United States of America

OCCUPATIONAL SAFETY AND HEALTH REVIEW COMMISSION 

 

 

OSHRC Docket No. 14-0404 

 

Appearances:

Elizabeth K. Arumilli, Esq., U.S. Department of Labor, Office of the Solicitor, Chicago, Illinois, 

 For Complainant 

Dennis Morikawa, Esq., Morgan, Lewis & Bockius LLP, Philadelphia, Pennsylvania1

 For Respondent 

Before: Administrative Law Judge Peggy S. Ball

DECISION AND ORDER

I. Procedural History

This proceeding is before the Occupational Safety and Health Review Commission (“the 

Commission”) under section 10(c) of the Occupational Safety and Health Act of 1970, 29 U.S.C. 

§ 659(c) (“the Act”). In response to a fire in Respondent’s crude oil unit, the Occupational 

Safety and Health Administration (“OSHA”) conducted an inspection of Respondent’s Lemont 

Refinery in Lemont, Illinois on October 24, 2013. (Tr. 10). The fire broke out after 

hydrocarbons leaked into the air during the removal of a pump. (Tr. 60; Ex. C-1). OSHA issued 

 

1. At trial Respondent was represented by Nina G. Stillman, with the firm of Scharf Banks Marmor, LLC in

Chicago, Illinois. On September 30, 2015, the Court received notice that Ms. Stillman withdrew as counsel and that 

Dennis Morikawa would serve as counsel for Respondent. 

SECRETARY OF LABOR, 

 

 Complainant,

 

 v. 

CITGO PETROLEUM CORPORATION,

 

 Respondent.
2

a Citation and Notification of Penalty (“Citation”) to Respondent alleging two serious violations 

and a proposed penalty of $14,000.00. As noted in the parties’ Joint Stipulations, which are 

reproduced below, Respondent withdrew its Notice of Contest as to Item 1 of the Citation. Thus, 

the only item under consideration is Citation 1, Item 2, and its associated penalty of $7,000.00. 

Respondent timely contested the Citation. 

The trial took place on April 29–30, 2015, in Chicago, Illinois. Five witnesses testified at 

trial: (1) James Tancredi, Respondent’s manager of Health, Safety, Security, and Environment 

(HSSE); (2) Compliance Safety and Health Officer (“CSHO”) Mark Blackmore; (3) Walt 

Siegfried, Complainant’s expert; (4) Ray Hill, HSSE Manager for Respondent’s St. Charles, 

Louisiana refinery; and (5) Ray Boutte, Respondent’s Process Safety Management (“PSM”) 

Coordinator. Both parties timely submitted post-trial briefs. After reviewing the parties’ 

arguments and the record, the Court issues the following Decision and Order. 

II. Stipulations2

The parties stipulated to the following: 

1. Jurisdiction of this proceeding is conferred upon this Occupational Safety and Health 

Review Commission by section 10(c) of the Occupational Safety and Health Act. 

2. Respondent is, and at all relevant times was, a business, with an office and place of 

business at 135th & New Avenue in Lemont, Illinois, and at all relevant times, it was engaged in 

petroleum refining and other related activities.

3. Respondent at all relevant times had a worksite and was engaged in petroleum refining 

and other related activities at 135th & New Avenue, Lemont, Illinois. 

 

2. The parties’ stipulations can be found in the parties’ Joint Stipulation Statement, which was filed with the Court 

on May 15, 2015. These stipulations were read in open court and can be found on page 10–11 of the transcript. 
3

4. Respondent, at all relevant times, was engaged in a business affecting interstate 

commerce in that Respondent was engaged in handling goods or materials which had been 

moved in interstate commerce. 

5. Respondent at all relevant times was an employer employing employees in said business 

at the aforesaid worksite. 

6. Respondent does not contest Item 1 of the Citation and Notification of Penalty. 

7. Under 29 C.F.R. § 1910.147(a)(1) the regulations found in 29 C.F.R. § 1910.147 apply to 

the removal of the 11GT-9A Vacuum Tower Bottoms pump that was the subject of Citation 1, 

Item 2 of the citations.

III. Jurisdiction

As noted in the previous section, the parties have stipulated that the Commission has

jurisdiction over this proceeding and that Respondent was an employer engaged in a business 

affecting commerce within the meaning of § 3(5) of the Act, 29 U.S.C. § 652(5). Slingluff v. 

OSHRC, 425 F.3d 861 (10th Cir. 2005). 

IV. Factual Background 

The scope of the case at bar is rather narrow—whether Respondent’s LOTO procedures 

comply with the requirements of 29 C.F.R. § 1910.147(c)(4)(ii)(D). That standard requires that 

an employer’s LOTO program contain “[s]pecific requirements for testing a machine or 

equipment to determine and verify effectiveness of lockout devices, tagout devices and other 

energy control measures.” 29 C.F.R. § 1910.147(c)(4)(ii)(D). The cited standard governs just 

one step in what is otherwise a comprehensive regulatory scheme for the control of hazardous 

energy. Although the Court’s focus is narrow, it is important to understand the context in which 

the alleged violation occurred and the import of this particular step to the LOTO process. Based 
4

on the following facts and subsequent Discussion, the Court finds that Respondent violated the 

standard 

A. The Accident

On October 23, 2013, employees at Respondent’s Lemont Refinery were in the process 

of removing the 11GT-9A Vacuum Tower Bottoms pump (“VTB pump”) from the crude oil unit 

in order to allow a contractor, Starcon, to perform maintenance.3 (Tr. 78). This process required 

Respondent’s employees to isolate the pump from all surrounding sources of stored, hazardous 

energy before custody of the equipment was handed over to Starcon. (Tr. 50, 236–37). After 

custody of the equipment was handed over to Starcon and work began on the pump, a leak was 

discovered. (Tr. 60). According to Respondent’s internal investigation, a ten-inch discharge 

valve had not been fully closed due to an internal obstruction. (Ex. C-1 at 19–21). This partially 

opened valve allowed flammable hydrocarbons to continue flowing into the system, which 

Respondent believed had been isolated. (Id.). Approximately 30 minutes later, the leaked 

material ignited, which caused a fire that resulted in approximately $320 million dollars in 

damage to the refinery. (Tr. 60). Fortunately, employees and contractors had been evacuated 

from the area before the fire began. 

On October 24, 2013, Complainant sent CSHO Blakemore to the refinery to conduct an 

inspection. During the course of his inspection, CSHO Blakemore conducted interviews of 

management and employees, reviewed Respondent’s policies and procedures, and performed a 

walk-around of the crude oil unit. (Tr. 75–76). Based on his review of Respondent’s lockout/tag-out (LOTO) policy, as well as other interrelated policies, CSHO Blakemore determined

Respondent did not have adequate procedures for verifying effective isolation while performing 

 

3. Vacuum Tower Bottoms is a fuel product that is created in the crude oil unit. (Tr. 65). 
5

LOTO. As a result of his findings, Complainant determined that Respondent had violated 29 

C.F.R. § 1910.147(c)(4)(ii)(D). 

B. Respondent’s LOTO Program

As testified to by Tancredi and Boutte, a LOTO program governing process equipment, 

such as that found in a refinery, will necessarily look different from a LOTO program for fixed 

pieces of equipment such as those found in a manufacturing warehouse. (Tr. 272–74, 365–66). 

Just as the name implies, the procedures applicable to lock-out of a particular fixed piece of 

equipment will not vary to any significant degree. With respect to a refinery such as 

Respondent’s, however, the procedures for LOTO will vary depending upon the scope of the 

work, the equipment, and the sources and types of energy involved. Due to this variability, 

Respondent’s LOTO program relies upon extensive training, generally applicable procedures, 

and safe work permits, which allow for the customization of LOTO procedures to a particular 

job. (Exs. J-1 to J-7, C-1, R-1, R-2). 

The primary document governing Respondent’s LOTO program is called Safe Practice 

Standard (SPS) No. 2, “Control of Hazardous Energy Standard”. (Ex. J-1; Tr. 282–83). This 

SPS sets forth the requirements for conducting LOTO such that the equipment operator can 

transfer custody/control of the equipment to a craftsman or maintenance person to perform

upkeep or replacement of a component (Ex. J-1). According to Respondent, the first step in this 

process is to identify the scope of the work, which, in this instance, was removing the VTB 

pump. (Tr. 275–76). Once that was delineated, the equipment operator prepared what is known 

as an “isolation list”, which set out the description and location of each isolation point, the size 

of the equipment to be isolated, lockset designations, lockbox numbers, and remarks applicable 

to specific isolation points. (Tr. 276; Ex. J-6). During the preparation of this list, employees
6

“walked the line” of equipment within the scope of the isolation and ensured that all necessary 

isolation points were on the list. (Tr. 48, 276–77). Tancredi testified that the isolation list at 

issue in this case was reviewed by a unit supervisor, who added more isolation points to the list

and gave it his approval. (Tr. 232, 277; Ex. J-6). Once this occurred, the isolation list became the 

master isolation list for the project. (Tr. 277). 

After the master isolation list was prepared, the equipment operators closed all associated 

valves, locked, and tagged them. (Tr. 277–78). Once a valve was closed, the equipment operator 

signed next to that isolation point on the isolation list to indicate that lock out had been

implemented at that location. (Tr. 278). This part of the process also included the installation of 

blinds, which are metal plates that are inserted between flanges to prevent the flow of energy 

through the system.4 (Tr. 278). The areas between the isolation points were then drained and/or 

flushed. (Tr. 278). After isolation was implemented, the equipment operator and Starcon 

walked the line again to verify that isolation had occurred. (Tr. 278–80). Prior to Respondent 

issuing a safe work permit and transferring custody of the equipment, Starcon requested a union 

break, or separation of bolted pipe, to further verify that no hydrocarbons remained in the 

isolated system. (Tr. 280). After 15 minutes, Starcon and Respondent were satisfied that the 

system had no residual energy and proceeded to issue the Safe Work Permit. (Tr. 280; Ex. C-1).

The issuance of a safe work permit is governed by Respondent’s Safe Practice Standard 

No. 22. As noted in SPS No. 2, the safe work permit works in conjunction with the procedures 

for LOTO. (Ex. J-1). At its most basic, the safe work permit is “an authorization to perform 

work and provides a checklist to help workers identify job hazards and necessary safety 

precautions.” (Ex. J-2 at 1). With respect to LOTO and equipment custody transfer, “the 

 

4. The installation of a blind requires the issuance of an additional safe work permit, in addition to the permit that 

authorizes work to be performed on the equipment to be isolated. 
7

Equipment Owner must review with the Lead Worker the Master Blind/isolation list, the job site, 

the equipment, isolated energy sources, and practices applied to dissipate, drain or de-pressure 

the energy sources.” (Id. at 11). Only after LOTO has been implemented and the requisite 

portions of the safe work permit have been completed and attested to can the permit be issued. 

(Tr. 299–300). 

In addition to the foregoing, Respondent’s employees testified regarding the extensive 

training regimen that is in place at the refinery. Respondent’s employees undergo a tiered 

training program, which includes eight weeks of initial, classroom-based instruction and six 

months of field training before they are allowed to participate in a LOTO procedure. (Tr. 267–

69, 304–307). Even after the training period has concluded, employees are subject to spot audits, 

testing, and refresher training on an annual basis. (Tr. 306–307). According to Tancredi, the 

training includes extensive instruction on the various methods to verify the effectiveness of 

isolation.

C. Respondent’s Incident Investigation 

In response to the fire, Respondent formed an incident investigation team to determine 

the cause. (Tr. 345; Ex. C-1). The investigation team found that the ten-inch discharge isolation 

gate valve of the VTB pump, which was one of the isolation points, was in a partially open 

position. (Ex. C-1 at 1 and 5). As a result of such opening, material leaked through the valve and 

through a flange that had been opened to the atmosphere, causing a fire. (Id.). Closer inspection

of the valve after the fire disclosed that seven full threads of the valve stem extended out from 

the hand wheel, which, according to Tancredi, Boutte and the Incident Report, indicated that 

“Operations failed to recognize the potential for energy to still be in the system and were not able 

to verify zero energy and that the system was clear.” (Tr. 324–25, 382; Ex. C-1 at 12–13, 25). It 
8

was later determined that foreign material may have prevented the valve from completely 

closing. (Ex. C-1 at 19–21).5

 

As a result of its investigation, Respondent concluded that the root and contributing 

causes of the accident primarily involved operator error—the failure of Respondent’s employees 

to verify “zero energy” and Starcon’s failure to abide by its own procedures. While many of the 

proposed corrective actions involved pipe configuration and equipment updates, the Incident 

Investigation Team also recommended that Respondent “[d]evelop an operating procedure that 

details the requirements for preparing the . . . pumps for maintenance and inspection” and 

“[r]eview the existing Operations Vacuum Tower Bypass Procedure to assure it distinguishes 

when it can be utilized; identify prerequisite unimpeded access to required ATB and VTB 

valves.” (Ex. C-1 at 26–27). 

V. Discussion 

A. Applicable Law

To establish a violation of an OSHA standard, Complainant must establish: (1) the 

standard applies to the facts; (2) the employer failed to comply with the terms of the standard; 

(3) employees were exposed to the hazard covered by the standard, and (4) the employer had 

actual or constructive knowledge of the violation (i.e., the employer knew, or with the exercise 

of reasonable diligence could have known, of the violative condition). Atlantic Battery Co., 16 

BNA OSHC 2131, 2138 (No. 90-1747, 1994). 

 

5. In addition, the report noted, “The check valve (installed new in August 2013) held, holding pressure in the upper 

spool. This condition as well as the IR temperature gun readings gave a false indication that the 10” discharge block 

valve was holding. Given the configuration of the discharge piping and the closed position of the 2” pump out and 

6” recirculation valves on the upper spool, the no leak condition at the open union on the check valve bypass was 

insufficient verification of zero energy in the system.” (Ex. C-1 at 15).
9

B. Citation 1, Item 1 

Complainant alleged a serious violation of the Act in Citation 1, Item 1a as follows: 

29 CFR 1910.147(c)(4)(ii)(D): The procedures shall clearly and specifically 

outline the scope purpose, authorization, rules, and techniques to be utilized for 

the control of hazardous energy, and including, but not limited to, the following: 

Specific requirements for testing a machine or equipment to determine and verify 

effectiveness of lockout devices, tagout devices and other energy control 

measures.

Crude unit (Vacuum Tower area) – On or about October 23, 2013, employees 

were required to lockout for the removal of the 11GT-9A VTB Vacuum Tower 

Bottoms pump. The written energy control procedure (Isolation List – 11GT-9A 

VTB pump) did not clearly and specifically outline the requirements for testing a 

machine or equipment to determine and verify the effectiveness of lockout 

devices, tagout devices, and other energy control measures. Employees were 

thereby exposed to the hazards associated with releases of petroleum 

hydrocarbons (Vacuum Tower Bottoms). 

i. The Standard Applies

 The parties stipulated that the cited standard applies to the removal of the 11GT-9A 

Vacuum Tower Bottoms pump. 

ii. The Terms of the Standard were Violated

As previously noted, the focus of this case is quite narrow—whether Respondent had 

adequately specific procedures for testing equipment to verify the effectiveness of its energy 

control measures. See 29 C.F.R. § 1910.147(c)(4)(ii)(D). Prior to determining whether 

Respondent violated the standard, however, the Court must determine what the standard requires. 

The cited standard is a performance standard. See Control of Hazardous Energy Sources 

(Lockout/Tagout), 54 Fed. Reg. 36644, 36671 (September 1, 1989) (indicating that standard is 

written in performance language and “addresses situations in which there is a need for entirely 

unique lockout/tagout procedures”). Performance standards “require an employer to identify the 

hazards peculiar to its own workplace and determine the steps necessary to abate them.” Thomas 
10

Indus. Coatings, Inc., 21 BNA OSHC 2283, 2287 (No. 97-1073, 2007). Because performance 

standards do not identify specific obligations, they are interpreted in light of what is reasonable. 

Id. “A reasonably prudent employer is a reasonable person familiar with the situation, including 

any facts unique to the particular industry.” W.G. Fairfield Co., 19 BNA OSHC at 1235 (No. 09-

0344, 2000). That said, while industry practice is relevant to the analysis, it is not dispositive. 

See id.; see also Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793 (No. 90-998, 1992). 

Complainant contends that Respondent failed to have specific, written procedures for 

verifying the effectiveness of energy control measures. In particular, Complainant argues that 

SPS No. 2, which governs LOTO at the refinery, falls short of providing the requisite specificity 

and that the supplemental documents, such as the Isolation/Blind list and the Safe Work Permit, 

do not provide additional clarity sufficient to comply with the standard’s requirements. In order 

to comply, Complainant argues that at least one of the foregoing documents should address 

verification techniques and locations, and provide guidance on specific testing to be used to 

confirm that isolation has been effective and zero energy status has been achieved. 

Respondent proffers multiple arguments in support of its position that Complainant failed 

to prove a violation of the standard. First, Respondent contends that the plain language of the 

standard does not require that the specific steps for verification of energy control be in writing. 

Relying on the performance-oriented language of the standard, Respondent argues that it 

exercised its discretion to implement the Act’s LOTO requirements in a reasonable manner and

did so consistently with industry practice. Second, Respondent contends that Complainant’s 

interpretation of the standard is at odds with the preamble to the LOTO standard, Commission 

case law, and Complainant’s own, prior interpretations of the standard. 
11

a. The Writing Requirement

In response to Complainant’s claim that it should have written procedures for verification 

of hazardous energy isolation, Respondent contends that the standard does not require those 

procedures to be in writing. Respondent suggests such a requirement is unprecedented in light of 

the fact that the standard is couched in performance-oriented language, which provides 

employers flexibility in its implementation. The Court disagrees. The cited standard is a 

subsection of 29 C.F.R. § 1910.147(c)(4), which governs hazardous energy control procedures

generally. It states, “Procedures shall be developed, documented and utilized for the control of 

potentially hazardous energy when employees are engaged in the activities covered by this 

section.” 29 C.F.R. § 1910.147(c)(4)(i) (emphasis added). Further, those procedures “shall 

clearly and specifically outline the scope, purpose, rules, and techniques to be utilized for the 

control of hazardous energy, and the means to enforce compliance including but not limited to . . 

specific requirements for testing a machine or equipment to verify the effectiveness of . . . energy 

control measures.” Id. § 1910.147(c)(4)(ii)(D) (emphasis added). 

Contrary to Respondent’s assertion, there is a clear requirement that energy control 

procedures shall be documented. The fact that subsection 1910.147(c)(4)(ii)(D) does not 

reiterate that the specific procedures referenced must be in writing does not undermine the clear 

mandate of 1910.147(c)(4). Indeed, it would make little sense for the Act to require 

documentation of energy control procedures as a general proposition only to then say that the 

specific elements of that program, i.e., steps for isolation, verification, etc., need not be in 

writing. The requirement for procedures to “clearly and specifically” outline requirements for 

verification of energy control methods would be rendered null if compliance could be achieved 
12

without including such verification in the documentation.6 See Solis v. Summit Contractors, Inc., 

558 F.3d 815, 823 (8th Cir. 2009) (“We also should ‘avoid a [regulatory] construction that would 

render another part of the same [regulation] superfluous.’” (quoting United States v. Stanko, 491 

F.3d 408, 413 (8th Cir. 2007))). Further, though the standard at issue is a performance standard, 

that does not mean that Respondent is free to ignore the documentation requirement. The 

performance language of the standard gives Respondent flexibility on what to include in its 

documented energy control procedures and how to document them (e.g., work authorization 

permits), not whether to document them in the first place.

In support of this proposition, and to counter any suggestion that the standard does not 

require written procedures, the Court notes that the LOTO standard provides an exception to the 

documentation requirement. That the standard, as a whole, provides only one exception to the 

general requirement of documentation is a clear indication that Respondent’s argument is 

mistaken. In order to qualify for the exception, the process/equipment at issue must meet eight 

separate requirements. In general, the exception applies to a single piece of equipment, powered 

by a single energy source, which can be locked out with a single lockout device. See 29 C.F.R. § 

1910.147(c)(4), NOTE. In contrast, here Respondent had to use multiple lockout devices to 

control multiple potential energy sources. Accordingly, Respondent was required to have written 

procedures for verification of energy control measures. 

b. Preamble to 29 C.F.R. § 1910.147 

There is no question that Respondent had a robust LOTO program in place at the time of

the fire, nor is there a suggestion that Respondent’s employees failed to perform testing or visual 

 

6. Not to mention that it would be exceedingly difficult to have clear and specific instructions that were 

communicated orally. 
13

inspection in an attempt to verify a zero energy state.7 The issue in this case is one of content—

did the procedures that Respondent had in place comply with the specificity requirements of 29 

C.F.R. § 1910.147(c)(4)(ii)(D), not only as to the points for isolation but also as to verification 

that isolation has been effective? Having addressed the question of whether such procedures 

need to be in writing, the next question is what is required to be in writing. Complainant argues 

that Respondent’s LOTO procedures must include: techniques for particular verification 

methods, identification of which techniques to use, and identification of proper locations on or 

around the equipment to perform verification. Compl’t Br. At 12. Respondent contends that such 

a requirement would not only be onerous but is unsupported by the plain language of the 

standard, the preamble, and relevant case law. Not only does Respondent contend that 

Complainant’s interpretation is unsupported by the preamble, but it also suggests that the 

preamble supports its belief that the particulars of its energy control verification procedures do 

not need to be documented. 

First, Respondent re-emphasizes that LOTO is a performance standard, and, as such, 

employers have flexibility in terms of how they comply. See 54 Fed. Reg. at 36659 (“The 

advantage of writing this OSHA standard in performance language is to allow flexibility of 

compliance for all systems in which hazardous energy is or may be present.”). According to 

Respondent, this flexibility means that it is “entitled to model its LOTO program after what other 

reasonable refinery operators are doing . . . .” Resp’t Br. At 18. That is not entirely true—while 

industry practice is relevant to the determination of what a reasonable person would do, it is not 

dispositive. See Farrens Tree Surgeons, Inc., 15 BNA OSHC 1793 (No. 90-998, 1992) (“[T]o 

consider industry practice as determinative would permit an entire industry to avoid liability by 

 

7. This does not mean that the verification process was effective. Tancredi testified that the individuals charged 

with this responsibility “didn’t do a good job”. (Tr. 320). 
14

maintaining inadequate safety.”). Respondent confuses the issue of how to document 

verification procedures with whether to document them in the first place. As noted above, the 

plain language of the standard requires written LOTO procedures for each element listed in 

1910.147(c)(4)(ii). Thus, the issue is not whether Respondent should document anything at all 

but, instead, what level of detail is required to comply. 

The evidence of industry practice was relatively scant—Respondent’s employees testified 

they had not seen a refinery that documented its verification procedures and techniques. 

Complainant’s expert, Siegfried, had limited refinery-specific experience. That said, Siegfried 

testified to his extensive experience in the arena of Process Safety Management, which included 

inspecting chemical plants and refineries, drafting interpretive documents, and participating in 

speaking engagements sponsored by the refinery industry. (Tr. 141–59). Based on his 

experience, the Court qualified Siegfried as an expert with respect to hazardous energy control in 

the context of chemical processing.8

 (Tr. 200). Siegfried testified about the similarities regarding 

the equipment and machinery used at chemical processing plants and refineries, the methods of 

verification that are typically employed by those industries, and how they document procedures 

for the implementation of those verification methods. (Tr. 212–13). He testified that, in some 

instances, such companies rely on a standardized procedure, whereas others may utilize a work 

authorization permit (also known as a safe work permit), to lay out specific steps for verification.

(Tr. 213). 

 

8. Although Siegfried’s experience is based, in large part, on his work in the chemical processing industry, the 

Court was convinced by his testimony that the equipment used in chemical processing plants and refineries is similar 

in type, if not in orientation, due to the different chemicals that are being manufactured. (Tr. 149–50). Further, to the 

extent that he has performed multiple inspections of process equipment in those industries, reviewed LOTO policies 

and procedures of other companies, and been engaged by those industries to speak at events, the Court finds that he 

is qualified to opine on industry practice. 
15

Regarding the specificity required for isolation verification procedures, an employer’s 

flexibility is more circumscribed than Respondent proposes. In its discussion on the standard’s 

use of the term “specific”, the preamble notes: 

OSHA has retained the word “specific” when detailing the elements of the 

procedure. This was done to emphasize the need to have a detailed procedure, one 

which clearly and specifically outlines the steps to be followed. 

Overgeneralization can result in a document which has little or no utility to the 

employee who must follow the procedure. 

54 Fed. Reg. at 36670 (emphasis added). The preamble goes on to state that “the procedure is 

required to be written in detail.” Id. However, because the standard is intended to be applicable 

across the field of “general industry”, the level of detail required should be commensurate with 

the complexity of the process. Id. Regardless of the level of detail, “OSHA believes that because 

of the need to follow the steps in the energy control procedure carefully and specifically, and the 

number of variables involved in controlling hazardous energy, a documented procedure is 

necessary for most energy control situations.” Id. (emphasis added). As noted above, 

Respondent does not qualify for the exception to the documentation requirement. Thus, 

irrespective of whether there are refineries that do not document their verification procedures, the 

Court finds that under any reasonable reading of the LOTO standard, Respondent’s verification 

procedures should be documented.9

 

Second, Respondent appears to suggest that its extensive training program is an 

acceptable substitute for specific procedures. Respondent notes a passage wherein the preamble 

states that a tagout system would be just as acceptable as a lockout system when combined with 

“extensive training programs to teach their employees about their energy control procedures.” 54 

Fed. Reg. at 36655. Respondent then lays out the particulars of its LOTO training program and 

 

9. If, as Respondent suggests, employers in the refinery industry do not document their verification procedures, that 

says more about the state of the industry than it does about the reasonableness of Complainant’s interpretation. 
16

concludes that it is “consistent with the preamble’s emphasis on training as an ingredient to a 

successful LOTO program.” Resp’t Br. at 19. The Court does not take issue with Respondent’s 

training program, nor does it disagree that training is an essential component of any 

comprehensive LOTO program; however, there is no indication in the preamble to suggest that a 

comprehensive training program is an acceptable substitute for specific procedures. In fact, the 

passage quoted by Respondent had a very limited application—the appropriateness of lockout 

versus tagout. 54 Fed. Reg. at 36655. In that passage, the importance of documented procedures 

was highlighted: 

In order to provide adequate protection to employees, the Final Rule, as did the 

proposal, requires employers to develop and utilize a comprehensive energy 

control program consisting of the development and utilization or [sic] procedures 

and training of employees. The procedures must consist of steps for

deenergization of equipment, isolation of the equipment from energy sources, and 

verification of deenergization before servicing and maintenance is performed on 

equipment, and the employees who either perform the servicing or maintenance or 

are affected by those operations must be properly trained in the energy control 

procedures which apply to their work. 

Id. The preamble clearly states that a comprehensive energy control program consists of both the 

development and utilization of procedures and the training of employees. The conjunction “and” 

mandates both components. Nowhere in the preamble does it suggest that training, in and of 

itself, is a sufficient replacement for specific procedures.10 

Third, Respondent argues that using a safe work permit, in conjunction with the isolation 

list and SPS Nos. 2 and 22, complies with the preamble’s statement “that a work permit checklist 

system or work authorization system could serve as the required written procedure . . . .” See 

 

10. In support of its argument, Respondent cites Unifirst Corp., 24 BNA OSHC 2261 (No. 13-1703, 2014) (ALJ 

Gatto). Respondent argues that the ALJ vacated the citation, in part, based on the safety training that was provided 

to its employees. This is incorrect. Judge Gatto vacated the citation because the Secretary failed to proffer evidence 

to establish that the respondent’s procedure for handling soiled hospital scrubs deviated from what a reasonably 

prudent employer would do under similar circumstances. While Judge Gatto mentioned that the respondent’s 

employees had been trained, there was no finding that such training was a sufficient substitute for adequate 

procedures. 
17

Resp’t Br. at 19 (quoting 54 Fed. Reg. at 36658). This is the sort of flexibility that was discussed 

above—LOTO procedures that can vary on a case-by-case basis cannot be captured by static, 

general procedures. Thus, the preamble recognizes that alternative methods of documenting 

procedures are acceptable. However, merely having a safe work permit or work authorization 

system is not sufficient in and of itself. To complete the passage quoted by Respondent: “[A] 

work permit checklist system . . . could serve as the required written procedure as long as it 

meets the criteria for a procedure spelled out in this Final Rule.” 54 Fed. Reg. at 36658

(emphasis added). While individual passages, divorced of context, appear to support 

Respondent’s position, the general thrust of the standard is clear: (1) Respondent is required to 

“develop, document, and utilize” a procedure for control of hazardous energy; and (2) those 

documented procedures shall have specific information regarding use of the procedure, steps for 

isolation, steps for placement of energy isolating devices, and requirements for testing and 

verifying the effectiveness of those energy isolating devices. See 29 C.F.R. §§ 1910.147(c)(4)(i), 

(ii). The passage cited by Respondent merely indicates where an employer may document the 

procedures, not that any checklist or work authorization will suffice as a “procedure”. In that 

regard, neither the isolation list nor the safe work permit at issue here contains procedures related 

to the verification of isolation. 

Finally, Respondent references the preamble’s discussion of the “different means to 

isolate the energy in piping and process systems” and the importance of “verification of the 

success of prior steps of a piping system isolation”. 54 Fed. Reg. at 36658. Respondent argues 

that this passage is notable for what it does not say: that an employer needs to document 

verification techniques in its energy control procedures. The preamble does not mention 

documentation in that paragraph, because the import of that passage is to illustrate that the 
18

LOTO standard’s requirements are “appropriate for the control of all hazardous energy sources, 

including those discussed by [American Petroleum Institute].” Id. In that respect, when the 

preamble discusses “verification of the success of prior steps of a piping system isolation”, it did 

so only to point out that such a procedural step is no different than “verification of proper 

implementation of the energy control program.” Id. Overall, this passage does no more to 

support Respondent’s case than the previously cited passages. Rather, it supports the proposition 

that OSHA’s purpose in utilizing performance-based language to define the general industry’s 

obligations under the LOTO standard was to make it broadly applicable to fit multiple energy 

control scenarios. That it is so written does not alleviate Respondent’s obligation under the 

standard to “develop[], document[], and utilize[]” energy control procedures, which “clearly and 

specifically outline the scope, purpose, authorization, rules, and techniques to be utilized for the 

control of hazardous energy . . . including . . . [s]pecific requirements for testing a machine or 

equipment to determine and verify the effectiveness of . . . energy control measures.” 29 C.F.R. 

§ 1910.147(c)(4). 

c. Case Law 

Similar to its arguments with respect to the preamble, Respondent attempts to find 

support for its position in isolated passages of applicable Commission precedent. Unfortunately 

for Respondent, nothing in the case law supports the proposition that an employer can choose 

whether to document its verification procedures. Rather, as the preamble suggests, whether an 

energy control procedure is adequate depends on the complexity of the process or equipment. 

See Gen. Motors Corp., 22 BNA OSHC 1019 (No. 91-2834 et. al, 2007) (“As GM acknowledges 

the amount of detail required would depend on ‘the complexity of the equipment and the control 

measures to be utilized.’” (quoting 54 Fed. Reg. at 36670)). 
19

Respondent places significant emphasis on Interstate Brands Corp., 2001 CCH OSHD ¶ 

32394 (No. 00-1077, 2001) (ALJ Rooney). Respondent’s reliance on this case is misplaced for 

two reasons. First, Interstate Brands was subsequently appealed to the Commission. See 

Interstate Brands Corp., 20 BNA OSHC 1102 (No. 00-1077, 2003). On appeal, the Commission 

affirmed the judge’s decision to vacate the citation items; however, it came to that conclusion on 

different grounds than had been relied upon by the judge. Id. Thus, the rationale for vacating the 

citations has no precedential value. Second, even if it did, the Interstate Brands decision does not 

stand for the proposition that lockout verification procedures do not need to be in writing. Judge 

Rooney carefully analyzed the facts of that case and determined that the machine at issue was 

covered by the exception to the documentation requirement. 2001 CCH OSHD ¶ 32394 at *8. 

Respondent, as discussed previously, does not qualify for the exception provided in 29 C.F.R. § 

1910.147(c)(4)(i). Respondent was persuaded by the judge’s finding that “the intent was not to 

require employers to identify each piece of equipment and to specify for each piece of 

equipment, the manner of verifying deenergization.” Id. However, the very next sentence 

clarifies the import of that statement: “Rather, where machines have similar controls, they may 

be covered under the same procedure.” Id. In Interstate, the complainant argued that the 

employer’s LOTO procedures were insufficient as to all of the machines under its control. Id. 

However, the court found the complainant failed to put forth evidence proving the LOTO 

procedures were insufficient for those machines. Id.; see also 20 BNA OSHC 1102 (noting that 

Secretary’s evidence failed to establish how procedures were inadequate as to the “other” 

machines, the nature of the energy involved, the function of the other machines, their operations, 

or the circumstances under which they would require lockout/tagout). The Interstate cases 

provide contour to the question of the quantum of proof necessary to establish the need for more 
20

specific procedures, but they in no way absolve an employer of its obligation to document its 

energy control procedures. The manifest reason the judge in Interstate Brands was comfortable 

with the lack of documentation was because it was fairly simple to implement and verify LOTO 

on the piece of equipment under discussion.11

The process for implementing LOTO to perform maintenance on the VTB pump was not

a simple task. (Tr. 276–81). There were no fewer than eleven isolation points and multiple 

energy sources identified in the safe work permit for the VTB pump versus only a single energy 

source and isolation point for the equipment in Interstate. (Ex. J-6). At the very least, it is safe to 

say that the equipment at issue here is far more complex than the equipment at issue in Interstate. 

The Court finds the holding and facts of the Interstate cases do not support Respondent’s 

position. 

Conversely, the Court finds that the cases cited by Complainant are instructive. In Drexel 

Chem. Co., 17 BNA OSHC 1760 (No. 94-1460, 1997), the employer co-opted the LOTO 

procedure contained in Appendix A to 29 C.F.R. § 1910.147.12 The problem, however, was that 

the employer did not fill in any of the provided blanks, which are intended to allow an employer 

to include facility- or equipment-specific information, including “the names of affected 

employees, the types and magnitudes of energy, the hazards, the methods to control the energy, 

the types and locations of machine or equipment operating controls, the types and locations of 

energy isolating devices, the types of stored energy and methods to dissipate or restrain energy, 

and the method of verifying the isolation of the equipment.” Drexel, 17 BNA OSHC 1760 at *5

 

11. Interestingly enough, even though the LOTO procedures for the equipment at issue were fairly basic, the 

employee still managed to injure himself because he failed to properly verify effective lockout. 20 BNA OSHC 

1102. 

12. Just as it did with respect to the Interstate Brands cases, Respondent cited ALJ Welsch’s decision in Drexel

instead of the Commission’s decision, which takes precedence. See Resp’t Br. at 21 (citing Drexel Chem. Co. ̧17 

BNA OSHC 1760 (ALJ Welsch, March 11, 1996)). 
21

(emphasis added). The Commission noted, “Because the purpose of the lockout procedure is to 

guide an employee through the lockout process, these general procedures are not acceptable.” Id. 

While Respondent’s LOTO program was more comprehensive than that of the employer 

in Drexel, it nonetheless relied upon generalized procedures with respect to verification of 

isolation. With respect to verification, Respondent’s Control of Hazardous Energy procedure, 

SPS No. 2, simply states, “Before starting the work the Equipment Owner and Lead Worker shall 

review the job and perform a survey to ensure all energy sources are isolated. The equipment 

Owner will verify equipment is de-energized by testing all start/stop controls, and/or visual 

inspection of energy isolating devices.” (Ex. J-1 at 6). This language is almost directly parroted 

from the sample “Typical Minimal Lockout Procedure” found in the Appendix to the standard. 

See 29 C.F.R. § 1910.147, Appendix A (“Ensure that the equipment is disconnected from the 

energy source(s) by first checking that no personnel are exposed, then verify the isolation of the 

equipment by operating the push button or other normal operating control(s) or by testing to 

make certain the equipment will not operate.”).13 In light of the general nature of Respondent’s 

written procedures, and considering the complexity associated with implementing LOTO in this 

context, the Court finds Respondent’s procedure for verification of isolation to be inadequate, 

because there is nothing to guide Respondent’s employees through the entire LOTO process, as 

dictated by 29 C.F.R. § 1910.147(c)(4)(ii). 

The Commission’s decision in Gen. Motors Corp., 22 BNA OSHC 1019, is also 

applicable to the present dispute. Similar to its holding in Drexel, the Commission emphasized 

the importance of having specific procedures commensurate with the complexity of the 

equipment and found that GM’s procedures were inadequate. Gen. Motors, 22 BNA OSHC 1019 

 

13. It is interesting to note that the Commission, perhaps tongue in cheek, stated that this language was “the most 

detailed discussion in GM’s procedure.” 22 BNA OSHC 1019 at *8. 
22

at *7–8. As an example of the complexity of the equipment at the GM facility, the Court noted 

that the motor rail conveyor required “at least four safety locks . . . to lock it out.” Id. (internal 

citation omitted). By comparison, here Respondent needed to implement eleven different 

isolation points for the VTB pump. (Ex. J-6). 

Based on the case law, the preamble, and the plain language of the standard, the law is 

clear that if an energy control procedure requires multiple lockout devices to control multiple 

energy sources, then the procedures governing LOTO should be correspondingly detailed. No 

matter how well-trained employees may be, or how familiar they are with their equipment, there 

is always a potential for a lapse in attention. (Tr. 80). This is particularly so in the process 

industries—not only are there multiple steps and multiple sources of energy, but by 

Respondent’s own account, those steps and sources change with each separate maintenance 

project (sometimes with respect to work on the same piece of machinery or process). (Tr. 273–

76). In such a dynamic environment, Complainant allows the use of work permits as a 

supplement to the primary LOTO procedure. See 54 Fed. Reg. at 36658. However, irrespective 

of what form the procedures take, Respondent is still obligated to specifically outline the steps an 

employee must follow to implement LOTO. 

Going beyond the question of whether specific procedures for verification of isolation

need to be documented, Respondent also takes issue with the specificity of information 

Complainant asserts must be included in the procedures. Complainant contends the standard 

requires Respondent to identify the location where verification is to occur and to indicate the 

method which will be employed to verify. Based on the plain language of the standard, the 

preamble, and associated case law, the Court finds that Complainant’s interpretation is 

reasonable. 
23

The process for isolating a piece of equipment in a refinery is a paradigmatic example of 

the sort of complicated and dynamic process that requires specific instructions to ensure safe 

implementation of LOTO. To suggest, as Respondent has, that extensive training can take the 

place of a written procedure runs afoul of the very reason for the requirement in the first place—

minimizing the element of human error. See id. at 36670 (“Overgeneralization can result in a 

document which has little or no utility to the employee who must follow the procedure.”). 

Respondent dedicates a lot of up-front work into preparing a piece of equipment for 

maintenance, including a fairly extensive isolation process; however, as this case illustrates, if a 

similar amount of detail is not employed on the back end to verify such isolation has been 

effective, there can be serious consequences.14 Subsequent review of the problematic valve 

showed that the valve stem was still visible after it had been hand-wrenched by one of the bigger 

employees in the unit. (Tr. 320). According to Hill, visual verification of this particular valve 

stem was difficult because it required scaffolding or a ladder to observe. (Tr. 358). A specific 

method for verifying the valve stem was fully engaged had not been documented. 

Tancredi testified that there are over 200 different techniques that can be employed to 

verify de-energization, which Respondent contends would be unduly burdensome to document. 

(Tr. 317). Based on the Court’s understanding of the case, Complainant is not suggesting that 

Respondent include each of the purported 200 different techniques in its procedures, isolation

list, or safe work permit; rather, pursuant to the standard, Complainant argues that Respondent is 

required to identify which verification technique should be applied to each point where isolation 

 

14. By so holding, the Court is not expressing an opinion as to the cause of the fire. To that point, the Court would 

note that it is irrelevant whether or not the lack of documented procedures caused the fire. See Western 

Waterproofing Co., Inc., 7 BNA OSHC 1625 (No. 1087, 1979) (“[A]s a general rule, whether an employer is in 

violation of the Act does not depend on the cause of a particular accident.”); Propellex Corp., 18 BNA OSHC 1677 

(No. 96-0265, 1999) (finding judge mistakenly focused on cause of accident in determining whether a violation 

occurred).
24

is planned. Further, Respondent’s claim that there are over 200 different verification methods is 

somewhat specious. First, during the trial, Respondent’s employees were only able to testify as 

to a handful of methods, such as opening high point vents and low point bleed valves, using an 

infrared gun to test temperature, and visual verification. (Tr. 312–14, 320). Second, if there are 

over 200 methods, it is hard to conceive of an employee being able to remember all of them each 

time he is required to implement them. Finally, to the extent that 200 different methods exist, it 

is curious that Respondent has not documented these methods anywhere. 

Insofar as Respondent already creates job-specific procedures through its use of isolation 

lists and safe work permits for each project, the Court does not perceive the burden of including 

verification methods specific to each job to be an onerous addition. The process for isolating a 

piece of equipment in a refinery can be complicated and fraught with potential hazards. The level 

of complexity is exemplified by the fact that project-specific procedures have to be developed 

each time LOTO is implemented. To suggest, as Respondent has, that documenting its 

verification procedures is not required by the standard is contrary to the plain language of the 

standard, the preamble, and Commission case law. Accordingly, the Court finds that the terms 

of the standard were violated. 

iii. Respondent Had Knowledge of the Violative Condition 

The Court finds that Respondent knew or, with the exercise of reasonable diligence, 

could have known that its energy control procedures were deficient. Tancredi testified that, as the 

HSSE manager, he works with the energy control procedures and is considered the owner of 

those procedures. (Tr. 32, 265). This means that Tancredi and his department ensure that the 

procedures are complete, current, and properly executed. (Id.). But Tancredi testified multiple 

times that the LOTO procedures do not contain a written description of verification. (Tr. 54, 317, 

329, 335–38). Nevertheless, the refinery leadership team approved SPS No. 2, which governs 
25

the control of hazardous energy. Accordingly, the Court finds that Respondent knew that its 

procedures were deficient. See Revoli Const. Co., 19 OSHC 1682 (No. 00-0315, 2001) (holding 

that knowledge of supervisors is generally imputable to employer). 

iv. Respondent’s Employees were Exposed to the Hazard

“To establish exposure, ‘the Secretary . . . must show that it is reasonably predictable 

either by operational necessity or otherwise (including inadvertence), that employees have been, 

are, or will be in the zone of danger.’” Delek Ref., Ltd., 25 BNA OSHC 1365 (08-1386, 2015) 

(citing Fabricated Metal Prods., Inc., 18 BNA OSHC 1072, 1074 (No. 93-1853, 1997)). See also 

Gilles & Cotting, Inc., 3 BNA OSHC 2002 (No. 504, 1976). 

The Court finds that Respondent’s employees were exposed to the hazard. According to 

CSHO Blakemore, four of Respondent’s employees were working in the area of the VTB pump 

during the LOTO process. (Tr. 78, 98). Tancredi confirmed that four employees were working 

in the crude unit and that at least one of the employees was working in close proximity to the 

location where Starcon employees were unbolting the flange to begin the maintenance project. 

(Tr. 65). In light of the size of the resulting fire, the Court finds that Respondent’s employees 

were exposed to the hazard resulting from inadequate procedures. (Ex. C-1 at 2). 

v. The Violation Was Serious 

A violation is “serious” if there was a substantial probability that death or serious 

physical harm could have resulted from the violative condition. 29 U.S.C. § 666(k). 

Complainant need not show that there was a substantial probability that an accident would

actually occur; he need only show that if an accident occurred, serious physical harm could 

result. Phelps Dodge Corp. v. OSHRC, 725 F.2d 1237, 1240 (9th Cir. 1984). If the possible 

injury addressed by a regulation is death or serious physical harm, a violation of the regulation is 
26

serious. Mosser Construction, 23 BNA OSHC 1044 (No. 08-0631, 2010); Dec-Tam Corp., 15 

BNA OSHC 2072 (No. 88-0523, 1993). 

The fire that occurred at Respondent’s refinery illustrated the seriousness of this 

violation. Respondent failed to adequately verify that the VTB pump had been isolated. 

Notwithstanding Respondent’s investigation report findings, this failure can be attributed, in part, 

to the fact that Respondent’s employees were not provided with specific and detailed instructions 

to ensure that the system was de-energized. As a result of Respondent’s failure to adequately 

verify zero energy status had been achieved, a fire broke out in the crude unit, which resulted in 

approximately $320 million in damages. A fire of this (or any) magnitude has the potential to 

cause serious injuries, such as burns or death. Accordingly, the Court finds the violation was 

serious. 

VI. Penalty

In calculating appropriate penalties for affirmed violations, Section 17(j) of the Act 

requires the Commission give due consideration to four criteria: (1) the size of the employer’s 

business, (2) the gravity of the violation, (3) the good faith of the employer, and (4) the 

employer’s prior history of violations. Gravity is the primary consideration and is determined by 

the number of employees exposed, the duration of the exposure, the precautions taken against 

injury, and the likelihood of an actual injury. J.A. Jones Construction Co., 15 BNA OSHC 2201 

(No. 87-2059, 1993). It is well established that the Commission and its judges conduct de novo

penalty determinations and have full discretion to assess penalties based on the facts of each case 

and the applicable statutory criteria. Valdak Corp., 17 BNA OSHC 1135 (No. 93-0239, 1995); 

Allied Structural Steel, 2 BNA OSHC 1457 (No. 1681, 1975). 
27

Respondent is a large employer, with over 100 employees working at the Lemont 

Refinery. (Tr. 84). When the fire broke out, four Citgo employees and three Starcon employees 

were present in the crude unit. (Tr. 98). The fire resulted from Respondent’s failure to 

adequately verify isolation at the ten-inch bypass valve, an isolation Respondent had not 

sufficiently planned and documented. The fact that a fire occurred in this instance, coupled with 

the presence of seven workers in the area of combustion (four of them Respondent’s employees), 

is a strong indication that the likelihood of an actual injury was high. Further, to the extent that 

Respondent contends that it does not need to document isolation verification procedures (and, in 

fact, did not), its employees were exposed to a risk of serious injury each time the LOTO 

procedures were implemented. The Court finds that although Respondent’s LOTO program in 

general is quite thorough, the potential for injury under this set of facts was such that a penalty of 

$7,000.00 is appropriate. 

ORDER

The foregoing Decision constitutes the Findings of Fact and Conclusions of Law in 

accordance with Rule 52(a) of the Federal Rules of Civil Procedure. Based upon the foregoing 

Findings of Fact and Conclusions of Law, it is ORDERED that:

1. Citation 1, Item 1, and its associated penalty of $7,000.00, are AFFIRMED. 

2. Citation 1, Item 2, and its associated penalty of $7,000.00, are AFFIRMED. 

SO ORDERED

 /s/

 ____________________________ 

 Peggy S. Ball 

 Judge, OSHRC 

Date: March 9, 2016 

Denver, Colorado