictable . . . that employees have been, are, or will be in the zone of danger.”), aff’d, 268 F.3d 

1123 (D.C. Cir. 2001). Accordingly, we vacate Items 15a and 15b.

IV. Items 19a through 27a, 19b through 27b

Items 19a through 27a and 19b through 27b involve nine of the refinery’s “heat 

exchangers”—vessels consisting of a shell with tubes inside, where one fluid flows through the 

 

22 We also reject an alternative exposure theory advanced by the Secretary—that even if the 

drum was empty as of June 2009, employees were nonetheless exposed, based on testimony from 

Dr. Melhem about welders in the refining industry being injured when vessels they thought had 

been emptied of hydrocarbons exploded. Although welding an out-of-service vessel is addressed 

by the PSM standard if done “on or near a covered process,” in which case a “hot work permit” 

is required, the Secretary did not cite BP for a violation of this provision. See 29 C.F.R. 

§ 1910.119(k). The issue here is whether the Secretary established exposure to the alleged 

failures regarding the deficient relief valves, not the hazard of combustion/explosion. He cannot 

circumvent that burden by showing that there was exposure to a different hazard. See RGM 

Constr. Co., 17 BNA OSHC 1229, 1234 (No. 91-2107, 1995) (“The zone of danger is 

determined by the hazard presented by the violative condition, and is normally that area 

surrounding the violative condition that presents the danger to employees which the standard is 

intended to prevent.”) (emphasis added).
20

tubes and another fluid flows through the shell to transfer heat between the fluids. The Secretary 

asserts that these heat exchangers were “not protected by pressure relieving devices that would 

prevent the pressure inside . . . from rising above acceptable limits” and that the absence of these 

devices violated § 1910.119(d)(3)(ii) (Items 19a through 27a) and § 1910.119(j)(5) (Items 19b 

through 27b). In the course of these proceedings, however, the Secretary has more specifically 

asserted that to be RAGAGEP-compliant each vessel needed two pressure relieving devices 

(“PRDs”)—one on the “tube side” and one on the “shell side”—and that the PRDs were required 

to be located directly on the vessel, not on a line connected to the vessel.

The judge vacated Items 19a through 27a based on the Secretary’s failure to prove either 

actual or constructive knowledge of the violative conditions. The judge found that there was no 

evidence BP knew of the missing PRDs and that the company could not have been expected to 

detect their absence due to the difficulty in discovering the lack of PRDs by looking at the 

refinery’s Piping and Instrument Diagrams (P&ID). The judge also vacated Items 19b through 

27b, finding that the Secretary failed to establish noncompliance with (j)(5) given that, after the 

company received the Middough reports, BP instituted interim measures to assure safe operation 

of the heat exchangers. On review, the Secretary focuses on the judge’s conclusion that 

constructive knowledge was lacking and argues that, prior to its receipt of the Middough reports, 

BP should have discovered (and thereafter remedied) the missing PRDs after reviewing the 

P&ID for the cited vessels, as well as from prior process hazard analyses (PHAs), which are 

governed by paragraph (e) of the PSM standard, conducted at the refinery.

The Secretary’s challenge to the judge’s knowledge finding, however, cannot be 

meaningfully addressed here because, based upon our review of the record, the Secretary has 

failed to establish BP’s noncompliance with either of the cited provisions.23 As to Items 19a 

 

23 The Secretary notes that BP did not seek review of the judge’s ruling on the noncompliance 

element of the Secretary’s case, seemingly arguing that the company should be precluded from 

now arguing the issue before the Commission. BP prevailed on these items, however, so the 

company was not required to challenge the noncompliance element to preserve the issue. See

Commission Rule 91(b), 29 C.F.R. § 2200.91(b) (“A party adversely affected or aggrieved by 

the decision of the Judge may seek review by the Commission . . . .”). Additionally, BP argued 

before the judge that the company complied with RAGAGEP with respect to the heat exchangers 

cited in these items. Compare Commission Rule 92(c), 29 C.F.R. § 2200.92(c) (“The 

Commission will ordinarily not review issues that the Judge did not have the opportunity to pass 

upon.”).
21

through 27a, (d)(3)(ii) requires the employer to “document that equipment complies with 

[RAGAGEP].” 29 C.F.R. § 1910.119(d)(3)(ii) (emphasis added). The record is silent on 

documentation for the heat exchangers. As is apparent from his briefs both below and on review, 

the Secretary has attempted to prove only that the vessels were not, in fact, RAGAGEPcompliant, which he has failed to do. Without evidence regarding any failure to document, Items 

19a through 27a must be vacated.

As to Items 19b through 27b, as noted above, (j)(5) requires employers to “correct 

deficiencies in equipment that are outside acceptable limits.” The Secretary argues that the 

vessels at issue were deficient because they did not comply with RAGAGEP, which he asserts—

by citing to the 2007 ASME Boiler and Pressure Vessel Code (ASME Code)—requires that 

PRDs be mounted on both “sides” of each vessel. While the Secretary fails to specify any 

particular ASME Code provision or language that compels this action, Part UG-125(a) states that 

“all pressure vessels . . . , irrespective of size or pressure, shall be provided with overpressure 

protection . . . .” Assuming one could view each heat exchanger at issue as consisting of two 

pressure vessels—one within the other (the pressurized tubes that are within the shell, and the 

shell itself, which is also pressurized)—the ASME Code would then require each vessel to be 

protected with a PRD. Nevertheless, Part UG-125(g) of the ASME Code also states that PRDs 

“need not be installed directly on [the] . . . vessel” (with certain exceptions) if: (1) “the source of 

pressure is external to the vessel and is under such positive control that the pressure in the vessel 

cannot exceed the maximum allowable working pressure at the operating temperature”; or (2) 

“there are no intervening stop valves between the vessel and the [PRD].” Therefore, even if we 

assume that each heat exchanger consists of two pressure vessels, for the Secretary to establish 

that they were non-compliant with the ASME Code (and thus not RAGAGEP-compliant), he 

must show that at least one side of each heat exchanger was unprotected by a PRD or that the 

two circumstances described in Part UG-125(g), where vessel-mounted PRDs are not required, 

are inapplicable to the heat exchangers.

The Secretary has failed to make either showing. With respect to whether at least one 

side of each heat exchanger was unprotected, the record is unclear. Smith testified that there was

pressure relief provided by another vessel’s relief valve for seven of the nine cited heat 

exchangers (Items 19 through 22 and 25 through 27), but he did not specify if this was the case 

for both sides. The record is also vague regarding the remaining two vessels cited in Items 23 
22

and 24. The relevant testimony as to these vessels refers to the absence of a PRD, but it is 

unclear whether this refers to a lack of protection at all (that is, no protection for either side, 

either on or connected to the vessel), or simply that there were no PRDs located on the vessels 

themselves.24 Finally, with respect to the location of the PRDs, either on or away from any of 

the cited vessels, there is nothing in the record addressing the two circumstances in the ASME 

Code in which PRDs are not required to be on the vessel, and the Secretary has not addressed 

what evidence in the record, if any, shows that these two circumstances were not present here.25 

See, e.g., Carmickle v. Comm’r, Soc. Sec. Admin., 533 F.3d 1155, 1161 n.2 (9th Cir. 2008) (“We 

do not address this [ALJ] finding because Carmickle failed to argue this issue with any 

specificity in his briefing.”).

In short, the Secretary has not: (1) explained why the ASME Code should be read as 

requiring overpressure protection on both sides of a heat exchanger; (2) shown, even if the 

ASME Code includes such a requirement, that the cited vessels lacked overpressure protection 

for at least one side; and (3) proven that the circumstances in which the ASME Code allows 

PRDs to be away from a vessel were not present in this case. Accordingly, we vacate Items 19b 

through 27b.

V. Items 31a and 31b

In Items 31a and 31b, the Secretary alleges that BP violated two provisions of the PSM 

standard with regard to the refinery’s “fire water” system, a pressurized ring of piping 

throughout the facility that contains water for fighting fires. The refinery, built in 1919, 

originally had a single water circuit throughout, supplying water for various uses, including 

fighting fires. In the 1980s, BP began the process of removing these “cross-connections” 

 

24 For example, the P&ID for the Stripper Reboiler Condensate Pot (Item 23) shows only that 

there was no PRD “on the heat exchanger itself,” and the testimony notes only that the “safety 

valve that’s on [that vessel] now wasn’t on there [then]” and “[t]here’s no device attached to it.” 

Similarly, regarding the Stripper Steam Reboiler (Item 24), the testimony states only that there 

was no PRD “on the tube side” or “on the shell side.”

25 Notably, the record also does not show BP violated its own internal guidance, which states that 

“[p]ressure relief capacity shall be provided on heat exchangers for the external fire condition on 

both sides if they can be isolated without draining or in an area where a fire could be sustained.” 

Even assuming that “on heat exchangers” means a PRD is required to be located on the vessel, 

nothing in the record shows the cited heat exchangers “can be isolated without draining or in an 

area where a fire could be sustained.”
23

between the fire water system and other water systems. At the time of the OSHA inspection, 

however, several cross-connections remained.

Item 31a alleges a violation of § 1910.119(d)(3)(iii), which provides that “[f]or existing 

equipment designed and constructed in accordance with codes, standards, or practices that are no 

longer in general use, the employer shall determine and document that the equipment is 

designed, maintained, inspected, tested, and operating in a safe manner.” The Secretary asserts 

that because the current best practice is to have a completely independent fire water system to 

ensure that water is not diverted for other uses and hydrocarbons resulting from the refining 

process do not contaminate water intended to fight fires, the refinery’s cross-connections violate 

(d)(3)(iii).

Item 31b alleges a violation of § 1910.119(e)(3)(i), which provides that PHAs—which 

employers are required to conduct and then update and revalidate at least every five years—

“shall address . . . [t]he hazards of the process.”26 The Secretary asserts that BP did not address 

in any PHA “the existence of permanent connections between the [refinery] fire water system 

and process systems that could lead to the contamination of fire water supply with hydrocarbons 

or other process fluids.”

The judge vacated these items. Specifically, she noted that one of BP’s expert witnesses, 

Bradley Wolf, and its emergency response specialist, Chris Herman, testified that there was no 

credible risk that the fire water could be contaminated due to the cross-connections. Thus, 

according to the judge, there was no need for any PHA to address the cross-connections, nor was 

there a need to determine and document that the cross-connections were “designed, maintained, 

inspected, tested, and operating in a safe manner.” 29 C.F.R. § 1910.119(d)(3)(iii). On review, 

the Secretary contends that this “no harm, no foul” approach misses the point of the cited 

provisions—to assess and address potential hazards like the cross-connections here.

To begin, we agree with the Secretary that no hazard need be proven to establish 

applicability of the cited provisions. By its plain terms, (d)(3)(iii) does not require that an actual 

hazard be shown for the provision to apply; rather, the provision presumes a hazard when 

 

26 Section 1910.119(e) requires an employer to have “a team with expertise in engineering and 

process operations” conduct “an initial [PHA] (hazard evaluation) on processes covered by this 

standard,” and then, “[a]t least every five (5) years after the completion of the initial [PHA],” 

update and revalidate it. 29 C.F.R. § 1910.119(e)(1), (4), (6).
24

outdated equipment is involved. See, e.g., Oberdorfer Indus., Inc., 20 BNA OSHC 1321, 1330 

(No. 97-0469, 2003) (consolidated) (“Wh[en] the standard presumes a hazard, . . . the Secretary 

is not obligated to show that the conditions in question are themselves hazardous in order to 

prove a violation.”). BP’s own expert, Wolf, acknowledged that it is now best practice to build 

fire water systems independent of other water systems, even if that has not always been the 

practice:27

[T]he current best practice—and if you build a brand[-]new refinery right now, 

you would strive to create a totally independent pressurized fire ring system 

around your plan[t] independent of any of the other—as independent as it can be 

of the other water systems, noting that most water systems, especially in this case, 

get their water from [an outside source] to start with.

* * *

[But] [i]f we go back long enough and specifically when this plant was built in 

1919, the common practice was—as I understand it, because obviously I wasn’t 

here and building plants in 1919, was a single utility water—or a single water 

circuit throughout the plant. So the water was available for things like washing 

down and diluting and filling up tanks when they needed to be, as well as the fire 

system. So it was one pressurized system. And that design over time has evolved 

to independent systems for a few good reasons.

* * *

[H]av[ing] an adequate volume and quality of water available in the event there’s 

a fire is the key reason why you want to have a standalone system.

Wolf also testified that “[y]ou wouldn’t design [BP’s fire water system] as it is now if you’re 

starting from scratch.” This testimony—from BP’s own expert—shows that the crossconnections at issue were “designed and constructed in accordance with . . . practices that are no 

longer in general use.” See 29 C.F.R. § 1910.119(d)(3)(iii) (emphasis added). In this respect, the 

record is sufficient to establish the applicability of (d)(3)(iii). Additionally, given the 

presumption of a hazard with regard to the cross-connections, BP was required to conduct and 

 

27 The judge qualified Wolf as an expert in the areas of “fire water systems in the refining 

industry,” “the design, operations and analysis of BP’s fire water system,” and “process hazards 

and risks associated with the refinery’s fire water systems.” We note that the judge’s 

qualification of Wolf as an expert on BP’s fire water system is quite unorthodox, given that 

experts are typically qualified as such in a particular field and then apply that expertise to the 

facts at issue. Nevertheless, given that Wolf was qualified as an expert in “fire water systems in 

the refining industry” and then opined on BP’s system, we do not consider the judge’s ruling 

reversible error.
25

document a PHA with regard to them. See 29 C.F.R. § 1910.119(e)(3)(i) (“The process hazard 

analysis shall address . . . [t]he hazards of the process.”). Accordingly, (e)(3)(i) applies as well.

Regarding noncompliance, the Secretary contends that the record shows the cited crossconnections were not evaluated by BP prior to the OSHA inspection because the company failed 

to produce any documents in response to the Secretary’s discovery request for “[a]ny and all risk 

analyses or other documents relating to the cross-connections between the process water systems 

and plant firewater systems identified in . . . Item 31a.” Though the Secretary’s First Request for 

Production—which he asserts contains this request—is not in evidence, BP does not dispute on 

review that the Secretary requested the required documentation.28 In addition, the record is 

bereft of any risk analyses, PHAs, or other documentation showing that BP determined that the 

cross-connections were safe. See MCC of Fla., Inc., 9 BNA OSHC 1895, 1899 (No. 15757, 

1981) (employer’s “failure to produce [records] at the hearing strongly indicate[s] that the 

required records were not maintained”). The absence of a PHA is particularly glaring given that 

a PSM compliance audit BP conducted several months before the OSHA inspection identified 

the cross-connections as “not [being] in accordance with” National Fire Protection Association 

(NFPA) and API standards, and it called for “inclusion of these cross-connections in a process 

hazard analysis.”29 Given the Secretary’s discovery request and BP’s apparent failure to respond 

to it, we find that the Secretary has established noncompliance with (d)(3)(iii) and (e)(3)(i).

As for the knowledge element of the Secretary’s case, the record shows that 

refinery management was aware of the existence of the cross-connections in the mid-1980s. 

Also, the report from BP’s PSM compliance audit stated that “[f]ire water should be supplied by 

a system that is independent of all other uses and be from a reliable source” and that the system 

“did not meet some recognized and generally accepted good engineering practices” in part 

 

28 Initially, in opposition to the Secretary’s petition for discretionary review, BP disputed that the 

Secretary had made such a request. However, in response to the Secretary’s reference in his 

opening review brief to this discovery request, BP now argues only that “[t]he Secretary has 

not . . . presented any evidence that Respondent[] did not produce any documents in response to 

this request.”

29 Compliance audits are governed by paragraph (o) of the PSM standard, which provides, 

among other things, that “[e]mployers shall certify that they have evaluated compliance with the 

provisions of this section at least every three years to verify that the procedures and practices 

developed under the standard are adequate and are being followed.” 29 C.F.R. § 1910.119(o)(1).
26

because, as noted above, the “cross-connections of the fire water main with process equipment 

were not in accordance with” NFPA and API standards. See N&N Contractors, Inc., 18 BNA 

OSHC 2121, 2122 (No. 96-0606, 2000) (“To meet [his] burden of establishing employer 

knowledge, the Secretary must show that the cited employer either knew or, with the exercise of 

reasonable diligence, could have known of the presence of the violative condition.”), aff’d, 255 

F.3d 122 (4th Cir. 2001). As to employee exposure, BP expert Wolf acknowledged that “the two 

overriding [concerns]” regarding cross-connections between the fire water system and other 

water systems are hydrocarbon “contamination” of the fire water and “having enough water 

available if you have a fire.” In other words, these cross-connections can impair the refinery’s 

ability to fight fires, so all the employees in the refinery were exposed to that condition. See 

Fabricated Metal Prods., Inc., 18 BNA OSHC 1072, 1074 (No. 93-1853, 1997) (“[T]he 

Secretary . . . must show that it is reasonably predictable . . . that employees have been, are, or 

will be in the zone of danger.”). In light of the foregoing, the Secretary has established 

violations of both (d)(3)(iii) and (e)(3)(i). Accordingly, we affirm Items 31a and 31b.

The Secretary maintains that these grouped violations are willful. Conduct is not willful, 

however, if the employer has “made a good faith effort to comply with a standard or eliminate a 

hazard, even though [its] . . . efforts were not entirely effective or complete.” A.E. Staley Mfg. 

Co., 19 BNA OSHC 1199, 1202 (No. 91-0637, 2000) (consolidated). Here, BP had already 

begun the complex process of removing the “cross-connections” between the fire water system 

and other water systems and its PSM compliance audit identified the still existing crossconnections as an issue to be resolved, setting a “due date” for resolution of March 31, 2010. 

We consider this a good faith effort to address the potential hazard associated with the crossconnections sufficient to negate willfulness. As the Secretary notes, however, the crossconnections could have compromised the refinery’s ability to effectively fight fires, putting 

employees at risk of injury or death. Moreover, employees were exposed to this violative 

condition for the entirety of the citation period, as the different water systems were connected 

throughout that time. Thus, we find that a serious characterization is appropriate here. Pressure 

Concrete Constr. Co., 15 BNA OSHC 2011, 2018 (No. 90-2668, 1992) (characterizing a 

violation as serious “does not mean that the occurrence of an accident must be a substantially 

probable result of the violative condition but, rather, that a serious injury is the likely result 

should an accident occur”).
27

These same considerations factor into our determination that an appropriate penalty for 

the violation is the maximum in effect at the time of the violation.30 Accordingly, we 

characterize these grouped violations as serious and assess a single penalty of $7,000. See 29 

U.S.C. § 666(b) (“Any employer who has received a citation for a serious violation . . . shall be 

assessed a civil penalty of up to $7,000 for each such violation.”); Capform, Inc., 19 BNA OSHC 

1374, 1378 (No. 99-0322, 2001) (gravity of violation for penalty purposes “depends upon the 

number of employees exposed, the duration of the exposure, the precautions taken against injury, 

and the likelihood that any injury would result.”), aff’d, 34 F. App’x 152 (5th Cir. 2002) 

(unpublished).

VI. Items 32 through 40

Items 32 through 40 concern “facility siting”—assessing and addressing potential damage 

that a workplace explosion or fire could cause to occupied buildings. In the mid-1990s, BP 

conducted a blast protection assessment for the refinery and memorialized the results in a report 

dated May 11, 1994 (“the 1994 Report”), which was updated in March 1995 (“the 1995 

Report”). Thereafter, BP began a facility siting program, under which the company planned and 

implemented a variety of actions to address the fire/explosion risk to thirty-three buildings. The 

program set as the highest priority those areas where employees worked around the clock and 

closest to the process units, and set as the lowest priority those areas where employees worked 

farther away from the process units. This resulted in a plan with three phases: buildings in and 

closest to the process units would be evaluated in the first phase; buildings located further from 

the process units would be evaluated in the second phase; and buildings located closer to the 

perimeter of the facility would be evaluated in the third phase.

In these citation items, the Secretary asserts that BP failed to resolve several 

recommendations in the 1994 and 1995 Reports in violation of § 1910.119(e)(5). This provision 

requires that employers address PHA findings and recommendations:

The employer shall establish a system to promptly address the [PHA] team’s 

findings and recommendations; assure that the recommendations are resolved in a 

 

30 Pursuant to the authority granted in Federal Civil Penalties Inflation Adjustment Act 

Improvements Act of 2015, Pub. L. No. 114-74, § 701 (2015), OSHA has revised the penalty 

amounts for violations of its standards. See 29 C.F.R. § 1903.15(d). The violation here, 

however, occurred prior to the effective date of these revisions, so the statutory maximum 

applicable in this case is $7,000.
28

timely manner and that the resolution is documented; document what actions are 

to be taken; complete actions as soon as possible; develop a written schedule of 

when these actions are to be completed; communicate the actions to operating, 

maintenance and other employees whose work assignments are in the process and 

who may be affected by the recommendations or actions.

Here, the Secretary alleges that BP failed to “document the actions to be taken, develop a 

schedule to implement the actions, and execute the actions necessary to control hazards 

associated with building collapse and damage due to explosion overpressures” regarding nine 

refinery facilities: the “WGI Insulators Building,” “Blender control room,” “Boiler Shop,” “E&I 

Shop,” “HSEQ Building,” “Laboratory,” “Main Office Building,” “WGI Administrative 

Building,” and “WGI Electricians Building.” The Secretary further points to two BP 

“Preliminary Building Damage Evaluation” reports, from 2006 and 2008, as evidence that as late 

as 2009, BP was aware that it had not properly responded to the 1994 and 1995 Reports.

The judge vacated these items, finding that the Secretary failed to establish that BP was 

not in compliance. She observed that “[a]lthough the citation is couched in terms of failure to 

document the resolution of recommendations, the Secretary’s primary issue [is that the] facility 

siting PHA recommendations . . . were not resolved on [his] timetable.” The judge also noted 

that BP’s facility siting program contained documentation on the progress of its efforts to resolve 

recommendations for the cited buildings, including several interim measures BP implemented at 

eight of the nine cited buildings. In light of this documentation and the interim measures, along 

with testimony from another BP expert, John Arendt, that the company’s facility siting program 

was reasonable, the judge concluded that the Secretary failed to establish a violation of (e)(5).

On review, the Secretary contends that the judge’s ruling was error because BP knew, as 

early as 1994, that the nine cited buildings “posed a risk of serious injury or death to occupants 

from a vapor cloud explosion” and that the interim measures were insufficient to address these 

risks, which were present for at least 15 years. BP responds that the company’s facility siting 

program satisfied the cited provision because neither the 1994 nor the 1995 Report 

recommended immediate modifications to the cited buildings; rather, BP asserts, these 

documents merely “recommended further study and, where cost-effective, steps to reduce [risk 

regarding] certain buildings, starting in the process core.”

We agree with BP that resolution of these citation items depends on what, in fact, the 

1994 and 1995 Reports recommended. The 1994 Report contains a “Discussion of Results”

section and a “Recommendations” section, and the 1995 Report contains a “Major Findings” 
29

section and a “Recommendations” section. Notably, though, none of the citation items asserts 

that BP failed to meet the provision’s mandate to “address . . . findings.” 29 C.F.R. § 

1910.119(e)(5) (emphasis added). Rather, the citation describes the violative conduct as BP 

having failed to “establish a system to assure that the [PHA] team’s recommendations are 

resolved.” (Emphasis added.) There is no indication that the parties ever agreed to a broader 

reading of the citation before the judge. Compare FED. R. CIV. P. 15(b)(2) (“When an issue not 

raised by the pleadings is tried by the parties’ express or implied consent, it must be treated in all 

respects as if raised in the pleadings.”); Jones v. Miles, 656 F.2d 103, 107 n.7 (5th Cir. 1981) 

(citing to transcript to support finding that parties tried issue by consent). Therefore, the only 

question is whether the Secretary established that BP failed to “assure that the recommendations” 

in the 1994 and 1995 Reports were “resolved in a timely manner and that the resolution is 

documented,” and it “complete[d the] actions as soon as possible.” 29 C.F.R. § 1910.119(e)(5).

The 1994 Report considered two types of risk: “Individual Risk,” defined as “the 

frequency of death or serious injury for a person most at risk from a given activity due to their 

location, habits, or time periods” of exposure; and “Population Risk,” defined as “the frequency 

of accidents involving multiple fatalities.” The 1994 Report’s “Recommendations” section 

stated that “Individual Risk reduction must be considered for all target buildings,” including the 

nine cited ones, and “Population Risk reduction should be considered on the ‘as low as 

reasonably practicable’ basis for half the buildings,” again including the nine cited ones. The 

1994 Report also identified ten buildings—none of which is a cited facility—to be specifically 

“assess[ed] . . . for possible mitigation measures” because they were in “the top 20 per cent based 

on Individual Risk calculations (nine buildings) and one additional building, the Nerve Center, 

due [to] its Population Risk result.” The 1994 Report further recommended that “[i]f analysis 

shows that the [risk] mitigation methods are cost effective for” these ten high-risk buildings, “it 

should be considered for the rest of the list,” including the cited buildings. At the same time, it 

stated that “a measured response is called for” because “no single site building is indicated to 

have an exceedingly high Individual Risk by the proposed criteria.”

As for the 1995 Report, its “Recommendations” section stated that as to four of the cited 

buildings—the WGI Electricians Building, Laboratory, Blender control room, and WGI 

Administrative Building—BP was to “consider relocating some of the people currently housed in 

that process building. This will reduce the population risks and require a lesser spend for cost-
30

effective mitigations.”31 (Emphasis added.) In sum, with respect to the nine cited facilities, the 

1994 Report did not recommend actual corrective action—it simply stated that a “measured 

response” was appropriate and certain risk mitigation should be “considered.” Similarly, the one 

pertinent recommended action in the 1995 Report’s “Recommendations” section was for BP to 

merely “consider” relocations for four of the cited facilities.

We find no support in the record for the Secretary’s contention that BP’s facility siting 

program—specifically the measures aimed at the cited buildings—failed to “consider” risk 

reduction and take the “measured response” called for by the 1994 and 1995 Reports. BP’s 

program involved assessing thirty-three buildings, ten of which (not among those cited here) 

were located in the process unit and therefore “targeted” in the 1994 Report as high-risk. The 

risk issues associated with these ten buildings were remediated between 2001 and OSHA’s 

inspection in 2009, primarily through relocation of personnel out of the process unit and, for 

those remaining inside, building new structures to house them. Meanwhile, BP instituted 

“interim” measures to address lower-risk buildings, including the nine cited facilities. For each 

of the nine facilities, BP installed new film on the windows, secured the lighting, and reviewed 

the building’s ability to withstand overpressure. Additionally, BP made specific changes at these 

buildings to address risks, such as posting evacuation signs and instructions in the WGI 

Insulators Building, Blender control room, and WGI Electricians Building; confirming that an 

eyewash station was within 50 yards of the WGI Insulators Building; upgrading the fire 

 

31 We note that the 1995 Report contains what may be considered recommendations in its “Major 

Findings” section—these findings, as they pertain to population risk, may be viewed as 

inconsistent with what appears in the “Recommendations” section. For example, the “Major 

Findings” section states that “population risks should be further reduced where such reduction 

can be cost-effectively achieved” and that “risks can be cost-effectively reduced through building 

modifications or relocation for” the WGI Electricians Building, Laboratory, Blender control 

room, and WGI Administrative Building. (Emphasis added.) We conclude, however, that the 

only relevant part of the 1995 Report is the “Recommendations” section. The report’s separation 

of “Major Findings” from “Recommendations” tracks the language of the standard, which 

requires the employer to have “a system to promptly address the team’s findings and 

recommendations” and to “assure that the recommendations are resolved in a timely manner and 

that the resolution is documented . . . .” 29 C.F.R. § 1910.119(e)(5) (emphasis added). To the 

extent BP was obligated to consider statements in the Major Findings section as 

“recommendations,” its failure to do so could be considered a deficiency in its PHA, but these

statements cannot be treated as a basis for finding a violation of the cited provision, which 

confines the Secretary to the substance of the PHA recommendations at issue.
31

protection system in the Blender control room; providing fire extinguishers for the Blender 

control room and Boiler Shop; ensuring that adequate exterior fire protection was in place for the 

Laboratory; and beginning construction of a new Laboratory. 

The Secretary suggests that the 1994 and 1995 Reports informed BP that the nine cited 

buildings could collapse in an explosion, and so the company’s actions were insufficient because 

they did not meaningfully address the hazard of building collapse from an explosion event. This 

is the wrong benchmark, however, for assessing the adequacy of BP’s response.32 Given how 

the Secretary has alleged the violations, the company’s compliance is measured solely by the 

recommendations in the 1994 and 1995 Reports. We conclude, based on the foregoing, that BP 

addressed them. Accordingly, we vacate Items 32 through 40.33

ORDER

Willful Citation 2, Items 2a through 18a, 4b through 12b, 15b, 19a through 27a, 19b 

through 27b, and 32 through 40, are vacated. Willful Citation 2, Items 31a and 31b, are affirmed 

as serious and a single penalty of $7,000 is assessed for these grouped violations.

SO ORDERED.

/s/

Heather L. MacDougall

Chairman

/s/

James J. Sullivan, Jr.

Dated: September 27, 2018 Commissioner

 

32 The Secretary seems to take issue with the substance of the recommendations in the 1994 and 

1995 Reports, claiming they are insufficient to address the hazard involved. To the extent this is 

the Secretary’s actual concern, we note that several provisions of the PSM standard appear to 

address the substance of PHAs but were not cited here. See 29 C.F.R. § 1910.119(e)(1) (“The 

process hazard analysis shall be appropriate to the complexity of the process and shall identify, 

evaluate, and control the hazards involved in the process.”), (e)(3)(i) (“The process hazard 

analysis shall address . . . [t]he hazards of the process.”), (e)(3)(v) (“The process hazard analysis 

shall address . . . [f]acility siting.”).

33 Both before the judge and on review, BP has challenged as “overbroad” the Secretary’s 

proposed abatement for most of the items at issue on review (all but Items 31a and 31b) because 

these items specify, in part, abatement of conditions that the Secretary did not cite as violative of 

the PSM standard. Because we vacate each of the items pertinent to BP’s argument, we need not 

address this abatement issue.
ATTWOOD, Commissioner, concurring and dissenting in part: 

I join all parts of the majority’s decision, except Part I, which addresses Willful Citation 

2, Items 2a through 12a, and 4b through 12b. For the reasons that follow, I would affirm as 

serious Items 6a and 6b, 9a through 12a, and 9b through 12b. I agree to vacate Items 2a through 

4a, 4b, 5a, 5b, 7a, 7b, 8a, and 8b, but on different grounds than my colleagues.

As the majority explains, each of these citation items pertains to a condition known as 

inlet pressure drop (“IPd”). The Secretary argues that the relief installations identified in Items 2 

through 12 are not compliant with recognized and generally accepted good engineering practices 

(“RAGAGEP”)—a requirement under OSHA’s standard for process safety management of 

highly hazardous chemicals, 29 C.F.R. § 1910.119—because the IPds for these installations 

exceeded 3%, and BP failed to conduct any engineering analysis (let alone a sufficient one) to 

support any higher levels. I agree with my colleagues that the Secretary failed to establish that a 

3% IPd limit is the only RAGAGEP on which BP could have relied. Section 4.2.2 of American 

Petroleum Institute Recommended Practice 520, Part II (“API 520”) expressly permits an 

employer to conduct an engineering analysis to allow for an IPd above 3%, and this option was 

certainly available to BP.1 

My colleagues do not dispute that the “Middough reports” show some of the relief 

installations at issue had IPds in excess of 5%,2and they recognize that the record “suggests” an 

 

1 API’s standard provides, “[a]n engineering analysis of the valve performance at higher inlet 

losses may permit increasing the allowable pressure loss above 3 percent.”

2 As discussed by my colleagues, the IPd levels for each of the relief installations at issue are 

from reports that Middough, Inc.—the safety consulting firm that conducted the revalidation 

study of the refinery’s valves—submitted to BP. For the reasons stated by my colleagues, I 

agree that these reports were not part of a voluntary self-audit and that, in any event, BP waived 

any admissibility arguments by submitting the underlying reports into evidence and failing to 

object to the December 2008 summary report offered by the Secretary. 

Unlike my colleagues, however, I would not be troubled by the Secretary’s use of these reports 

in this case, even if they were the type of voluntary self-audits discussed in OSHA’s policy. 

Final Policy Concerning the Occupational Safety and Health Administration’s Treatment of 

Voluntary Employer Safety and Health Self-Audits, 65 Fed. Reg. 46,498 (July 28, 2000). OSHA 

explicitly notes in its policy that it does not prohibit the use of such audits in enforcement 

proceedings. Specifically, OSHA explains that it would be “imprudent” to completely prohibit 

the agency’s “use of voluntary self-audit documentation” because doing so “would hamper 

OSHA’s ability to enforce the Act effectively.” Id. at 46,500. OSHA also states that the policy 

is an “internal” one “intended only to provide OSHA inspectors with guidance regarding the 
33

IPd in excess of 5% for the relief installations at issue would not have “provide[d] an appropriate 

safety margin.” My colleagues nonetheless conclude that these citation items should be vacated 

because no other issue—besides whether a 3% IPd limit constitutes the only RAGAGEP—has 

been asserted by the Secretary or litigated by the parties. I disagree with this analysis, and 

therefore reach the other issues raised by the parties with respect to these citation items.

I. What constitutes RAGAGEP is an issue in controversy

My colleagues rest their decision to vacate the IPd citation items on their narrow 

resolution of the following question—do the allegations include whether the referenced relief 

installations were RAGAGEP-compliant, or are they limited by the Secretary’s assertion that a 

3% IPd limit is the only RAGAGEP? They conclude that “the parties were clearly litigating 

whether a 3% IPd limit is, in fact, the only RAGAGEP for existing relief installations.” In fact, 

as my colleagues explicitly recognize, the Secretary did not simply argue that a 3% IPd limit was 

the only RAGAGEP—he acknowledged that API 520 allows for an IPd limit higher than 3% if it 

is supported by an engineering analysis “of the valve performance at higher [IPds].” My 

colleagues seek to minimize this acknowledgement by focusing solely on the Secretary’s claim 

that API 520 provides no acceptable methodology for conducting such an engineering analysis, 

leaving 3% as the only appropriate consensus limit. 

That has not been the Secretary’s only contention, however. He argues in the alternative 

that BP’s internal IPd limit standards of 7% and then 5% were not RAGAGEP because the 

engineering analyses that BP relied on to support these standards were not analyses “of the 

[actual] valve performance at higher [IPds]” as specified in the API 520 exception to the 3% 

limit. As discussed in more detail in Part II of this opinion, BP witnesses testified that at the 

time OSHA’s inspection began, the engineering analysis used to support BP’s 7% IPd limit 

 

circumstances under which [OSHA] considers it appropriate to review and consider 

documentation generated by employers as a result of voluntary self-audits.” Id. Finally, OSHA 

explains that it will not promulgate a formal rule concerning use of voluntary self-audits, because 

it “believes that a rule that creates legal rights for third parties would be more likely to produce 

unproductive litigation than will a policy that only provides guidance to OSHA inspectors.” Id.

at 46,501; see Dayton Tire, 23 BNA OSHC 1247, 1257 n.8 (No. 94-1374, 2010) (“The 

Commission has long held that while OSHA’s internal manuals may ‘provide[] guidance to 

OSHA professionals,’ they ‘[do] not have the force and effect of law, nor [do they] confer 

important procedural or substantive rights or duties on individuals.’ ” (citation omitted)), aff’d in 

part, 671 F.3d 1249 (D.C. Cir. 2012).
34

involved calculating each valve installation’s IPd and comparing this calculation to the “lower 

of” the valve’s blowdown specification or “7% of the set pressure.” As the blowdown for the 

valves at issue was presumed (by OSHA as well as BP) to be 7% of the set pressure, the analysis 

compared this value to the valve’s calculated IPd. If the IPd was calculated at 7% or less, BP 

would find the valve to be in conformance with BP’s internal guidance. BP followed this same 

methodology in the analysis it relied upon to support its revised 5% IPd limit, but used 5% of the 

set pressure as the point of comparison rather than 7%.

In looking beyond the 3% IPd limit and addressing whether BP’s internal standards were 

RAGAGEP-compliant, the Secretary argued below that, in order to comply with API 520’s 

exception to the 3% limit, BP’s engineering analysis was required to include more than a simple 

mathematical calculation. The Secretary finds support for this claim in the factors (such as 

verifying the valve’s blowdown and reviewing records for evidence of chatter) that the API 

working group considered in its (failed) attempt to come up with a recommended method for 

determining whether a valve’s performance at a higher IPd limit was acceptable, as well the 

testimony of the Secretary’s expert witness, Harold Fisher. The Secretary similarly argues in his 

briefs to the Commission that, “[a]t a minimum, a sound analysis should have included an 

assessment of the individual valve installation’s characteristics and configuration to provide 

some assurance that the valve has not been chattering.” 

Like the Secretary, BP has litigated the broader issue of what constitutes RAGAGEP.3 

As I read BP’s briefs before the judge as well as before us, it makes two types of arguments. 

First, BP raises several legal arguments supporting its primary assertion that the Secretary cannot 

enforce the 3% IPd limit. For example, BP argues that the judge correctly determined that the 

Secretary was improperly attempting to incorporate the 3% IPd limit into the RAGAGEP 

standard without engaging in rulemaking. However, BP also argues that its internal guidelines 

(originally requiring IPds at or below 7% and later 5%) constitute RAGAGEP. Thus, BP argues 

in its briefs to the Commission that its engineering analysis “[c]omplied with RAGAGEP.” The 

 

3 At the very least, BP has never argued, either before the judge or on review before the 

Commission, that what constitutes RAGAGEP is not an issue in controversy. Brabham-Parker 

Lumber Co., 11 BNA OSHC 1201, 1202 (No. 78-6060, 1983) (consolidated) (“The defense of 

lack of particularity is an affirmative defense that must be raised pre-hearing, in a pleading or by 

motion, or tried by the consent of the parties.”). 
35

parties’ arguments, therefore, do not merely focus on whether a 3% IPd limit is the only 

RAGAGEP, but also address whether BP’s 5% and 7% IPd limits constitute RAGAGEP under 

API 520 (which, as the majority notes, is the consensus standard on which BP’s policy explicitly 

relies). 

Finally, even without considering the parties’ arguments concerning RAGAGEP, it is 

clear that the language of the citation itself apprised BP that what constitutes RAGAGEP for IPd

on each referenced relief installation is, indeed, in controversy. 29 U.S.C. § 658(a) (citations 

must “describe with particularity the nature of the violation”); L & L Painting Co., 22 BNA 

OSHC 1346, 1349 (No. 05-0050, 2008) (citation omitted) (citation must be drafted “ ‘with 

sufficient particularity to inform the employer of what he did wrong, i.e., to apprise reasonably 

the employer of the issues in controversy’ ”). Certainly, the Secretary’s position has been that a 

3% IPd limit is the only RAGAGEP (absent a valid engineering analysis that points to a different 

number) for the types of relief installations at issue. But the citation items themselves concern

whether the IPds for these relief installations are compliant with RAGAGEP, and the fact that 

RAGAGEP is the focal point of these items is evident in the language used by the Secretary in 

the citation. 

Specifically, in Items 2a through 12a, the Secretary cites to 29 C.F.R. 

§ 1910.119(d)(3)(ii) and, consistent with that provision’s language, alleges in each item that 

“[t]he employer does not document that [a particular relief valve] providing pressure relief 

protection to [a particular pressure vessel] complies with recognized and generally accepted 

good engineering practices, in that, it has an inlet pressure drop greater than 3%.” (Emphasis 

added.) In Items 4b through 12b, the Secretary cites to 29 C.F.R. § 1910.119(j)(5) and, 

consistent with that provision’s language, alleges that “[t]he employer does not correct 

deficiencies in equipment that are outside acceptable limits . . . as defined by process 

information in [§] 1910.119(d),” and further alleges that “[t]he employer does not ensure [that 

the valve referenced in the corresponding “a” item], located in [a particular unit], has an inlet 

pressure drop of not more than 3%.” (Emphasis added.) And then, in the section pertaining to 

abatement for each “a” and “b” item, the Secretary instructs BP to:

submit an abatement plan describing the actions it is taking to ensure that it is in 

compliance with the standards including documentation that each pressure relief 

valve and associated piping for all process units have been evaluated and, if 

necessary, repaired or replaced to ensure inlet pressure drop is limited in 
36

accordance with recognized and generally accepted good engineering practices, 

such as API Recommended Practice 520 and the [American Society of 

Mechanical Engineers] Boiler and Pressure Vessel Code. 

(Emphasis added.) Cf. L & L Painting Co., 22 BNA OSHC at 1349 (holding that citation 

provided notice that calculation of medical removal plan benefits was issue in controversy where 

citation tracked language of cited provision—29 C.F.R. § 1926.62(k)(2)(i)—and specified that 

employee “ ‘did not receive [MRP] benefits as defined under this standard, on or about 

5/26/04’ ”).

Although I view the citation’s language as clearly apprising BP that RAGAGEP was an 

issue in controversy, even if the Secretary’s reference to the 3% IPd limit could be said to have 

muddied the issue, I find that the record, as discussed at length above, establishes that any lack of 

particularity was cured at the hearing and in the parties’ subsequent briefs. See Meadows Indus., 

Inc., 7 BNA OSHC 1709, 1710-11 (No. 76-1463, 1979) (“Lack of particularity in a citation may 

be cured at the hearing.”). Therefore, I reach the issue clearly tried by the parties here: whether 

the record shows that the relief installations at issue were not RAGAGEP-compliant.4 

 

4 The judge’s basis for vacating Items 2a through 12a, and 4b through 12b, is different than that 

of my colleagues. The judge concluded that by arguing that a 3% IPd limit is the only 

RAGAGEP, the Secretary impermissibly attempted to convert the cited PSM provisions from 

performance requirements to specification requirements. Although § 1910.119(d)(3)(ii) requires 

compliance with only one of any available RAGAGEPs, that does not mean there are necessarily 

multiple engineering practices for every specific aspect of all equipment that meet the standard’s 

performance criteria, i.e., engineering practices that are both recognized and generally accepted, 

and good.

By the terms of § 1910.119(d)(3)(ii), one way the Secretary can prove noncompliance is to 

establish that BP’s engineering practice for IPd does not meet the RAGAGEP criteria. If the 

Secretary proves, as he argues, that BP failed to comply with RAGAGEP by implementing an 

IPd limit for existing relief installations that was neither “recognized and generally accepted” nor 

a “good engineering practice” (or that the practice failed one of these two requirements), he has 

not “converted” a performance standard into a specification standard; he has simply established 

that in this instance, the facility’s practice was non-compliant. Cf. Brown & Root, Inc., 9 BNA 

OSHC 1833, 1834 n. 2, 1840 (No. 76-190, 1981) (concluding that frequency of testing—for 

carbon monoxide, conducted three times over a six- to eight-month period—was inadequate 

under standard requiring that “[i]f only a high-temperature alarm is used, the air from the 

compressor shall be frequently tested for carbon monoxide . . . .”); D. Fortunato, Inc., 7 BNA 

OSHC 1643, 1648 (No. 76-3103, 1979) (where garbage containers were found to be 

overflowing, employer’s daily removal of garbage was inadequate to meet standard’s 

requirement that removal occur “at frequent and regular intervals”). In this respect, I conclude 

that the judge erred in vacating the citation items on this basis. 
37

II. The Secretary has established that an IPd limit above 5% is not RAGAGEPcompliant

I agree with my colleagues that a 3% IPd limit for the types of relief installations at issue 

is not the only RAGAGEP available to BP. In my view, however, the record establishes that at 

the time of the violative conduct, an IPd limit above 5% was not RAGAGEP-compliant for the 

relief installations at issue. The record also establishes that BP continued to use the relief 

installations with IPds measuring above 5%, without instituting interim measures to assure their 

safe operation. For these reasons, as discussed in more detail below, I would affirm the “a” and 

“b” items that concern relief installations with IPds in excess of 5%.

BP’s 7% IPd limit

When OSHA’s inspection commenced on September 10, 2009, BP’s corporate-wide 

internal standard for pressure relief systems required that the IPd limit for existing relief 

installations not exceed the lesser of 7% or the blowdown. Because BP understood at the time 

that the manufacturers’ blowdown specification for the relief valves at issue was 7%,5 BP’s 

internal standard for these installations was, in effect, an IPd limit of 7%. In an internal guidance 

document dated August 2007, BP provided the following “engineering analysis” to support this 

internal standard: 

For existing installations involving pressure relief valves, an inlet line pressure 

loss should not exceed the lower of a) the blowdown pressure or b) 7% of the set 

pressure (gauge units). If the pressure does not decrease to below the reseat 

pressure, then experience has shown that the valve will remain open. This 

constitutes the engineering analysis required by API to allow higher inlet line 

pressure losses. API RP-520 Part II, 5th Edition section 4.2.2 states:

“An engineering analysis of the valve performance at higher inlet losses 

may permit increasing the allowable pressure loss above 3 percent.”

 

5 At the time of the alleged violative conduct, it was a common understanding throughout the 

refining industry (and even at OSHA) that the valve types at issue here were shipped by their

manufacturers with a blowdown specification of 7%. Indeed, OSHA stated in an April 2010 

letter to API that “[o]ur understanding is that most relief valves in compressible service,” which 

means vapor or gas service, “in the US are shipped with 7% blowdown.” In addition, Georges 

Melhem and Fisher both testified that in 2009 and 2010 (the period of BP’s alleged violative 

conduct), blowdown was understood in the refining industry to be 7%.
38

BP asserts that its engineering analysis consisted of calculating each relief installation’s IPd and 

comparing it to the valve’s blowdown6to verify that the calculation was less than the blowdown. 

In other words, BP’s analysis in support of its 7% IPd limit begins with the premise that these 

valves will reseat properly (i.e., without “chatter”) as long as the IPd does not exceed the 

blowdown. BP reasoned that because the manufacturers supply the valves with a blowdown 

specification of 7%, an IPd that does not exceed 7% would allow the valves to function properly. 

Before OSHA’s inspection, BP (through Middough) had begun the process of calculating the IPd 

in each existing relief installation to assess whether, in conformance with its internal standard, 

the IPd in fact did not exceed 7%.

The record supports BP’s assumption that as long as no other factors affect the stability 

of a relief valve, the valve should function properly if the IPd is lower than the blowdown. 

However, the record also shows that at the time of the citation, for an IPd limit to have 

constituted a “good engineering practice,” it must have been low enough to include a safety 

margin. Specifically, Fisher and Melhem, as well as Steve Cloutier, BP’s former technical 

authority on pressure relief systems, agreed that such a safety margin is necessary to account for 

calculation inaccuracies and imperfections (sticking and misalignment, for example). 

Citing to Melhem’s testimony, BP maintains that “[a] refinery’s internal guidelines 

comply with the PSM Standard so long as they result in IPd below blowdown,” i.e., an IPd limit 

up to 7%. BP, however, ignores the advice Melhem gave to its Texas City, Texas refinery before 

the OSHA inspection of its Ohio refinery commenced in this case. When the Texas refinery 

provided Melhem with BP’s 7% IPd guideline, he told BP personnel that the basis behind that 

limit—“7% is at or below the blowdown”—is “not without merit.” But Melhem also advised BP 

that there should be a safety margin, of which there was none, and he “would like to see” an IPd 

safety margin of 2% for existing relief installations.7 Through his company ioMosaic, Melhem 

 

6 BP asserts that it compared each valve’s IPd to either the “actual [blowdown] figure” or the 

manufacturer’s 7% specification, but the record shows that Middough did not measure the 

valves’ blowdown values, and there is no evidence in the record—or assertion by BP—that BP 

independently measured these values. Accordingly, the record shows that BP’s engineering 

analysis is based on a comparison between the IPd, actually calculated by Middough, and the 

manufacturer’s 7% blowdown setting. 

7 Melhem made it clear in his testimony that he did not consider the 7% IPd limit a “good 

engineering practice” absent a safety margin:
39

issued a report to BP in December 2008—nine months before the inspection here commenced—

that recommended lowering its IPd limit for existing relief installations to 5%. Thus, BP’s 

rationale for its 7% IPd limit was flawed because its IPd policy did not incorporate a safety 

margin as recommended by its own expert and confirmed by the testimony of the Secretary’s 

expert witness.

Given the necessity of a safety margin, I find that the Secretary has established that BP’s 

7% IPd limit was not a “good engineering practice” and, thus, not RAGAGEP. 

BP’s 5% IPd limit

Starting in December 2008, a corporate BP committee held meetings to discuss updating 

BP’s IPd policy for existing relief installations. A final draft of the updated internal standard, 

which lowered the IPd limit to 5%, was formally issued by BP on October 26, 2009, six weeks 

after OSHA commenced its inspection in this case. The Secretary argues that this 5% IPd limit 

was not based on an adequate engineering analysis because BP merely calculated each “valve’s 

IPd and compar[ed] it to the valve’s rated, or assumed, blowdown number,” and no evidence in 

the record shows that “BP analyzed the performance of the valve, as recommended by API

 

BP’s Counsel: So [the 7% IPd limit is] the same guideline as . . . the 5% rule and 

3% rule, just without a safety margin? 

Melhem: Yeah, you’ve got to have a little bit of a margin. So we came in and 

said, you can’t just have it with no margin, you've got to put in some margin. 

BP’s Counsel: Okay, so what did you say -- what did you think about their 7% 

rule?

Melhem: I’m going to have to select my words very carefully because I 

remember writing that in that report that was served to OSHA and BP. I think I 

said . . . the 7% inlet pressure drop is not without merit. 

BP’s Counsel: Well, what would you think would be a good engineering practice 

for the company to adopt?

Melhem: Five percent. Blowdown minus some margin.

BP’s Counsel: Okay. And they adopted that? 

Melhem: And they did adopt that. But the 7% has some engineering basis. And 

we just wanted to see a little bit more of a margin.

Melhem subsequently repeated this view when he testified that “you can’t have a zero percent 

[safety] margin” because “nobody’s that good”; and “[f]or existing systems, to make sure that we 

don’t expose people to undue risk . . . go up to blowdown minus some margin.”
40

[520].” BP concedes this is what its engineering analysis entailed, but BP maintains that the 

analysis was conducted by “experienced professionals,” and the results “mirrored generally 

accepted industry practices within the refining industry.”

The Secretary, not BP, has the burden on this issue and I find that he has failed to show 

BP’s 5% IPd limit did not constitute RAGAGEP. See Motiva Enters., LLC, 21 BNA OSHC 

1696, 1699 n.3 (No. 02-2160, 2006) (noting that Secretary bears “burden of proving that the 

combination of activities at issue here constituted a ‘process’ under the PSM standard”); cf. Am. 

Sterilizer Co., 18 BNA OSHC 1082, 1086 (No. 91-2494, 1997) (“When, as here, the Secretary 

alleges a violation of a broadly-worded training standard and the employer defends by showing 

that it has provided the type of training at issue, the burden shifts to the Secretary to show some 

deficiency in the training provided.”). At the time OSHA issued the citation here, there was no 

guidance from API or OSHA (beyond the text of API 520) addressing what such an engineering 

analysis must entail. The Secretary focuses on the word “performance” in the relevant portion of 

API 520—“[a]n engineering analysis of the valve performance at higher inlet losses may permit 

increasing the allowable pressure loss above 3 percent”—to argue that BP’s engineering analysis 

was deficient because, among other alleged shortcomings, BP did not independently verify the 

manufacturers’ blowdown. But no evidence in the record shows that BP had reason to believe 

the manufacturers’ representation of blowdown performance for the relief valves at issue was so 

inaccurate that an appropriate safety margin would not sufficiently address any deficiencies. 

The Secretary’s expert witnesses—Fisher and Patricia Hamlin—advocated for a “bright 

line” 3% IPd limit for both new and existing relief installations. The preponderance of the 

evidence, however, shows that for existing installations, using an IPd limit that incorporated a 

2% safety margin constituted a good engineering practice. Specifically, Melhem testified that it 

was “common industry practice” to allow IPds, after a valve was installed, to increase from 3% 

to 5% to avoid the serious risks associated with shutting down the equipment, implementing 

corrective actions, and then restarting equipment.8 Cloutier’s testimony concerning BP’s 

consideration of these risks is consistent with Melhem’s testimony. According to Cloutier, to 

 

8 Discussing shutdowns and startups, a BP general operator testified that these are the most 

unstable operations, because the temperature of the metals is changing “from ambient” to as 

much as 1400 degrees, and the pressure is changing from “0 to 1000 pounds”—this creates a 

“tendency” for equipment “to give.”
41

determine the appropriate IPd limit for existing installations, “we have to decide which is worse, 

the illness or the cure,” and to bring a unit down and change its design, or cut into an existing 

configuration, to correct an IPd between 3% and 5% is less safe than allowing a 5% IPd. Finally, 

the testimony in support of a 3% IPd limit for existing installations mostly focuses on the 3% 

limit’s inclusion in multiple consensus standards, rather than the necessity of a particular safety 

margin. But as discussed by my colleagues, this testimony is not consistent with API 520’s 

inclusion of an engineering analysis option to allow for an IPd above 3%.

The other aspect of BP’s engineering analysis—its valve-by-valve analysis—involved 

calculating each valve’s IPd to ensure that it was below 5% and then comparing that level with 

the manufacturer’s blowdown specification. Fisher disputed the adequacy of this analysis, but 

mostly focused on BP’s failure to consider “dynamic factors,”9and its reliance on the 

manufacturers’ certifications of blowdown performance, neither of which were recognized as 

pertinent considerations by the refining industry or API at the time OSHA issued the citation. 

Under these circumstances, I conclude that the Secretary has failed to show that BP’s adoption of 

a 5% IPd limit for existing relief installations was, at the time OSHA issued the citation, not a 

good engineering practice and that its corresponding engineering analysis was not compliant 

with API 520.10 As such, I find that the Secretary failed to show that BP’s 5% IPd limit did not 

constitute RAGAGEP. 

III. Citation 2, Items 4b through 12b

Under the PSM standard, an employer is required to “complete a compilation of written 

process safety information” (“PSI”) “before conducting any process hazard analysis” (“PHA”) 

required by the standard; this PSI must include, among other things, “information pertaining to 

the equipment in the process.” 29 C.F.R. § 1910.119(d) (introductory paragraph), (d)(3)(i) 

 

9 Fisher claimed that dynamic factors—such as resonance and vibrations, which could affect the 

stability of a valve when it is opening or closing—must be considered but admitted that such 

factors are more prevalent in the nuclear industry. He also acknowledged that there is no 

mention of dynamic factors in API 520 and that as of 2003 in the refining and chemical 

industries (when this version of the API standard was first published, before being reaffirmed in 

2011), dynamic factors were not recognized as “having to do with relief valve operation.” In 

fact, Fisher admitted that since the “engineering analysis” language was first added to API 520 in 

1994, at the time that language could not have been intended to address dynamic factors. 

10 As my colleagues explain, there is no dispute that, at the time of the violations, API 520 was 

recognized and generally accepted (the “RAGA” part of RAGAGEP).
42

(identifying specific types of information included in “information pertaining to the equipment in 

the process”). Once the PSI is compiled, the employer must conduct an initial PHA to 

“determine and evaluate the hazards of the process being analyzed,” and then conduct a PHA 

revalidation every five years thereafter. 29 C.F.R. § 1910.119(e)(1)-(3), (6). In addition to 

conducting PHAs, employers must also inspect and test process equipment—including pressure 

vessels and piping systems. 29 C.F.R. § 1910.119(j)(1), (4). If “deficiencies in equipment” are 

identified “that are outside acceptable limits” as defined by the PSI, paragraph (j)(5)—the cited 

provision—requires the employer to “correct” the deficiencies, and to do so either “before 

further use or in a safe and timely manner when necessary means are taken to assure safe 

operation.” 29 C.F.R. § 1910.119(j)(5).

It is undisputed that after Middough calculated and documented the IPds concerning the 

relief installations identified in Items 4b through 12b, BP continued to operate the pressure 

vessels and rely on the associated relief valves. Because I find that the Secretary failed to prove 

that BP’s 5% IPd limit was not RAGAGEP and the relief installations referenced in Items 4b, 5b, 

7b, and 8b all had IPd levels that did not exceed 5%,11 I agree to vacate these items based on the 

Secretary’s failure to establish that the identified installations had “deficiencies in equipment” 

under paragraph (j)(5) that would have required corrective action.

Each of the relief installations referenced in Items 6b, 9b, 10b, 11b, and 12b had an IPd 

that exceeded 5%.12 The Secretary asserts that BP failed to comply with paragraph (j)(5) by 

 

11 The IPd calculations asserted by the Secretary in these citation items are derived from the 

December 2008 summary report from Middough. However, in evidence with respect to each 

referenced relief installation are several versions of the Middough reports that, in some cases, 

postdate the summary report. These reports include revised IPd levels, which resulted from new 

API recommendations on how to perform certain underlying calculations and issues noticed 

during field checks. 

Items 5b, 7b, and 8b allege that the referenced relief installations had IPds of 5%, 3.2%, and 

3.2%, respectively. The Middough reports in evidence show that these levels were never revised 

in excess of 5%. I note that based on the summary report, Item 4b alleges an IPd of 5.377% for 

the referenced relief installation. But in a report from June 2010, after the citation was issued, 

Middough revised this level to 4.17%. The Secretary, in his briefs, appears to concede that the 

IPd level for the relief installation identified in Items 4a and 4b was not in excess of 5%.

12 The citation alleges that the relief installations identified in these items had IPds of 6.3%, 

7.7%, 7.7%, 8.8%, and 6.8%, respectively. The Middough reports in evidence show that these 

levels, when revised, continued to be in excess of 5%.
43

taking no action to mitigate the risks posed by the elevated IPds (“the deficiencies”) in these 

relief installations. In response, BP argues that even if the relief installations were not in 

compliance with RAGAGEP, “it is undisputed that the Refinery implemented any necessary 

interim actions to assure safe operation, fully complying with [paragraph (j)(5)].” To support 

this assertion, BP cites to the testimony of one of its technical managers, but does not specify 

what “interim actions” were actually taken “to assure safe operation.” In the part of this 

testimony relating to “interim actions” taken with respect to the installations referenced in these 

five citation items, the technical manager testified that his team conducted “risk assessments” 

using Middough’s IPd levels and determined that the systems could operate safely until a 

subsequent scheduled shutdown to perform maintenance (known as a “turnaround”), at which 

time BP would modify the systems to reduce the IPds to below 3%. In other words, although BP 

conducted risk assessments, no interim actions were taken to reduce the hazards associated with 

the elevated IPds. Indeed, even though all of the deficiencies were initially identified by 

Middough in either 2008 or 2009, none of them had been fixed as of the technical manager’s

testimony in June 2012, and permanent corrective actions were not scheduled until either the 

2012 or 2013 turnarounds.

Consequently, the outstanding issue is whether performing a risk assessment was a 

“necessary means” of “assur[ing] safe operation” under § 1910.119(j)(5), thus allowing BP to 

correct the deficiencies “in a safe and timely manner.” The Secretary claims the risk assessments 

are not a means of assuring safe operation under the standard, emphasizing that BP “did not offer 

any evidence of interim measures that would ensure safe operation until the deficiencies could be 

corrected.” I agree. 

 

BP argues that allowing the Secretary to use these results “to prove a deficiency would create a 

strong disincentive against the desirable practice of employers obtaining such data to quickly 

take (potentially) necessary interim safety measures.” As my colleagues point out, however, BP 

itself submitted the Middough reports into evidence and did not object when the Secretary 

submitted into evidence, and relied upon, Middough’s December 2008 summary report. BP, 

therefore, has no basis for challenging the Secretary’s use of this evidence. FED. R. EVID. 103(a) 

(“A party may claim error in a ruling to admit . . . evidence only if the error affects a substantial 

right of the party and . . . a party, on the record: (A) timely objects or moves to strike; and (B) 

states the specific ground, unless it was apparent from the context[.]” (emphasis added)); see 

Commission Rule 71, 29 C.F.R. § 2200.71 (“The Federal Rules of Evidence are applicable.”).
44

Paragraph (j)(5) sets three criteria for delaying correction of a deficiency until after 

“further use”: it must be corrected (1) “in a safe . . . manner,” (2) “in a . . . timely manner,” and 

(3) “when necessary means are taken to assure safe operation.” See Superior Masonry Builders, 

Inc., 20 BNA OSHC 1182, 1184 (No. 96-1043, 2003) (determination of standard’s meaning 

starts with its text and structure). The criterion to correct the deficiency “in a safe . . . manner” 

relates to what must occur when the correction is made, whereas here, the pertinent inquiry 

concerns what must occur prior to the correction. The timely manner criterion sets a time limit 

for the period prior to the completion of the correction and means “timely” from the standpoint 

of safety.

As for the last criterion—“when necessary means are taken to assure safe operation”—it 

must refer to a concept that addresses neither the manner in which the correction is made nor the 

timeliness of the correction. See TRW Inc. v. Andrews, 534 U.S. 19, 31 (2001) (“It is ‘a cardinal 

principle of statutory construction’ that ‘a statute ought, upon the whole, to be so construed that, 

if it can be prevented, no clause, sentence, or word shall be superfluous, void, or insignificant.’ 

”). BP’s risk assessments, however, addressed only the timeliness criterion—the refinery 

analyzed the risk associated with waiting until the next turnaround before correcting the 

deficiencies but, as BP’s technical manager admitted, no “interim mitigations” were taken to 

reduce the risk posed by the elevated IPds. This contradicts BP’s position that the risk 

assessments alone—at least under the circumstances here—constituted a means of assuring safe 

operation under the standard.13

In addition, the Secretary’s contention that “necessary means . . . taken to assure safe 

operations” includes only those actions that mitigate the risk is supported by the final rule 

preamble, in which OSHA discusses a comment submitted by AMOCO Corp. AMOCO 

commented that “there are occasionally instances when a piece of equipment exceeds what is 

deemed ‘acceptable’, and interim measures are taken to bring the equipment back into 

 

13 BP also cites to a portion of the technical manager’s testimony, in which he discusses measures 

taken to address certain issues that arose following installation of a “balance line.” However, 

these measures were completed in 2009, before Middough started revalidating the affected valves, 

and the manager admitted that when Middough conducted its review, BP had not anticipated that 

problems with IPd would be found. He did testify that as part of the risk assessment for back 

pressure, his team determined that BP should continue to use the measures that were in place 

before Middough started the revalidation process, but that these measures did not pertain to IPd.
45

conformance with safe operating parameters.” Process Safety Management of Highly 

Hazardous Chemicals, 57 Fed. Reg. at 6391 (emphasis added). Immediately following its 

recitation of this comment, OSHA concludes the discussion of this issue by echoing AMOCO’s 

suggestion:

The comments have convinced OSHA that there may be many situations where it 

may not be necessary that the deficiencies be corrected “before further use” as 

long as the deficiencies are corrected in a safe and timely manner when necessary 

means are taken to assure safe operation.

Id. (emphasis added). See Superior Rigging & Erecting Co., 18 BNA OSHC 2089, 2091 (No. 

96-0126, 2000) (“[T]he preamble to a standard is the most authoritative evidence of the meaning 

of the standard.”) (citing Tops Markets, Inc., 17 BNA OSHC 1935, 1936 (No. 94-2527), aff’d 

without published opinion, 132 F.3d 1482 (D.C. Cir. 1997); Am. Sterilizer Co., 15 BNA OSHC 

1476, 1478 (No. 86-1179, 1992)).

Although the clause at issue—“when necessary means are taken to assure safe 

operation”—is included in a “broad, performance-oriented standard” that “may be given 

meaning in particular situations by reference to objective criteria, including the knowledge of 

reasonable persons familiar with the industry,” the measures taken must at least be within the 

parameters set by the language of the standard. Siemens Energy & Automation, Inc., 20 BNA 

OSHC 2196, 2198 & n.4 (No. 00-1052, 2005) (observing that employer’s interpretation of 

performance standard was contrary to standard’s plain meaning). Because BP’s risk assessments 

addressed only the timeliness of the deficiencies’ subsequent correction, they cannot qualify as 

“necessary means . . . to assure safe operation” under § 1910.119(j)(5). Accordingly, I would 

affirm Items 6b and 9b through 12b, all of which identify relief installations with IPds above 5%, 

but vacate Items 4b, 5b, 7b, and 8b, which identify installations with IPds equal to or less than 

5%.

IV. Citation 2, Items 2a through 12a

Section 1910.119(d)(3)(ii) requires the employer to “document that equipment complies 

with [RAGAGEP].” As I discuss above, the Secretary has failed to prove that the existing relief 

installations with IPds of 5% or less are not RAGAGEP-compliant. Moreover, the Secretary has 

not argued that the Middough reports documenting IPds that complied with RAGAGEP 

otherwise failed to satisfy the cited provision’s documentation requirement. Accordingly, I agree 

to vacate Items 2a through 5a, 7a, and 8a, all of which identify relief installations with IPds that 
46

did not exceed 5%.14 However, as noted above, the relief installations referenced in Items 6a and 

9a through 12a had IPds over 5%, which the Secretary has shown is not a good engineering 

practice and, thus, not RAGAGEP. I find, therefore, that the documentation for these relief 

installations was not compliant with § 1910.119(d)(3)(ii) when the citation was issued,15 and 

would affirm Items 6a and 9a through 12a.16

V. Characterization

“The hallmark of a willful violation is the employer’s state of mind at the time of the 

violation—an ‘intentional, knowing, or voluntary disregard for the requirements of the Act or . . . 

plain indifference to employee safety.’ ” Kaspar Wire Works, Inc., 18 BNA OSHC 2178, 2181 

(No. 90-2775, 2000) (citation omitted), aff’d, 268 F.3d 1123 (D.C. Cir. 2001).

[I]t is not enough for the Secretary to show that an employer was aware of 

conduct or conditions constituting the alleged violation; such evidence is already 

necessary to establish any violation . . . . A willful violation is differentiated by 

 

14 The Middough reports that serve as the basis for the IPd citation items documented that the 

IPd levels for the relief installations referenced in Items 2a and 3a were 3.8% and 4.6%, 

respectively. Middough subsequently revised these levels to 0.66% and 1.63%. The Secretary 

argues that even though Middough determined that the IPds for these relief installations “did not 

actually exceed 3%,” BP still violated § 1910.119(d)(3)(ii) because it failed “to document

compliance with RAGAGEP.” The Secretary asserts that “BP has not offered any proof of the 

required documentation,” and that “from 2008 until Middough revised its calculations, BP 

believed that these [relief installations] did not comply with RAGAGEP.” Based on my view of 

the case, however, I find that the levels Middough originally reported to BP for the referenced 

relief installations were RAGAGEP-compliant. And since there is no dispute that the Middough 

reports can be used to document compliance with RAGAGEP, the Secretary has not established 

BP’s non-compliance with respect to Items 2a and 3a.

15 BP argues that a prior consultant reviewed these relief installations in 1998 and did not report 

any of them as having an IPd deficiency. However, this 1998 report was twelve years old when 

the citation here was issued. Given that PHA revalidation must be conducted every five years, 

29 C.F.R. § 1910.119(e)(6), it would be inconsistent with that provision to allow BP to rely on 

twelve-year-old data to document the equipment’s compliance with RAGAGEP. 

16 As discussed in the part of the majority opinion that I join, when equipment is not RAGAGEPcompliant, but the employer is acting in accordance with the requirements of § 1910.119(j)(5), 

documentation of RAGAGEP-compliance under § 1910.119(d)(3)(ii) is not required. As to 

Items 6 and 9 through 12, however, BP continued to use the relief installations despite its failure 

to take interim measures to “assure safe operation” under paragraph (j)(5). BP, therefore, was

not exempt from the requirement to document that these relief installations were compliant with 

RAGAGEP.
47

heightened awareness of the illegality of the conduct or conditions and by a state 

of mind of conscious disregard or plain indifference . . . . 

Hern Iron Works, Inc., 16 BNA OSHC 1206, 1214 (No. 89-433, 1993). This state of mind is 

evident where “ ‘the employer was actually aware, at the time of the violative act, that the act 

was unlawful, or that it possessed a state of mind such that if it were informed of the standard, it 

would not care.’ ” AJP Constr., Inc. v. Sec’y of Labor, 357 F.3d 70, 74 (D.C. Cir. 2004) 

(emphasis and citation omitted).

The judge, having vacated the IPd citation items, did not address their willful 

characterization. The Secretary argues that Items 6a, 6b, 9a through 12a, and 9b through 12b 

(the items I would affirm) should be characterized as willful because BP exhibited plain 

indifference to employee safety. Although this issue, in my view, poses a close question, for the 

reasons discussed below, I conclude that the Secretary has failed to establish BP had a willful 

state of mind.

The Secretary first asserts that BP maintained a 7% IPd limit while knowing that this 

allowed for no safety margin and was not supported by any “technical basis.” It is true that when 

ioMosaic submitted its report to BP in December 2008 following its review of the relief systems 

at BP’s refinery in Texas City, BP was specifically informed that to avoid conditions such as 

chatter in its relief installations, there had to be a safety margin between the IPd limit and the 

blowdown setting. Also, the record shows that at this time, BP personnel in positions of 

authority, such as Cloutier, were well aware of the need for such a safety margin. 

But rather than ignore the ioMosaic report, corporate BP initiated a review of its IPd 

policy in December 2008 that culminated in the decision to lower the company’s internal 

standard to 5%. This process began with committee meetings held from December 2008 to 

February 2009 to discuss updating BP’s policy document, which at that time set forth the 7% IPd 

limit for existing relief installations. Serving on this committee was Cloutier and Ed Zamejc, 

another one of BP’s former technical authorities on pressure relief systems, as well as 

representatives of an engineering firm that provides technical support to refineries and chemical

plants. As to the maximum allowable IPd for existing installations, there was a difference of 

opinion between Cloutier and Zamejc about what the internal standard should be. Based on his 

30 years of experience in the area of pressure relief, Cloutier had found that “people” at other 

companies “accepted . . . an upper limit [of] 5% on the inlet pressure loss,” and he advocated that 

BP lower its IPd limit for existing installations to 5%. Also, Cloutier preferred an IPd limit with 
48

a 2% IPd safety margin, because he believed that the blowdown listed by the valve manufacturer 

was a “soft number.” But, according to Cloutier, Zamejc argued that the “physics on the [valve] 

disk allowed” the IPd “to go right up to the blowdown of the valve” and that he recommended 

maintaining the IPd limit at 7%. Zamejc testified that he believed a 7% IPd limit could be 

defended on a technical basis “based on it being within the operating range of the valve.” 

After discussing the issue, the committee decided during its January and February 2009 

meetings to leave the IPd limit at 7% for existing installations. The committee then sent the draft 

policy document to BP’s five U.S. refineries, including all of their engineering authorities, for 

feedback. In the summer of 2009, the committee reconvened and reexamined the draft, 

addressing the comments received and concerns raised. Then, at some point in September 2009, 

the committee decided that the IPd limit for existing installations should be lowered to 5%. 

Cloutier testified that, at that point, a decision to reduce the limit in accordance with his opinion 

was now possible because Zamejc had retired several months earlier, in March 2009. Cloutier 

also noted that there was agreement within BP’s refinery community that the IPd limit should be 

reduced, and the report from ioMosaic recommended the same. A final draft of the revised 

internal standard was placed into BP’s document control system for approval by “higher levels” 

in September 2009, and it was formally issued on October 26, 2009, six weeks after OSHA’s 

inspection in this case commenced on September 10, 2009. 

In short, the record does not support the Secretary’s contention that BP ignored the 

information ioMosaic provided the company about its 7% IPd limit and the need to account for a 

safety margin. And because it is not clear from the record on what day in September BP’s 

committee decided to lower the IPd limit to 5%, the Secretary cannot claim that BP’s decision to 

lower its IPd limit—the culmination of a lengthy undertaking that began more than eight months 

earlier—was motivated solely by OSHA’s inspection of the refinery.

The Secretary also argues that BP’s decision to lower its internal standard to 5% shows 

“BP knew that IPd[s] in excess of 5% were hazardous to employees.” According to the 

Secretary, despite BP’s knowledge of this hazard, it allowed the five relief installations at issue 

to “lurch into the range [above 5%] that BP presumably agreed was dangerous” and then failed 

to “promptly correct any deficiencies,” thus showing plain indifference to employee safety. 

Based on the evidence discussed above, including Melhem’s communications with BP and the 

well-informed view Cloutier expressed on the matter as a member of BP’s committee, I agree 
49

that BP knew, before OSHA inspected the refinery in September 2009, that an IPd in excess of 

5% could be hazardous when the valve’s blowdown is presumed to be 7%. But given the scope 

of Middough’s revalidation project and the procedures BP had in place for evaluating 

deficiencies, the Secretary has not established that BP exhibited plain indifference to employee 

safety by failing to promptly correct the relief installations with IPds exceeding 5%. 

The record shows that Middough’s project was a multi-year, comprehensive undertaking 

to conduct a valve-by-valve review of all 1,800 pressure relief valves across the entire refinery, 

which included around twenty process units. As far as identifying and correcting IPd 

deficiencies, BP used Middough’s IPd calculations—once they had been approved by the 

refinery’s technical authority on relief systems and completed for an entire unit—to assess the 

“risk” posed by the deficiencies and prioritize when the deficiencies would be corrected. 

Although it is not entirely clear at what point in the process the elevated IPd levels for these 

particular relief installations were assessed, it appears that risk assessments were performed 

following receipt of the earliest versions of the Middough reports (i.e., those that are in the 

record).17 

I view the Middough revalidation project as a genuine effort by BP to address and 

improve safety. The project shows that, even before OSHA’s inspection of the refinery, BP was 

committed to addressing IPd deficiencies in its relief systems. While BP clearly violated the 

cited standard by deciding not to institute interim measures to assure the safe operation of its 

relief installations, those decisions were made only in light of the company’s comprehensive risk 

assessments of the relief installations.18 Therefore, in the context of the revalidation project as a 

 

17 For the relief installations identified in Items 6a, 6b, 12a, and 12b, which alleged IPd levels 

above 5% but less than 7%, BP would have performed no risk assessment by the time OSHA 

commenced its inspection in September 2009, because the IPds for these relief installations 

complied with BP’s internal IPd standard until it was lowered to 5% in late October 2009 

(though risk assessments were performed at some point after the IPd limit was revised). 

Additionally, Middough had to revise some of its reports, even though BP had previously 

approved them and conducted risk assessments, due to the revision to BP’s internal IPd standard 

and changes to API’s recommendations on how to perform certain calculations. Following each 

revision, once the calculations were approved by BP, a new risk assessment would be conducted 

unless the revision was a “minor adjustment.”

18 The Secretary’s only expert witness to testify on when to fix deficiencies in relief installations 

admitted that while he “can speak to chemical plants,” as to relief installation deficiencies 
50

whole, the violations do not reflect an indifference to employee safety. In short, the Secretary 

has simply not shown that BP’s process for responding to the deficiencies identified by 

Middough was anything but a sincere attempt to address those deficiencies, taking into account 

the risks associated with corrective action and additional startups and shutdowns.19

Based on this evidence, I find that BP’s determination to wait until a scheduled 

turnaround to correct IPd deficiencies in existing relief installations—IPds above 5%, where the 

blowdown is presumed to be 7%—has not been shown to constitute plain indifference to 

employee safety.20 See E.R. Zeiler Excavating, Inc., 24 BNA OSHC at 2055 (finding Secretary 

 

identified in refineries, he did not “know standard practice” for prioritizing and correcting those 

deficiencies—i.e., “when you fix it or when the turnarounds occur.” 

19 Once the calculations for a particular unit were approved through a preestablished process, BP 

personnel would discuss deficiencies found by Middough and determine each deficiency’s 

“severity level” and “probability” of occurrence, as designated on a “risk matrix.” Based on this 

assessment, BP would then determine into which color-coded box on the risk matrix a particular 

deficiency should be assigned. The color of the box dictated BP’s subsequent action: as to the 

relief installations identified in Items 6a, 6b, 9a through 12a, and 9b through 12b, BP assessed 

their deficiencies—all had IPds exceeding 5%—as falling within the second lowest color-coded 

risk category. According to this risk category, for the referenced relief installations to continue 

operating with the deficiencies uncorrected until a future scheduled turnaround, the pertinent 

operations superintendent had to (and did) “sign off.” Nothing in the record establishes why the 

superintendents determined that interim mitigations were unnecessary for these particular relief 

installations, or what basis the superintendents had for determining that it was “[s]afe to operate 

until [a future scheduled] turnaround.” E.R. Zeiler Excavating, Inc., 24 BNA OSHC 2050, 2053

(No. 10-0610, 2014) (declining to characterize violation as willful where record is poorly 

developed on key evidentiary issues); George Campbell Painting Corp., 17 BNA OSHC 1979, 

1983 (No. 93- 0984, 1997) (same); Access Equip. Sys., Inc., 18 BNA OSHC 1718, 1727-28 (No. 

95-1449, 1999) (same). 

20 The Secretary also argues that BP exhibited “utter indifference to employee safety” in 

“tolerat[ing]” the relief installation identified in Items 6a and 6b that had an IPd (as calculated by 

Middough) exceeding BP’s own original 7% IPd limit. In this regard, the Secretary is relying on 

a revised IPd calculation of over 7% made by Middough on March 4, 2011, almost two years 

after the citation was issued—as to these items, the allegations included in the citation stated that 

the IPd for the referenced relief installation was 6.26%. The Secretary cannot rely on the revised 

calculation to show that BP was aware, during the six-month period before the citation was 

issued, that this relief installation’s IPd exceeded BP’s original internal standard of 7%. See 

OSH Act § 9(c), 29 U.S.C. § 658(c) (“No citation may be issued under this section after the 

expiration of six months following the occurrence of any violation.”). Although BP was aware 

that Middough’s calculations could change based on the revalidation process, the Secretary fails 

to point to any evidence that would show BP had reason to expect that the IPd level at issue in 

Items 6a and 6b would be revised upward, in excess of 7%. The Secretary does not appear to be 
51

failed to establish plain indifference as to cave-in protection violation based on judge’s “finding 

that [employee] ‘erroneously, but honestly’ believed the trench was safe”). Accordingly, I find 

that the Secretary failed to establish that BP exhibited a willful state of mind with respect to 

Items 6a, 6b, 9a through 12a, and 9b through 12b.

 

relying on the IPd levels set forth in Items 9a through 11a, and 9b through 11b—the only items 

that alleged IPds in excess of 7%—to support this particular argument. For the relief 

installations identified in these items, revisions to the Middough reports that post-dated the 

citation show the IPds were recalculated at less than 7%.

In any event, these relief installations, like the other ones at issue, were subject to BP’s risk 

assessment process. As discussed above, the Secretary, in my view, failed to establish the BP’s 

reliance on this process constituted plain indifference to employee safety.
52

For all of these reasons, I disagree with my colleagues’ basis for vacating Willful Citation 

2, Items 2a through 12a, and 4b through 12b, and would affirm Items 6a and 6b, 9a through 12a, 

and 9b through 12b as serious,21 and vacate Items 2a through 4a, 4b, 5a, 5b, 7a, 7b, 8a, and 8b on 

other grounds. For the reasons stated by my colleagues, I join their decision to affirm Willful 

Citation 2, Items 31a and 31b, as serious and vacate Willful Citation 2, Items 13a through 18a, 

15b, 19a through 27a, 19b through 27b, and 32 through 40.

/s/

Cynthia L. Attwood

Dated: September 27, 2018 Commissioner

 

21 I see no reason, at this juncture, to address what penalty I would assess for these violations.
United States of America

OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION

1924 Building - Room 2R90, 100 Alabama Street, S.W.

Atlanta, Georgia 30303-3104

Secretary of Labor,

 Complainant,

 v.

BP Products North America, Inc., & BP-Husky 

Refining, LLC,

 Respondent,

OSHRC Docket No. 10-0637

 and

United Steelworkers Local 1-346,

 Authorized Employee Representative.

Appearances:

Patrick L. DePace, Esquire, Linda Hastings, Esquire, 

U. S. Department of Labor, Office of the Solicitor, Cleveland, Ohio

For Complainant

Jordana W. Wilson, Esquire

U. S. Department of Labor, Office of the Solicitor, Washington, D.C.

For Complainant

Gregory C. Dillard, Esquire, Christopher Bacon, Esquire, and Tommer Yoked, Esquire

Vinson & Elkins, LLP, Houston, Texas

For Respondent BP Products North America, Inc.

Felix C. Wade, Esquire

Ice Miller, Columbus, Ohio

For Respondent BP Husky

Kim Nibarger

United Steelworkers, Pittsburgh, PA 15222

For the Authorized Employee Representative

Mark Lowry

United Steelworkers, BP Toledo Refinery, Toledo, Ohio

For the Authorized Employee Representative

Before: Administrative Law Judge Sharon D. Calhoun
2

DECISION AND ORDER

On March 8, 2010, the Secretary issued three citations to BP Products North America, 

Inc. (BPP), and BP-Husky Refining, LLC (BP-Husky), alleging twenty serious, forty-two 

willful, and three other-than-serious violations of the Occupational Safety and Health Act of 

1970 (Act), 29 U.S.C. §§ 651, et seq. The Secretary issued the citations following an inspection 

conducted by the Occupational Safety and Health Administration (OSHA) at a refinery in 

Oregon, Ohio. The Secretary proposed penalties totaling $3,042,000.00 for the three citations.

BPP and BP-Husky timely contested the citations. The undersigned held a nineteen-day 

hearing in this matter from June 4, 2012, to June 28, 2012, in Detroit, Michigan.55 The United 

Steelworkers Local 1-346 (Union) elected party status in this proceeding. 

Prior to the hearing, the Secretary and BPP settled all items alleging serious violations in Citation 

No. 1 and all items alleging other-than-serious violations in Citation No. 3 (The parties submitted 

a written agreement to the undersigned on December 7, 2012). The Secretary agreed to 

withdraw Citation Nos. 1 and 3 against BP-Husky (Exh. JX-54). The undersigned approves the 

parties’ settlement agreement, as reflected in the Order below.

The first day of the hearing, the Secretary withdrew Item 42 of Citation No. 2 (Tr. 52). In his 

post-hearing brief, the Secretary also withdrew Item 2b, Item 3b, and Instance (a) of Item 41 of 

Citation No. 2 (Secretary’s brief, p. 2). 

BPP and BP-Husky stipulate the Commission has jurisdiction over this proceeding under 

§ 10(c) of the Act. BPP also stipulates it is an employer engaged in a business affecting 

commerce under § 3(5) of the Act. BP-Husky contends it is not an employer under § 3(5) of the 

Act (Tr. 23).

Remaining for disposition are Items 1 through 41 of Citation No. 2, which allege willful 

violations of various subsections of 29 C.F.R. § 1910.119, the Process Safety Management 

(PSM) standard. The Secretary proposed a penalty of $70,000.00 for each item, for a total 

proposed penalty of $2,870,000.00.

Item 1 of Citation No. 2 alleges a willful violation of 29 C.F.R. § 1910.119(d)(3)(i), for failing to 

maintain required process equipment information. 

 

55 For the first time in a Commission proceeding, all pleadings, motions, orders, exhibits, and 

other documents that make up the record were filed electronically.
3

Items 2 through 27 of Citation No. 2 are grouped items. Items 2a through 27a (as well as 

Items 28, 29, and 30) allege willful violations of 29 C.F.R. § 1910.119(d)(3)(ii), for failing to 

document that equipment in the process complies with recognized and generally accepted good 

engineering practices. Items 4b through 27b allege willful violations of 29 C.F.R. 

§ 1910.119(j)(5) for failing to correct deficiencies in equipment that are outside recognized and 

generally accepted good engineering practices. 

Item 31a alleges a willful violation of 29 C.F.R. § 1910.119(d)(3)(iii) for failing to 

determine and document equipment is designed, maintained, inspected, tested, and operating in a 

safe manner. Item 31b alleges a willful violation of 29 C.F.R. § 1910.119(e)(3)(ii) for failing to 

identify any previous incident which had a likely potential for catastrophic consequences in the 

workplace.

Items 32 through 40 allege willful violations of 29 C.F.R. § 1910.119(e)(5) for failing to 

establish a system to promptly address the findings and recommendations of the employer’s 

process hazard analysis team.

Item 41 alleges a willful violation of 29 C.F.R. § 1910.119(j)(4)(ii) for (in instances (b) 

and (c)) failing to follow recognized and generally accepted good engineering practices for the 

employer’s inspection and testing procedures.

The Secretary, BPP, and BP-Husky submitted post-hearing briefs on February 25, 2013. 

The undersigned finds BP-Husky is an employer under § 3(5) of the Act. The undersigned 

vacates Items 1 through 12; Items 13b and 14b; Item 15; Items 16b, 17b, and 18b; and Items 19 

through 41 of Citation No. 2. The undersigned affirms Items 13a, 14a, 16a, 17a, and 18a. The 

affirmed items are classified as serious. A penalty of $7,000.00 is assessed for each affirmed 

item, for a total penalty of $35,000.00.

Background

BPP operates a refinery located at 4001 Cedar Point Road in Oregon, Ohio (Oregon is a suburb 

of Toledo, Ohio). BP-Husky is a joint venture with a business interest in the refinery. BPP 

purchased the refinery (which was built in 1919) in 1991 (Tr. 119-123). 

The Ohio refinery manufactures different grades of gasoline and diesel from crude oil in its 

numerous process units. BPP pumps crude oil from storage tanks on the property to the different 

units and refines it by boiling the crude oil and removing chemical fractions as they cool (Tr. 

152, 552, 991, 1841-1842, 2039-2046, 3137). 
4

OSHA implements a program known as the Petroleum Refinery Process Safety Management 

National Emphasis Program (NEP). As part of the NEP, in the second half of 2009 OSHA 

requested documents relating to process safety management at the Ohio refinery from BPP and 

BP-Husky. OSHA also reviewed reports of safety audits conducted at the refinery by 

consultants commissioned by BPP. OSHA then randomly selected certain pressure vessels and 

piping equipment, and requested documents relating to them (Tr. 692). OSHA reviewed the 

paperwork before inspecting the refinery. 

On September 10, 2009, a team of compliance safety and health officers (CSHOs) and industrial 

hygienists (IHs) from OSHA began an inspection of the refinery. During the inspection, OSHA 

focused on the specific pressure vessels and piping equipment for which BPP provided 

documentation (Tr. 693). The OSHA inspection focused on three units: the Fluid Catalytic 

Cracker (FCC) Unit, which processes 50,000 barrels of crude oil a day, and the ALKY 1 and 

ALKY 2 Units, which remove sulfur from the crude oil (Tr. 695, 1736-1737, 1821, 1841-1842, 

2039-2046). 

The Middough Report

BPP commissioned safety consultant Middough to conduct an extensive revalidation project for 

the refinery. The project began in 2008 and was continuing at the time of the OSHA inspection. 

Middough issued several draft reports as its revalidation project progressed. BPP spent more 

than $6 million in engineering costs for the Middough revalidation project and more than $10 

million in equipment upgrades in response to the Middough findings (Tr. 2916). 

OSHA requested copies of the Middough draft reports from BPP. BPP provided copies of the 

reports, including drafts issued in July, October, and December of 2009 (Exh. CX-2, CX-3; 

RBPP-84; Tr. 618-619). OSHA Industrial Hygienist (IH) Leonard Zielinski testified, “[W]e 

were told that [BPP] had a study done. We asked who the—you know, how the study was done 

and we came to the understanding that it was done by the Middough Report, so we asked for—

we made a request for that report” (Tr. 619).

On July 28, 2000, OSHA published its Final Policy Concerning the Occupational Safety and 

Health Administration’s Treatment of Voluntary Safety and Health Self-Audits, 65 Fed. Reg. 

46489 (2000). The summary of the rule states, “[OSHA’s] policy provides that the Agency will 

not routinely request self-audit reports at the initiation of an inspection, and the Agency will not 
5

use self-audit reports as a means of identifying hazards upon which to focus during an 

inspection.” Id.

Although the OSHA publication is a policy and not a regulation, it provides well-reasoned 

guidance regarding the use of an employer’s self-auditing information. The goal of OSHA’s 

policy is to encourage employers to proactively address worksite safety without raising concerns 

they are inadvertently providing OSHA with a roadmap for issuing citations. Employers should 

not have to fear that self-auditing will lead to self-incrimination.

In Solis v. Grede Wisconsin Subsidiaries, 24 BNA OSHC 1061 (D. Wis. 2013), the court for the 

Western District of Wisconsin considered the Secretary’s motion to compel compliance with an 

administrative subpoena duces tecum he issued for internal audit documents prepared by Grede. 

The court denied the Secretary’s motion to compel, citing OSHA’s Final Policy on self-audits 

(the court provisionally granted the Secretary’s motion to compel compliance with the subpoena 

duces tecum “if and when OSHA discloses independently-identified hazards found at” Grede’s 

facility. Id. at 1064). Although the court’s decision in Grede is not precedential in this 

proceeding, its reasoning accords with the undersigned’s view of the issue. The court states:

Despite providing this public assurance—with the obvious goal of encouraging 

companies to thoroughly investigate and correct health and safety violations, thereby 

protecting far more workers than OSHA could hope to achieve through its own

investigations alone—OSHA now takes the position that its assurance was never adopted 

as a rule and, therefore, in no way binds the agency. In the court’s view, however, it is 

irrelevant whether one calls this guidance a “rule” or merely a “final policy,” or even 

whether it is legally binding on the agency for purposes outside of the exercise of its 

agency subpoena power. What is important is that it creates a reasonable expectation of 

privacy that businesses rely on in conducting internal safety audits; in turn, this 

expectation serves OSHA’s paramount goal of promoting safety in the workplace.

Id. at 1063.

OSHA explicitly states in its Final Policy that OSHA “will not use self-audit reports as a 

means of identifying hazards upon which to focus during an inspection.” OSHA made extensive 

use of the Middough reports during its inspection of the refinery. In many instances, the CSHOs 

did not otherwise verify the self-identified deficiencies or conduct independent hazard 

assessments. The majority of the items at issue were self-identified by BPP and BP-Husky in 

documentation provided to OSHA. OSHA’s use of BPP and BP-Husky’s self-audit reports is in 

blatant contravention of its Final Policy. Although the undersigned is troubled by the Secretary’s 
6

ill-advised use of the Middough reports, I am not using the Middough reports as a basis for 

vacating the alleged violations self-identified in the reports.

Is BP-Husky an Employer as Defined by § 3(5) of the Act?

BP-Husky argues it is not an employer under § 3(5) of the Act and thus should be dismissed 

from this proceeding. Based upon a review of the record, the undersigned disagrees. It is 

determined that BP-Husky is an employer within the meaning of the Act.56 BP-Husky remains a 

party to this case.57 

DISCUSSION

Citation No. 2

Elements of the Secretary’s Burden of Proof

To prove a violation of an OSHA standard, the Secretary must show by a preponderance 

of the evidence that: (1) the cited standard applies; (2) the employer failed to comply 

with the terms of the cited standard; (3) employees had access to the violative condition; 

and (4) the employer either knew or could have known with the exercise of reasonable 

diligence of the violative condition. 

JPC Group Inc., 22 BNA OSHC 1859, 1861 (No. 05-1907, 2009).

BPP and BP-Husky contend the Secretary failed to establish the elements of noncompliance, 

employee access, and employer knowledge for the alleged violations. They do not dispute the 

applicability of the cited standard. 

Applicability of the Cited Standard

The PSM standard is found in Subpart H--Hazardous Materials of OSHA’s general 

standards. Section 1910.119 addresses “Process safety management of highly hazardous 

 

56 At the hearing, BP-Husky moved to seal certain exhibits and certain portions of the testimony 

of two witnesses. The Secretary did not object to the motion, nor did BPP or the Union. The 

undersigned granted BP-Husky’s motion. The sealed portions of the record relate to the joint 

venture agreement that created BP-Husky, as well as the operating services agreement between 

BPP and BP-Husky (Tr. 1339-1342). The Secretary and BP-Husky also redacted the sections of 

their briefs addressing the issue of whether BP-Husky is an employer. The parties filed 

unredacted copies of the briefs with the undersigned.

 For purposes of review, the undersigned has attached a Sealed Appendix to this Decision and 

Order, discussing the analysis and rationale for concluding BP-Husky is an employer. 

57 BPP and BP-Husky are both cited for violations in all the remaining items at issue. BPP 

operated the refinery for years before BP-Husky was formed and continued afterwards to oversee 

its daily operation. For simplicity’s sake, the undersigned will at times use “BPP” 

interchangeably with “BPP and BP-Husky.” 
7

chemicals,” and states, “This section contains requirements for preventing or minimizing the 

consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals. 

These releases may result in toxic, fire or explosion hazards.”

Section 1910.119(a)(1)(ii) provides:

This section applies to the following:

. . .

(ii) A process which involves a flammable liquid or gas (as defined in 1910.1200(c) of 

this part) on site in one location, in a quantity of 10,000 pounds (4535.9 kg) or more[.]

George Yoksas, OSHA’s area director for its Milwaukee office, testified 10,000 pounds 

“equate[s] to something on the order of 1,300 gallons” (Tr. 152). The refinery at issue performs 

a series of chemical processes, including the FCC Unit that processes 50,000 barrels of crude oil 

a day (Tr. 1736-1737). This quantity of crude oil (a flammable liquid) is more than sufficient to 

bring the refinery and its processes within the ambit of the PSM standard. BPP and BP-Husky 

do not dispute that the various cited subsections of the PSM standard apply to the cited 

conditions. (“One element is undisputed: that the cited standards apply to BPP as operator of 

the Refinery and as employer of the BPP workers at the site” (BPP’s brief, p. 5, footnote 3).) 

The Secretary has established the first element of his burden of proof for all the items at 

issue. The PSM standard applies to the cited conditions. 

Item 1: Alleged Willful Violation of § 1910.119(d)(3)(i)

Missing U-1 Form

Item 1 of Citation No. 2 alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not maintain a U-1 form 

for the Isobutane Recycler Coalescer (PR 511468).

Section 1910.119(d)(3)(i) provides:

[T]he employer shall complete a compilation of written process safety information before 

conducting any process hazard analysis required by the standard. 

. . .

(3) Information pertaining to the equipment in the process. (i) Information pertaining to 

the equipment in the process shall include:

(A) Materials of construction;

(B) Piping and instrument diagrams (P&ID’s);

(C) Electrical classification;

(D) Relief system design and design basis;

(E) Ventilation system design;

(F) Design codes and standards employed;

(G) Material and energy balances for processes built after May 26, 1992; and
8

(H) Safety systems (e.g. interlocks, detection or suppression systems).

Background

The American Society of Mechanical Engineers (ASME) developed a form, known as a 

U-1 form, which pressure vessel manufacturers use to provide information to their customers 

(Tr. 137). After it has designed and constructed a pressure vessel, the manufacturer issues a 

copy of the U-1 form to the purchaser. The U-1 form contains important information relating to 

the safe use of the pressure vessel (Tr. 137-138, 2370).

CSHO Anthony Lowe is one of the CSHOs who inspected the Ohio refinery. He 

explained the importance of the U-1 form:

When we do inspections, we always ask for, if you’re looking at pressure vessels, et 

cetera, we always ask for the U-1 report, and that’s basically the birth certificate for that 

vessel. It talks about the maximum allowable working pressures, maximum allowable 

working temperatures, et cetera, on the vessel. So it’s important stuff to look at to make 

sure that, you know, when you look at what the company is doing, that they’re not 

exceeding those.

(Tr. 695). 

OSHA requested copies of the U-1 form for five pressure vessels chosen at random (Tr. 696). 

OSHA also targeted pressure vessels identified by BPP’s consulting company, Middough, who 

audited the Ohio refinery at BPP’s request and issued several safety reports. OSHA reviewed the 

Middough reports as part of its inspection. In March 2009, Middough identified the Isobutane 

Recycler Coalescer (PR 511468) at issue here as not having a U-1 form available (Exh. RBPP57; Tr. 702). During his inspection, CSHO Lowe requested a copy of the U-1 form for the 

Isobutane Recycler Coalescer. BPP and BP-Husky informed him they did not have a copy 

available (Tr. 739-740). 

Steve Rowe is BPP’s Safety and Operations Risk Director and the site engineering authority (Tr. 

2368). Rowe acknowledged that the U-1 form at issue was missing (Tr. 2370). He contacted the 

National Board and requested a copy of the U-1 form. The National Board did not have a copy 

on file (Tr. 2376-2377).

Rowe testified that all of the information provided for a pressure vessel in a U-1 form was 

available at the Ohio refinery for the Isobutane Recycler Coalescer (Tr. 2391-2395). The 

information is found within the drawings of the pressure vessel, the bill of material on the 

drawings, the design code book, and the vessel’s name plate. With the exception of the name 

plate (which is physically located on the pressure vessel) the listed items are located either 
9

electronically or in the engineering vault in the administrative building (Exh. RBPP-14; 

Tr. 2390-2396, 2410-2412, 2418). 

Once Rowe became aware the U-1 form for the Isobutane Recycler Coalescer was missing, he 

was able to locate the required information for the vessel within 30 minutes (Tr. 2420).58 OSHA 

Area Director George Yokas and CSHO Lowe conceded the required information was available 

at the Ohio refinery (Tr. 169, 740). 

Compliance with the Terms of the Standard

Section 1910.119(d)(3)(i) requires an employer to compile specified written PSM information 

for its equipment, including pressure vessels. The cited standard requires only that the written 

information be available—it does not specify the form the documentation should take. 

Section 1910.119(d)(3)(i) does not mention the U-1 form. In fact, the U-1 form does not provide 

most of the information listed in § 1910.119(d)(3)(i)(A) through (H). OSHA Area Director 

Yoksas acknowledged the divergence between the requirements of the standard and the 

information provided by the U-1 form:

Q. Now the U-1 form would not include process safety information, such as piping and 

instrument diagrams, P&Ds, correct?

Yoksas: Correct.

Q. And it wouldn’t include information about electrical classification, correct?

Yoksas: The U-1 report? Correct.

Q. And what I’m doing is I’m going through (A) through (H) in the regulations 

identifying which ones of those don’t apply. The U-1 form won’t have anything about 

relief systems design and design basis, correct?

Yokas: Correct.

Q. It will not have anything about ventilation system design?

Yoksas: Correct.

Q. It will not have anything about material energy balances, correct?

 

58 In his post-hearing brief, the Secretary asserts that Rowe stated that gathering the required 

information for the pressure vessel “could take ‘days’” (Secretary’s brief, pp. 16, 83). This is a 

mischaracterization of Rowe’s testimony. Rowe was referring to conducting a “fitness for 

service evaluation” which is performed “because components degrade over time and you need to 

make sure that they remain fit for service. It’s a common practice. . . [T]o do a fitness for 

service evaluation, depending on the nature of the damage, it can take days to do the evaluation”

(Tr. 2419) (emphasis added). Rowe was referring to performing an evaluation, not merely 

locating the information.
10

Yokas: Correct.

Q. It will not have anything about safety systems, correct?

Yoksas: Correct

(Tr. 170-171). 

OSHA’s Area Director conceded that a U-1 form would not provide the information 

required for six out of the eight required specifications set out in the standard (only the 

materials of construction (§ 1910.119(d)(3)(i)(A)) and the design codes and standards employed 

(§ 191.119(d)(3)(i)(F)) are supplied by the U-1 form. See Exhibit RBBP-13). Despite the 

discrepancy between the information required by § 1910.119(d)(3)(i) and the information 

provided by the U-1 form, the Secretary charges in the alleged violation description (AVD) of 

Item 1 that BPP and BP-Husky did “not maintain a U-1 form for the Isobutane Recycler 

Coalescer.” The AVD otherwise does not specify what information required by § 

1910.119(d)(3)(i)(A) through (H) is missing.

The Secretary’s flawed AVD dooms his case with respect to Item 1. By couching the 

alleged violation in terms of the missing U-1 form, the Secretary impermissibly creates a 

significant requirement not found in the cited standard. The Secretary’s focus on the U-1 form 

is misplaced. BPP and BP-Husky cannot be found in violation of a standard for not possessing a 

document the cited standard does not require.

Furthermore, the record establishes BPP and BP-Husky had compiled the required 

information. Yoksas and CSHO Lowe conceded the information was on site. The Secretary has 

failed to establish BPP and BP-Husky were not in compliance with the terms of 

§ 1910119(d)(3)(i). Item 1 is vacated. 

Items 2 through 12: Alleged Willful Violations of §§ 1910.119(d)(3)(ii) and (j)(5)

IPDs59 Exceeding 3%

The AVDs of Items 2a through 12a are identical except for the identifying pressure safety 

valve number, the specific pressure vessel, and the IPD percentage. Items 2a through 12a follow 

this formula: 

29 CFR 1910.119(d)(3)(ii): The employer does not document that the equipment in the 

process complies with recognized and generally accepted good engineering practices:

 

59 IPD refers to “Inlet Pressure Drop.”
11

a. BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document 

that PSV-[identifying number] providing pressure relief protection to [specific 

pressure vessel] complied with recognized and generally accepted good 

engineering practices in that it has an inlet pressure drop greater than 3%. 

PSV-[identifying number] was determined to have an inlet pressure drop of 

[ ]%. 

The cited relief valves and their IPDs are:

Item 2a: PSV-134 on the Debutanizer Reflux Drum in the Alky Unit had an IPD of 3.8%;

Item 3a: PSV-137 on the First Stage Butane Treater Drum in the Alky Unit had an IPD of 4.6%;

Item 4a: PSV-447 on the Depropanizer Feed Treater Drum in the Alky Unit had an IPD 

of 5.4%;

Item 5a: PSV-1299 on the Cat Gas Light Oil/BFW Preheater had an IPD of 5.0%;

Item 6a: PSV-1301 on the FCC Feed Drum in the FCC Unit had an IPD of 6.3%;

Item 7a: PSV-1321 on the Fractionator Tower in the FCC Unit had an IPD of 3.2%;

Item 8a: PSV-1338A on the First Stage Drum in the FCC Unit had an IPD of 3.2%;

Item 9a: PSV-1280 on the FCC Feed Drum in the FCC Unit had an IPD of 7.7%;

Item 10a: PSV-1281 on the FCC Feed Drum in the FCC Unit had an IPD of 7.7&;

Item 11a: PSV-1332 on the Stripper Tower in the FCC Unit had an IPD of 8.8%; 

Item 12a: PSV-440 on the Rerun Tower in the Alky Unit had an IPD of 6.8%.

Items 4b through 12b (the Secretary withdrew Items 2b and 3b) refer to the same pressure safety 

valves and IPDs identified respectively in Items 4a through 12a. The items state:

29 CFR 1910.119(j)(5): The employer does not correct deficiencies in equipment that are 

outside acceptable limits (as defined by process information in 29 CFR 1910.119(d) 

before further use or in a safe and timely manner:

a. BP-Husky Refining, LLC - Oregon, Ohio: The employer does not ensure 

PSV-[identifying number], located in [specific pressure vessel], has an inlet 

pressure drop of not more than 3%. PSV-[identifying number] was 

determined to have an inlet drop of [ ]%.

Items 2a through 12a allege BPP and BP-Husky violated § 1910.119(d)(3)(ii), which provides:

The employer shall document that equipment complies with recognized and generally 

accepted good engineering practices.

Items 2b through 12b allege BPP and BP-Husky violated § 1910.119(j)(5), which 

provides:

The employer shall correct deficiencies in equipment that are outside acceptable limits 

(defined by the process safety information in paragraph (d) of this section) before further 
12

use or in a safe and timely manner when necessary means are taken to assure safe 

operation.

The disposition of these items depends upon the interpretation of the phrase “recognized 

and generally accepted good engineering practices,” or RAGAGEP. The Secretary argues that 

numerous industry consensus standards establish the RAGAGEP requires employers maintain an 

inlet pressure drop of no more than 3%. Because the inlet pressure drop of the cited relief valves 

in the refinery exceeded 3%, the Secretary contends they were mechanically deficient. 

OSHA’s inspection team used the Middough report to find IPDs in excess of 3%. OSHA did not 

independently verify the IPDs or perform hazard assessments of the cited valves. OSHA safety 

engineer James Lay testified, “We evaluated the calculations that had been done by Middough 

against RAGAGEP and issued the citations on that basis. . . . The assumption was, if you’re not 

in compliance with RAGAGEP, there is potential for hazard” (Tr. 516).60

BPP and BP-Husky argue BPP has established its own RAGAGEP based on its engineering 

knowledge and industry experience, and that the Secretary’s 3% inlet pressure drop limit is too 

restrictive. 

Background

Inlet Pressure Drop (IPD)

A pressure vessel in a refinery must have relief protection. Often this protection is 

provided by a relief valve, which is designed to open at its set point, remain open while pressure 

relieves, and close as pressure decreases to its blowdown point. Inlet pressure drop (IPD) is the 

amount of pressure lost due to friction as vapor or liquid passes through piping from a pressure 

vessel to the relief valve. IPD can be affected by numerous factors, including the length, 

diameter, configuration, and surface texture of the piping between the pressure vessel and the 

relief valve, as well as the velocity of the flow of material through the piping. The IPD is the 

difference between the pressure in the vessel and the pressure at the relief valve. When a vessel 

exceeds its maximum allowable working pressure (MAWP), it reaches the relief valve’s set 

point, which is the pressure at which the valve opens to relieve the overpressure. The blowdown 

point is the pressure at which the relief valve is set to close. The blowdown point is always less 

 

60 BPP and BP-Husky objected to the testimony of James Lay before, during, and after the 

hearing (Tr. 238, 295-296, 470; BPP’s brief, pp. 152-160). In its post-hearing brief, BPP moves 

to strike Lay’s testimony on the grounds Lay provided expert testimony but was a lay witness. 

BPP’s motion is denied.
13

than the set point so that the valve remains open long enough to relieve pressure. The IPD is 

usually described as a percentage of the valve’s set point. For example, if the set point for a 

relief valve is 100 pounds per square inch (psi) and the calculated IPD in the piping is 3 psi, then 

the IPD is 3% (Tr. 64, 225, 548-551, 559, 563, 2480-2483). 

If an excessive IPD occurs, the relief valve may close prematurely, resulting in a condition 

known as “chatter” (because it sounds like teeth chattering). During chatter, the relief valve 

opens and closes so rapidly and violently that it can become damaged and possibly fail (Tr. 550-

552, 2193). 

Failure of the relief valve could result in the release (loss of containment) of hot hydrocarbons 

that could explode and burn, causing serious injuries or death to employees in the refinery. The 

relief valve is the last line of defense against an overpressure resulting in an accidental release of 

hazardous chemicals. By the time the relief valve is engaged, all other safety systems have failed 

and the pressure in the pressure vessel has risen to a dangerous level (Tr. 542-543, 552, 2877-

2878). In the words of Cassandra Hamlin, the Secretary’s expert in inlet pressure drop hazards, 

“[W]hat you’re doing in an oil refinery, you’re basically boiling gasoline and the only thing 

protecting you is the steel that keeps things in. So we use this term that sounds kind of 

innocuous, ‘loss of containment.’ Well, loss of containment means that hot gasoline, like down 

at BP Texas City, gets out and potentially could kill a lot of people” (Tr. 552). 

The PSM Standard is a Performance Standard

The PSM Standard, § 1910.119, took effect in May 1992 as a performance standard. 

57 Fed. Reg. 6390 (1991). Unlike a specification standard, which details precise requirements an 

employer must meet, a performance standard indicates the degree of safety and health protection 

required, but leaves the method of achieving the protection to the employer (Tr. 108). 

Compliance with a performance standard is determined by whether the employer acted as a 

reasonably prudent employer would:

[T]he employer is required to assess only those hazards that a “reasonably prudent 

employer” would recognize. See W.G. Fairfield Co., 19 BNA OSHC 1233, 1235, 

2000 CCH OSHD ¶ 32,216, p. 48,864 (No. 09-0344, 2000), aff'd, 285 F.3d 499 (6th Cir. 

2002); see also Thomas Indus. Coatings, Inc., 21 BNA OSHC 2283, 2287, 2004-09 CCH 

OSHD ¶ 32,937, p. 53,736 (No. 97-1073, 2007) (“[P]erformance standards ... are 

interpreted in light of what is reasonable.”). A reasonably prudent employer is a 

reasonable person familiar with the situation, including any facts unique to the particular 

industry. W.G. Fairfield Co., 19 BNA OSHC at 1235, 2000 CCH OSHD at pp. 48,864-

65; Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793, 1794, 1991-93 CCH OSHD ¶ 
14

29,770, p. 40,489 (No. 90-998, 1992); see also Brennan v. Smoke-Craft, Inc., 530 F.2d 

843, 845 (9th Cir. 1976). Under Commission precedent, industry practice is relevant to 

this analysis, but it is not dispositive. W.G. Fairfield, 19 BNA OSHC at 1235-36, 

2000 CCH OSHD at p. 48,865; Farrens Tree Surgeons, 15 BNA OSHC at 1794, 1991-

93 CCH OSHD at p. 40,489; see also Smoke-Craft, 530 F.2d at 845 (noting that in 

absence of any industry custom the need to protect against an alleged hazard “may often 

be made by reference to” what a reasonably prudent employer “familiar with the industry 

would find necessary to protect against this hazard”).

Associated Underwater Services, 2012 WL 76200 at *2 (No. 07-1851, 2012).

BPP and BP-Husky contend that OSHA is impermissibly adopting a prescriptive 3% IPD limit, 

in contravention of the flexibility inherent in a performance standard.

RAGAGEP

Section 1910.119(d)(3)(ii) requires an employer to document its equipment complies 

with “recognized and generally accepted good engineering practices,” and § 1910.119(j)(5) 

requires an employer to correct deficiencies in equipment that are outside acceptable limits as 

defined by RAGAGEP. The Secretary contends, “[T]he numerous industry consensus standards 

specifying an IPD of no more than 3% constitute applicable RAGAGEP for the process 

equipment at issue” (Secretary’s brief, pp. 88-89; emphasis in original). BPP and BP-Husky 

disagree, arguing, “BPP and other peer refineries have developed robust and well-supported 

relief system guidelines that justify up to 7% IPD on conventional relief valves. . . . [S]o long as 

the blowdown for an existing relief valve exceeds its IPD, a 5% or even 7% IPD limit for a 

conventional valve will not be the cause of any unstable operations or chatter” (BPP’s brief, p. 

15).

Industry Standards

In 1963, the American Petroleum Institute (API) established 3% of a relief valve’s set 

point as the IPD limit (Tr. 2861, 2863). In December 1994, the API published its Recommended 

Practice 520 (RP 520) (“Sizing, Selection, and Installation of Pressure-Relieving Devices in 

Refineries”), amending its previous Recommended Practice by replacing the word “shall” with 

the word “should.” Amended RP 520 provides:

When a pressure relief valve is installed on a line directly connected to a vessel, the total 

non-recoverable pressure loss between the protected equipment and the pressure relief 

valve should not exceed 3 percent of the set pressure of the valve except as permitted in 

2.2.3.1 for pilot-operated pressure relief valves. When a pressure relief valve is installed 

on a process line, the 3 percent limit should be applied to the sum of the loss in the 

normally non-flowing pressure relief valve inlet pipe and the incremental pressure loss in 

the process line caused by the flow through the pressure relief valve. The pressure loss 
15

should be calculated using the rated capacity of the pressure relief valve. Pressure losses 

can be reduced materially by rounding the entrance to the inlet piping, by reducing the 

inlet line length, or by enlarging the inlet piping. Keeping the pressure loss below 3

percent becomes progressively more difficult as the orifice size of a pressure relief valve 

increases. . . . An engineering analysis of the valve performance at higher inlet losses 

may permit increasing the allowable pressure loss above 3 percent.

(Exh. JX-17, p.2, § 2.2.2; emphasis added). 

In 2007, the ASME issued its “Boiler & Pressure Vessel Code,” (BPVC) which included 

“Rules for Construction of Pressure Vessels.” In its Nonmandatory Appendix M of the Rules 

(“Installation and Operation”), the ASME states: “[T]he flow characteristics of the upstream 

system shall be such that the cumulative total of all nonrecoverable inlet losses shall not exceed 

3% of the valve set pressure” (Exh. JX-55, p. 593).

The Center for Chemical Process Safety (CCPS), a branch of the American Institute of 

Chemical Engineers (AICHE) which focuses on process safety issues in the chemical process 

industry, states in its 1998 “Guidelines for Pressure Relief and Effluent Handling Systems”: “The 

‘3% rule’ (ASME BPVC, Appendix M) is currently acceptable as the criterion for the upper limit 

on inlet losses to safety relief valves” (Exh. JX-23, p.35). The CCPS acknowledges, however, 

that the 3% rule is a reductive approach to a complicated system:

Typically a safety valve comes from the manufacturer with its blowdown set at 7% or 

more. After allowing for the additional losses in the valve nozzle itself (typically about 

3%), the 3% limit on inlet piping loss contains a margin of safety. Somewhat higher 

values of blowdown may be observed for conventional valves in service conditions of 

constant superimposed back pressure.

A study of the dynamic response to inlet pressure loss has been performed (Kastor

1986, 1986a, 1990, 1994). The proposed computational model is in general agreement 

with test results for gas flow. The study concludes that the 3% rule is an oversimplified 

view of the complex dynamic behavior of a valve. Chatter is not observed at higher loss 

in certain piping configurations, while chatter can be observed at lower loss levels in 

other configurations. Guidelines for piping layout and sizing based on this work are yet 

to be developed and accepted by rule-making bodies. Thus, the 3% rule remains as the 

accepted good practice.

(Exh. JX-23 at 36).

API Study and Testimony of Cassandra Hamlin and Harold Fisher

The API commissioned Berwanger, Inc., a consulting company specializing in oil, gas, 

and petrochemicals, to conduct a study on pressure relief valves (PRVs). Berwanger issued an 

interim report for the study in 2002. The goal of the study was to determine whether the 3% rule 

is “necessary and sufficient to assure against unstable operation of spring loaded PRVs and to 
16

develop validated engineering tools (screening criteria and software) that would allow plant 

engineers to design and to evaluate PRV installation for stable PRV performance” (Exh. RBPP384, p.2; Tr. 565). Berwanger surveyed seven refineries who reported they had experienced 45 

loss-of-containment incidents resulting from PRV instability (Tr. 573-574). 

The owner of Berwanger, Inc., (until she sold the company in 2006) and the project 

manager for the API study was Cassandra Hamlin (Tr. 536). Hamlin testified as an expert 

witness for the Secretary at the hearing. Hamlin graduated from Vanderbilt University in 1981 

with a degree in engineering. She worked for five years for Exxon as a project manager (Tr. 

535). She was qualified, without objection, as an expert in IPD, back pressures, the hazards 

associated with IPDs and back pressures, RAGAGEP, and pressure relief stability (Tr. 544-547). 

Hamlin testified that, as part of the API study, she interviewed Dr. Singh, one of the lead 

scientists with the Electric Power Research Institute (EPRI) who investigated the partial nuclear 

meltdown of Three Mile Island in 1979. Dr. Singh informed Hamlin that valve chatter was a 

contributing factor to the partial meltdown (Tr. 581-582). After conducting a $30,000,000.00 

study to determine how best to ensure valve stability, the EPRI concluded there was no 

correlation that would predict whether or not a valve would become unstable:

Like us at the API, [the EPRI’s] stated goal is to come up with some type of correlation 

to be able to predict when and when not a valve would become unstable. Their 

conclusion after spending $ 30 million was that the problem was intractable in the sense 

that predicting the weather is intractable. You can’t predict weather with 100% certainty 

because there are just too many variables. . . . In this case, the uncertainties come from—

there are so many different relief valves manufactured. One variable is just how slick is 

the stem that, you know, the disk is sliding on? You know, it’s going to vary greatly 

from, is it a new relief valve? How was it machined? 

So, they concluded it was not a tractable problem in the sense of being able to 

come up with a correlation that would predict when and when not it would occur. So, 

they opted, as a solution for their industry, to ensure that they would only install relief 

valves that they knew would operate safely. 

And, what did they do? And, this is what Dr. Singh described to me, they would actually 

test each and every relief valve in place. They tested it in place, you know, installed in 

the vessel it’s protecting and it didn’t chatter, good to go.

(Tr. 582-583).

Hamlin contends that under RAGAGEP principles, an employer should only ever “install things 

you know or have a very high certainty are going to work,” as the EPRI did by requiring each 

relief valve to be tested in place (Tr. 585). Hamlin’s conclusion is that there are no reasonable 

alternatives to implementing the 3% rule: “From an engineering standpoint, the burden of proof 
17

is never on somebody to have to prove that something is unsafe. In the case of the 3% rule, the 

only rule we have for these installations, the only one is 3%” (Tr. 585).

Hamlin was emphatic that the 3% rule is both the industry standard and the only possible 

RAGAGEP a reasonably prudent employer could consider with regard to a pressure relief valve: 

[T]he engineering rule is very, very clear. I mean it’s been since—you know, it’s like 

when Moses came down off of Mount Sinai, the engineering law is going to limit the 

pressure to 3%[.]

(Tr. 551).

Really, the only rule that’s been around for years and years and years by every 

publication relevant to this topic that I’ve ever seen has been 3%.

(Tr. 560).

[The 3% rule is] totally ubiquitous in the world.

(Tr. 561).

Harold Fisher is a consultant affiliated with Balky & Associates, a company that 

specializes in nuclear and chemical process safety. Fisher graduated from Syracuse University in 

1961 with a bachelor’s degree in chemical engineering, and later earned a master’s degree in 

chemical engineering and a master’s degree in engineering with industrial engineering statistics 

from West Virginia University. He worked as a chemical engineer for forty years with Union 

Carbide (Tr. 2141-2146). Since 1982, Fisher has chaired the Design Institute for Emergency 

Relief System (DIERS) (Tr. 2147-2148). Fisher was qualified as an expert witness in 

RAGAGEP’s application to pressure vessels and pressure relief systems, valve chatter, IPD, and 

research and literature relevant to RAGAGEP (Tr. 2164-2166). 

Fisher concurs with Hamlin that the 3% rule is recognized as the standard observed by industries 

engaged in chemical processes (Tr. 2297). He testified, “It mentions in the ASME Boiler and 

Pressure Vessel Code that the inlet pressure drop would be 3% of the set pressure. And there are 

requirements in the code for that and that’s the expectation of the code and most of the other 

publications that are out there” (Tr. 2175).

BPP and BP-Husky Argue § 1910.119(d)(3)(ii) Does Not Mandate a Maximum IDP

BPP and BP-Husky contend that by insisting upon the 3% rule, the Secretary is impermissibly 

imposing a prescriptive requirement on a performance standard. The companies argue that 

Secretary is selectively ignoring the parts of the industry codes that allow for higher IPDs. 

For example, the API’s RP 520 states that the IPD “should not exceed 3 percent of the set 
18

pressure,” but goes on to say, “An engineering analysis of the valve performance at higher inlet 

losses may permit increasing the allowable pressure loss above 3 percent” (Exh. JX-17, p.2). 

The preamble to RP 520 indicates it is not the API’s intent to dictate prescriptive rules: “These 

standards are not intended to obviate the need for applying sound engineering judgment 

regarding when and where standards should be utilized. The formulation and publication of API 

standards is not intended to inhibit anyone from using other practices” (Exh. JX-17). The API, 

through multiple revisions of RP 520, has continued to use the permissive “should” language 

with regard to the 3% rule, rather than the mandatory “shall” language (Exhs. JX-17 & 18). 

Furthermore, ASME ‘s endorsement of the 3% rule for IPD is found in the Nonmandatory

Appendix M to its “Rules for Construction of Pressure Vessels” (Exh. JX-55, p. 593) (emphasis 

added).

The companies point out that the industry standards endorsing the 3% rule address specifications 

for newly-built pressure vessels. BPP and BP-Husky assert that their new pressure vessels are 

built to the recommended specifications, but the industry standards are inappropriate for older 

pressure vessels that were in place at the refinery (built in 1919) when BPP originally bought it. 

OSHA safety engineer Lay agreed that valves with an IPD in excess of 3% can operate safely 

(Tr. 491).

BPP informed OSHA it had conducted an engineering analysis for IPD (Tr. 153). Based on its 

analysis, BPP developed internal IPD guidelines in a document referred to as GP 44-70, which 

was first implemented in April 2006 (Exh. JX-48). BPP engineer Edward Zamjec modeled GP 

44-70 on API’s methodology. Based on Zamjec’s research, BPP originally implemented a 

requirement for existing relief valves to maintain an IPD of 7%, while new installations were 

required to follow the 3% rule (Tr. 2825). Later, BPP revised GP 44-70 to require an IPD of 5% 

for existing relief valves (Exh. JX-49; Tr. 158-159). 

BPP and BP-Husky argue the Secretary’s interpretation of § 1910.119(d)(3)(ii) denies the 

employer the option, as contemplated by the drafters of the standard, to develop appropriate 

internal standards as an alternative to following industry codes. BPP and BP-Husky assert the 

Secretary is establishing a bright-line test of 3% for IPD in what OSHA intended to be a 

performance standard.
19

Compliance with the Terms of the Standard

OSHA’s intent that § 1910.119(d)(3)(ii) be applied as a performance standard is evident in the 

Preamble to the final rule. The Secretary attempts to get around OSHA’s intent by selectively 

quoting from the Preamble in his brief:

It is undisputed that the performance standards published by such respected consensus 

standards organizations are “recognized and generally accepted good engineering 

practices” under the standard. 57 Fed. Reg. 6390 (“[R]ecognized and generally accepted 

good engineering practices” include codes and standards published codes and standards 

published by NFPA, ASTM, ANSI, etc.).61

(Secretary’s brief, p. 89).

This edited sentence distorts the meaning of the full sentence, which is: “The Agency 

believes that this phrase [“recommended and generally accepted good engineering practices”] 

would include appropriate internal standards of a facility, as well as codes and standards 

published by NFPA, ASTM, ANSI, NFPA, etc.” Id. (emphasis added). In the full sentence, 

OSHA puts internal standards on an equal footing with industry codes. 

In his brief, the Secretary states, “[I]t is clear from the preamble discussion of this issue that 

OSHA did not intend that internal standards displace applicable consensus standards,” and cites 

to, without quoting from, 57 Fed. Reg. 6390 (1992) (Secretary’s brief, p. 90). The actual 

language of the cited document does not support the Secretary’s position. 

The Preamble lays out the concerns of commenters from industries affected by the proposed PSC 

Standard. Commenters were leery that, instead of being suggested guidelines, the listed codes 

and standards would become de facto requirements:

Paragraph (j)(3)(ii) also contained examples of codes and standards that an employer 

could use to comply with the proposed provision. Many rulemaking participants 

disagreed with this proposed provision. . . . Some commenters were concerned that the 

Agency would incorporate by reference all of the codes applicable to testing and 

inspection such as those published by the National Fire Protection Association (NFPA), 

the American Society for Testing and Materials (ASTM), the American National 

Standards Institute (ANSI), etc. These commenters asserted that it would be difficult for 

 

61 In this sentence the Preamble is addressing § 1910.119(j)(3)(ii), the inspecting and testing 

subsection, not the subsection at issue here § 1910.119(d)(3)(ii). In its discussion of § 

1910.119(d)(3)(ii), the Preamble explicitly directs the reader to the section addressing § 

1910.119(j) for an explanation of the RAGAGEP language. (“OSHA has modified this paragraph 

by eliminating the list of codes and standards producing organizations. The discussion in 

paragraph (j), mechanical integrity, discusses the reasons for this change.” 57 Fed. Reg. 6375 

(1992)).
20

an employer to obtain all such standards and decide which standards the Agency intended 

for them to use. They also stated that some of the standards may conflict with each other.

Other commenters were concerned that some of the standards may be outdated and no 

longer applicable to their process equipment. As a result, many of these commenters 

suggested that the employer be permitted to use their own internal standards, or that 

inspection and testing procedures follow recognized and generally accepted good 

engineering practices.

57 Fed. Reg. 6390 (1992) (citations omitted).

The Preamble goes on to explicitly reject the position the Secretary now advocates, i.e., 

converting suggested industry codes and standards into statutory requirements: “The codes and 

standards contained in proposed paragraph (j)(3)(ii) were examples of what the employer could 

use for inspection and testing of process equipment. The Agency did not intend to incorporate by 

reference into the standard all of the codes and standards published by these consensus groups.”

Id. (emphasis added). 

OSHA safety engineer Lay, however, testified, “We have, in this case, certainly taken the 

position that any inlet pressure drop exceeding the 3% value referenced in API 520 Part II, the 

ASME code, ISO 4126, and other published guidance documents, if you can’t document that you 

are in compliance with that, that’s a (d)(3)(ii) violation” (Tr. 490-491). OSHA IH Zielinski was 

part of OSHA’s inspection team at the refinery. When asked how OSHA concluded BPP and BPHusky were in violation of § 1910.119(d)(3)(ii), IH Zielinski replied, “Well, we determined that 

by looking at the API standard” (Tr. 615).

The Preamble states that the inspection and testing subsection was revised to include the 

RAGAGEP language, consistent with OSHA’s intent that the subsection remain a performance 

standard, and not a specification standard.

This proposed provision was a performance-oriented requirement that would provide 

flexibility for the employer to choose the frequency which would provide the best 

assurance of equipment integrity.

Several rulemaking participants . . . suggested that if this provision is to be truly 

performance-oriented, employers should have the flexibility to follow internal standards 

and manufacturers’ recommendations as well as applicable codes and standards.

OSHA agrees with these rulemaking participants. Since the phrase “recognized 

and generally accepted good engineering practices” would include both appropriate 

internal standards and applicable codes and standards, the Agency has decided to use 

this phrase in this provision of the final rule.

Id. at 6390-6391 (citations omitted; emphasis added).

In the Preamble, OSHA explains in unmistakable terms its intent in drafting the 
21

RAGAGEP provisions of the PSM Standard. As a performance standard, § 1910.119(d)(3)(ii) 

allows the employer the flexibility to achieve compliance by use of appropriate internal 

standards, as well as by adhering to industry codes and standards. OSHA area director Yoksas 

praised the flexibility the PSM Standard afforded employers: “And that’s kind of the beauty of a 

performance standard, that the company can come up with a variety of methodologies for which 

they would address those hazards under” the PSM Standard (Tr. 117). By insisting compliance 

with § 1910.119(d)(3)(ii) can only be achieved by following the 3% rule (which is not mandatory 

even under the cited codes), the Secretary has impermissibly adopted a prescriptive standard. 

The Secretary’s interpretation contradicts the terms of the cited standard. Area director Yoksas 

insisted, “[W]e do not enforce consensus standards” (Tr. 110). However, the Secretary is 

attempting do so here. 

In the AVDs of Items 2 through 12, the Secretary does not allege BPP and BP-Husky violated 

the terms of §§ 1910.119(d)(3)(ii) and (j)(5) by not complying with the relevant RAGAGEP; 

rather, the Secretary alleges the companies violated the cited standards by allowing eleven of its 

pressure relief valves to exceed 3% IPD. The Secretary deliberately drafted the AVDs to 

incorporate the 3% rule into §§ 1910.119(d)(3)(ii) and (j)(5). In doing so, he erased the 

performance aspect of the RAGAGEP standards. 

The Secretary is bound by the language in which he chose to frame the AVDs. Under the 

Secretary’s interpretation, 3% is the only possible RAGAGEP for IPDs in the refining industry. 

The Secretary is equating one of the terms of the standard, RAGAGEP, with the 3% rule. 

Three of the cited pressure relief valves (Items 9, 10, and 11) had IPDs outside of BPP’s own 

original IPD limit of 7%, and three more (Items 4, 6, and 12) fell outside of BPP’s revised limit 

of 5%. However, the Secretary did not cite the companies for failing to comply with an 

alternative RAGAGEP, such as being outside acceptable limits set by BPP’s internal standards. 

The Secretary cited BPP and BP-Husky for exceeding 3% IPD, a prescriptive standard he 

impermissibly shoehorned into a performance standard. The Secretary is held to that violation 

description. Because the AVD improperly imposes a requirement on employers not found in the 

cited standards, the Secretary failed to establish BPP and BP-Husky were not in compliance with 

the appropriate RAGAGEP. 

Items 2 through 12 are vacated.
22

Items 13, 14, and 15: Alleged Willful Violations of §§ 1910.119(d)(3)(ii) and (j)(5)

Undersized Relief Valves

Items 13, 14, and 15 concern relief valves that were undersized. As in Items 2 through 

12, the Secretary alleges BPP and BP-Husky failed to document that equipment complied with 

RAGAGEP (in violation of § 1910.119(d)(3)(ii) for Items 13a, 14a, and 15a), and failed to 

correct deficiencies in equipment outside acceptable RAGAGEP limits (in violation of § 

1910.119(j)(5) for Items 13b, 14b, and 15b).

Background

BPP hired consultants on two different occasions in the 1990s to conduct safety reviews 

of the Ohio refinery. In 1990 consultant Kellog issued a relief system report and in 1998 

consultant Steward and Bottomly (S&B) issued a similar report. Neither report identified a 

sizing deviation in connection with the cited valves (Exhs. CX-35 and RBPP-38). In June 2008, 

consultant Middough issued a draft report that for the first time identified the cited valves as 

undersized (Exh. RBPP-84; Tr. 3005, 3008). The Middough report identified PSV-115, PSV124, and PSV-136 as being “not adequately sized for the governing scenario” (Exhs. RBPP-84, 

RBPP-88, and RBPP-96). 

Items 13a and 14a

Compliance with the Terms of the Cited Standard

Item 13a alleges a violation of § 1910.119(d)(3)(ii), stating the employers did not 

document compliance with RAGAGEP by “ensuring PSV-115, located in the Alky Unit, is 

properly designed. PSV-115 provides protection to the Recycle Isobutane Coalescer by relieving 

hydrocarbons to the flare and was determined to be undersized and does not have adequate 

relieving rate during relief scenarios.” Item 14a alleges a violation of § 1910.119(d)(3)(ii) 

because BPP and BP-Husky did not document compliance with RAGAGEP by “ensuring PSV124, located in the Alky Unit, is properly designed. PSV-124 provides protection to the 

Isobutane Product Coalescer by relieving hydrocarbons to the flare and was determined to be 

undersized and does not have an adequate relieving rate during relief scenarios.” For PSV-115, 

the required orifice area of the valve was 0.119 square inches. The actual size was 0.110 

(Tr. 634). For PSV-124, the required orifice area was 0.114 square inches. The actual size was 

0.11 square inches (Tr. 635). 
23

BPP and BP-Husky concede these deviations, found in its own Middough report, are correct. 

The Secretary has established the employers failed to comply with the terms of 

§ 1910.119(d)(3)(ii). 

Employee Access to the Violative Conditions

Employees in the refinery were exposed to the hazards of loss of containment caused by vessel 

overpressure due to inadequate relieving rate. Loss of containment could expose employees to 

death or serious physical injury.

Employer Knowledge

Middough issued the draft report identifying the undersized valves in June 2008, several months 

prior to the commencement of OSHA’s inspection. BP and BP-Husky were aware of the 

Middough report and thus knew of the violative condition.

Items 13a and 14a are affirmed.

Items 13b and 14b

Compliance with the Terms of the Cited Standard

Section 1910.119(j)(5) requires employers to “correct deficiencies in equipment that are outside 

acceptable limits. . . before further use or in a safe and timely manner when necessary means are 

taken to assure safe operation.” Item 13b alleges a violation of § 1910.119(j)(5), stating the 

employers did not correct deficiencies in the relief valves because they did “not ensure PSV-115, 

located in the Alky Unit, is properly designed.” Item 14b alleges a violation of § 1910.119(j)(5), 

for failing to “ensure PSV-124, located in the Alky Unit, is properly designed.”

Once it was alerted by the Middough report that the relief valves were undersized, BPP followed 

its Relief System Guidelines by verifying the calculations, analyzing the risk associated with the 

relief valves, and implementing interim actions that could be put in place pending a permanent 

solution. BPP “car-sealed”62 open valves between adjoining vessels and implemented 

administrative controls to ensure protection was maintained (Tr. 1607-1610, 3005-3011). The 

implementation of these interim measures changed the risk assessment to “a very low level of 

concern” (Tr. 3007).63

 

62 To “car-seal” means to lock open a valve, ensuring that there will be an open pathway for the 

product to relieve through in the event of overpressure (Tr. 3050-3051).

63 BPP subsequently replaced the undersized valves during turnarounds in 2011 and 2012 (Tr.

3007-3009). 
24

Dr. Georges Melhem owns ioMosaic, a specialist firm in process safety management and 

relief systems (Tr. 2443). Dr. Melhem earned a Ph.D. in chemical engineering from 

Northeastern University (Tr. 2442). He was qualified as an expert witness at the hearing in the 

areas of relief valve and relief systems operation and stability in oil and gas facilities, 

RAGAGEP for relief valves and relief systems, and risk analysis and risk management related to 

risk systems (Tr. 2466).

Dr. Melhem testified that an employer is not required immediately to shut down a process 

or fully correct a deviation as soon as it becomes aware of an equipment deficiency. He stated:

We also discussed that these mitigants, okay, will depend on the risk level. If the risk is 

extremely high, you shouldn’t be afforded a lot of time. You should fix them then. Shut 

down and fix them. Or you have to put in interim measures that will give you risk 

reduction until you can put [in] a permanent fix. If the technical violation or, you know, 

estimated to be a very low risk, very low risk exposure, the right time to do it is during a 

turnaround because of all the additional risks that we said would expose your employees 

to, if you have to do it on a one by one basis.

(Tr. 2544).

Dr. Melhem’s testimony comports with the Preamble’s commentary on § 1910.119(j)(5). 

Commenters to OSHA’s proposed paragraph that became § 1910.119(j)(5) objected to the 

requirement that any deficiency in equipment be corrected “before further use.” The Preamble

notes:

It was contended that the phrase “before further use” would mean that the process would 

have to be shutdown, and that shutdown has its own inherent hazards. It was suggested 

that equipment operating beyond acceptable limits does not always create a serious 

hazard. Participants asserted that deficiencies might need to be corrected promptly, or in 

a time and manner to assure safe operation instead. . . . The purpose of this proposed 

requirement was to require equipment deficiencies to be corrected promptly if the 

equipment was outside the acceptable limits specified in the process safety information. 

The comments have convinced OSHA that there may be many situations where it may 

not be necessary that the deficiencies are corrected in a safe and timely manner when 

necessary means are taken to ensure safe operation.

57 Fed. Reg. 6391 (emphasis in original).

The Secretary does not contend BPP’s interim measures to minimize the risk created by 

the undersized valves resulted in unsafe conditions. Section 1910.119(j)(5) did not require BPP 

to immediately shut down and completely correct the undersized valves before further use. It is 

within the parameters of the standard, as articulated in the Preamble, for the employer to take 

interim measures to ensure safe operation of the equipment until such time the equipment can be 
25

corrected safely. Here, BPP took interim measures to ensure the safe operation of the deficient 

relief valves by car-sealing them until it could replace them entirely during a scheduled 

turnaround. 

The Secretary has failed to establish BPP and BP-Husky violated the terms of 

§ 1910.119(j)(5). Items 13b and 14b are vacated.

Items 15a and 15b

Items 15a and 15b allege the companies violated §§ 1910.119(d)(3)(ii) and (j)(5), 

respectively, because PSV-136, located in the Alky Unit and providing protection to the Second 

Stage Butane Treater Drum, was undersized. The required orifice area for the relief valve was 

0.449 square inches. The relief valve’s actual orifice area was 0.307 square inches (Tr. 635).

BPP took the Second Stage Butane Treater Drum out of service in May of 2009 and 

drained it of hydrocarbons (Tr. 3012). The vessel remained out of service during OSHA’s 

inspection and was still out of service at the time of the hearing (Tr. 3013). 

Item 15a: 

Compliance with the Terms of the Standard 

It is undisputed PSV-136 was deficient and BPP and BP-Husky failed to document the 

relief valve complied with RAGAGEP. The companies failed to comply with the terms of 

§ 1910.119(d)(3)(ii).

Employee Access to the Violative Condition

The Secretary must establish employees had access to the violative condition in order to 

meet his burden of proof. He fails to do so here. BPP emptied the pressure vessel and took it out 

of service in May of 2009, four months before OSHA began its inspection of the refinery. Thus, 

at the time of OSHA’s inspection, the undersized relief valve did not present a hazard while 

installed on the empty pressure vessel. Area director Yoksas conceded there was no hazard to 

employees posed by PSV-136 (Tr. 191). OSHA safety engineer Lay agreed that “[i]f the piece 

of equipment had been properly removed from service . . . that would have been no hazard” 

(Tr. 464-465). Item 15a is vacated

Item 15b: 

Compliance with the Terms of the Standard

Section 1910.119(j)(5) requires employers to correct deficiencies in equipment “before 

further use.” In this case, after BPP took the Second Stage Butane Treater Drum out of service 
26

(before OSHA’s inspection), there was no further use of the pressure vessel. The Secretary has 

failed to establish BPP and BP-Husky were not in compliance with the terms of the standard. 

Item 15b is vacated.

Items 16, 17, and 18: Alleged Willful Violations of § 1910.119(d)(3)(ii) and (j)(5)

Back Pressures Exceeded 10%

Items 16, 17, and 18 concern relief valves (PSV-1280, PSV-1281, and PSV-1301) whose back 

pressures exceeded their set pressures. As in the previous sections, the Secretary alleges BPP 

and BP-Husky failed to document that equipment complied with RAGAGEP (in violation of § 

1910.119(d)(3)(ii) for Items 16a, 17a, and 18a), and failed to correct deficiencies in equipment 

outside acceptable RAGAGEP limits (in violation of § 1910.119(j)(5) for Items 16b, 17b, and 

18b).

Background

Built-up back pressure is the pressure exerted on the side of the vessel opposite to the 

inlet side, on the outlet piping (relief) side (Tr. 563-564, 2177, 2980). Back pressure exerts force 

on the valve and can operate independently or with the IPD to close the valve prematurely, 

raising the risk of chatter (Tr. 2188, 2193, 2521, 2523-2524). 

The refinery’s FCC Feed Drum receives hydrocarbons from multiple sources and then 

feeds them into the FCC Fractionator tower (Tr. 2982). When consultant S&B conducted its 

safety audit of the refinery in 1998, it discovered PSV-1280 and PSV-1281 could experience 

back pressure in excess of BPP’s acceptable limits under certain overpressure relief scenarios 

(S&B did not identify a back pressure issue for PSV-1301) (Exh. RBPP-38). S&B 

recommended installing safety system trips to shut down the process and prevent the 

overpressure relief scenarios from occurring). BPP followed S&B’s recommendation and 

installed the safety system trips in 1999 (Tr. 2976-2980). 

In 2007, BPP commissioned Equity Engineering to re-evaluate the FCC Feed Drum. 

Equity Engineering designed a balance line between the FCC Feed Drum and the FCC 

Fractionator to remediate concerns related to relief system capacity. Part of this project included 

re-routing PSV-1301 from a blowdown drum to the flare system. Equity Engineering found no 

back pressure deviations. The balance line was intended to divert overpressures to the 

Fractionator, which could better handle them. Shortly after its installation, however, the balance 

line plugged, rendering it unusable (Tr. 2982-2983). BPP conducted another risk assessment for 
27

further operation and determined there was a low risk due to the potential insufficient relief 

capacity for these valves. BPP implemented several interim remedial actions to ensure safe 

operation (Tr. 2987). At this time, BPP was unaware of back pressure deviations on PSV-1280, 

PSV-1281, or PSV-1301 (Tr. 1612, 1280).

In its draft report issued in July 2009, Middough identified PSV-1280, PSV-1281, and 

PSV-1301 as credible scenarios requiring very high relief rates (Exh. RBPP-108, RBPP-115, 

RBPP-126). 

Items 16a, 17a, and 18a

Compliance with the Terms of the Standard

Items 16a, 17a, and 18a of Citation No. 2 allege BPP and BP-Husky violated 

§ 1910.119(d)(3)(ii) by failing to document three relief valves complied with RAGAGEP. Item 

16a alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document compliance 

with recognized and generally accepted good engineering practices by ensuring PSV1280, a conventional relief valve, has a back pressure of less than or equal to 10% of its 

set pressure. This relief device provides protection to the FCC Feed Drum, and relieves 

hydrocarbons to the flare.

Items 17a and 18a repeat the AVD, each with its respective relief valve identification 

(PSV-1281 and PSV-1301).

BPP and BP-Husky do not dispute that RAGAGEP for back pressure on conventional 

spring-loaded valves is generally limited to 10%. The companies concede the back pressures for 

the three cited relief valves exceeded 10%, as stated in the Middough report. The Middough 

report calculated PSV-1280 and PSV-1281 had IPDs over 7% and built-up back pressures above 

50%. PSV-1301 had an IPD above 6% and a built-up back pressure above 40% (Exhs. RBPP108, RBPP-115, RBPP-126; Tr. 332-335, 352, 359). 

Employee Access to the Violative Conditions

Employees in the refinery were exposed to the hazards of loss of containment caused by 

excessive back pressures for the three relief valves. Loss of containment could expose 

employees to death or serious physical injury.

Employer Knowledge

BPP and BP-Husky received a draft of the Middough report in July of 2009. At the time 

of the inspection, the companies were aware the valves were not in compliance with RAGAGEP.

Items 16a, 17a, and 18a are affirmed.
28

Items 16b, 17b, and 18b

Items 16b, 17b, and 18b of Citation No. 2 allege BPP and BP-Husky violated 

§ 1910.119(j)(5) by failing to correct deficiencies in the relief valves that were outside 

acceptable limits before further use or in a safe or timely manner when necessary means were 

taken to assure safe operation. The items allege BPP and BP-Husky did not ensure PSV-1280, 

PSV-1281, and PSV-1301 had back pressures of less than 10%.

Upon receipt of Middough’s draft report in July of 2009, BPP implemented its Relief 

Systems Guidelines by verifying the accuracy of the calculations, conducting a new risk analysis, 

and implementing interim actions to ensure safe continued operation of the valves until 

permanent modifications could be completed (Tr. 2991-2992, 3002-3004). BPP added a riser to 

the water tanks that can feed the FCC Feed Drum to prevent and overflow of water into it. BPP 

also increased the management review and approval required for continued operation of the 

valves and the FCC Feed Drum. It also installed a full sized relief valve in an interim location 

that could be installed without incurring the risks associated with a shutdown of the equipment 

(Tr. 2987, 2992, 3053). 

As noted previously, § 1910.119(j)(5) does not require an employer to immediately shut 

down an operation and replace a deficient piece of equipment. The standard allows an employer 

to take interim measures to ensure safe operation of the equipment. The Secretary has adduced 

no evidence that BPP and BP-Husky’s interim measures failed to ensure safe operation of the 

equipment until the valves could be replaced during turnaround.

The Secretary has failed to establish violations of he cited standard. Items 16b, 17b, and 

18b are vacated.

Items 19 through 27: Alleged Willful Violations of §§ 1910.119(d)(3)(ii) and (j)(5)

Pressure Relief Devices (PRDs)

Items 19 through 27 address the lack of pressure relief devices (PRDs) on nine heat 

exchangers. The Secretary alleges BPP and BP-Husky failed to document equipment complied 

with RAGAGEP (in violation of § 1910.119(d)(3)(ii) for Items 19a through 27a) and failed to 

correct deficiencies in equipment outside acceptable RAGAGEP limits (in violation of 

§ 1910.119(j)(5) for Items 19b through 27b). 
29

Background

The cited pressure vessels are “shell-and-tube” heat exchangers. The heat exchangers 

consist of the vessel itself (the “shell” side), and the tubes inside the vessel. One material moves 

through the vessel outside the tubes while another material moves inside the tubes, allowing the 

transfer of heat from one material to the other (Tr. 253-255, 1573, 1594-1595). 

BPP issued its original GP 44-70 guideline in April 2006. BPP amended GP 44-70 in 

October 2009, implementing more restrictive requirements for its pressure relief systems 

(Tr. 2922-2923). In conjunction with its new guidelines, BPP had Middough analyze its heat 

exchangers. Middough issued a preliminary report in December 2009, toward the end of 

OSHA’s inspection of the refinery. The Middough report identified the nine cited heat 

exchangers as potentially needing additional or more direct relief protection (Exh. CX-2). 

The specific heat exchangers cited are:

Item 19: Upper Pumparound Cooler (PR543576)

Item 20: Lower Pumparound Cooler (PR543575)64

Item 21: Primary Absorber Lean Oil Cooler (PR543585)

Item 22: Primary Absorber Lean Oil Cooler (PR543586)

Item 23: Stripper Reboiler Condensate Pot (PR511134)

Item 24: Stripper Steam Reboiler (PR543538)

Item 25: Stripper CHGO Reboiler (PR543539)

Item 26: Steam Slurry Generator (PR543565)

Item 27: Cat Heavy Gas Oil Cooler (PR543567)

After BPP received the Middough report, the company performed risk assessments to 

determine if the heat exchangers were safe to continue operating (Tr. 3022). BPP determined the 

heat exchangers had open flow paths to another vessel’s relief device under normal operating 

procedures (Tr. 3023). The company concluded no interim measures were necessary for the two 

Primary Absorber Lean Oil Coolers (Items 21 and 22). BPP implemented the following interim 

actions for the other exchange heaters to assure safe operation:

1. Item 19: car-sealed open a pathway from the exchanger to relief protection and 

 

64 Item 20a of Citation No. 2 contains a typo, identifying the cited heat exchanger as 

“PR543757.” CSHO Sternes testified as to the correct identification number at the hearing (Tr. 

817).
30

developed administrative procedures to drain the vessel if it became blocked in;

2. Item 20: installed a bypass around a control valve to piping that provided sufficient 

relief protection;

3. Item 23: installed an adequately sized relief valve but placed it in an interim position 

that could be installed without shutting down the exchanger;

4. Item 24: installed an adequately sized relief valve but placed it in a temporary 

position that could be installed without shutting down the exchanger;

5. Item 25: car-sealed open a pathway from the exchanger to relief protection and 

developed administrative procedures to drain the vessel if it became blocked in;

6. Item 26: car-sealed open a pathway from the exchanger to relief protection and 

developed administrative procedures to drain the vessel if it became blocked in; and 

7. Item 27: car-sealed open a pathway from the exchanger to relief protection and 

developed administrative procedures to drain the vessel if it became blocked in.

(Tr. 3051-3053).

BPP developed action plans to permanently install relief valves during the next 

turnaround (Tr. 847).

Items 19a through 27a

Items 19a through 27a allege:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document the need for 

overpressure protection on pressure vessels as required by [RAGAGEP]. The [cited heat 

exchanger] is not protected by pressure relieving devices that would prevent the pressure 

inside the vessel from rising above acceptable limits.

Compliance with the Terms of the Standard

The Secretary has established BPP and BP-Husky failed to document compliance with 

RAGAGEP for the heat exchangers cited in Items 19a through 27a. Both industry consensus 

standards and BPP’s GP 44-70 required PRDs on heat exchangers.

Employee Access to the Violative Conditions

Employees in the refinery were exposed to the hazards of loss of containment caused by the 

missing PRDs on the heat exchangers. Loss of containment could expose employees to death or 

serious physical injury. Without proper PRDs, the piping could rupture, releasing hydrocarbons 

into the atmosphere (Tr. 825).
31

Employee Knowledge

CSHO Justin Sternes conducted OSHA’s inspection with regard to the heat exchangers cited in 

Items 19 through 27. He testified he identified the cited heat exchangers by reviewing the 

December 2009 draft Middough report commissioned by BPP (Tr. 843). CSHO Sternes’s 

inspection of the refinery began in October of 2009 (Tr. 809). He stated BPP representatives, 

including asset coordinator Dan Chovanec, relief systems technical authority David Hasselbach, 

and technical manager Tim Smith, were not aware until the December 2009 Middough report 

that the PRDs were missing (Tr. 812, 844). CSHO Sternes conceded he found no evidence that 

anyone at the Ohio refinery had any knowledge the heat exchangers lacked PRDs until 

December 2009 (Tr. 845).

The Secretary has failed to establish BPP or BP-Husky had actual knowledge of the violative 

conditions. CSHO Sternes’s inspection began in October of 2009. It was not until December 

2009 that BPP (and Sternes) became aware of the missing PRDs through the Middough report. 

There is no evidence anyone at BPP or BP-Husky was aware of the missing PRDs.

The Secretary argues BPP and BP-Husky should have known, through the exercise of reasonable 

diligence that the PRDs were missing. He contends that the cited pressure vessels were installed 

years before the PSM Standard was enacted and BPP should have detected at some point before 

the 2009 inspection that the cited heat exchangers lacked PRDs. CSHO Sternes agreed with 

Hasselbach, however, that it is difficult to discover the absence of PRDs by looking at the piping 

and IP&Ds (Tr. 845-846, 1598). Indeed, CSHO Sternes was at the Ohio refinery for two and a 

half months, five days a week, but he learned of the missing PRDs the same way BPP and BPHusky did—by way of the December Middough report (Tr. 809, 843). The Secretary has failed 

to establish BPP and BP-Husky had constructive knowledge of the missing PRDs. 

Items 19a through 27a are vacated.

Items 19b through 27b

Items 19b through 27b allege:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not address the need for 

overpressure protection on pressure vessels. The [cited heat exchanger] is not protected 

by pressure relieving devices that would prevent the pressure inside the vessel from rising 

above acceptable limits.
32

Compliance with the Terms of the Standard

After receiving the Middough report in December 2009, BPP conducted a risk analysis 

for each heat exchanger. It then implemented interim measures to ensure the safe operation of 

the heat exchangers. CSHO Sternes did not conduct an independent risk analysis. He did not 

dispute the effectiveness of the interim measures or challenge the company’s decision to install 

the PVDs during the next scheduled turnaround (Tr. 846-847).

Again, § 1910.119(j)(5) does not require an employer to immediately shut down an operation 

and replace a deficient piece of equipment. The standard allows an employer to take interim 

measures to ensure safe operation of the equipment. The Secretary has adduced no evidence that 

BPP and BP-Husky’s interim measures failed to ensure safe operation of the equipment until the 

PVDs could be installed during turnaround. 

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with the terms 

of the standard. Items 19b through 27b are vacated.

Items 28, 29, and 30: Alleged Willful Violations of § 1910.119(d)(3)(ii)

Furnaces

Items 28, 29, and 30 address combustion safeguards on furnaces. The Secretary alleges BPP and 

BP-Husky failed to document the cited furnaces complied with RAGAGEP, in violation of §

1910.119(d)(3)(ii). BPP and BP-Husky contend the cited furnaces fully complied with 

RAGAGEP.

Background

Refinery furnaces consist of separate fireboxes with many (from 20 to 70) burners that supply 

the heat required to boil crude oil. If a burner flame dies out, a vapor cloud of unburned fuel 

may form, creating an explosion hazard (Tr. 1650-1652). API’s recommended practice for 

furnaces, Instrumentation and Control Systems for Fired Heaters65and Steam Generators, is RP 

556 (Exh. JX-20). RP 556 emphasizes the importance of combustion safeguards on furnaces:

The greatest danger is from a fuel system that may fail long enough for the flame to die 

and then reintroduce fuel while the refractory is hot enough to ignite the fuel.

(Exh. JX-20, § 3.9).

CSHO Todd Jensen was OSHA’s team leader for the Ohio refinery inspection. He earned a 

bachelor’s degree in industrial and environmental health from Ferris State University in Big 

 

65 RP 556 uses “heaters” and “furnaces” interchangeably (Tr. 1184).
33

Rapids, Michigan (Tr. 1113-1114). CSHO Jensen conducted the inspection of the three cited 

furnaces. He identified the furnaces by reviewing the safety self-audit report commissioned by 

BPP and issued in May 2009 (Exh. JX-1; Tr. 1163). 

CSHO Jensen recommended citing BPP and BP-Husky for failing to document the three 

furnaces complied with RAGAGEP. Jensen stated:

There [was] instrumentation in the furnaces to detect various temperatures and whatever 

they were trying to detect in the furnace, but there was nothing that would shut the 

furnaces down automatically. It would require an operator to intervene with the central 

board to shut down a furnace or it would require an operator to detect a problem and then 

radio an employee in the field to go turn a valve or so forth. There was nothing that 

would automatically shut the furnace down.

(Tr. 1127).

Items 28, 29, and 30

Items 28, 29, and 30 allege:

BP-Husky Refinery, LLC – Oregon, Ohio: The employer does not document compliance 

with recognized and generally accepted good engineering practices by ensuring 

combustion safeguards are provided on the [cited heater].

The cited heaters are the Crude Heater A + B firebox (Item 28), the Vac Tower Furnace 

C firebox (Item 29), and the Naphtha Treater Furnace (Item 30). 

Compliance with the Terms of the Standard

The Secretary relied solely on the testimony of CSHO Jensen to establish the violations 

cited in Items 28, 29, and 30. CSHO Jensen testified he referred only to RP 556 when inspecting 

the furnaces (Tr. 1165). He treated Table 1 of RP 556 as a checklist, against which he compared 

the cited furnaces. Table 1 is entitled Typical Alarms and Shutdown Initiators—Fire Heaters. It 

lists 22 separate items from which employers may choose as combustion safeguards. After 

reviewing RP 556 (which he regarded as RAGAGEP for furnaces), CSHO Jensen determined 

BPP failed to comply with it because the cited heaters did not have automatic shutdown devices 

(Tr. 1127).

RP 556 intends for the employer to have flexibility in determining the best combustion 

safeguards to use depending on its particular furnaces. The Forward to RP 566 states, 

“Successful instrumentation depends upon a workable arrangement that incorporates the simplest 

systems and devices that will satisfy specified requirements” (Exh. JX-20). RPP 556’s 

Protective Instrumentation Alarms and Shutdown Devices also promotes the employer’s use of 

discretion to implement combustion safeguards best suited to its individual circumstances:
34

Because of the lack of the uniformity in the design and operation of fired heaters, each 

installation must be studied to determine how failures impact reliability and availability 

(See Table 1 for typical listing of alarms and shutdowns).

The final protective control system should be selected to make sure it cannot cause unsafe 

conditions and will not contribute to unnecessarily difficult start-ups or lead to nuisance 

shutdowns.

(Exh. JX-20, § 3.9).

RP 556 provides a list of factors to be considered before a safety instrument system is installed 

on a furnace:

The purpose of protective controls is to ensure safe operation, start-up, and shutdown 

conditions for fired heaters. How elaborate these systems need be depends on several 

factors, including the following:

a. The type of process.

b. The type and size of the heater.

c. What fuels are fired.

d. How reliable the fuel supply is.

e. The type and reliability of the pilots.

f. The operator coverage.

g. Applicable regulations.

h. Process hazard analysis.

(Id.).

Despite the directives of RP 556, CSHO Jensen testified he did not “actually look at the 

type of process in the Crude Unit or the Naphtha Unit when evaluating” the furnaces (Tr. 1183-

1184). His grasp of the types and operations of furnaces was tenuous at times:

Q. So did you look at the type and size of furnace that was used?

Jensen: We looked at the size. Yeah. We looked at the type as well.

Q. Okay. What was the type of furnace that the crude—that’s used in the Crude Unit?

Jensen: I don’t recall what type it is.

Q. Okay. But you looked at it. At one point do you think you knew what type it was?

Jensen: Yeah, I do—yeah. Yes.

. . .

Q. If it’s a larger heater, how does that change what shutdown you need, or control you 

need?

Jensen: I’m not sure.

Q. When you’re determining what safeguards to put in, why is it important to know what 

type of fuel is being used?

Jensen: Because you want to know how flammable it is in case you would have a fire in 

the furnace.
35

Q. I think you always have a fire in the furnace, don’t you? That’s kind of the point of it.

(Tr. 1184-1186).

Edward Marszal owns a consulting company, Conexis, specializing in the design of 

safety instrument systems for process industries, including oil refineries. Marszal has a 

bachelor’s degree in chemical engineering from Ohio State University, which he earned in 1992 

(Tr. 3123-3124, 3171). He was qualified as an expert in the design and implementation of 

engineered safeguards, controls, and instruments (Tr. 3134).

Marszal reviewed BPP’s combustion safeguards in the three cited furnaces. Asked his 

conclusion about the company’s existing safeguards, Marszal replied, “[M]y opinion is that at 

the time the safeguards that they had in place were appropriate for the hazards, or the degree of 

risk that the hazards presented” (Tr. 3143). 

Marszal explained that Table 1’s list of alarms and shutdown indicators is “a list of 

different safeguards that are recommended to be considered for a typical fired heater” (Tr. 3148). 

It is not a list of mandatory safeguards. Marszal stated he had never recommended installing all 

of the alarms and shutdowns listed in Table 1 (Tr. 3148). He explained why, from a safety 

engineering point of view, it would not be effective to install all available safeguards:

[I]f you over-complicate the system, you run the risk of making your system too difficult 

to use, preventing the workers from getting their job done, then things happen like safety 

systems get put in bypass, because they’re preventing people from getting their job done 

and that just makes a more hazardous situation.

(Tr. 3145-3146).

CSHO Jensen had listed the alleged deficiencies of the furnaces in his 1B worksheets, 

including missing sensors and other controls. Using simplified diagrams of the furnaces, 

Marszal identified the location of various sensors and controls on the furnaces (Tr. 3149-3165). 

Marszal testified the controls and instruments on each furnace at the time of the inspection 

permitted its safe operation. He stated, “My opinion is that at the time of the inspection, the 

existing system was in accordance with RAGAGEP (Tr. 3149).

Marszal took issue with CSHO Jensen’s interpretation of “automatic” as used in RP 556. 

Jensen interpreted “automatic shutdown” to require no human intervention. If adequate 

safeguards had been installed on the furnaces, he stated, a computer system would take over 

during an upset and bring the furnace into a safe condition independent of the control room 

operator. Jensen testified manual valves and operator control boards were insufficient to protect 
36

workers (Tr. 1127, 1144, 1165).

Marszal testified an automatic shutdown is one that works without human intervention at 

the valve. A shutdown implemented by remote control (a human operator pushing a button at a 

location removed from the valve) is still an automatic shutdown (Tr. 3190). Marszal stated, 

“[T]hey have an automated shutoff valve and what that means is that it’s actuated. You don’t 

need to go out to the valve and turn a crank. There’s an actuator that has air pressure on it and 

when you press a button, it will de-energize the circuit, de-pressure the actuator and the valve 

will go closed, so the valve is automatic, but it wasn’t connected to a flow transmitter or a 

temperature transmitter that’s automatically sending the signal for the valve to go to the closed 

position” (Tr. 3190-3191).

Marszal had more experience with furnace systems and demonstrated greater knowledge 

of their operation than Jensen did. Marszal was able to give detailed answers to the technical 

questions he was asked. He spoke confidently and without hesitation. Jensen, on the other hand, 

stumbled over some of the questions concerning RP 556 and the combustion safeguards:

Q. And what API does is it gives a wide range of potential options you are required to 

consider using on any specific type of furnace, right?

Jensen: I’m not sure. I’d have to read it to see if it says that or not.

Q. You don’t recall?

Jensen: I don’t recall.

Q. You’re not familiar enough with API 556 to know that?

Jensen: Right. Not that much detail.

(Tr. 1171-1172).

Q. Let me ask you to take a look at the last sentence. It says, “Purge systems may be 

used to prevent plugging.” Is that something that is required?

Jensen: I don’t know.

. . .

Q. So purge systems may be used to prevent plugging. Is that something BP Products 

Refinery had to have on its system? You talked about plugging earlier, right?

Jensen: Yeah. You’re talking about the “may” in that statement.

Q. Yes.

Jensen: So I don’t know what the purging system is. So are you talking about the word 

“may”?

Q. Well, I’m asking—you talked about plugging earlier and I’m asking whether or not 
37

the refinery had to have purge systems to prevent plugging?

Jensen: I don’t know. I don’t know.

Q. Okay. So you don’t have an opinion on whether or not guidance from “may be used” 

is a compliance requirement or not?

Jensen: I’m not sure.

(Tr. 1176). 

Marszal’s testimony regarding combustion safeguards is accorded more weight than that of 

CSHO Jensen. Jensen conceded he did not ask anyone at BPP if the company had analyzed the 

cited furnaces to determine if they had the correct controls and safeguards. Jensen conducted no 

analysis to determine what safeguards were present and what safeguards were appropriate for the 

furnace configurations (Tr. 1186-1189). Jensen did not distinguish between RP 556’s use of 

“shall” and “should,” stating that employers are required to comply with both, and he did not 

realize RP 556 used “heater” and “furnace” interchangeably (Tr. 1182, 1184). 

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with 

§ 1910.119(d)(3)(ii) with respect to the cited furnaces. The Secretary, through CSHO Jensen, is 

attempting to enforce as mandatory the recommended practices found in RP 556. The Secretary 

also is incorrectly interpreting RP 556 to require employers to install all of the safeguards listed 

in Table 1, rather than to select the individual safeguards best suited to the individual furnaces. 

Items 28, 29, and 30 are vacated.

Item 31: Alleged Willful Violation of §§ 1910.119(d)(3)(iii) and (e)(3)(i)

Cross Connections

Item 31 alleges BPP and BP-Husky failed to document the refinery’s fire water system was 

operating safely, in violation of § 1910.119(d)(3)(iii) (for Item 31a), and failed to analyze 

potential hazards posed by connections between the fire water system and the process water 

system, in violation of § 1910.119(e)(3)(1) (for Item 31b).

Background

Refineries have multiple water systems, including systems for utility purposes, for carrying water 

used in the process, and for firefighting (Tr. 3276). “Cross connection” means a connection 

between a fire water system and any other system in the plant (Tr. 3277). A cross connection 

between a fire water system and a process water system poses two potential hazards: first, the 

fire water may be diverted for other uses and will have insufficient water pressure to effectively 

fight fire in an emergency situation, and second, the process water may contaminate the fire 
38

water system with hydrocarbons, thus creating a greater fire hazard (Tr. 3280-3282). The 

Secretary is only concerned with the hazard of cross contamination in Item 31.

BPP’s “fire water system is a pressurized ring of piping throughout the facility that has sufficient 

quantity and quality of water available in case there’s a need to fight a fire” (Tr. 3276). New 

refineries are built with a totally independent fire water system (Tr. 3276). The Ohio refinery, 

which was built in 1919, was designed with a single water circuit throughout the plant (Tr. 

3277). When there is a direct connection between the fire water system and the process stream, 

which could have hydrocarbons in it, the process water can migrate through backflow and 

contaminate the fire water. Contamination of the fire water affects its foaming ability. 

Generating foam is the one of the most effective methods of extinguishing refinery fires 

(Tr. 3280-3282).

Items 31a and 31b

Item 31a alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer permits the existence of 

permanent connections between the plant fire water system and process systems, that can 

lead to the contamination of fire water supply with hydrocarbons or other process fluids, 

in that,

a. In the Isocracker 2 Unit, there is a cross connection at the 6” supply water to 

the cooler box on the east side of the unit;

b. In the Hydrogen Unit there are two cross connection instances on the 

blowdown drum;

c. In the Sulfur Recovery Unit there are two filter backwash cross connections;

d. In the Reformer 2 regeneration system, there is a cross connection between 

the quench and cooling water;

e. There are cross connections on the discharge sides of the fire water booster 

pumps in the FCC Unit.

Section 1910.119(d)(3)(iii) provides:

For existing equipment designed and constructed in accordance with codes, standards, or 

practices that are no longer in general use, the employer shall determine and document 

that the equipment is designed, maintained, inspected, tested, and operating in a safe 

manner.

Item 31b alleges:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not address in the process 

hazard analyses, the existence of permanent connections between the plant fire water 

systems that could lead to the contamination of fire water supply with hydrocarbons or 

other process fluids, in that, 

a. In the Isocracker 2 Unit, there is a cross connection at the 6” supply water 

to the cooler box on the east side of the unit;
39

b. In the Hydrogen Unit there are two cross connection instances on the 

blowdown drum;

c. In the Sulfur Recovery Unit there are two filter backwash cross 

connections;

d. In the Reformer 2 regeneration system, there is a cross connection 

between the quench and cooling water;

e. There are cross connections on the discharge sides of the fire water 

booster pumps in the FCC Unit.

Section 1910.119(e) requires employers to perform an initial hazard analysis on covered 

processes. Section 1910.119(e)(3)(i) provides:

The process hazard analysis shall address:

(i) The hazards of the process[.]

Compliance with the Terms of the Standard

CSHO Chad Positano recommended issuing the citation addressing BPP’s fire water 

system in Item 31. CSHO Positano based his recommendation primarily on BPP’s internal 2009 

PSM audit, which he characterized as “a finding from BP’s internal audit group that there was 

evidence that some of the fire water connections potentially posed a hazard the way that they 

were set up” (Tr. 949-950). After the report was issued on June 3, 2009, BPP and the PSM audit 

team established deadlines for abatement or remedial action to resolve any issues identified in 

the audit. The first scheduled deadline was March 31, 2010 (Exh. JX-1; Tr. 958-959).

CSHO Positano did not perform a field inspection of the cross connections (Tr. 970). In fact, 

Positano testified he did not know what a cross connection looked like and he could not explain 

how one operated. He testified, “I couldn’t sit here and describe physically what the cross 

connection would entail, no” (Tr. 970). When asked if he could explain how a cross connection 

works in the refinery’s water system, CSHO Positano replied, “No, not at this time. I remember 

the explanation coming from Mr. Herman when I interviewed him during the inspection, but to 

be able to sit here today and explain those to you, I don’t think I would be able to do that, no” 

(Tr. 970-971).

CSHO Positano claimed § 1910.119(d)(3)(iii) requires BPP and BP-Husky to document 

that equipment is in compliance with applicable codes and standards (Tr. 965). Actually, the 

cited standard requires BPP and BP-Husky to “document that the equipment is designed, 

maintained, inspected, tested, and operating in a safe manner.” Positano did not review the 

design documents for the fire water connections (Tr. 964). CSHO Positano could not identify 

any hazard created by any of the five cited cross connections (Tr. 973-975). For example, when 
40

asked if the Isocracker 2 Unit, identified in Instance (a) of Item 31 posed a hazard, Positano 

replied, “If it did, I don’t know how—if I would describe it, which hazard that might have posed, 

no” (Tr. 973). Area director Yoksas stated OSHA did not perform any analysis nor did it come 

to any conclusion “that there is in fact a credible possibility of contaminated process water to get 

into the fire water through the cross connection in Citation 31a” (Tr. 182).

Bradley Wolf graduated from Lehigh University in Bethlehem, Pennsylvania, in 1979 with a 

degree in material science. He worked for over a decade with Bagen Mckee, a major builder of 

refineries (Tr. 3263-3265). Wolf works as an oil refinery consultant (Tr. 3267). He was 

qualified as an expert in the areas of fire water systems in the refinery industry; the design, 

operations, and analysis of BPP’s fire water system; and risks associated with BPP’s fire water 

system (Tr. 3273). 

Wolf inspected and photographed each of the cited areas in the field and reviewed the P&ID in 

December 2011, two years after the OSHA inspection occurred (Tr. 3284). The Secretary 

contends Wolf’s opinions are immaterial because he visited the Ohio refinery more than a year 

after the citations were issued. Wolf testified, however, that the conditions were the same as 

they were at the time of OSHA’s inspection:

You can pretty much tell if something’s been worked on. I didn’t see any new signs of 

any new construction or anything in the area. It all looked like—I don’t want to call it 

tired, old equipment. But it’s been there, been used. I was able to review the drawings 

and the drawings agreed with what was there.

(Tr. 3284-3285).

Wolf’s testimony is deemed material to Item 31. The Secretary presented no evidence 

showing the conditions had changed since the inspection. Wolf had photographs and P&IDs of 

each of the cited areas. The Secretary did not show the photographed areas and P&IDs differed 

from the areas as they existed during the inspection.

Wolf went through each of the cited instances and described how the water system 

worked in that area in great detail (Tr. 3283-3284, 3312-3317 (Instance (a)); 3321-3332 

(Instance (b)); 3332-3338, 3409-3410 (Instance (c)); 3339-3343 (Instance (d)); 3344-3349 

(Instance (e)). He testified there was no credible hazard of contamination in the cited areas (Tr. 

3285). The cross connections did not violate industry standards (Tr. 3286). Wolf saw no 

credible risk of reverse flow on any of the connections (Tr. 3358).

Chris Herman has worked for BPP since 1978. For the past 25 years he has been BPP’s 
41

emergency response specialist, with the technical authority for all emergency response and fire 

protection issues in the refinery. Herman has a degree in fire science technologies and is a 

certified fire protection specialist with the NFPA (Tr. 3415).

Herman testified he participates in four to eight PHAs a year at the refinery, including 

PHAs for the fire water system (Tr. 3416-3417). He stated there was no credible risk of cross 

contamination in any of the cited areas (Tr. 3417).

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with the 

terms of §§ 1910.119(d)(3)(iii) and (e)(3)(i). OSHA did not conduct an independent 

investigation of the alleged violation, but instead attempted to piggyback onto an internal selfaudit commissioned by BPP. BPP’s expert Wolf and its emergency response specialist Herman 

testified there was no credible risk that the fire water could be contaminated at the cited 

locations. Because there is no credible risk of hazard, there was no need for BPP’s PHA team to 

address the hazards of the process.

Items 31a and 31b are vacated.

Items 32 through 40: Alleged Willful Violations of § 1910.119(e)(5)

Facility Siting PHA Recommendations

In Items 32 through 40, the Secretary alleges BPP and BP-Husky failed to establish a 

system to assure that facility siting process hazard analysis (PHA) recommendations for nine 

buildings were resolved in a timely manner and that the resolution is documented, in violation of 

§ 1910.119(e)(5).

Background

Ronald Unnerstall was BPP’s Business Unit Leader (the highest position at the refinery) from 

2006 to 2009. When he arrived, a facility-siting program was in place. The program consisted 

of an “inside-out” strategy that addressed higher risks first by focusing on buildings located 

nearest the process units and progressively working outward toward the perimeter of the refinery 

(Tr. 3627). The program reserved the highest priority for areas where employees worked around 

the clock and who were closest to the process units. Lower priority was given to areas where 

employees worked farther away from process units (Tr. 1497). The cited buildings were part of 

later phases of BPP’s program because they were located outside the process block (Tr. 4029).

By 2009, BPP had initiated a standardized site implementation plan (SIP) to address risks 

related to permanent buildings across its U. S. refineries. As part of the SIP, BPP developed a 
42

structured approach toward implementing building risk mitigation plans (Tr. 3692-3698). BPP 

used additional documents to provide more technical detail and prioritize their facility planning 

(Exhs. RBPP-12, RBPP-282, RBPP-283; Tr. 3699-3701, 4026, 4030). 

Between 2001 and 2012, the refinery spent a cumulative $69.6 million dollars on facility siting. 

The refinery spent $33 million dollars on facility siting between 2006 and 2009. BPP relocated 

approximately 435 employees to hardened shelters and strengthened buildings as part of the 

facility siting plan since 2006. BPP has built 109,000 square feet of new space (Tr. 3757-3758, 

4061, 4078, 4099).

Items 32 through 40

Items 32 through 40 allege:

BP-Husky Refining, LLC – Oregon, Ohio: The employer does not document the actions 

to be taken, develop a schedule to implement the actions, execute the actions necessary to 

control hazards associated with building collapse and damage to explosion overpressures 

to the [cited building], which could result in serious or fatal injuries to the building 

occupants.

The cited buildings are:

Item 32: WGI Insulators Building (PR-532430);

Item 33: Blender control room (PR-532354);

Item 34: Boiler Shop (Pr-532473);

Item 35: E&I Shop (PR-532419);

Item 36: HSEQ Building (PR-532380);

Item 37: Laboratory (PR-532490);

Item 38: Main Office Building (PR-532399/532400);

Item 39: WGI Administrative Offices (PR-532480); and 

Item 40: WGI Electricians Building (PR-532416)

Section 1910.119(e)(5) provides:

The employer shall establish a system to promptly address the team’s findings and 

recommendations; assure that the recommendations are resolved in a timely manner and 

that the resolution is documented; document what actions are to be taken; complete 

actions as soon as possible; develop a written schedule of when these actions are to be 

completed; communicate the actions to operating, maintenance and other employees 

whose work assignments are in the process and who may be affected by the 

recommendations or actions.

BPP and BP-Husky’s Argument

BPP argues its “actions were not untimely given the context of its long-term, complex, resource-
43

intensive facility siting program and thus were not in violation of the” cited standard (BPP’s 

brief, p. 107). John Arendt is vice president for North American Process Industries sector for 

ABSG Consulting (Tr. 3877). He has a bachelor’s degree in nuclear engineering and a master’s 

degree in engineering (Tr. 3878). He has assisted 60 to 70 oil refineries with risk studies and 

facility-siting studies (Tr. 3878-3890). Arendt is responsible for the acronym RAGAGEP, used 

so much in this proceeding: “[W]hen I was testifying, both on behalf of [the CMA and API] and 

other associations, as well as myself, I got tired of saying [recognized and generally accepted 

good engineering practices] so many times so I coined the acronym RAGAGEP during that 

rulemaking” (Tr. 3897). Arendt was qualified as an expert in process hazard analysis and risk 

assessments, as well as auditing and evaluating facility siting in compliance with the PSM 

Standard (Tr. 3898-3899).

Arendt testified BPP’s facility siting program is reasonable. “Industry and probably the 

government considers high risk first and then lower risk to be a best practice” (Tr. 3908). Arendt 

stated that usually a refinery will have many buildings or processes that require some 

remediation. It is, therefore, customary for companies to rank the risks associated with occupied 

buildings and to address the higher risk buildings first (Tr. 3900). Arendt conducted a risk-based 

assessment of the nine buildings cited in Items 32 through 40. He used industry practice to look 

at the likelihood of risk and the consequence to determine whether an employee could be 

impacted in each of the buildings (Tr. 3925-3926). Arendt concluded that seven of the nine 

buildings were at such low risk that industry practice would not have required any mitigation at 

all (Tr. 3929). The companies described the steps taken or planned under the facility siting 

program for each of the cited buildings: 

Item 32: WGI Insulators Building (PR-532430)

At the time of the inspection, approximately six employees worked in the WGI Insulators 

Building (Tr. 894). The start-of-shift safety meetings and breaks are located in this building. 

For the remainder of their shifts, the employees work in the plant (T. 4070). 

BPP plans to relocate the function of this building to a warehouse after modifications are 

completed in 2013 (Tr. 4071, 4129). BPP implemented interim mitigation measures prior to 

2008 (Exh. RBPP-274).

Item 33: Blender control room (PR-532354)

In 2010, the refinery relocated the blender operator to the Central Control Room. The 
44

refinery leased space outside the facility for storage of material from its existing warehouse 

(Tr. 4055, 4057). It also reassigned some field duties so employees could move to a location 

farther away from the process units (Tr. 1499-1500). The Blender Control Room was 

completely depopulated when its remaining workers were relocated to PODs (advanceddesigned, hardened, blast-resistant buildings that can be built in or near the process units) in 

2011 (Tr. 3713-3714, 4056). Prior to the depopulation, BPP implemented interim mitigation 

measures (Exh. RBPP-274).

Item 34: Boiler Shop (Pr-532473)

BPP has depopulated the Boiler Shop in stages. In 2006, approximately 99 employees 

worked there. At the time of the hearing approximately 30 employees remained in the Boiler 

Shop (Tr. 4071). BPP initially planned to move these employees to a new building located 

across Cedar Point Road. BPP later determined that course of action was less feasible than 

strengthening new buildings within the refinery or building a new building within the refinery 

(Tr. 1413, 1419-1420). The 2011 Baker Risk structural analysis demonstrated that it would not 

be feasible to strengthen the Boiler Shop (Tr. 4071-4072). BPP is currently reformulating its 

facility siting plan for this building and has decided to build a new building (Tr. 4072). BPP 

implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Item 35: E&I Shop (PR-532419)

BPP implemented interim measures, such as the installation of film on the windows, in 

the E&I Shop prior to 2008 (Exh. RBPP-274). In early 2012, the Shop was completely 

depopulated. The employees that formerly worked in this building were all relocated to a new 

addition built onto and existing warehouse (Tr. 4120)

Item 36: HSEQ Building (PR-532380)

The HSEQ Building, now referred to as the HSSE Building, is on the refinery’s fence 

line at the parking lot. The building has been fully mitigated, the walls hardened, and the 

windows and doors strengthened during a major remodel (Exh. RBPP-274; Tr. 1508-1510, 

4059). BPP implemented interim mitigation measures prior to 2008 (Exh. RBPP-274).

Item 37: Laboratory (PR-532490)

BPP was in the process of constructing a new Laboratory at the time of the inspection. 

The old Laboratory at issue here was depopulated in conjunction with the new Laboratory that 

was completed in 2010 (Tr. 1512).
45

Item 38: Main Office Building (PR-532399/532400)

BPP has depopulated the single-story portion of the main office building down to 

approximately 15 employees. Approximately 60 employees work in a two-story extension of the 

building that has been strengthened. The completion of the Refinery Operating Center has 

opened up additional space. BPP is in the process of relocating additional employees from the 

single-story portion of this building to the strengthened extension (Tr. 4074-4075).

Item 39: WGI Administrative Offices (PR-532480)

BPP had initially planned to transfer employees from the administrative offices to the 

building it planned to construct across Cedar Point Road. BPP later determined this option 

would take too much time and has since developed plans to relocate the remaining employees 

from the WGI Administrative Offices building to space BPP has created in an existing building 

(Tr. 1413, 1419-1420, 1426). BPP implemented interim mitigation measures prior to 2008 

(Exh. RBPP-274).

Item 40: WGI Electricians Building (PR-532416)

This building was depopulated in conjunction with the E&I Shop. BPP implemented 

interim mitigation measures prior to 2008 (Exh. RBPP-274).

Compliance with the Terms of the Standard

The Secretary cites BPP and BP-Husky’s failure to document efforts to resolve recommendations 

with respect to the cited buildings. Although the citation is couched in terms of failure to 

document the resolution of recommendations, the Secretary’s primary issue with BPP and BPHusky’s facility siting PHA recommendations is that they were not resolved on the Secretary’s 

timetable. CSHO Positano testified BPP and BP-Husky did not document the PHAs or see them 

“through to action” (Tr. 864). He stated, “There was no indication that a final decision had been 

made for the majority of the buildings that we cited as far as what action the company was 

planning to take to protect their employees” (Tr. 945).

Section 1910.119(e)(5) does not mandate any specific form of documentation or provide 

a schedule for completion. CSHO Positano conceded “there is no set schedule or time frame 

within our standard that says how long a company has to correct the findings themselves” (Tr. 

942-94), and agreed the PSM Standard “is a performance-based standard. So the regulations 

allow employers to determine how to document its plan” (Tr. 981). OSHA provides no guidance 

for what constitutes documentation in compliance with the standard. Employers use a variety of 
46

documents to satisfy the standard’s requirements (Tr. 3933). BPP established it did have 

documentation of its efforts to resolve recommendations for the cited buildings (Exhs. RBBP-12, 

RBBP-274, RBBP-283, RBBP-284).

In his post-hearing brief, the Secretary asserts, “Timely means in this context, at most one to two 

years depending on the scope and complexity of the issue analyze, and the risk posed by the 

hazard. . . . In light of the context and the standard’s purpose to prevent catastrophes, resolution 

of the PHA recommendations and hazard control must be completed within the five-year PHArevalidation cycle. . . . Regardless, BP’s failures to resolve the facility siting recommendations at 

issue in this case go far beyond any reasonable construction of the term ‘timely’” (Secretary’s

brief, p. 132-133). 

Arendt testified BPP’s facility siting program necessarily could not be completed on a 

tightly fixed schedule:

BP dealt with the highest risk buildings first and they fixed those, dealt with those. And 

then proceeded to deal with the next tier of building risks, which they used interim 

mitigations for until they could get a permanent solution. The permanent solutions that 

they put in place, some of them took time. And it takes time to be able to construct and 

to build a capital project, to be able to implement solutions like that. So I was okay with 

the strategy and I was okay with the things they were doing with those buildings.

(Tr. 3922). 

Arendt stated that if an employer determines a project will take an extended time to 

complete, the employer should take effective interim measures to ensure the safety of its 

employees:

[Employers] will look at the highest risk situations first and then they will determine what 

needs to be done to be able to mitigate that risk. If that mitigation is something that 

requires capital expenditure or requires a unit to be shut down or a refinery to be shut 

down for other things, then they will look at what the general time frame is in order for 

that final mitigation to take place. If that amount of time is on the order of years for 

whatever the reason, then a company will look to implement interim risk mitigation 

measures because it’s prudent to be able to try to keep the risk as low as they can until 

they get to a final mitigation. The higher risk mitigation is something that is sort of 

embedded throughout the PSM Standard.

(Tr. 3901-3902),

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with 

§ 1910.119(e)(5). The companies had documentation of the refinery’s facility siting program 

and the progress being made on it. The Secretary failed to show that the refinery’s extensive 

project for building, moving, and remodeling its facility, using the inside-out strategy for risk 
47

assessment, was not done in a timely manner.

Items 32 through 40 are vacated.

Item 41: Alleged Willful Violation of § 1910.119(j)(4)(ii)

Pipe Inspections

The Secretary alleges BPP and BP-Husky failed to follow RAGAGEP by not testing specific test 

points on the thickness measurement locations (TMLs) and/or the condition monitoring locations 

(CMLs), and by not increasing the number of inspections in the ALKY 1 Unit where there was a 

history of thinning and leaks from exposure to sulfuric acid.

Background

A piping circuit is a length of pipe that is identified on isometric drawings for inspection 

purposes (Tr. 3433-3434). An employer periodically takes measurements of the pipe’s thickness 

to monitor for corrosion “to make sure that any fluid stays inside the pipe” (Tr. 3440). 

Dennis Layman is BPP’s inspection superintendent. He is certified by API as a pressure vessel 

and piping inspector (Tr. 3430). Layman testified that BPP uses either ultrasonic or radiographic 

testing devices to measure the thickness of the pipe at various points within a TML. The test 

point that is lowest (thinnest) is recorded as the pipe’s thickness at that TML. That measure is 

then compared to prior readings from the TML in order to estimate the remaining life for the 

pipe and to establish the next inspection date (Tr. 3440-3444). 

Item 41

Item 41 alleges:

b. BP-Husky Refining, LLC – Oregon, Ohio: In the FCC and Alky units, the 

employer does not follow RAGAGEP (recognized and generally accepted good 

engineering principles) when they do not conduct thorough piping inspections by 

failing to take thickness readings at a specific designated test point within a TML 

(thickness measurement location)/CML (condition monitoring location).

c. BP-Husky Refining, LLC – Oregon, Ohio: The employer does not conduct 

additional piping inspections on the Alky flare header/subheader when historical 

inspections indicate flare header thinning and leaks.

Section 1910.119(j)(4)(ii) provides:

Inspection and testing procedures shall follow recognized and generally accepted good 

engineering principles.

Compliance with the Terms of the Standard

Instance (b)
48

CSHO Anthony Lowe recommended issuing the citation for this item. CSHO Lowe was of the 

opinion that RAGAGEP requires an employer to physically mark TMLs on pipes, rather than on 

isometric drawings, as BPP does. He believed BPP and BP-Husky were in violation of the cited 

standard because there were “no markings in particular on those vessels or piping. All they had 

was on their inspection drawings. So for accuracy sake, they really probably weren’t going to 

get the exact same spot each time, because there was no marking, et cetera, on the vessel or 

piping” (Tr. 747-748). 

The Secretary cited BPP because it failed to take the thickness readings at the exact same test 

point (or “examination point”) within each TML, as indicated by physically marking the pipes. 

The Secretary’s case is based on the belief that TMLs are the same thing as test points or 

examination points. 

The publication both the Secretary and BPP look to for guidance is API 570, Piping Inspection 

Code (Exhs. JX-13 (June 2006 version) and JX-14 (November 2009 version). Section 3.46 of 

the 2006 version of API 570 defines “test point” as:

An area defined by a circle having a diameter not greater than 2 inches (50 mm) for a line 

diameter not exceeding 10 inches (250 mm), or greater than 3 inches (75 mm) for larger 

lines. Thickness reading may be averaged within this area. A test point shall be within a 

thickness measurement location.

Section 3.46 of the 2006 version of API 570 defines “thickness measurement 

locations (TMLs) as:

Designated areas on piping systems where periodic inspections and thickness 

measurements are conducted.

By definition, a TML is not one point, but an area where “thickness measurements” 

(plural) are taken. API 570 establishes CSHO Lowe’s belief that test points and TMLs are the 

same thing is mistaken. The Secretary acknowledges this in his brief, conceding, “[T]he citation 

alleged the failure to test the same test points, which the Secretary agrees is not RAGAGEP” 

(Secretary’s brief, p. 140). Despite this concession that the AVD for Instance (b) 

mischaracterizes RAGAGEP, the Secretary believes he still somehow has a viable case:

Although the citation alleged the failure to test the same test points, which the Secretary 

agrees is not RAGAGEP, this instance addresses the concern that there was no assurance 

that corrosion readings would be taken sufficiently close to tests made five or ten years 

previously to assure an accurate picture of the piping’s corrosion rate because the TMLs 

were not marked on uninsulated piping. Tr. at 160, 706-32, 764, 3433-34, 3440. A 

preponderance of the evidence establishes this violation.
49

(Secretary’s brief, p. 140).

The Secretary’s belief is mistaken. The AVD for Instance (b) imposed a requirement not 

found in the standard. Taking thickness readings at the exact same test point is not required by 

API 570, or any other publications purported to be RAGAGEP. 

The Secretary has failed to establish BPP and BP-Husky were in noncompliance with the 

cited standard. 

Instance (c)

CSHO Lowe testified there had been a leak in one circuit in the Alky flare header/subheader on 

August 30, 2009 (Tr. 778). BPP conducted an extended survey of the circuit the following day 

and took interim measures to contain the leak (Tr. 779). BPP replaced the piping in October 

2009, during OSHA’s inspection (Tr. 788).

The Secretary adduced no evidence showing BPP’s procedures did not follow RAGAGEP. He 

has failed to establish BPP and BP-Husky were in noncompliance with the cited standard.

Item 41 is vacated.

Willful Classification

The Secretary classified all the items at issue in Citation No. 2 as willful.

A willful violation is one “committed with intentional, knowing or voluntary disregard 

for the requirements of the Act, or with plain indifference to employee safety.” Falcon 

Steel Co., 16 BNA OSHC 1179, 1181, 1993-95 CCH OSHA ¶30,059, p. 41, 330 (No. 89-

2883, 1993) (consolidated); A.P. O’Horo Co., 14 BNA OSHC 2004, 2012, 1991-93 C.H. 

OSHA ¶ 29,223, p. 39,133 (No. 85-0369, 1991). A showing of evil or malicious intent is

not necessary to establish willfulness. Anderson Excavating and Wrecking Co., 17 BNA 

OSHC 1890, 1891, n.3, 1995-97 C.H. OSHA ¶ 31,228, p. 43,788, n.3 (No. 92-3684, 

1997), aff’d 131 F.3d 1254 (8th Cir. 1997). A willful violation is differentiated from a 

nonwillful violation by an employer’s heightened awareness of the illegality of the 

conduct or conditions and by a state of mind, i.e., conscious disregard or plain 

indifference for the safety and health of employees. General Motors Corp., ElectroMotive Div., 14 BNA OSHC 2064, 2068, 1991-93 C.H. OSHA ¶ 29,240, p. 39,168 (No. 

82-630, 1991)(consolidated). 

A.E. Staley Manufacturing Co., 19 BNA OSHC 1199, 1202 (Nos. 91-0637 & 91-0638, 2000).

OSHA’s Final Policy on self-audits policy includes a “safe harbor” provision, which 

states:

Consistent with the prevailing law on willfulness, if an employer is responding in good 

faith to a violative condition discovered through a voluntary self-audit and OSHA detects 

the condition during an inspection, OSHA will not use the voluntary self-audit report as 

evidence that the violation is willful.
50

This policy is intended to apply when, through a voluntary self-audit, the employer learns 

that a violative condition exists and promptly takes diligent steps to correct the violative 

condition and brings itself into compliance, while providing effective interim employee 

protection, as necessary.

65 Fed. Reg. 46503.

The Secretary discovered all the affirmed violations in the instant case by reviewing 

BPP’s Middough draft reports. At the time of the inspection, BPP and BP-Husky were taking 

steps to correct the violative conditions and were providing effective interim protection to the 

refinery employees.

Items 13a and 14a: BPP commissioned two separate safety audits in the 1990s, neither 

of which identified the cited relief valves as deficient. The Middough draft report issued in July

2009 served as the first notice BPP and BP-Husky had that the valves were deficient. Upon

learning of the deficiencies, BPP immediately implemented interim measures to ensure the safe 

operation of the equipment. Indeed, in his post-hearing brief the Secretary notes the steps taken 

by BPP once it became aware of the undersized valves: “Upon receipt of Middough's 

calculations, Toledo implemented interim measures, sealing open piping leading to and from the 

serviced pressure vessel, and corrected the deficiencies at the next regularly scheduled 

equipment shutdown (or ‘turnaround’) in late 2011 or early 2012” (Secretary’s brief, p.110). 

Nothing in the record indicates an intentional, knowing or voluntary disregard for the 

requirements of the Act or plain indifference to employee safety. BPP self-identified the valve 

deficiencies and then took steps to ensure safe operation of the equipment until it could replace 

the valves. There is no illegality of either BPP’s conduct or the cited conditions, and thus no 

heightened awareness of illegality. 

Items 16a, 17a, and 18a: Upon receipt of Middough’s draft report in July of 2009, BPP 

implemented its Relief Systems Guidelines by verifying the accuracy of the calculations, 

conducting a new risk analysis, and implementing interim actions to ensure safe continued 

operation of the valves until permanent modifications could be completed (Tr. 2991-2992, 3002-

3004). BPP added a riser to the water tanks that can feed the FCC Feed Drum to prevent and 

overflow of water into it. BPP also increased the management review and approval required for 

continued operation of the valves and the FCC Feed Drum. It also installed a full sized relief 

valve in an interim location that could be installed without incurring the risks associated with a 

shutdown of the equipment (Tr. 2987, 2992, 3053). There is no evidence of BPP or BP-Husky 
51

having a heightened awareness of illegality regarding the relief valves.

The undersigned determines the Secretary’s classification of willfulness is not appropriate for 

BPP and BP-Husky’s violations of § 1910.119(d)(3)(ii) and reclassifies the violations as serious. 

Penalty Determination

The Commission is the final arbiter of penalties in all contested cases. “In assessing penalties, 

section 17(j) of the OSH Act, 29 U. S. C. § 666(j), requires the Commission to give due 

consideration to the gravity of the violation and the employer’s size, history of violation, and 

good faith.” Burkes Mechanical Inc., 21 BNA OSHC 2136, 2142 (No. 04-0475, 2007). 

“Gravity is a principal factor in a penalty determination and is based on the number of employees 

exposed, duration of exposure, likelihood of injury, and precautions taken against injury.” 

Siemens Energy and Automation, Inc., 20 BNA OSHC 2196, 2201 (No. 00-1052, 2005).

BPP employed approximately 600 employees at the Ohio refinery (Tr. 1339, 1812, 1830-1832). 

OSHA had previously cited BPP for violations at the Ohio refinery. BPP and BP-Husky 

demonstrated good faith during this proceeding.

Items 13a and 14a of Citation No.2, § 1910.119(d)(3)(ii): The gravity of the violation is high. 

BPP installed PSV-115 (Item 13a) in 1995 and PSV-124 (Item 14a) in 1999 (Exhs. RBPP-84 and 

RBPP-88). Refinery employees were exposed to the hazards of inadequate pressure relief for 14

years and 10 years, respectively, while working in proximity to the undersized valves. The 

undersigned determines a penalty of $7,000.00 for each item is appropriate.

Items 16a, 17a, and 18a of Citation No. 2, § 1910.119(d)(3)(ii): The gravity of the violation is 

high. The in-service date of PSV-1280 and PSV-1281 (Items 16a and 17a) was 1973 (Tr. 355, 

361). The in-service date of PSV-1301 (Item 18a) was 1958 (Tr. 335). Refinery employees 

were exposed for decades to the hazards of working in proximity to relief valves with excessive 

built-up back pressure. The undersigned determines a penalty of $7,000.00 for each item is 

appropriate. 

FINDINGS OF FACT AND CONCLUSIONS OF LAW

The foregoing decision constitutes the findings of fact and conclusions of law in 

accordance with Rule 52(a) of the Federal Rules of Civil Procedure.

ORDER

Prior to the hearing, the Secretary and BPP settled the items cited in Citation No. 1 and Citation 

No. 3. The parties filed a written partial settlement agreement on December 7, 2012, 
52

incorporating these dispositions. The undersigned hereby approves the December 7, 2012, 

partial settlement agreement, the terms of which are set out below in the sections addressing 

Citation No. 1 and Citation No. 3.

Citation No. 1

Citation No. 1 contained Items 1 through 20 alleging serious violations, issued to BPP and to BPHusky. Prior to the hearing, the Secretary and BPP entered into a settlement agreement. The 

Secretary agrees to withdraw all items of Citation No. 1 against BP-Husky. BPP agrees to accept 

as serious Items 1, 2, 3, 8, 12, 17, 18, 19, and 20 of Citation No. 1 and to pay $5,000.00 for each 

item. The Secretary agrees to withdraw Items 4, 13, and 16, with remedial action to be agreed 

upon. The Secretary withdraws Items 5, 7, 10, and 11. Items 6, 9, 14, and 15 are classified as 

other than serious with abatement agreed on by the Secretary and BPP. No penalties are 

assessed for the items classified as other than serious (Exh. JX-54; Partial Settlement 

Agreement).

Citation No. 2

1. Item 1 of Citation No. 2, alleging a willful violation of 29 C.F R. §1910.119(d)(3)(i), is 

vacated and no penalty is assessed;

2. Items 2a through 12a of Citation No. 2, alleging willful violations of 29 C.F.R 

§ 1910.119(d)(3)(ii), are vacated and no penalties are assessed; 

3. Items 2b and 3b of Citation No. 2, alleging willful violations of 29 C.F.R. § 1910.119(j)(5), 

are withdrawn by the Secretary and no penalties are assessed;

3. Items 4b through 12b of Citation No. 2, alleging willful violations of 29 C. F. R. 

§ 1910.119(j)(5), are vacated and no penalties are assessed;

4. Items 13a and 14a of Citation No. 2, alleging willful violations of 29 C.F.R. 

§ 1910.119(d)(3)(ii), are affirmed as serious and a penalty of $7000.00 each for Item 13a and 

Item 14a is assessed;

5. Items 13b and 14b of Citation No. 2, alleging willful violations of 29 C.F.R. 

§ 1910.119(j)(5), are vacated and no penalties are assessed;

6. Items 15a and Item 15b of Citation No. 2, alleging willful violations of 29 C.F.R. 

§§ 1910.119(d)(3)(ii) and (j)(5), respectively, are vacated and no penalties are assessed;

7. Items 16a, 17a, and 18a of Citation No. 2, alleging willful violations of 29 C.F.R 

§ 1910.119(d)(3)(ii) are affirmed as serious and a penalty of $7000.00 each for the items is 
53

assessed;

8. Items 16b, 17b, and 18b of Citation No. 2, alleging willful violations of § 1910.119(j)(5), are 

vacated and no penalties are assessed;

9. Items 19a through 27a of Citation No. 2, alleging willful violations of § 1910.119(d)(3)(ii), 

are vacated and no penalties are assessed;

10. Items 19b through 27b of Citation No. 2, alleging willful violations of § 1910.119(j)(5), are 

vacated and no penalties are assessed;

11. Items 28, 29, and 30 of Citation No. 2, alleging willful violations of § 1910.119(d)(3)(ii), are 

vacated and no penalties are assessed;

12. Items 31a and 31b of Citation No. 2, alleging willful violations of §§ 1910.119(d)(3)(iii) and 

(e)(3)(i), respectively, are vacated and no penalties are assessed;

13. Items 32 through 40 of Citation No. 2, alleging willful violations of § 1910.119(e)(5), are 

vacated and no penalties are assessed;

14. Item 41 of Citation No. 2, alleging a willful violation of § 1910.119(j)(4)(ii), is vacated and 

no penalty is assessed; and 

15. Item 42 of Citation No. 2, alleging a willful violation of § 1910.119(j)(4)(iii), is withdrawn 

by the Secretary and no penalty is assessed. 

Citation No. 3

Citation No. 3 contained Items 1, 2, and 3 alleging other than serious violations, issued to BPP 

and BP Husky. Prior to the hearing, the Secretary and BPP entered into a settlement agreement. 

The Secretary agrees to withdraw all items of Citation No. 3 against BP-Husky. The Secretary 

agrees to withdraw Item 1 against BPP. BPP agrees to accept as other than serious Items 2 and 

3, with abatement agreed on by the Secretary and BPP. No penalties are assessed for Items 2 and 

3 (Exh. JX-54).

SO ORDERED.

/s/ Sharon D. Calhoun

SHARON D. CALHOUN

Judge

Dated: August 12, 2013
54

Atlanta, Georgia
55