U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD



# REGULATORY REPORT

R EPORT N O

. 2012-03-I-CA

JANUARY 2014 

# C HEVRON 

# R ICHMOND 

# R EFINERY



# P IPE 

# R UPTURE AND 

# F IRE

C HEVRON 

## R ICHMOND 

## R EFINERY 

## #4 C RUDE 

## U NIT

R ICHMOND

, C ALIFORNIA A UGUST 6, 2012Chevron Richmond Refinery Regulatory Report January 2014

2Chevron Richmond Refinery Regulatory Report January 2014

3 

## Table of Contents

Table of Contents ............................................................................................................. ............................. 3

Acronyms and Abbreviations .................................................................................................... ................... 5

1.0 Executive Summary ............................................................................................................. ............ 7

1.1 Incident Summary .............................................................................................................. .............. 7

1.2 Interim Report ................................................................................................................ .................. 7

1.3 Background .................................................................................................................... .................. 9

1.4 Key Findings .................................................................................................................. ................ 10

1.5 Regulatory Conclusions ........................................................................................................ ......... 12

1.6 Recommendations ............................................................................................................... ........... 13

2.0 Introduction .................................................................................................................. .................. 14

3.0 The Safety Case Regulatory Regime ............................................................................................. 21

3.1 Introduction .................................................................................................................. .................. 21

3.2 Initial Safety Case Implementation ............................................................................................ .... 22

3.2.1 United Kingdom ................................................................................................................ .... 22

3.2.1.1 Onshore ....................................................................................................................... ... 22

3.2.1.2 Offshore ...................................................................................................................... ... 25

3.2.2 Global Analysis of Safety Case Implementation .................................................................. 27

3.2.2.1 Australia ..................................................................................................................... ... 27

3.2.2.1.1 Offshore ................................................................................................................. 27

3.2.2.1.2 Onshore .................................................................................................................. 28

3.2.2.2 Norway ........................................................................................................................ .. 29

3.2.2.3 The United States........................................................................................................... 30

3.2.2 .3.1 OSHA PSM Standard ............................................................................................ 31

3.2.2.3.2 U.S. Environmental Protection Agency Risk Management Program .................... 33

3.2.2.3.3 Safety Case in the United States ............................................................................ 35

4.0 Key Features of an Effective Safe ty Case Regulatory Regime ...................................................... 37

4.1 Duty Holder Safety Responsibility, including a Written Case for Safety ...................................... 38

4.2 Continuous Risk Reduction to ALARP ......................................................................................... 40

4.3 Adaptability and Contin uous Improvement ................................................................................... 44

4.4 Active Workforce Participation ................................................................................................ ..... 53

4.5 Process Safety Indicators th at Drive Performance ......................................................................... 57Chevron Richmond Refinery Regulatory Report January 2014

4 4.6 Regulatory Assessment, Verifi cation, and Intervention ................................................................ 61

4.7 Independent, Competent, Well-Funded Regulator ........................................................................ 65

5.0 Oversight of Petroleum Refineries in California ........................................................................... 69

5.1 Cal/OSHA ...................................................................................................................... ................ 69

5.1.1 Background Information ....................................................................................................... 69

5.1.2 Analysis ...................................................................................................................... ........... 75

5.1.2.1 ALARP ......................................................................................................................... . 75

5.1.2.2 Adaptability and Contin uous Improvement ................................................................... 77

5.1.2.3 Process Safety Indicators ............................................................................................... 79

5.1.2.4 Inspections ................................................................................................................... .. 79

5.1.2.5 Workforce Participation ................................................................................................ 80

5.1.2.6 Funding and Regulator Competency ............................................................................. 82

5.2 U.S. Environmental Protection Agency ......................................................................................... 84

5.2.1 Risk Management Plan (RMP) Program ............................................................................... 84

5.2.2 Implementation of the RMP Program ................................................................................... 85

5.3 Unified Program ............................................................................................................... ............. 86

5.3.1.1 Contra Costa County Hazardous Materials Programs ................................................... 86

5.3.1.1.1 CalARP .................................................................................................................. 87

5.3.1.1.2 Industrial Safety Ordinance ................................................................................... 88

5.3.1.1.3 City of Richmond Industria l Safety Ordinance ..................................................... 89

5.3.1.2 Analysis ...................................................................................................................... ... 89

6.0 Conclusion .................................................................................................................... ................. 91

7.0 Reco mmendations ............................................................................................................... ........... 92

References .................................................................................................................... ............................... 95

Appendix A: Significant Petroleum Refinery Incidents in 2012 ............................................................... 9 8

Appendix B: Regulatory Comparison Table ...................................................................................... ...... 103

Appendix C: Frequently Asked Questions (FAQs) Re garding the Safety Case Regulatory Approach ... 106Chevron Richmond Refinery Regulatory Report January 2014

5 

## Acronyms and Abbreviations

ALARA As Low As Reasonably Achievable ALARP As Low As Reasonably Practicable ALJ Administrative Law Judge ANPRM Advance Notice of Proposed Rulemaking
APA Administrative Procedure Act
API American Petroleum Institute ASARP As Safe As Reasonably Practicable BSEE Bureau of Safety and Environmental Enforcement CA Competent Authority
CAA Clean Air Act
CAAA Clean Air Act Amendments
CalARP California Accidental Release Prevention Cal/EPA California Environmental Protection Agency
Cal/OSHA California Division of Occupational Safety and Health
CAPA California Administrative Procedure Act
CCHMP Contra Costa Health Serv ices’ Hazardous Materials Program CCPS Center for Chemical Process Safety CCR California Code of Regulations CERCLA Comprehensive Environmental Response, Compensation, and Liability
Act CFR Code of Federal Regulations Chevron ETC Chevron Energy Technology Company
CIMAH Control of Industria l Major Accident Hazards COMAH Control of Major Ac cidents Hazards Regulations CSB U.S. Chemical Safety and Hazard Investigation Board CSHO Compliance Safety and Health Officer CUPA Certified Unified Program Agency DIR California Department of Industrial Relations

DNV Det Norske Veritas 

### EA Environment Agency EPA U.S. Environmental Protection Agency FSA Formal Safety Assessment
FY Fiscal Year GAO U.S. Government Accountability Office HSC California Health and Safety Code HSE Health and Safety Executive HTHA High Temperature Hydrogen Attack ISO Industrial Safety OrdinanceChevron Richmond Refinery Regulatory Report January 2014

6 

### ISOM Isomerization LOHP Labor Occupa tional Health Program MOC Management of Change MOOC Management of Organizational Change NASA National Aeronautics and Space Administration NDU Naphtha Desulfurization Unit NEP National Emphasis Program NOHSC Australia National Occupati onal Health and Safety Commission
NOPSEMA Australian National Offshore Petroleum Safety and Environmental Management Authority NPRM Notice of Proposed Rulemaking
NRC U.S. Nuclear Re gulatory Commission OERI Operational Excellence and Reliability Intelligence OIG Office of Inspector General OMB Office of Management and Budget OSHA U.S. Occupational Safe ty and Health Administration OSHAct Occupational Safety and Health Act PHA Process Hazard Analysis PHMSA Department of Transportation, Pi peline and Hazardous Materials Safety
Administration PQV Program Quality Verification PSA Petroleum Safety Authority PSI Process Safety Information PSLA Petroleum Submerged Lands Act PSLG Process Safety Leadership Group PSM Process Safety Management QRA Quantitative Risk Assessment RAGAGEP Recognized and Generally A ccepted Good Engineering Practices RFI Request for Information RISC Risk-Informed Safety Case RISO City of Richmond Indus trial Safety Ordinance
RLOP Richmond Lube Oil Plant RMP Risk Management Plan
RP Recommended Practice SEPA Scottish Environmental Protection Agency SFAIRP So Far As Is Reasonably Practicable SOP Standard Operating Procedure UK United Kingdom
USCG U.S. Coast Guard
USW United Steelworkers UnionChevron Richmond Refinery Regulatory Report January 2014

7 

## 1.0 

## Executive Summary

1.1 Incident Summary

On August 6, 2012, the Chevron U.S.A. Inc. Refinery in Richmond, California, (“the Chevron Richmond Refinery”) experienced a catastrophic pipe failure in the #4 Crude Unit (“the crude unit”). The pipe, a 52- inch long carbon steel piping component of the #4 sidecut line, ruptured and released flammable, hydrocarbon process fluid, which partially vaporized into a large vapor cloud that engulfed 19 Chevron employees and ignited. All of the employees escaped, narrowly avoiding serious injury. The ignition of the flammable portion of the vapor cloud and subseq uent continued burning of the hydrocarbon process fluid resulted in a large plume of particulates and vapor traveling across the Richmond, California area. Approximately 15,000 people from the surrounding area sought medical treatment due to the release.



## 1.2 Interim Report

The CSB released an Interim Report on the Chevron inci dent in April 2013 (“the Interim Report”), which highlighted technical findings and safety system deficiencies. Testing conducted on the ruptured pipe determined that it had experienced extreme thinni ng near the rupture location due to sulfidation
corrosion. 1 Sulfidation corrosion is a damage mechan ism that causes thinning in iron-containing materials, such as steel, due to the reaction between sulfur compounds and iron at temperatures ranging
from 450 °F to 800 °F. 2 This damage mechanism 3 causes pipe walls to gradually thin over time, and is
common in crude oil distillation 4 where naturally occurring sulfur and sulfur compounds found in crude oil feed, such as hydrogen sulfide, 5 are available to react with steel piping and equipment. The Interim Report stated that virtually all crude oil feeds contain sulfur compounds and, as a result, sulfidation corrosion is a damage mechanism present at every refinery that processes crude oil. Sulfidation corrosion can cause thinning to the point of pipe failure when not properly monitored and controlled.

The Interim Report noted a number of causal safety sy stem deficiencies that highlight regulatory gaps relating to major accident prevention at California petr oleum refineries. For example, in conducting its process hazard analysis 6 (PHA) of the crude unit, which was required under California’s Process Safety

1 With respect to the sulfidation corrosion damage mechan ism that caused the Chevron in cident, carbon steel piping corrodes at a rate that is significantly faster than other materials of construction, such as high chromium steels, including stainless steel.

2 For an electronic copy of the CSB Chevron Interim Report see http://www.csb.gov/assets/1/19/Chevro n_Interim_Report_Final_2013-04-17.pdf (accessed October 24. 2013).

3 Piping damage mechanisms are any type of deterioration encountered in the refining and chemical process industry that can result in flaws/defects that can affect the integrity of piping (e.g. corrosion, cracking, erosion, dents, and other mechanical, physical or chemical impacts). See API 570. "Piping Inspection Code: In-Service Inspection, Rating, Repair, and Alteration of Piping Systems." 3 rd ed., Section 3.1.1.5, November 2009.

4 Distillation separates mixtures into broad categories of its components by heating the mixture in a distillation column where different products boil off and are recovered at different temperatures. See http://www.eia.gov/todayinenergy/detail.cfm?id=6970 (accessed April 4, 2013).

5 Hydrogen sulfide is the most aggressive sulfur compound that causes sulfidation corrosion.

6 A process hazard analysis (PHA) is a hazard evaluation to identify, evaluate, and control the hazards of a process. Facilities that process a threshold quan tity of hazardous materials, such as the Chevron Richmond refinery, are required to conduct a process hazard analysis per the Calif ornia Code of Regulations Title 8 Section 5189, ProcessChevron Richmond Refinery Regulatory Report January 2014

8 Management (PSM) standard, 7 Chevron did not conduct a rigorous review of corrosion and damage mechanisms present in the crude unit, and did not id entify sulfidation corrosion as a hazard. As such, Chevron did not effectively address inherent safety 8 or implement effective controls to prevent sulfidation corrosion, including those controls proposed by Chevron’s technical group. Although both the California and federal PSM standards require that hazards be identified, evaluated, and controlled, there is no further discussion of how far to reduce risks, and there is no requirement to address the effectiveness of controls or to use the hierarchy of controls. 9 Therefore, this type of analysis was not required to be conducted, and Chevron was never cited post-incident for failing to evaluate the effectiveness of safeguards.

In another example, despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction through th e Management of Change (MOC) process, incident investigations, techni cal reports, and employee recommendations, Chevron repeatedly failed to implement those proposed r ecommendations. Chevron’s 2006 MOC analysis limited application of those recommendations to only a small sec tion of the pipe. As a result, the portion of the pipe that failed on the August 6 th incident remained in service until the incident. As there is no requirement to implement effective recommendations or control hazards under the MOC element, it is essentially an activity-based requirement. Chevron w as not cited for narrowing the scope of the MOC, despite its disregard of internal recommendations. Th e CSB concluded in its Interim Report that Chevron did not regularly or rigorously apply inherently safer technology, which provides an opportunity for preventing major accidents, in its PHAs, MOCs, incident investigation recommendations, or during
turnarounds.

The CSB made safety recommendations in the Inte rim Report to a number of entities, including the California State Legislature, the U.S. Environmental Protection Agency, and Contra Costa County. The Board recommended that the California State Legisl ature require California petroleum refineries to perform damage mechanism hazard reviews, to id entify and report leading and lagging process safety indicators, to document recognized methodologies, rationale, and conclusions used to claim that safeguards intended to control hazards will be effective, and to document their inherently safer systems analysis and the hierarchy of controls in establis hing safeguards for process hazards, with the goal of driving risk of major accidents to as low as reas onably practicable, or ALARP. These concepts, introduced in the Interim Report and highlighted in the recommendations, are the basic building blocks for the implementation of the safety case regime, a regul atory scheme that will be discussed in great detail in the following report.

The CSB concluded its Interim Report by highli ghting additional issues that were still under investigation, including emergency planning and re porting, emergency response, safety culture, and regulatory oversight of petroleum refineries in Calif ornia. The following report fulfills the CSB’s

Safety Management of Acutel y Hazardous Materials (1992). PHAs are also required by the California Accidental Release Prevention Program and the federal EPA Risk Management Program.

7 Under 8 CCR §5189 (e). https://www.dir.ca. gov/title8/5189.html (accessed September 25, 2013).

8 According to the Center for Chemical Process Safety (CCPS), “inherently safer design solutions eliminate or mitigate the hazard by using materials na d process conditions that are less hazar dous.” Center fo r Chemical Process Safety (CCPS). Inherently Safer Chemical Processs – A Life Cycle Approach. 2 nd ed., Section 5.1.1, 2009.

9 An effectiveness ranking of techniques used to control hazards and the risk they represent can be described as a hierarchy of controls. The further up the hierarchy, the more effective the risk reduction achieved.Chevron Richmond Refinery Regulatory Report January 2014

9 commitment to examine whether the implementation of the safety case regulatory regime could be a more effective regulatory tool to achieve major accident prevention for California petroleum refineries. The reader will find additional issues, arguments, and counterarguments regarding the safety case regulatory regime addressed in Appendix C of this report.



## 1.3 Background

Although both the federal and Californi a PSM standards, respectively, were intended to be goal-setting or performance-based, 10,11 in practice they appear to function primarily as reactive and activity-based 12 regulatory schemes that require extensive rulemaking to modify. As a result, the federal and California
PSM standards have become static in the face of advancing best practices and technology, with the emphasis placed on the completion of a task or activity rather than achievement of continuous risk
reduction. 13 Many regions around the world such as the United Kingdom (UK), Australia, and Norway have acknowledged similar deficien cies and have implemented regula tory regimes consisting of both prescriptive 14 and goal-setting elements that require duty holders 15 to demonstrate to the regulator through rigorous reviews and audits that they have reduced risks to as low as reasonably practicable, or ALARP. This is referred to as the safety case regulatory regime. 16 The safety case regulatory regime is a rigorous prescriptive and goal-setting regulatory approach appl ied globally both onshore and offshore. It is highlighted by its adaptability and requirements for continuous improvement in risk reduction for high hazard industrial facilities. A written case for safety, known as the safety case report, is generated by the duty holder and is generally rigorously reviewed, aud ited, and enforced by highly technically competent inspectors with skill sets familiar to those employed by the industries they oversee. Despite this global shift, the US has persisted in the use of a more ac tivity-based regulatory scheme that lacks the ability to adapt to advancing technology and recently develo ped industry standards, and which has failed to adequately engage companies and their employees in continuous improvement and risk reduction with similarly-skilled inspectors.

10 Also referred to as performance-based regulations, goal-setting regulatory requi rements and acceptance criteria are specified and industry must docume nt that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels.

11 See Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section III. Summary and Explanation of the Final Rule (March 4, 1992). https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed August 13, 2013).

12 Activity-based standards and regulations require the me re completion of an activity and do not focus on the effectiveness of major accident pr evention or risk reduction.

13 As will be discussed below, certain sections of th e PSM standard have elements of a performance-based regulatory approach.

14 A prescriptive regulation or standard describes the specific means or ac tivity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective.

15 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include op erators, contractors, and subcontractors. http://www.hse.gov.uk/offs hore/guidance/entrants.pdf (accessed June 5, 2013).

16 Norway’s offshore regulatory regime is not referred to as the safety case regime, but it does contain many of the same elements as the safety case regime, with some di fferences in style, substances, and implementation.Chevron Richmond Refinery Regulatory Report January 2014

10 

## 1.4 Key Findings

Technical

1. In the ten years prior to the incident, highly knowledgeable and experienced Chevron technical staff repeatedly recommended that inspectors perform 100 percent component inspections on high temperature carbon steel piping susceptible to sulfidation corrosi on. These recommendations were not implemented by Chevron management. 17

2. Chevron technical staff recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past recommendations from employees. However, Chevron failed to implement proposed inherently saf er recommendations prior to the incident. For example, an inspection recommendation to upgrade piping to 9-Chrome was made, but the MOC to implement the recommendation narrowed the scope, allo wing the 52-inch component that failed to remain
in service.

3. In January 2007, a failure due to sulfidation corrosion caused a fire in the Chevron Richmond Refinery crude unit, initiating a shelter-in-place for the surrounding community. A carbon steel piping spool 18 failed catastrophically during operation. Chevron informed Contra Costa Health Services’ Hazardous Materials Program 19 in a letter that the crude unit pi ping metallurgy had been upgraded following this incident as an inherently safer soluti on. However, this upgrade was limited to only the immediate piping spool that had failed. The inherent ly safer, more corrosion resistant metallurgy was not implemented more broadly in the crude unit as a result of this incident.

4. Chevron and Chevron Energy Technology Comp any metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion . However, they had limited practical influence to implement their recommendations. They did not partic ipate in the most recent crude unit PHA, and they did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround

process. 20

5. The 2009 crude unit PHA did not identify corrosion as a potential cause of a leak or rupture in piping. The PHA cited non-specific, judgment-based qualitativ e safeguards to reduce risk, such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances. 21 The effectiveness of these safeguards was neither evaluated nor

17 These recommendations are discussed in detail in paragraphs 44 through 51 of the Chevron Interim Report.

18 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits.

19 Contra Costa Health Services’ Hazar dous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013).

20 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown.

21 Corrosion allowance refers to extra wall thickness added as a safety factor to the de sign of a piece of equipment beyond that needed solely for mechani cal considerations such as design te mperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment.Chevron Richmond Refinery Regulatory Report January 2014

11 documented; instead the safeguards were merely listed in the PHA. Had the adequacy of these safeguards been verified, improved safeguards intended to protect against sulfidation-induced failure of carbon steel piping could have been recommended.



## Regulatory

6. Following the August 6 th incident, California’s Division of Occupational Safety and Health (Cal/OSHA) inspected the Chevron f acility and issued citations. Only one citation was related to PHAs; and it was not associated with evaluating the effectiv eness of safeguards. Rather, the emphasis was that Chevron’s PHA did not adequately account for hazards caused by other units associated with the crude unit. Had the California PSM standard required documentation of the effectiveness of safeguards, Chevron would have been obligated to conduct this analysis.

7. There is a significant discrepancy in the co mpensation between the California regulators and the Chevron Richmond Refinery personnel they interact with. The California regulators also lack the technical staff with the necessary skills, knowledge, and experience to provide sufficient direct oversight of petroleum refineries in California.

8. The CSB has examined records that demonstrat e a considerable problem with significant and deadly incidents at petroleum refineries over the last decade. The EPA has noted 234 recordable accidents at petroleum refineries between 2000 and 2010. This is more than any other industry despite the fact that the nation’s petroleum refineries make up only roughl y one percent of the some 13,000 facilities covered by the EPA’s Risk Management Program. In 2007, OSHA stated that according to its IMIS (Integrated Management Information System) database, sin ce May 1992, 36 fatality/catastrophe (FAT/CAT)
incidents related to HHC releases in the refini ng industry occurred. These incidents included 52 employee deaths and 250 employee injuries, 98 of th ese injuries required hospitalization. This number surpassed the combined total of the next three highest industries over the same period. In 2010, an OSHA official testified to a Congressional Subcommittee th at over 20 major incidents resulting in injuries or fatalities across the country occurred between 2005 and 2010, including the Tesoro Anacortes explosion and fire in Washington. These incidents all repeated a lesson that should have already been learned by the industry. Finally, in 2012 alone, the CSB tr acked 125 significant process safety incidents at US petroleum refineries. Seventeen of these took place in California.

9. Under the existing regulatory regimes for onshore petroleum refineries in the US and California, such as the PSM and RMP programs, there is no requirement to reduce risks to ALARP. For example, under both PSM and RMP an employer must “control” hazards when conducting a process hazard analysis (PHA) of a covered process. However, there is no requirement to address the effectiveness of the controls or the hierarchy of controls. Thus, a PHA that meets the regulatory requirements may inadequately identify or mitigate major hazard risk. In addition, there is no requirement to submit PHAs to the regulator, and the regulator is not responsible fo r assessing the quality of the PHA or the proposed safeguards.Chevron Richmond Refinery Regulatory Report January 2014

12 10. The PSM standard does not effectively establish goa ls to prevent accidents or reduce risk. Only two of the 14 elements (PHA and mechanical integrit y) of the PSM standard contain some goal-setting
component.

11. In the last decade, the CSB has made a num ber of process-safety related recommendations to OSHA and EPA in its investigation repor ts and studies (e.g. Motiva, BP Texas City, and Reactive Hazards). However, none of the regulatory recommendations ha ve been implemented, and there have been no substantive changes made to the PSM and RMP regulati ons to improve the prevention of major accidents.

12. Available data from Norway and the Unite d Kingdom (UK) shows a reduction in hydrocarbon releases offshore under the safety case regulatory regime. 22

13. Regulatory approaches similar to the safety case re gulatory regime, which requi re risk reduction to ALARP or equivalent, have been implemented in the nuclear sector by the Nuclear Regulatory Commission (NRC) and the aerospace sector by NASA.

14. Independent studies of the safety case regulatory regime in the UK have identified improvements to safety performance from the safety case and a variety of stakeholders, including major oil companies, have shown support of the safety case. 23



## 1.5 Regulatory Conclusions

The existing regulatory regimes for onshore petroleum refineries in the US and California:

1. Rely on a safety and environmental management system framework that is primarily activity-based rather than requiring goal-based risk reduction to as low as reasonably practicable (ALARP) or equivalent.

2. Are static, unable to adapt to innovation and ad vances in the management of major hazard risks.

3. Do not require that companies effectively manage the risks they create; nor do they require regulator evaluation of the effectiveness of safeguards or regul ator acceptance of companies’ plans for controlling
those risks.

4. Do not ensure continuous improvement by e ffectively incorporating lessons learned from major accidents; nor do they require companies to address newly-identified safety issues as a result of such
incidents.

5. Do not effectively collect or promote industry use of major accident performance indicators to drive industry to reduce risks to ALARP.

22 Norway’s indicator data is discussed in Section 4.5. The UK data is discussed in Appendix C.

23 See Sections 2.0, 3.2.1.2, and 3.2.2.3. Also see FAQ 4.Chevron Richmond Refinery Regulatory Report January 2014

13 6. Do not require the use or implementation of inhere ntly safer systems analysis or hierarchy of controls.

7. Do not effectively involve the workforce in risk reduction and prevention of major accidents.

8. Do not provide the regulator w ith the authority to accept or reject a company’s hazard analysis, risk assessment, or proposed safeguards; and

9. Do not employ the requisite number of staff w ith the technical skills, knowledge, and experience to provide sufficient direct safety oversight of petroleum refineries.



## 1.6 Recommendations

As a result of the findings and conclusions of th is report, the CSB makes recommendations, summarized below, to the following recipients:



## California State Legislature,
Governor of California

Develop and implement a step-by-step plan to establish a more rigorous safety management regulatory framework for petroleum refineries in the state of California based on the principles of the “safety case”
framework.



## ____________________________________________

The Chemical Facility Safety and Security Workin g Group and the Occupational Safety and Health Administration

As part of your response to Executive Order 13650, de velop questions and evaluate issues raised from the findings and conclusions in this report concerning the safety case regime.

_________________________________________________________________

Section 7.0 details the recommendations.Chevron Richmond Refinery Regulatory Report January 2014

14 

## 2.0 

## Introduction

Despite the fact that the nation’s roughly 150 petroleum refineries represent only a small fraction of the
thousands of industrial and chemical facilities that ex ist in the US, the CSB has seen a great number of serious and deadly incidents at refineries over the last decade.

In March 2005, the BP Texas City Refinery suffere d one of the worst industrial accidents in recent US history, when overfill of a distillation column resulted in an explosion and fire that led to 15 fatalities, another 180 injuries, and the issuance of a shelter-i n-place order that required 43,000 people to remain indoors. Houses were damaged as far as three-quarter s of a mile away from the refinery. In a 2006 statement, former CSB Chairwoman Carolyn Merr itt said that while BP did make some safety improvements before the March 2005 explosion, “the focus of many of these initiatives was on improving procedural compliance and reducing occupational injury rates, while catastrophic safety risks
remained....” 24

In November 2009, an explosion at the Silver Ea gle Refinery damaged over 100 homes in a nearby subdivision in Woods Cross, Utah. At a public me eting to discuss the incident, former CSB Chairman John Bresland called on refineries to impr ove their safety performance, stating:

The frequency of accidents in US refineries is very troubling. These accidents cost lives, inflict serious injuries and can harm communities. They also earn scrutiny from government regulators; in the past few weeks a refinery in Texas drew the largest OSHA fine in history, more than US $80 million, for alleged proc ess safety violations. I call on all refineries to redouble their commitment to safer operations and safer
communities. The current rate of accidents in refineries is not sustainable and it is not acceptable. 25

On the five-year anniversary of the BP Texas City explosion in March 2010, Chairman Bresland continued to relay his concern regarding refinery safety, noting that “refinery accidents...continue to occur with dismaying frequency...[and] will only stop when every refinery has made the financial and human commitment to sound process safety management.” 26 Yet just ten days later, seven workers were fatally injured at the Tesoro refinery in Anacortes, Washington, following the catastrophic failure of a heat exchanger. Again, Chairman Bresland pointed out the alarming frequency of refinery incidents, stating that “if the aviation industry had the same num ber and types of incidents as the refining industry, I don’t think people would be flying too much.” 27

24 Scrutiny Finds BP Safety Troubles. http://usatoday30.usatoday.com/mone y/industries/energy/2006-10-30-bpblast-findings_x.htm (accessed September 5, 2013).

25 US Refineries Commitment to Safety Called Into Question. http://www.engineerlive.com/content/22354 (accessed September 5, 2013).

26 http://www.csb.gov/statement-from-csb-chairman-john-bresland-on-5th-anniversary-of -fatal-bp-texas-city-2005- explosion/?pg=18 (accessed September 5, 2013).

27 Refinery Tragedies All Too Common. See http://seattletimes.com/html/localne ws/2011518449_safetysunday04m.html (accessed September 5, 2013)Chevron Richmond Refinery Regulatory Report January 2014

15 On June 10, 2010, OSHA Deputy Assistant Secretary Jo rdan Barab testified before the Senate Committee on Health, Education, Labor a nd Pensions’ Subcommittee on Employment and Workplace Safety regarding worker safety in US energy production industries. Mr. Barab noted that OSHA had counted over 20 major incidents resulting in injuries or fataliti es across the country that had occurred within the last five years, including the Tesoro Anacortes explosion and fire in Washington. These incidents all repeated a lesson that should have already been learned by the industry. 28 According to Mr. Barab, “[t]his cycle of workers being hurt or killed because thei r employers failed to implement well-known safety measures points out major deficiencies in chemical pr ocess safety management in the nation’s refineries and, quite possibly, to systemic safety and health problems in the entire petrochemical industry.” 29

According to OSHA’s compliance instruction document CPL-03-00-004 30 on the OSHA Petroleum Process Safety Management National Emphasi s Program (NEP) issued in 2007,

Since the PSM standard was promulgated by OSHA in 1992, no other industry sector has had as many fatal or catastrophic incidents related to the release of HHC [highly hazardous chemicals] as the petroleum refining industry []. According to OSHA's IMIS [Integrated Management Information System] database, since May 1992, 36 fatality/catastrophe (FAT/CAT) incidents related to HHC releases in the refining industry have occurred. These incidents included 52 employee deaths and 250 employee injuries, 98 of these injuries required hospitalization. The number of refinery FAT/CAT incidents surpasses the combined total of the next three highest industries over the same period (SIC 2899 Chemical Manufacturing, Not Elsewhere Classified (NEC) – 12 FAT/CATs; SIC 2869 Industrial Organic Chemical Manufacturing, NEC – 12 FAT/CATs; and SIC 2892 Explosive Manufacturing – 11 FAT/CATs). 31

In 2012 alone, the CSB tracked 125 significant 32 process safety incidents at US petroleum refineries, which are listed in Appendix A. Seventeen of th ese took place in California, including a major release of 8,614 pounds of highly toxic hydrogen sulfide at the Chevron Richmond Refinery on August 2, 2012, just four days prior to the incident.

Of the 15 major accidents that the CSB is currently in vestigating, six occurred in petroleum refineries. These include two separate explosions at the Silver Ea gle refinery in Woods Cross, Utah, which resulted in injuries and offsite consequences, the heat exchanger rupture at th e Tesoro refinery in Anacortes, Washington, which resulted in seven fatalities, and a series of equipment failures at CITGO’s refinery in

28 Jordan Barab’s Congressional testimony is available at http://www.dol.gov/ocia/congressi onaltestimony/20100610_JBarab.htm (accessed January 7, 2014).

29 Ibid.

30 OSHA Instruction CPL 03-00-004. Petroleum Refinery Process Safety Management National Emphasis Program. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show _document?p_table=DIRECTIVES&p_id=3589#VIII (accessed January 7, 2014).

31 Ibid at Section VIII.

32 These incidents were reported to the Department of Energy and/or the National Response Center and examined by the CSB’s Incident Screening Department. The CSB believes that incidents that result in disruptions to the national energy supply, serious injuries, or receive hi gh media attention are all significant.Chevron Richmond Refinery Regulatory Report January 2014

16 Corpus Christi, Texas, involving highly toxic hydr ogen fluoride. The U.S. Environmental Protection Agency (EPA) has also documented 234 recordable ac cidents at petroleum refineries between 2000 and 2010. Despite the fact that the nation’s petroleum refineries make up only roughly one percent of the some 13,000 facilities covered by the EPA’s Risk Management Program, they accounted for more incidents in that time period than any other industry, including the much larger sector of chemical manufacturing, which EPA documented as having 218 recordable accidents. 33

The CSB concludes that the continui ng occurrence of refinery accidents demonstrates the pressing need to examine the current regulatory structure in place in the US and, in light of the Chevron incident, in the state of California for petroleum refineries. There have been a number of positive developments in the
wake of the Chevron incident that demonstrate Ca lifornia’s prime opportunity to lead the nation in implementing changes to improve safety and health in the refining industry. In the Fall of 2012 following the Chevron incident, California Governor Jerry Brown created the California Interagency Working Group on Refinery Safety (“the working group”), charged with improving cooperation among agencies, including the EPA, Cal EPA, California’s Division of Occupational Safety and Health (Cal/OSHA), and Contra Costa County, with the goal of improving safety at California’s petroleum refineries and preventing major accidents.

The working group began its initiative by commissi oning the Labor Occupational Health Program 34 (LOHP) to conduct “listening panels” throughout Califo rnia, enabling community members to meet with working group members to discuss their concerns surrounding refineries. LOHP convened a series of meetings and conference calls with labor unions, community-based organizations, fire agencies, and environmental health groups between November 6, 2012, and March 18, 2013. Dr. Michael P. Wilson, the former Director of LOHP, 35 documented his findings and recommendations regarding refinery safety in a summary report entitled Refinery Safety in California: Labo r, Community and Fire Agency Views

, which was released on June 4, 2013. 36 In the report, Dr. Wilson quoted Swiss Re’s finding that the US has experienced financial losses from refinery incidents that are three times that of industry counterparts in countries within the “EU cluster,” 37 a gap which continues to grow due in part to the US refining industry’s “pushing...mode of operation”, its “comp liance-driven focus on safety”, and “a ‘detached’
workforce....” 38

33 Matthiessen, Craig. EPA Risk Management Program: An Overview of the EPA Risk Management Program and Inherently Safer Processes. NAS-MIC Bayer Public Meeting Power Point Presentation; May 24, 2011; p 20.

34 LOHP is a public service program for the Center for Occupational and Environmental Health at UC Berkeley’s School of Public Health. LOHP seeks “to reduce occupational injury, illness and death by protecting the health and safety of workers worldwide.” For more information, see http://www.lohp.org/ (accessed July 8, 2013).

35 Dr. Wilson now serves as Chief Scientist in the Offi ce of the Director, California Department of Industrial Relations (DIR). DIR oversees state programs dedicated to protecting the health, safe ty, and economic security of California’s workers.

36 Dr. Wilson released an initial draft of the summary report on March 27, 2013. He then released a revised copy of the summary report on June 4, 2013. See http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013).

37 The countries in the EU cluster are all of Europe, Singap ore, South Korea, Japan, Saudi Arabia, Gulf States and Egypt.

38 Wilson, Michael P. Refinery Safety in California: Labor, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interagency Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013; pp 5 and 6. Citing Zirngast, Ernst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the World, History of Selective U/W, Cause of Losses. Technical report-DRAFT-Chevron Richmond Refinery Regulatory Report January 2014

17 Dr. Wilson reiterated a number of the findings cont ained in the CSB’s Interim Report on the Chevron incident, including the “striking lack of attention on the part of the Richmond Chevron refinery to maintenance and metallurgy upgrades...,” and the Chevron Richmond Refinery’s failure to implement a recommended 100% component inspection program for high -risk piping. He also stated that California’s refineries are able to operate without demonstrating competence in health, safety, and environmental performance to a regulatory agency or to the public, and as such recommended that California establish a regulatory approach similar to that of the safety case regulatory regime, a rigorous prescriptive 39 and goalsetting 40 regulatory regime used widely by other regions throughout the world such as the United Kingdom (UK) and Australia to regulate high hazard industrial facilities. It is highlighted by its adaptability and requirements for c ontinuous improvements in risk reduction, places the duty on industry to demonstrate its competence in health and safety to the regulator. The regime is overseen by highly competent, well-funded regulators that rigorously audit facilities for compliance with the written safety case report and good industry practice.

On July 11, 2013, the working group released a draft report entitled Improving Public and Worker Safety at Oil Refineries

, 41 which the CSB has recognized as an important step forward in improving petroleum refinery safety and environmental performance both in California and nationally. The report outlined the process of adopting several of the CSB‘s recommendations from its Interim Report on the Chevron incident, including requiring refineries to implem ent inherently safer systems and conduct damage mechanism hazard reviews. Furthermore, the report announced the creation of an Interagency Refinery Task Force within the California Environmental Protection Agency (Cal/EPA) by September 1, 2013, aimed at facilitating information sharing and im proving coordination of oversight and enforcement activities among regulatory agencies. The CSB welcom ed the report’s recommendation for California to study the safety case regulatory approach.

In addition to the work being done by the worki ng group, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Department of Industrial Relations to charge state petroleum refineries a “fee” by March 31, 2014, to help pay for at least 15 new positions in Cal/OSHA’s Process Safety Unit, which enforces th e California Process Safety Management (PSM) standard throughout the state. 42

The Chevron incident also spurred the formation of the City of Richmond’s Refinery Action Collaborative (“the collaborative”), which was launche d on January 30, 2013. The collaborative, whose

EXTRACT. Risk Engineering Services, Swiss Re. http://coeh.berkeley.edu/people/apers_educ/docs/LOHPRefinery%20Safety.pdf (accessed December 30, 2013).

39 A prescriptive regulation or standard describes the specific means or ac tivity-based actions to be taken for hazard abatement and compliance. Performance or goal-based regulations, on the other hand, state the objective to be obtained (such as risk reduction or hazard abatement) without describing the specific means of obtaining that objective.

40 Also referred to as performance-based regulations, goal-setting regulatory requi rements and acceptance criteria are specified and industry must docume nt that their specific solutions meet such requirements, e.g. in terms of acceptable risk levels.

41 See http://www.calepa.ca.gov/Publicati ons/Reports/2013/Refineries.PDF (accessed September 25, 2013).

42 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013).Chevron Richmond Refinery Regulatory Report January 2014

18 members include the United Steelworkers 43 (USW) Local 5, the USW International, Communities for a Better Environment, 44 and LOHP, 45 was launched after a preliminary e xploratory meeting held in October 2012. The collaborative advocates for community and worker safety, better transparency, and environmental health, and has already made recomme ndations to the working group to improve emissions reporting and require more thorough assessments of pipe corrosion damage at oil refineries. 46

On October 10, 2013, the collaborative formally responded in a memo to the July 2013 draft report issued by the Interagency Working Group on Refinery Safety ( Improving Public and Worker Safety at Oil Refineries ). In the memo, the collaborative stated its support for the working group’s findings and recommendations. The collaborative also issued its own recommendations and highlighted 12 principles as being important to the development of effectiv e regulatory policy in California. These principles include linking regulatory non-compliance to an operato r’s license to operate and integrating meaningful participation in decision-making by workers and communities. 47 The collaborative also noted in the memo that it supported “shifting the ‘burden of proof’ of safety from public agencies to the industry, as is required in the ‘Safety Case’ approach....” 48

The CSB noted in its Chevron Interim Report the import ant role of transparency between industry and the public in improving health and safety for the fac ility and the surrounding communities. Following the Chevron incident the collaborative, worker representa tives, regulators, and governmental bodies played a key role in driving transparency, accountability, a nd improved risk reduction during the decision-making process related to crude unit piping repairs. The CSB recommended to the California State Legislature in the Interim Report to establish a multi-agency pro cess safety regulatory program for all California petroleum refineries to further improve public accountab ility and transparency by establishing a system to report to the regulator methodologies, findings, conc lusions, and corrective actions related to refinery mechanical integrity inspection and repair work arising from California petroleum refinery PHAs, turnarounds, and maintena nce-related shutdowns. 49 This system would require reporting of information such as damage mechanism hazard reviews, establis h procedures for greater workforce and public participation, and provide mechanis ms for federal, state, and local agency operational coordination,

43 The USW is the largest industrial union in North Amer ica and has approximately 1.2 million active and retired members in the US, Canada, and the Caribbean. For more information see http://www.usw.org/ (accessed July 17, 2013).

44 Communities for a Better Environment is an “environmental justice organization[s]” in California which has the mission of “build[ing] people’s power in California’s comm unities of color and low income communities to achieve environmental health and justice by preventing and reducing pollution and building green, health and sustainable communities and environments.” See http://www.cbecal .org/about/mission-vision/ (accessed August 14, 2013).

45 Other members of the collaborative include the Bl ueGreen Alliance (a coalition of labor unions and environmental groups that advocate for a green economy and safer workpl aces), the National Resources Defense Council, and the Asian Pacific Environmental Network.

46 See http://richmondconfidential.org/2013/ 02/20/labor-and-environmental-groups -join-forces-on -refinery-issues/ (accessed July 9, 2013).

47 Refinery Action Collaborative. Initial Response of the Collaborative to the Findings & Recommendations of The July 2013 Draft Report of the Interagency Working Group on Refinery Safety, Governor Jerry Brown. October 10, 2013; p 10.

48 Ibid at 7.

49 Under the existing federal and California state PSM standa rds, this information is not currently made publicly available.Chevron Richmond Refinery Regulatory Report January 2014

19 sharing of data, and joint accident prevention activities. California is actively working to implement this recommendation through the creation of the Interage ncy Refinery Task Force mentioned above.

The positive and productive developmen ts that have taken place in the wake of the Chevron incident strongly suggest that California has a unique opportunity to implement changes to improve safety and health in the refining industry that can serve as a model to the rest of the country.

It is also important to note that a growing dial ogue has emerged throughout the US surrounding the need to improve the regulation of hazardous materials and processes, to which the CSB has been an important contributor. The CSB first examined the safety case in its 2002 investigation report entitled Improving Reactive Hazard Management 50 as a potentially effective alternativ e framework for the regulation of reactive hazards. The CSB noted that successful implementation of this “comprehensive” regulatory approach required a competent and experienced regulator. In December 2010, the CSB held a public hearing in Washington, DC on the Regulatory A pproaches to Offshore Oil and Gas Safety, where internationally recognized experts in industrial safet y and accident analysis provided important testimony on managing risks offshore. 51 Much of this testimony supported the implementation of the safety case as a model for regulating major hazards, both onshore and off. For example, a Shell Oil Company representative testified that the company had been using the safety case globally since 2002, and noted that the most valuable aspect of that type of regul atory regime was the need to demonstrate that major hazards have been managed using effective barriers 52 and controls. In July 2012, the CSB held an additional public hearing on Safety Performance Indicators. 53 A number of international regulators testified on the regulator’s ability under the safety case to drive continuous improvement in the oil and gas industry. Finally, on July 25, 2013, the CSB held a public meeting to discuss the U.S. Occupational Safety and Health Administration’s (OSHA’s) fa ilure to implement a number of key CSB safety recommendations made to OSHA in the last decade to revise and improve its Process Safety Management (PSM) standard and to issue a new combustible dust standard.

On January 18, 2011, President Obama issued Executive Order 13563, 54 which called for improvements in the nation’s regulatory system to promote predic tability and reduce uncertain ty and to use the best, most innovative, and least burdensome tools for achieving regulatory ends. Specifically, it directed that agencies review existing and proposed standards and regul ations to ensure they effectively protect “public health, welfare, safety, and our environmen t while promoting economic growth, innovation, competitiveness, and job creation.” 55 Finally, the order emphasized that to the extent feasible, regulations

50 A full copy of the report is available at http://www.csb.gov/improving-reactive-hazard-management/ (accessed July 10, 2013).

51 For a copy of the transcript from th e CSB Public Hearing on the Regulatory Approaches to Offshore Oil and Gas Safety, see http://www.csb.gov/assets/1/19/Transcript_of_Public_Meeting_12_15_2010.pdf (accessed August 14, 2013).

52 A barrier is a “technical, operational and/or organizational element[] which individually or collectively reduce[s] opportunities for specific error, hazard or accident to occur, or which limit s its harm/drawbacks.” Petroleum Safety Authority. Safety Status & Signals, 2012-2012; 2013; p 31.

53 For the proceedings of the CSB Public Hearing on Safety Performance Indicators see http://www.csb.gov/events/csb-public-hear ing-safety-performance-indicators/ (accessed August 14, 2013).

54 Improving Regulation and Regulatory Review. Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.archives.gov/federal-regi ster/executive-orders/2011.html (accessed July 10, 2013).

55 Ibid.Chevron Richmond Refinery Regulatory Report January 2014

20 and standards should specify performance objectives ra ther than the behavior or manner of compliance that regulated entities must adopt, and be adopted thr ough a process that involves public participation. As a result of this Executive Order, OSHA, the Bureau of Safety and Environmental Enforcement (BSEE), the EPA, the Department of Transportation’s Pipe line and Hazardous Materials Safety Administration (PHMSA), and the U.S. Coast Guard (USCG) solicite d views from the public and stakeholders regarding opportunities to address improving efficiency and eff ectiveness of safety and environmental regulations and standards in the oil and gas industry. 56 These five agencies then convened an expert forum 57 in September 2012 in Texas City, Texas, to explore the benefits of implementing goal or performance-based regulatory models such as the safety case in the oil and gas industry, and ways to advance the use of such models in the US. The forum included a discussion of the safety case regulatory regime as a performance-based regulatory model, and industrial safety and accident analysis expert Dr. Andrew Hopkins spoke in support of that model.

In the wake of the April 2013 explosion and fire th at occurred at a fertilizer storage and distribution facility in West, Texas, and resulted in fifteen fata lities and hundreds of injuries, President Obama issued
Executive Order 13650 58 on August 1, 2013. The Executive Order established the Chemical Facility Safety and Security Working Group, a working group of federal agencies 59 tasked with, among other things, developing options for enha ncing and modernizing policies, regul ations, and standards to improve the safety and security of chemical facilities. 60 As will be discussed in Sec tion 4.3, the group has included the safety case regulatory model in a list of potential actions it may consider taking to improve chemical safety regulation. 61

The CSB has utilized a broad range of expert t estimony and research to gain a comprehensive understanding of regulatory models for onshore and offshore oil and gas facilities in countries around the world, and, in light of this investigation, the state of California. This report highlights the significant attributes of the safety case regime that together result in a more effective regulatory approach to process safety and risk reduction. It also provides a detaile d contrast of the safety case regulatory model to the existing regulatory structures in the US and Ca lifornia, and makes recommendations to improve California’s regulatory oversight of its petroleum refi neries and to promote a broader national dialogue on the safety case regulatory approach.

56 For more information see https://www.osha.gov/pls/oshaweb/owadisp.show_d ocument?p_table=FEDERAL_REGISTER&p_id=23267 (accessed July 10, 2013).

57 See https://www.osha.gov/pls/oshaweb /owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=23267 (accessed August 13, 2013).

58 Improving Chemical Facility Safety and Security. Exec. Order No. 13650, 78 Fed. Reg. 48029 (August 1, 2013). https://www.federalregister .gov/articles/2013/08/07/2013-19220/improv ing-chemical-facility-safety-and-security (accessed January 7, 2014).

59 The working group includes the EPA, the Department of Justice, the Department of Agriculture, the Department of Transportation, and the Department of Labor.

60 See Section 6 of the Executive Order.

61 See Working Group response to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. https://www.osha.gov/chemicalexecutiv eorder/Section_6ai_Options_List.html (accessed January 7, 2014).Chevron Richmond Refinery Regulatory Report January 2014

21 

## 3.0 

## The Safety Case Regulatory Regime

3.1 Introduction

Throughout modern history, major industrial accident s have been catalysts for significant regulatory reform, as countries around the world strive to mitigate risk and improve the safety of their facilities and processes in order to protect human health and the environment. According to industrial safety and accident analysis expert Dr. Andrew Hopkins, “[d]isas ters...offer an unparalleled opportunity to study the workings of an organisation and to identify where things are going wrong.” 62 Around the world, many of these large-scale incidents have resulted in sweeping changes to legislation surrounding industrial safety and health. These changes repl ace prescriptive, compliance-based regulations with goal-setting regulations supplemented by prescriptive requirements that support adaptability, require duty holders 63 to demonstrate to the regulator that they have driven risks to as low as reasonably practicable (ALARP) or equivalent, and provide the regulator with the tools to drive continuous improvement among major hazard
facilities. 64 A majority of these regulatory regimes are re ferred to as the safety case, which Dr. Hopkins
defines as:

a case which the operator of a hazardou s facility makes to the regulator, setting out how safety is to be managed. It must include details of the hazard identification process, the hazards which have been identified and the procedures which have been set in place to control them. The system remains self-regulatory in principle but rather than the facility being left to its own devices by the regulator it must convince the regulator that its strategy for managing safety is satisfactory [emphasis added]. Under any safety case regime, facility operators are expected to adopt best practice risk management. 65

The safety case regulatory regime is much more than a written report; it shifts risk management responsibility to the company and its employees and provides for rigorous review and oversight by a technically competent regulator to ensure effective implementation. 66

62 Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999; p 1.

63 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. These entities may include op erators, contractors, and subcontractors. http://www.hse.gov.uk/offs hore/guidance/entrants.pdf (accessed June 5, 2013).

64 Major hazard facilities are workplaces that store, handle or process la rge quantities of hazardous material. Incidents at such facilities have the potential to cause serious damage to employees, people in surrounding areas, and the environment. See http://www.pc.gov.au/__data/assets/p df_file/0018/82350/21-appendixd.pdf (accessed May 9, 2013).

65 Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online]; p 7. http://www.sirfrt.com.au/Meetings/I MRt/Southeast/IMRt%20East%2000Nov30 /Andrew%20Hopkins%20presentati on/Lonford%20talk.PDF (accessed May 8, 2013).

66 The CSB notes that that the burden is currently on the PSM regulator to verify compliance with existing regulations, which is primarily done following an incident or complaint. Rarely is this done proactively under theChevron Richmond Refinery Regulatory Report January 2014

22 The remaining portions of Section 3 will introdu ce major accidents that have occurred around the world and discuss the history behind the global development and implementation of the safety case regulatory approach on and offshore. Section 4.0 will then hi ghlight major attributes of the safety case regulatory approach. The US regulatory model will also be in troduced and discussed throughout these sections to allow for comparisons between the different approach es. Finally, Section 5.0 will discuss the regulation of petroleum refineries in California specifically, including Chevron. The report concludes with important recommendations focused on improving the regul atory oversight of California’s 15 refineries, and encouraging OSHA, industry, labor, and others to work together to improve the regulation of petroleum refineries throughout the US.



## 3.2 Initial Safety Case Implementation

3.2.1 United Kingdom

3.2.1.1 Onshore

Two major onshore incidents in the 1970s helped sp ark legislative reform focused on major accident prevention and risk reducti on for onshore major hazard facilities. A large dioxin 67 release in Seveso, Italy, in 1976, which injured hundreds of individuals, led the European Commission 68 to adopt legislation in 1982 known as the Seveso Directive, aimed at the prevention and control of major industrial
accidents. 69 Following the 1984 toxic release in Bhopal, India, which resulted in several thousand known fatalities, and the Sandoz chemical plant fire near Basel, Switzerland, which injured 14 individuals and released nearly 30 tons of pesticides into the Rhin e River, turning it red, the Seveso Directive was amended and replaced in 1996 with the Seveso II Directive. 70 The regulation requires owners or operators of facilities that contain threshold quantiti es of listed substances to submit safety reports to a competent authority (CA) within a Member State of the European Commission for its review and
acceptance. 71 These reports must demonstrate to the CA that major-accident prevention policies, safety management systems, and internal emergenc y plans have been created and implemented. 72 The

current system. The Refinery NEP is a primary example of proactive inspections to verify compliance. It was discontinued in 2011.

67 The term Dioxin refers to a family of toxic chemicals. They have been characterized by EPA as likely to be human carcinogens and are anticipated to increase the risk of cancer at background levels of exposure. See http://www.epa.gov/pbt/pubs/dioxins.htm (accessed June 17, 2013).

68 The European Commission consists of 27 Commissioners and “represents the interests of the EU [European Union] as a whole. It proposes new legislation to the European Parliament and the Council of the European Union, and it ensures that EU law is correc tly applied by member countries.” http://ec.europa.eu/atwork/index_en.htm (accessed May 6, 2013).

69 See http://ec.europa.eu/environment/seveso/ (accessed May 6, 2013).

70 The Seveso Directive was adopted in 1982 and was amende d twice, in 1987 and 1988. On December 9, 1996, the Seveso II Directive was adopted and re placed the original Seveso Directive. The Seveso III Directive was then adopted on July 4, 20 12, and became effective on Augu st 13, 2012. Member States must implement Seveso III by June 1, 2015. http://ec.europa.eu/ environment/seveso/ (accessed May 6, 2013).

71 See http://ec.europa.eu/environment/seveso/legislation.htm (accessed May 6, 2013).

72 Seveso II Directive, Article 9 (1996). Available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L0082:20031231:EN:PDF (accessed July 15, 2013).Chevron Richmond Refinery Regulatory Report January 2014

23 regulation also requires owners or ope rators to “prove to the competen t authority...that he has taken all measures necessary as specified in this Directive.” 73

On June 1, 1974, the Flixborough Works of Nypro (UK) Limited experienced a massive cyclohexane vapor cloud explosion, killing 28 workers and injuring 36 workers and hundreds of members of the public offsite. This incident along with the Seveso incident led to the Seveso Directive in 1982, and this was converted into legislation in the United Kingdom (UK) via the Control of Industrial Major Accident Hazards (CIMAH) 1984 Regulations. The Control of Major Accidents 74 Hazards Regulations (COMAH) replaced CIMAH in April 1999 to conform to the updated Seveso II Directive. The Health and Safety Executive 75 (HSE), the Environment Agency 76 (EA), and the Scottish Environmental Protection Agency 77 (SEPA) are considered to be the UK’s CA responsible for the enforcement of these regulations. A key feature differentiating these two regulations is the increasing emphasis from the operator having to “describe” the safety systems in CIMAH to being required to “demonstrate” their adequacy in
COMAH. 78

73 Seveso II Directive, Article 5, Paragraph 2 (1996). Available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1996L 0082:20031231:EN:PDF (accessed July 15, 2013).

74 The COMAH regulations define “major accident” as “an occurrence (including in particular, a major emission, fire or explosion) resulting from uncontrolled developments in the course of the operation of any establishment and leading to serious danger to human health or the environment, immediate or delayed, inside or outside the establishment, and involving one or more dangerous substances...” COMAH Regulations, Part 1, Regulation 2 (2005).

75 HSE is an independent regulator, and “act[s] in the public interest to reduce work-related death and serious injury across Great Britain’s workplaces.” See http://www.hse.gov.uk/aboutus/ (accessed May 7, 2013). According to the HSE’s Enforcement Policy Statement, the HSE’s purpose is “to protect the hea lth, safety and welfare of people at work, and to safeguard others, mainly members of the public, who may be exposed to risks from the way work is carried out.” http://www.hse.gov.uk/pubns/hse41.pdf (accessed May 7, 2013).

76 EA is an Executive Non-departmental Public Body responsible for protecting the environment and promoting sustainable development. For more information see http://www.environment-agency.gov.uk/default.aspx (accessed July 17, 2013).

77 SEPA is Scotland’s environmental regulator, aimed at protecting and improving the environment. For more information see http://www.sepa.org.uk/ (accessed July 17, 2013).

78 COMAH Regulations. Schedule 4, Part 1. Purpose of safety reports is to “1 . demonstrate[e] that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2; 2. Demonstrate[e] that major accident hazards have been identified and that the necessary measures have been taken to prevent such accidents and to limit their consequences for persons and the environment; 3. Demonstrate[e] that adequate safety and reliability have been incorporated into the – (a) design and construction, and (b) operation and maintenance, of any installation and equipment and infrastructure connected with its operation which are linked to major accident hazards within the estab lishment....” (2005).Chevron Richmond Refinery Regulatory Report January 2014

24 The COMAH regulations apply to all onshore fac ilities that have sufficient quantities of dangerous
substances as listed in Schedule 1 79 of the regulations. 80 The general duty for all duty holders of facilities covered under the COMAH regulations is to “take all measures necessary to prevent major accidents and limit their consequences to people and the environment.” 81 The HSE interprets this duty as the equivalent of reducing risks 82 to “as low as reasonably practicable,” or ALARP. 83,84,85 Duty holders are required to prepare a safety report that “demonstrate[s] to the CA that all measures necessary for the prevention and mitigation of major accidents have been taken.” 86 These reports must contain information for the CA to review and analyze, including a policy on preventing and mitigating major accidents; a management system for implementing that policy that complies with good practice; 87 an effective method for identifying any major accidents that might occur; and measures to prevent and mitigate major accidents. 88 To assist operators with reducing risks to ALARP, the HSE publishes guidance documents that contain good practice guidelines and st andards and that discuss what constitutes good practice. 89

79 Available at http://www.legislation.gov.uk/uksi/1999/743/schedule/1/made (accessed June 17, 2013).

80 COMAH Regulations, Part 1, Regulation 3 (2005).

81 COMAH Regulations, Part 2, Section 4 (2005).

82 HSE describes “risk” as “the likelihood that a hazard will actually cause its adverse effects, together with a measure of the effect.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013).

83 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37 / (accessed May 15, 2013).

84 The principal health and safety legislation in the UK is the Health and Safety at Work etc. Act 1974. It requires employers to ensure that risks to employ ees and others are reduced “so far as is reasonably practicable,” or SFAIRP. Health and Safety at Work etc. Act, Part I, Section 2 (1) and (2) (1974). HSE has interpreted that SFAIRP duties call for the same set of tests to be applied as duties to re duce risks “as low as reasonably practicable,” or ALARP. According to HSE, “”the two terms mean essentially the same thing and at their core is the concept of ‘reasonably practicable’;...” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013).

85 According to HSE, the concept of “reasonably practicabl e” “involves weighing a risk against the trouble, time and money needed to control it. Thus, ALARP describes th e level to which [they] expect to see workplace risks controlled.” This allows HSE to “set goals for duty-holders, rather than being prescriptiv e; HSE’s policy is that any proposed regulatory action should be based on what is reasonably practicable.” According to HSE, in most situations, deciding whether the risk s are ALARP involves a “comparison be tween the control measures a dutyholder has in place or is proposing and the measures [they] would normally expect to see in such circumstances i.e. relevant good practice. ‘Good practice’ is defined as ‘those standards for controlling risk that HSE has judged and recognized as satisfying the law, when applied to a partic ular relevant case, in an ap propriate manner.’... Once what is good practice has been determined, much of the discussion with duty-holders about whether a risk is or will be ALARP is likely to be concerned with the relevance of th e good practice, and how appropriately it has been (or will be) implemented.” See http://www.hse.gov.uk/risk/theory/alarpglance.htm (accessed May 7, 2013).

86 COMAH Regulations, Schedule 4, Part 1 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013).

87 HSE defines “good practice” as “tho se standards for controlling risk th at HSE has judged and recognized as satisfying the law, when applied to a particular relevant case, in an appropriate manner.” HSE, “Assessing compliance with the law in individu al cases and the use of good pr actice,” May 2003. Available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013).

88 COMAH Regulations, Schedule 4, Part 2 (2005). See http://www.hse.gov.uk/comah/background/comah99.htm (accessed May 7, 2013).

89 Such as HSE’s “Guidance for the topic assessment of the major accident hazard aspects of safety cases,” published in April 2006, and HSE’s “Assessing compliance with the law in individual cases and the use of good practice,” May 2003, available at http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 11, 2013).Chevron Richmond Refinery Regulatory Report January 2014

25 

## 3.2.1.2 Offshore

The international offshore energy sector experienced several catastrophic incidents in the 1980s, including the Alexander Kielland 90 incident in Norway in 1980 which resulted in 123 fatalities, and the Piper Alpha 91 incident in the UK in 1988, which fatally injured 167 workers. These incidents initiated offshore regulatory changes focused on risk reducti on and control that were modeled after the CIMAH regulations.

Following the Piper Alpha incident, the UK Secretary of State for th e Department of Energy ordered that a public inquiry be held to determine the circumstances surrounding the incident. 92 The Secretary directed Lord Cullen, a Senator of the College of Jus tice in Scotland, to hold the inquiry and report to the Secretary “the circumstances of the accident a nd its cause together with any observations and
recommendations which he thinks fit to make with a view to the preservation of life and the avoidance of
similar accidents in the future.” 93

The result was The Public Inquiry into the Piper Alpha Disaster (“the Cullen Report”), an extensive report released in October 1990. The report called into question the adequacy of the detailed prescriptive regulatory regime that existed at the time of the incident 94 for offshore oil and gas operations, and listed 106 recommendations to revamp offshore safety regulation in the UK, 57 of which the HSE was responsible for overseeing. 95

The Cullen Report found that the operating company (Occidental Petroleum, a US company), “did not possess any system which ensured that such remote, but potentially disastrous, events were subjected to systematic scrutiny...[and] there was for major proj ects no comprehensive system of safety assessment and management did not appear to appreciat e fully the contribution which it could make.” 96 The report noted that there was a need for a formal safety assessment (FSA), “an assessment essentially equivalent to the Safety Case,” 97 which “involves the identification and assessment of hazards over the whole life cycle of a project...[because]...the combinations of potentia l hardware and human failures are so numerous that a major accident hardly ever repeats itself...[and] [a ] strategy for risk management must [] address the entire spectrum of possibilities.” 98

90 The Alexander Kielland was a flotel for housing workers. A total of 212 people were on board when it capsized near the Edda platform in the Ekofisk area of the North Sea on March 27, 1980. As a result of this incident, 123 individuals lost their lives and only 89 survived.

91 On July 6, 1988, an explosion occurred aboard the Piper Alpha oil production platform 120 miles off the coast of Scotland in the North Sea. A series of explosions and fire killed 167 workers and almost completed destroyed the platform. This incident became the deadliest accident in the history of the offshore industry.

92 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iii.

93 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p iv.

94 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 27.

95 Oil &Gas UK. Piper Alpha: Lessons Learnt; 2008; p 2.

96 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 275.

97 Lord Cullen describes the Safety Case as “a means by wh ich an operator demonstrates to itself the safety of its activities...[and] as the basis for the regulation of major hazard activities...” Ibid at 276-277.

98 Ibid.Chevron Richmond Refinery Regulatory Report January 2014

26 In his analysis, Lord Cullen noted that the current o ffshore regulations were prescriptive in nature rather than goal-setting, and that this had the effect of hampering operators’ flexibility and stifling innovation. 99 He stated that “one of the reasons for adopting th e goal-setting approach was to make regulations that were more flexible, so that changing technology could be accommodated without the need for new legislation.” 100 Lord Cullen pointed to the CIMAH Regulations, discussed above, as a forward-looking regulatory model, which required ons hore major hazard installation ope rators to “provide HSE with a written report on the safety of the installation...commonly called the Safety Case.” 101 Lord Cullen noted that the safety case “is a means by which an operator demonstrates to itself the safety of its activities...[and] also serves as the basis for the regulation of major hazard activities.” 102

Lord Cullen concluded that an FSA “is an essential el ement in a modern safety regime for major hazard
installations...that this FSA should take the form of a Safety Case...[and that] [t]he regime should have as its central feature demonstration of safe operation by the operator.” 103 He recommended that a safety case regulatory regime be implemented offshore for both fixed and mobile installations as it already was for onshore major hazard installations, that it be comp lemented by other regulations dealing with specific features, that the safety case contain goal-setting regula tions, and that it be part of a continuing dialogue between the operator and the regulatory body. 104

Lord Cullen recommended the implementation of safet y regulations requiring the owner or operator of every fixed and mobile installation operating in UK wate rs to submit a safety case to HSE. In response, the UK established the Offshore Installations (Safety Case) Regulations in 1992. 105 The primary goal of these Regulations was “to reduce the risks from major accident hazards to the health and safety of the workforce employed on offshore insta llations or in connected activities.” 106

Oil & Gas UK, 107 the main UK offshore oil in dustry trade association who se members include the major oil companies that operate in the Gulf of Mexico (such Shell and Exxon), h as expressed strong support for the safety case regime. In its response to the Eu ropean Commission’s published draft legislative proposals to modify offshore safety case regulations, Oil & Gas UK noted that those proposals would undermine the “proactive, flexible and responsive approach to managing risks, borne out of the lessons learnt from Piper Alpha as well as the evolving nature of the offshore oil and gas business itself.” 108 In
the wake of the Macondo incident in the Gulf of Mexico, the UK government directed Professor Geoffrey

99 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 339.

100 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 364.

101 Ibid at 276.

102 Ibid at 276 and 277.

103 Ibid at 282.

104 Ibid at 283 and 284.

105 The 1992 Regulations have since been replaced by the Offshore Installations (Safety Case) Regulations 2005, which were effective as of April 6, 200 6. The objective of the revisions in 2005 was “to improve the effectiveness of the regulations whilst at the same time reducing th e burden of three yearly resubmissions.” Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008.

106 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 5. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

107 See http://www.oilandgasuk.co.uk/aboutus/aboutus.cfm (accessed December 10, 2013).

108 Oil & Gas UK. European Commission Proposed Regulation on Offshore Safety and Related Issues: Oil & Gas UK Position Paper. November 2011; p 1. http://www.oilandgasuk.co.uk/ProposedEURegulation.cfm (accessed December 10, 2013).Chevron Richmond Refinery Regulatory Report January 2014

27 Maitland of Imperial College London to lead an indepe ndent review of the offshore safety case regime in
the UK. 109 In the report stemming from the review, which highlighted strengths of the safety case regime as well as recommendations for improvement, Prof essor Maitland commended the UK’s “‘goal-setting’ safety regime and its ability to foster innovation and continuous improvement in process integrity...” 110 and noted that the UK authorities, including the HSE, are held in high regard by both the UK operators
and international observers. 111



## 3.2.2 Global Analysis of Safety Case Implementation

3.2.2.1 Australia

3.2.2.1.1 Offshore

Following the Piper Alpha disaster in 1988, the then Australian Commonwealth Minister for Resources at the time, Senator Peter Cook, formed a Consulta tive Committee on Safety in the Offshore Petroleum Industry to advise him on safety issues surrounding offshore operations in Australia. In 1991, the
Committee released its Report of the Consultative Committee on Safety in the Offshore Petroleum Industry

. 112 In the report, the Committee examined th e circumstances, causes, and recommendations described in both the Cullen Report and Esso Australia’s 113 investigation report on a fire that occurred on the Tuna platform in April 1989 in Bass Strait that injured four individuals. The Committee noted that while there were many differences between the two incidents, they “both demonstrated the need for greater attention to the management of safety in a number of areas of offshore operations.” 114 They pointed to the safety case as an important regulator y concept that should be applied to oil and gas operations in Australian waters, and concluded by recommending that the safety case concept described by Lord Cullen and carried out onshore by the Seve so Directive and CIMAH regulations be adopted for Australian offshore petroleum operations. 115 It would “require the operator of a facility to formally document how safety is to be managed within the facilit y, [and] [] demonstrate that the major hazards of
the installation have been identified and appropriate c ontrols provided...” 116 The Committee also recommended the implementation of both prescriptive and “objective” regulations. 117 At that time, offshore petroleum safety was the joint responsib ility of the Commonwealth and the States/Northern Territory. Following this inquiry, new Commonwealth regulations were created: for example, Schedule

109 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed December 10, 2013).

110 Ibid at 3.

111 Ibid at 3.

112 See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013).

113 Esso was an oil and gas company in Australia that was sold to Mobil Oil Corporation in 1990. It is now part of Exxon Mobil. See http://www.exxonmobil.com/Australia-Eng lish/PA/about_who_history_esso.aspx (accessed May 8, 2013).

114 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 2. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013).

115 Ibid at 25.

116 Report of the Consultative Committee on Safety in the Offshore Petroleum Industry, 1991; p 3. See http://www.mrt.tas.gov.au/mrtdoc/petxplor/download/OR_0935/OR_0935.pdf (accessed May 8, 2013).

117 Ibid.Chevron Richmond Refinery Regulatory Report January 2014

28 8 on “Occupational Health and Safe ty” was added to the Petroleum Submerged Lands Act (PSLA) in 1992 to require safety cases to be develope d for all offshore petroleum facilities.

The Offshore Petroleum and Greenhouse Gas Storage (Saf ety) Regulations 2009 set out the requirements for the contents of offshore safety cases. The operato r of an offshore petroleum facility must submit a safety case for review and acceptance to the Aust ralian National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA), the Australian Commonwealth Statutory Agency charged with regulating the health and safety, structural integrity, and environmental management of all offshore petroleum facilities in Australian Commonwea lth waters, and in coastal waters where State powers have been reduced. NOPSEMA accepts a safety case “if it is satisfied that the arrangements set
out in the document demonstrate that the risks will be reduced to...ALARP.” 118



## 3.2.2.1.2 Onshore

In 1998, Esso Australia’s gas plant at Longford in Vi ctoria suffered a major release and fire caused by cold temperature embrittlement due to a process upset and lack of engineering support for diagnosis, which resulted in two fatalities, eight additional injuries, and cut the State of Victoria’s gas supply for two weeks causing major industrial disruption and workfo rce stand downs. While the safety case at this time was required for offshore operations in Australia, onshore facilities like the Longford plant were subject only to prescriptive provisions contained within the Victoria Occupational Health and Safety Act 1985. In its report on the incident, the Royal Commission conc luded that all major hazard facilities in Victoria should be required to develop and su bmit a safety case to the appropriate regulatory authority. In 1996, Australia’s National Occupational Health and Safety Commission 119 (NOHSC) recommended the safety case be adopted for all major onshore hazard facilitie s in Australia, and in 2002 NOHSC established a National Standard for the Control of Major Hazard Facilities and a National Code of Practice for the Control of Major Hazard Facilities. 120 The Standard states that operators of major hazard facilities “shall provide the relevant public authority with a safety re port...” that, among other things, identifies the type, relative likelihood and consequences of major accidents that might occur, and provides details of the safety management system (SMS) for that facility. 121 In addition, operators of major hazard facilities must identify all major hazards and the risks associated with those hazards, and minimize each risk “so far as practicable.” 122

118 See http://www.nopsema.gov.au/safety/s afety-case/what-is-a-safety-case/ (accessed July 15, 2013).

119 In 1985 The National Occupational Health and Safety Commission (NOHSC) was established as a tripartite body to develop, facilitate and implement a unified national appro ach to occupational health and safety in Australia. On January 1, 2006, NOHSC was replaced by the Australian Safety and Compensation Council (ASCC). On March 31, 2009, the ASCC was abolished and replaced with Safe Work Australia. Safe Work Australia was established by the Safe Work Australia Act 2008 with the authority to help develop policy to improve worker health, safety, and compensation across Australia. It does not regulate work health and safety laws; rather it develops national policy. See http://www.safeworkaustralia.gov.au/sites/swa/about/pages/about (accessed May 8, 2013).

120 National standards are documents whic h prescribe preventative action to avert occupational deaths, injuries and diseases; national codes of practice are documents prepared for the purpose of advising employers and workers of acceptable ways of achievin g national standards. National Standard for the Control of Major Hazard Facilities [NOHSC: 1014(2002)], p 2. http://www.safeworkaustralia.gov.au/ sites/SWA/about/Publications/Documen ts/271/NationalStandard_ControlMajo rHazardFacilities_NOHSC_1014-2002_PDF.pdf (accessed May 8, 2013).

121 Ibid at 13.

122 Ibid at 12.Chevron Richmond Refinery Regulatory Report January 2014

29 According to the Australian Safety and Compensation Council’s 2004 Annual Situation Report for the National Standard for the Control of Major Hazard Facilities , all Australian jurisdictions were expected to have the standard in place before the e nd of 2005, roughly three years after its inception. 123



## 3.2.2.2 Norway

Following the capsizing of the Alexander Kielland in 1980

, Norway moved in a direction similar to the European Commission and developed performance-b ased regulations focused on major accident prevention. Although the country did not adopt th e safety case regulatory regime per se, the current regulatory approach implements many similar elements.

Currently in Norway, the Petroleum Safety Authority 124 (PSA) regulates safety for activities at onshore and offshore major hazard facilities, and requires the responsible party 125 to reduce risk “to the extent possible,” and “select technical, operational and organi sational solutions that reduce the probability that harm, errors and hazard and accident situations occur.” 126 This concept is akin to ALARP whereby companies choose the solutions and barriers that have the greatest risk-reducing effect, provided the costs are not significantly disproportionate to the risk reduction achieved. 127 However, unlike the UK and Australia, PSA regulations do not require the submission of a safety case report by the operator of a facility, although facilities are still expected to develo p them and make them available to the regulator upon request for auditing purposes. Rather, PSA “s upervises” industry, as explained in the following:

Supervision involves much more than audits offshore or on land. It embraces the total contact between the regulator and the regulated. It covers everything which gives the PSA the necessary basis to determine whether the companies are accepting their responsibility to operate acceptably in all phases. Supervisor y activities include investigations, considering consent applications and meetings with the industry. 128

As will be discussed below, because the safety case regul atory approach requires the regulator to conduct detailed assessments of safety case reports and aud iting of facilities against the safety case, its implementation requires substantial funding to s upport and maintain a sufficient number of highly experienced and competent staff.

123 Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004; p1. http://www.safeworkaustralia.gov.au/ sites/SWA/about/Publications/Documen ts/475/MHFAnSituationReport_2004. pdf (accessed May 8, 2013).

124 The Petroleum Safety Authority (PSA) is “the regulatory authority for tec hnical and operational safety and for the working environment.” PSA was created in 2004 as a result of a government decision to split the Norwegian Petroleum Directorate (NPD) into two parts. See http://www.ptil.no/main-page/category9.html (accessed May 8, 2013).

125 PSA defines a “responsible party” as “[t]he operator and others participating in activities covered by these regulations, without being a licensee or owner of an onshore facility.” Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 6(a). Definitions. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013).

126 PSA. Regulations Relating to Health, Safety and the Environment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations); Section 11, Risk Reduction Principles. http://www.ptil.no/framework-hse/category403.html (accessed November 26, 2013).

127 Ibid.

128 http://www.ptil.no/supervision/what-i s-supervision-article8519-88.html (accessed June 3, 2013).Chevron Richmond Refinery Regulatory Report January 2014

30 

## 3.2.2.3 The United States

Despite the international shift to the safety case regime and even though major oil companies that operate both onshore and offshore in the US also operate globally under safety case regimes and have shown support for the safety case, 129 the US has persisted in the use of a more activity-based regulatory scheme that does not contain a specific risk reduction target and that lacks the ability to adapt to advancing technology and recently developed industry standard s. Due to the major potential hazards present in onshore and offshore oil and gas operations, these sector s should have in place adaptable safety regimes that adequately engage companies and their employees in continuous improvement and risk reduction.
As the CSB has devoted extensive time and resources to studying and analyzing the regulation of offshore oil and gas facilities in the US as a result of its Maco ndo incident investigation, this report will focus on the regulation of onshore oil and gas operations in the US and California.

On October 23, 1989, a massive explosion and fi re occurred at the Phillips 66 Company’s Houston Chemical Complex in Pasadena, Texas, resulting in 23 fatalities and injuring more than 130. In response, the U.S. Department of Labor issued a report to the President and declared, among other things, that the U.S. Occupational Safety and Health Administra tion (OSHA) would “expedite completion of its rulemaking requiring employers to implement comprehensive chemical process safety management plans for hazardous chemical processes.” 130 Sparked by a number of serious accidents, including the Phillips 66 incident and the 1984 toxic release in Bhopal, Indi a, which resulted in several thousand known fatalities, OSHA published in the Federal Register (55 FR 29150) on July 17, 1990, a proposed standard containing requirements for the management of hazards associated with processes using highly hazardous
chemicals. 131 Soon after, Congress adopted the Clean Ai r Act (CAA) Amendments (CAAA) of 1990,

129 A Shell Oil Company representative testified at the CSB D ecember 2010 public meeting on the safety case that the company had been using the safety cas e globally since 2002, and noted that the most valuable aspect of that type of regulatory regime was the need to demonstrate that major hazards have been managed using effective barriers and controls. Shell Geelong Refinery Plant Manager Huck Po h has stated, “As a Major Hazard Facility, Shell Geelong Refinery and Lara Terminal is require d to submit a Safety Case for assessment by Safe Work Victoria. This document is a summary of that Safety Case and explains the potential impact of the facility on our neighbours and the community. We take a systematic approach to managi ng safety and preventing inci dents that place our people, our neighbours, the Geelong community, the environment and our facilities at risk. This is reflected in our Safety Management System and the approach that has been undertaken for the development and review of the Safety Case. Shell is committed to achieving continuous Health, Safety, Security and Environment (HSSE) performance improvement. There are ongoing review and revision activities to ensure our analyses remain relevant and reflect the current status of operations and our risk reduction measur es are consistent with latest industry practice. This commitment to continuous improvement is reflected in the Shell HSSE Policy and supported by our HSSE results.” See http://s04.static-shell.com/content/dam/shell-new/local/country/aus/downloads/geelong/safety-casesummary.pdf p3. (accessed December 10, 2013). Esso Longford Plant Manager Monte Olson has stated that “[t]he Safety Case is a systematic and comprehensive review of our operations and pr ocesses which includes the identification of potential major incidents that could occur, assesses the risks associated with these major incidents and demonstrates the controls we have in place to mana ge these risks to as low as reasonably practicable.” See http://www.exxonmobil.com/Australia-English/PA/ Files/publication_Longford_Safety_Case_2013.pdf p5. (accessed December 10, 2013)

130 Dole, Elizabeth. Phillips 66 Company Houston Chemical Complex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990; p ix. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013).

131 Preamble to Process Safety Management of Highly H azardous Chemicals; Explosiv es and Blasting Agents. Section 1 – I. Background (March 4, 1992). See http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1039 (accessed May 10, 2013).Chevron Richmond Refinery Regulatory Report January 2014

31 which resulted in the creation of the CSB and authori zed the first federal regulations specifically designed to prevent major chemical accidents that threaten workers, the public, and the environment: OSHA’s Process Safety Management (PSM) standard and the U.S. Environmental Protection Agency’s (EPA’s) Risk Management Program.



## 3.2.2.3.1 OSHA PSM Standard

Section 304 of the CAAA mandated that OSHA develop “a chemical process safety standard designed to protect employees from hazards associated with accident al release of highly hazardous chemicals in the workplace.” 132 OSHA responded by adopting 29 CFR §1910.119 Process Safety Management of Highly
Hazardous Chemicals (“the PSM standard”) in 1992. The PSM standard applies to a process 133 involving a chemical at or above the listed threshold quantity (also known as a highly hazardous chemical), or flammables in a quantity of 10,000 pounds or more. 134 It contains 14 elements with broad requirements to implement management systems, identify and cont rol hazards, and prevent “catastrophic releases of highly hazardous chemicals.” While the PSM standa rd was intended to be performance-based and does contain some goal-setting elements, a majority of the standard is activity-based, and there is no general duty requirement under the PSM standard to reduce risks to a certain extent or prevent catastrophic accidents. As will be discussed at length in Secti on 4.3, the PSM standard has essentially remained stagnant since its inception in 1992. According to the Center for Chemical Process Safety (CCPS), the PSM standard has resulted “in a minimum cost, comp liance-based approach to managing process safety... ‘If [it] isn’t a regulatory requirement, I’m not going to do it!’” 135

A key provision of the PSM standard is the process hazard analysis (PHA) of covered processes. 136 PHA requirements include a review of the process to identify, evaluate, and c ontrol the hazards, and an evaluation of the consequences of failure of those controls. 137,138 The PHA required by the OSHA PSM standard is an example of a goal-setting requirement in that it allows for a variety of hazard analysis methodologies to be performed to satisfy the requirement. However, the element is activity-based in that completing a PHA for each covered process and updating it at least every five years is satisfactory. The regulator is not responsible for evaluating the effec tiveness of controls or safeguards, and there is no requirement to reduce risks to a certain extent such as ALARP. Thus, the resulting PHA that meets the

132 Clean Air Act Amendments of 1990. S ection 304(a). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013).

133 The PSM standard defines “process” as “any activity i nvolving a highly hazardous ch emical including any use, storage, manufacturing, handling, or the on-site movement of such chemicals, or combination of these activities.” 29 CFR §1910.119(b) (1992).

134 29 CFR §1910.119(a)(1) (1992). This standard also applie s to the manufacture of explosives and pyrotechnics in any quantity [29 CFR §1910.109(k)(2) & (3)].

135 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2.

136 A Process hazard analysis is a thorough, orderly, syst ematic approach for identifying, evaluating, and controlling hazards of processes involving highly hazardous chemicals. The employer mu st perform an initial process hazard analysis on all processes covered by the PSM standard and all process hazard analyses must be updated and revalidated, based on their completion date, every five years. See http://www.osha.gov/ doc/outreachtraining/htmlfiles/psm.html (accessed May 10, 2013).

137 29 CFR §1910.119(e) (1992).

138 The other elements of the PSM standard are process safety information, operating procedures, employee participation, training, contractor safety, pre-startup safety review, mechanical integrity, hot work permits, management of change, incident investigation, emergency planning and response, and compliance audits. The 14 th “element” is mainly a requirement that maintaining trade secrecy not interfere with an employer’s compliance with the other 13 elements.Chevron Richmond Refinery Regulatory Report January 2014

32 regulatory requirements of “controlling” hazards may actually inadequately identify or mitigate the hazards. In addition, there is no requirement for em ployers to submit their PHAs to the regulator for review. In most cases, this means the regulator will not review these PHAs until there is a significant process accident, a complaint, or a (rare) planned inspection.

Another key element of the PSM standard, the Management of Change (MOC) provision, requires the development of written procedures “t o manage changes to process chemicals, technology, equipment, and procedures...” 139 The procedures must consider, among other things, the technical basis for a proposed change and its potential impact on safety and health. 140 Historically, the MOC requirement has been treated and enforced as an activity-based requirement as well. For example, when the BP Texas City refinery explosion and fire occurred on March 23, 2005, all 15 fata lities and many of the 180 injuries
occurred in or around nine contractor trailers that we re sited near process areas and as close as 121 feet to the isomerization (ISOM) unit where the incident occu rred. The refinery had been using trailers as temporary office spaces for several years. The refi nery addressed facility siting for trailers during its 2004 MOC for an upcoming 2005 turnaround. The MOC form indicated that a double-wide mobile office trailer would be temporarily sited in the open area between the ISOM and naphtha desulfurization units (NDU) for use during the upcoming turnaround, to be removed at the end of April 2005. However, the MOC did not analyze siting hazards; rather the MOC team attached a drawing showing the proposed interior configuration of the trailer and me asured its location from the catalyst warehouse. 141 In early 2005, eight other trailers were s ited between the ISOM and NDU without even conducting an MOC. The CSB pointed out in its Urgent Recommendations st emming from the Texas City incident that these trailers could have been easily relocated to less hazar dous sites, and BP did so following the incident. 142 Despite this fact, BP’s siting policy considered that utilizing trailers in this way posed little or no danger to occupants, which conformed with the American Petroleum Institute’s (API) Recommended Practice (RP) 752, Management of Hazards Associated with Location of Process Plant Buildings.

Although the MOC failed to identify or analyze hazards stemming from siting trailers so close to process areas, OSHA did not cite BP for conducting a poor MOC following the incident, as merely completing the MOC satisfied the requirements of the PSM standard . As it would have been very practical to move the trailers to a safer location, a regulator under the safety case regulatory regime would have the ability to require BP to do just that to reduce risks to ALARP.

The OSHA PSM standard includes requirements for two of its 14 elements – mechanical integrity and process safety information (PSI) – to comply with recognized and generally accepted good engineering practices, or RAGAGEP. 143 RAGAGEPs are technologically focused, with no emphasis on

139 29 CFR §1910.119(l)(1) (1992).

140 Id at (l)(2)(i) and (ii) (1992).

141 To learn more about the PHA and MOC proce sses relating to the BP Texas City Refinery, see the CSB BP Texas City Final Investigation Report at http://www.csb.gov/assets/1/ 19/CSBFinalReportBP.pdf (accessed October 24. 2013).

142 See CSB Urgent Trailer Siting Recommendations at http://www.csb.gov/assets/1/19/BP_Recs_2.pdf (accessed October 24. 2013).

143 RAGAGEPs “are engineering, opera tion, or maintenance activities based on established codes, standards, published technical reports or recommended practices (RP) or a similar document. RAGAGEPs detail generally approved ways to perform specific engineering, inspection or mechanical integrity activities, such as fabricating aChevron Richmond Refinery Regulatory Report January 2014

33 organizational, human factors, or culture-based me asures. OSHA developed the mechanical integrity RAGAGEP requirement to “make sure that process equi pment is inspected and tested properly, and that the inspections and tests are performed in acco rdance with appropriate codes and standards.” 144 OSHA has recognized a number of practices, guidelines, and standards as RAGAGEPs, including the American Society of Civil Engineers, Design of Blast Resistant Buildings in Petrochemical Facilities, the Department of Defense, TMS-1300 Structures to Resist the Effects of Accidental Explosions, and the American Petroleum Institute (A PI) Recommended Practice (RP) 520: Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries. 145 Unlike other regulators such as the HSE, OSHA has not compiled a comprehensive list of good practices, or RAGAGEPs, for companies to utilize during operations, and the CSB has only identified tw o OSHA Letters of Interpretation regarding implementation of RAGAGEP in PSM. According to CCPS, “[o]rganizations lack a thorough understanding of recognized and ge nerally accepted good engineering practices and are inconsistent in interpreting and applying them.” 146 In addition, key PSM elements such as PHA, incident investigation, and MOC do not reference RAGAGEP, and have not kept up to date with good practice guidelines, including CCPS’ Guidelines for Risk Based Process Safety, which addresses 20 PSM elements for process safety, including human factors, workforce involvement, and safety culture.

Historically, OSHA has primarily enforced 147 RAGAGEP reactively, and may cite companies for violations of RAGAGEPs following an incident. Fo r example, following the BP Texas City Refinery incident, OSHA issued BP hundreds of citations, some of which covered BP’s willful violations of API
520 and the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, both considered by OSHA to be RAGAGEPs. Following the Chevron incident, California’s Division of Occupational Safety and Health (Cal/OSHA) issued Chevron two willful citations for allegedly not complying with API RP 939-C, Guidelines for Avoiding Sulfidation ( Sulfidic) Corrosion Failures in Oil Refineries and Chevron’s own internal corrosion mitigation plan as RAGAGEPs (this will be discussed in greater detail in Section 5.1.2.2).



## 3.2.2.3.2 U.S. Environmental Protection Ag ency Risk Management Program

Section 301(r) of the CAAA called for EPA to develop regulations related to the prevention and detection of accidental releases for regulated substances, incl uding requiring owners or operators of stationary sources that have regulated substances present to pr epare and implement a “risk management plan to

vessel, inspecting a storage tank, or servicing a relief valv e.” OSHA Instruction CPL 03-00-004. June 7, 2007. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=3589&p_table=DIRECTIVES (accessed August 13, 2013).

144 OSHA. Preamble to 29 CFR Part 1910, Process Safety Management of Highly Hazardo us Chemicals, Section 3, Title III. Summary and Explanation of th e Final Rule, 1992. Available at http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=PREAMBLES&p_id=1041 (accessed June 6, 2013).

145 All three are cited in OSHA Letter of Interpretation. Applicability of the PSM standard’s mechanical integrity requirements to refinery structures, February 1, 2010. http://www.osha.gov/pls/oshaweb/owadisp.show _document?p_table=INTERPRETATIONS&p_id=27443 (accessed June 6, 2013).

146 CCPS. Guidelines for Risk Based Process Safety. 2007; p 2.

147 An exception to this would be OSHA’s NEP that was implemented from 2007 to 2011, where OSHA inspectors cited to RAGAGEP following NEP audits.Chevron Richmond Refinery Regulatory Report January 2014

34 detect and prevent or minimize accidental relea ses of such substances from the stationary source....” 148 The risk management plan would require a “hazar d assessment to assess the potential effects of an accidental release of any regulated substance.” 149 In 1996, EPA promulgated the Risk Management Program regulations at 40 CFR Part 68, which went into effect in 1999.

The EPA’s Risk Management Program requires facilities that contain more than the threshold quantity of any of the 77 listed toxic chemicals or 63 flammable substances 150 to prepare and submit to the regulating agency emergency contact information, descripti ons of processes and hazardous chemicals onsite, an accident history, and worst-case release scenarios. 151 The regulation defines three different Program levels (Program 1, 2, or 3) based on a process unit’s potential for impact to the public and the requirements to prevent accidents. 152 Program 3 processes are subject to additional, more stringent requirements to prevent accidents similar to those of the OSHA PSM standard. Program 3 facilities must implement elements of a prevention program, including: process safety information (PSI), PHA, standard operating procedures (SOPs), training, mechanical inte grity, compliance audits, incident investigations, MOC, pre-startup reviews, employee participation, and hot work permits. These prevention program elements are based primarily on the OSHA PSM standard, and much of the language contained in each element is identical to the PSM standard. As such, the Risk Management Program regulations contain the same RAGAGEP requirements for mechanical integrity and PSI as the OSHA PSM standard for covered facilities. For example, 40 CFR §68.48 requires an owner or operator to “ensure that the process is designed in compliance with recognized a nd generally accepted good engineering practices [RAGAGEP].” 153 Like OSHA, the EPA is able to cite facilities for failure to comply with RAGAGEP following an incident, but does not mainta in a list of RAGAGEPs for reference.

Finally, each covered facility must submit a risk management plan (RMP) to EPA for all covered

processes 154 and update and resubmit these plans at least once every five years, or whenever a major accident occurs or the emergency contact inform ation changes. Completing and submitting the RMP satisfies the regulatory requirement; again, the effectiveness of the RMP in risk reduction is not assessed by the EPA, rendering this another activity-based requireme nt for a covered facility. There is no approval of the RMP by the EPA, and there is no additional du ty on the facility to implement what it says it is doing in the RMP, unlike the safety case regulatory regime.

Any facility with one or more covered processes mu st include in its RMP an executive summary; the registration for the facility; the certification statement; a worst-case scenario for each process involving flammables or toxics; the five-year accident history for each process; information concerning emergency

148 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013).

149 Clean Air Act Amendments of 1990. Section 301(r)(7)(B)(ii)(I). November 5, 1990. See http://www.epa.gov/air/caa/caaa.txt (accessed May 10, 2013).

150 According to 40 CFR §68.10(a), “[a]n owner or operator of a stationary source that has more than a threshold quantity of a regulated substance in a process, as determined under §68.115, shall comply with the requirements of this part no later than the latest of the following dates...”

151 See 40 CFR §68.12. General Requirements.

152 See 40 CFR §68.10. Applicability.

153 40 CFR §68.48(b) (1999). Additionally see 40 CFR §68.56 (d) which requires the owner or operator‘s inspection and testing procedures to “follo w recognized and generally accepted good engineering practices.”

154 40 CFR §68.150 (1999).Chevron Richmond Refinery Regulatory Report January 2014

35 response at the facility; at least one alternative releas e scenario analysis for each regulated toxic substance or flammable; a summary of the prevention program for each Program 2 process; and a summary of the prevention program for each Program 3 process. 155

The CSB found in its BP Texas City Investigation Report that as of March 2007, the RMP regulation had focused primarily on reviewing the submitted RMPs a nd required updates by covered facilities. The EPA Office of Inspector General (OIG) concluded in 20 09 that over half of the RMP-covered facilities identified in the US as high-risk 156 had never received an on-site insp ection or audit, and over 65 percent
of all active RMP facilities had not received an on-si te inspection or audit since inception of the RMP program in 1999. 157 The EPA OIG also noted that of the 296 uninspected high-risk facilities regulated by the EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario. 158



## 3.2.2.3.3 Safety Case in the United States

In contrast to its mainly activity-based regulation of hazardous chemicals, including oil and gas operations, the US has adopted a more goal-based regulatory approach for its nuclear and aeronautics and space science sectors. The U.S. Nuclear Regulatory Commission (NRC) was an early adopter of goal or performance-based regulation, which it defines as “[a] regulatory approach that focuses on desired, measureable outcomes, rather than prescriptive processes, techniques, or procedures...[and] leads to defined results without specific direction regarding how those
results are to be obtained.” 159 According to the NRC, performance-based regulations pe rmit licensees to “have flexibility to determine how to meet the established performan ce criteria in ways that encourage and reward improved outcomes.” 160 The NRC’s Reactor Oversight Process, the means by which it achieves its mission of public health and safety in commercia l nuclear power plant operations, is its primary

155 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; pp 9-1 and 9-2. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013).

156 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program f acility with a hazard index greater than or e qual to 25; and/or 3) Facilities that have had one or more significant accidental rel eases within the previous five years. See “ EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

157 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15.

158 Ibid.

159 See NRC Glossary, available at http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-basedregulation.html (accessed June 10, 2013).

160 US NRC NUREG/BR-0303. Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/readingrm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013).Chevron Richmond Refinery Regulatory Report January 2014

36 performance-based regulation. 161 It uses seven “cornerstones,” such as mitigating systems and barrier integrity, to monitor three performance areas (reactor safety, radiation safety, and security safeguards). 162 Licensee performance data, inspection plans, qua rterly assessments, and assessment and inspection responses are tied to each performance area and sever al cross-cutting objectives, such as worker involvement and human performance. 163 Licensees are permitted to choose the precise methods they use to meet overarching performance goals, which are gui ded by their duty to reduce risks to as low as reasonably achievable, or ALARA. 164,165 The NRC has stated that this flexibility is one of the main reasons that its regulatory philosoph y encourages continuous improvement. 166

The National Aeronautics and Space Administration (NASA) has the goal of implementing a safety system that is “as safe as reasonably practicable,” or ASARP, 167 which it considers to be closely related to ALARP. NASA relies on a risk-informed safety case, or RISC, 168 to ensure that the system’s safety objectives, goals, and thresholds have been achieved, and that safety risk is as low as possible within reasonable impacts on cost, schedule, and performance. 169

161 http://www.nrc.gov/about-nrc/regulatory/ris k-informed/concept/performance.html#example (accessed June 13, 2013).

162 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013).

163 NRC Reactor Oversight Process publication (2006), available at http://pbadupws.nrc.gov/docs/ML0708/ML070890365.pdf (accessed June 13, 2013).

164 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/readingrm/doc-collections/nuregs/brochures/br0303/br0303.pdf (accessed June 13, 2013).

165 ALARA “means making every reasonable effort to maintain exposures to radiation as far below the dose limits in this part as is practical consistent with the purpos e for which the licensed activity is undertaken, taking into account the state of technology, the econom ics of improvements in relation to state of technology, the economics of improvements in relation to benefits to the public health and safety, and other societal and socioeconomic considerations, and in relation to utilization of nuclear ener gy and licensed materials in the public interest.” 10 CFR §20.1003 (2007).

166 US NRC NUREG/BR-0303, Guidance for Performance-Based Regulation (2002). http://www.nrc.gov/readingrm/doc-collections/nuregs/brochures/br0303/br0303.pdf

167 NASA defines ASARP as “a fundamental principle of adequate safety. A determination that a system is ASARP entails weighing its safety performance against the sacrific e needed to further improve it. The system is ASARP if an incremental improvement in safety would require a disproportionate deterioration of system performance in other areas.” NASA/SP-2010-580, NASA System Safety Handbook, Volume 1, System Safety Framework and Concepts for Implementation; November 2011; p 5. http://ntrs.nasa.gov/archive/nasa/casi. ntrs.nasa.gov/20120003291_2012003429.pdf (accessed June 10, 2013).

168 NASA defines RISC as “a structured argument, supported by a body of evidence that provides a compelling, comprehensive and valid case that a system is or will be adequately safe for a given application in a given environment. This is accomplished by addressing each of the operational safety objectives that have been negotiated for the system, including articulation of a roadmap for the ac hievement of safety objectiv es that are applicable to later phases of the system life cycle. The term ‘risk-informed’ is used to emphasize that a determination of adequate safety is the result of a deliberative decision making proces s that necessarily entails an assessment of risks and tries to achieve a balance between the system’s safety performance and its performance in other areas.” Ibid at 13.

169 Ibid at xiii.Chevron Richmond Refinery Regulatory Report January 2014

37 

## 4.0 

## Key Features of an Effect ive Safety Case Regulatory Regime

Following the Macondo disaster, the National Commission on the Macondo Oil Spill and Offshore Drilling 170 made a recommendation in its Report to the President 171 for the US to “develop a proactive, risk-based performance approach specific to individual facilities, oper ations and environments, similar to the ‘safety case’ approach in North Sea.” 172 Despite the major potential hazards that are present in both onshore and offshore oil and gas operations, the safety case regime has not been implemented in the US for either sector. The US has instead implemented for major hazards at onshore facilities a more activitybased approach, resulting in static regulations such as the PSM and RMP regulations that have not seen significant improvements 173 since their inception, despite adva nces in technology and good industry practice.

According to Dr. Hopkins and other renowned experts in the field, it is essential for an effective major accident prevention safety regime to take the form of a safety case, with adaptable goal-setting regulations that facilitate innovation and sustainability, and that drive industry to continuously improve and reduce risks to ALARP. To accomplish this, the regime must utilize sufficient numbers of highly competent personnel to effectively collect or promote industry use of process safety indicators 174 and to provide knowledgeable oversight of industry operations.

The CSB has determined that there are several key features of an effective major accident prevention regulatory approach such as the safety case regime:

 Duty Holder Safety Responsibility, including a Written Case for Safety

 Continuous Risk Reduction to ALARP

 Adaptability and Continuous Improvement

 Active Workforce Participation

 Process Safety Indicators that Drive Performance

 Regulatory Assessment, Verification, and Intervention; and an

 Independent, Competent, Well-Funded Regulator

As will be discussed in Section 5, California’s patc hwork of regulations does not effectively implement these features, which are also illustrated in the figure below. Section 4 provides a detailed discussion of
these features.

170 President Barack Obama established the National Commission on the BP Macondo Oil Spill and Offshore Drilling through Executive Order 13543 on May 21, 2010, to examine the facts and circumstances concerning the root causes of the Macondo explosion and fire. For more information see http://www.oilspillcommission.gov/page/about-commission (accessed June 17, 2013).

171 Available at http://www.oilspillcommission.gov/final-report (accessed June 17, 2013).

172 National Commission on the BP Macondo Oil Spill and Offshore Drilling. Report to the President: Deep Water, The Gulf Oil Disaster and the Future of Offshore Drilling; January 2011; 252.

173 OSHA did implement changes to 29 CFR §1910.106, creating a new Hazard Communication Standard. However, no changes have been made that impact the management of process safety under PSM. See https://www.osha.gov/dsg/hazcom/ (accessed August 6, 2013).

174 Process safety indicators are also referred to as perf ormance indicators, metrics, key process indicators (KPI), performance measures, indicators, etc.Chevron Richmond Refinery Regulatory Report January 2014

38 Figure 1. Safety Case Attributes.



## 4.1 Duty Holder Safety Responsibility, including a Written Case for Safety

Under the safety case regulatory regime, each individual company is responsible for the safety of each hazardous facility. The onus is on the duty holder 175 to prove to the regulator that the company’s processes, methodologies used to assess risks, and reas oning for choosing one cont rol over another have substantially reduced risks to as low as reasonably pr acticable (ALARP), or equivalent. The duty holder

175 Duty holders are considered to be “those who create and/or have the greatest control of the risks associated with a particular activity. Those who create the risks at the workplace are responsible for controlling them.” HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011; p 2. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 20 13). These entities may include operators, contractors, and subcontractors. According to NOPSEMA, the idea is that those who create the risk must manage it. See http://www.nopsema.gov.au/safety/s afety-case/what-is-a-safety-case/ (accessed July15, 2013).Chevron Richmond Refinery Regulatory Report January 2014

39 is required to prepare a written case for safety 176 (“safety case report”) that identifies the hazards and risks and describes how they will be reduced to ALARP. The HSE has noted that the safety case report “demonstrates that the duty holder has arrangements in place which, if implemented, are capable of achieving compliance with legal objectives set out in other [] regulations...[and] provides a comprehensive core document that can be used as a check by both the duty holder and HSE that the accepted risk control measures and the health and saf ety management systems are in place and operate as they should.” 177 The HSE has also stated:

[t]he principal matters to be demonstr ated in a safety case are that: a) the management system is adequate to ensure compliance with statutory health and safety requirements; and for management of arrangements with contractors and sub-contractors, b) that adequate arrangements have been made for audit and for audit repor ting, [and] c) that all hazards with the potential to cause a major accident have been identified, their risks evaluated, and measures have been, or will be, taken to control those risks to ensure that the relevant statutory provisions will be complied
with. 178

The safety case report must also demonstrate “how inherently safer design concepts have been applied in the design decisions
taken.” 179 This principle applies to all stages of the installation’s life cycle, and includes materials selection and managing corrosion in the design.

It is also important to note that safety case reports are meant to be evergreen documents that reflect continuous improvement in risk reduction. For onshore operations in the UK, the duty holder is required to review the safety case report during the construction of a new facility, whenever new facts or technical knowledge about safety matters become known, or whenever the operator makes a change to the safety management system that could have significant impacts on the prevention of major accidents. 180 The duty holder must revise the safety report to ensure that it “remains up to date and continues to provide an accurate representation of the major accident hazards...and the

176 The HSE defines “safety case” as “a document that give s confidence to both the duty holder and HSE that the duty holder has the ability and means to control major accident risks effectively. It provides an extra level of regulatory control on top of regulations such as the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 (PFEER) and the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR ), justified by the major accident pote ntial of the offshore activities within scope.” HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p 6. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed January 13, 2014).

177 Ibid at 6.

178 HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006; p 7. http://www.hse.gov.uk/of fshore/aposc190306.pdf (accessed August 6, 2013).

179 Ibid at 16.

180 COMAH Regulations, Part 3, Regulation 8 (1) (a)(b) and (c) (1999).Chevron Richmond Refinery Regulatory Report January 2014

40 measures in place to control them.” 181 According to HSE guidance on the offshore Safety Case Regulations, safety case reports are “intended to be living documents, kept up to date and revised as necessary during the operational life of the installation.” 182

In order for the facility to begin operation or remain in operation, the regulator must “accept” 183 the facility’s safety case report; however, the regulator ’s acceptance of a safety case does not license the facility or installation as “fit,” 184 nor does it shift the duty of risk control and reduction away from the facility owner or operator and onto the regulator; rath er, the duty of major accident prevention and risk
reduction to ALARP remains with th e duty holder throughout the life of the facility. Following the regulator’s acceptance of the safety case report, the du ty holder must ensure that the installation is operated in conformity with the management system and other provisions described in the safety case. 185

In the US, facilities commence operation before they ar e inspected or evaluated for complying with PSM or RMP regulations. In fact, the CSB has investigat ed incidents where the employer disputed that its process was covered by the PSM standard or RMP regu lations. Regulators do not evaluate and approve
PHAs or other hazard reviews and do not have the authority to license specific facilities for operation, based on the adequacy of their process safety prog rams. If an operating facility contains processes covered by the PSM standard, the facility must comp lete primarily activity-based regulatory requirements at least once every five years. The employer h as no general duty to contin ually reduce risk. RMPcovered facilities must submit fairly high-lev el information exhibiting compliance with RMP requirements at least once every five years. While the regulator ensures the RMP has been filed and contains the required sections, there is no analysis of the effectiveness of controls identified in the RMP to mitigate hazards.



## 4.2 Continuous Risk Reduction to ALARP

As discussed above, a majority of the safety case re gimes implemented globally impose a duty on owners or operators of covered facilities on and offshore to re duce risks to ALARP or equivalent. The Center for Chemical Process Safety (CCPS) defines ALARP as “a risk reduction goal, where risk reduction efforts
are continued until the incremental effort to further reduce risk becomes grossly disproportionate to the
level of additional risk reduction.” 186 This principle provides the regulator with the main foundation on

181 The Competent Authority. Revised guidance for operators of top tier COMAH establishments. Review and revision of COMAH safety reports. December 2009; p 5. http://www.hse.gov.uk/comah/report-review.pdf (accessed November 26, 2013).

182 HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations; 2006; p
7. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

183 “Acceptance requires satisfaction with the duty holder’s approach to identifying and meeting health and safety needs...HSE ‘accepts’ the validity of the described approach as being capable, if implemented as described, of achieving the necessary degree of risk control, but HSE does not confirm the outcomes of that approach.” Therefore, “HSE will accept a safety case or a revision ...when duty holders demonstrate and describe specified matters to HSE’s satisfaction. Acceptance will be base d on HSE’s judgment that the arrangements and measures described in the safety case taken as a whole are likely to achieve compliance if implemented as described. To give acceptance HSE does not need to be satisfied that compliance will be achieved....” Ibid at 6.

184 TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9, 1996; p 8.

185 Ibid at 7.

186 Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2 nd ed., 2009; p 46.Chevron Richmond Refinery Regulatory Report January 2014

41 which to accept or reject a safety case report. In essence, the regulator ultimately determines whether ALARP has been achieved through the authority to accep t or reject the safety case report. An advantage of ALARP as opposed to a prescriptive or activity -based approach is that ALARP results in the continuous reduction of risk to keep up-to-date w ith advancing technology a nd industry best practices. 187 Although two of the 14 PSM elements (PHA and me chanical integrity) contain performance-based or goal-setting requirements, 188 the PSM standard does not provide a specific risk reduction target such as

ALARP.

In reviewing the safety case report, the regulator may accept the application of relevant good practice as a sufficient
demonstration of ALARP. 189 As the HSE notes, “the measures in place to prevent or limit major accidents should be described in the safety report and be at least to ‘relevant good practice.’” 190 According to Dr. Hopkins, the duty of ALARP “provides leverage for the regulator...[i]f an operator wishes to adopt a procedure or a standard that falls short of good or best practice, the regulator can reject it on the grounds that it does not reduce the risk as low as reasonably practicable.” 191 As noted above, regulators such as HSE provide guidance on what is considered good practice, and publish documents containing good practice standards to assist operators w ith applying this concept. However, the duty holder must make the case for the standard or practice being utilized, and the regulator may determine that applying good practice alone is not sufficient to demonstrate that risks have been reduced to ALARP. In addition, if there is no directly applicable rule or standard, operators still have a duty to manage risk, and they therefore must mainta in a reasonable level of risk awareness that goes beyond mere compliance. 192 This raises a safety case regime above the compliance mentality of a more activity-based regime, such as PSM, and requires the duty-holder and the regulator to continuously ask whether there are other measures that would be effective in further reducing risks.

The UK HSE provides ample guidance on determining wh at is considered to be ALARP, and many British courts have interpreted th e concept as well. In the 1949 case Edwards v. National Coal Board, decided by the Court of Appeal, Judge Asquith wrote:

‘Reasonably practicable’ is a narrower term than ‘physically possible’ and seems to me to imply that a computation must be made by the

187 See http://www.hse.gov.uk/foi/internalops/hid_circs/permissioning/spc_perm_37/ (accessed December 9, 2013).

188 29 CFR §1910.119(e)(1) requires the employer to “identify, evaluate, and control the hazards involved in the process.” 29 CFR §1910.119(j)(5) stat es that “[t]he employer shall correct deficiencies in equipment that are outside acceptable limits (defined by th e process safety information in paragrap h (d) of this section) before further use or in a safe and timely manner when necessary means are taken to assure safe operation.”

189 HSE. Assessing compliance with the law in individual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013).

190 HSE. Guidance on ALARP Decisions in COMAH. http://www.hse.gov.uk/fo i/internalops/hid_circs/p ermissioning/spc_perm_37/ (accessed November 26, 2013).

191 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6.

192 Hopkins, Andrew. The Meaning of “Safety Case”; February 2013; p 6.Chevron Richmond Refinery Regulatory Report January 2014

42 owner, in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other; and that if it be shown that there is a gross disproportion between them – the risk being insignificant in relation to th e sacrifice – the defendants discharge
the onus on them. 193

While some critics in the US have argued that the dete rmination of ALARP is strictly a quantitative risk assessment (QRA) calculation that is not sufficiently protective, the CSB has found that the HSE allows reliance upon qualitative assessments, QRA, and semi -quantitative risk assessments to determine
ALARP. 194 According to the HSE, essential considerations for determining whether a duty holder has
reduced risks to ALARP include “the adoption of inherently safer designs...” 195 and “[i]dentification of possible further measures that could be applied to lower the risk.” 196 The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the application of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” 197 In Norway, the PSA requires companies to “select technical, operational and organisational solutions that reduce the probability that harm, errors and hazard and accident situations
occur.” 198 PSA regulations require companies to choose th e solutions that offer the best results, provided the costs are not significantly disproportionate to the risk reduction achieved. 199 In Australia, the
NOPSEMA enforces the Offshore Petroleum and Greenhouse Gas Storage Act 2006 and its regulations, which imposes a duty of care on the operator of a f acility to “take all reasonably practicable steps” to ensure the facility is safe and all work and other activities are “carried out in a manner that is safe and

193 Edwards, [1949] 1 K.B. at 704.

194 Center for Chemical Process Safety (CCPS) guidanc e on risk assessment implies that as the predicted consequence of potential hazard scenar ios increases, the level of analytical detail should also increase. Risk assessment approaches range in order of increasing analytical detail from qualitative, to semi-quantitative, to quantitative. Qualitative risk assessment is the simplest approach where judgments about consequence, likelihood, and the tolerability of risk are made on a subjective basis using the knowledge and experience of team members and may not be consistently applied within an organization. Semi-quantitative ri sk assessment is the second level of analytical detail, where organizations develop and provide to team members predetermined risk matrices and guidance for establishing numerical consequence and frequency levels. This approach is of greater value to team members as based upon their collective experience; the team typically has a se nse of how frequently an event might occur and how great the potential consequence may be within the predetermined ranges. Layer of protection analysis (LOPA) is a semi-quantitative form of risk assessment, using order of magnitude categories for evaluating frequency, consequence, and adequacy of safeguards. Quantitative risk assessment involves the highest level of analytical detail and typically involves specialized expertise to perform. Complex models are commonly developed to evaluate frequency, consequence, and the effectivene ss of safeguards in a quantitative risk assessment. Such approaches are typically standardized to minimize result variability within an organization and even between organizations in countries where a quantitative risk assessme nt is mandated by regulatory authorities. Center for Chemical Process Safety (CCPS). Guidelines for Developing Quan titative Safety Risk Criteria; August 2009.

195 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013).

196 Ibid at 8.

197 Ibid at 8.

198 Regulations Relating to Health, Safety and the Enviro nment in the Petroleum Activities and at Certain Onshore Facilities (The Framework Regulations). Section 11, Risk Reduction Principles. http://www.ptil.no/frameworkhse/category403.html (accessed November 26, 2013).

199 Ibid.Chevron Richmond Refinery Regulatory Report January 2014

43 without risk to the health of any person at or near the facility.” 200 NOPSEMA explains that to achieve ALARP, the company “has to show, through reasone d and supported arguments, that there are no other practical measures that could reasonabl y be taken to reduce risks further.” 201

In the US, the NRC has “gradually revised its origin al scheme, giving an increasing importance to the ‘economic and social factors’, in particular th e involvement of all ‘stakeholders’ (authorities, management, staff, public) in the ALARA process.” 202 For the regulator, the focus for whether ALARA has been achieved is on “processes, procedures, and judgments.” 203 The duty holder must ensure that choices made to achieve ALARA are “fully documented together with the criteria which have brought to those choices. When the criteria are qualitative, it is more likely that subjective judgments play a large role, but those judgments must be equally recorded.” 204

There is no corresponding duty to reduce risks to ALARP in the PSM standard or RMP program. Rather, these regulations require that facilities “control” iden tified hazards, with no further dialogue on how far the operator must go to control those hazards. Neith er the facility nor the regulator is required to
determine whether more could be done to contro l hazards or reduce risk s to comply with these regulations, and this may result in the implementation of insufficient controls relating to a hazard.

While OSHA and the EPA do rely on general duty st andards when implementing the PSM standard and the RMP program, these duties do not drive onshore companies toward reducing the risks of their activities to ALARP, and instead are utilized as enforcement tools typically after an incident has occurred, meant to cover those activities not specifically regulat ed. These standards may also be used by OSHA or EPA to cite a company for not following a specific RAGAGEP for 2 of the 14 process safety elements - mechanical integrity and PSI.

OSHA enforces section 5(a) of the Occupational Safe ty and Health Act (OSHAct), which states the following:

(a) Each employer –

(1) shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees;

(2) shall comply with occupati onal safety and health standards promulgated under this act... 205

Section 5(a)(1), also known as OSHA’s General Duty Clause, has been descr ibed as a “catch-all” provision meant to fill gaps in OSHA law for recognized unregulated hazards. 206,207 In order for OSHA to

200 Offshore Petroleum and Greenhouse Storage Act 2006, Volume 3, Schedule 3, Clause 9. http://www.comlaw.gov.au/Details/C2012C00148/Html/Volume_3#_Toc315688204 (accessed October 30, 2013).

201 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013).

202 Fasso, Alberto, and Rokni, S. Operational Radiation Protection in Hi gh Energy Physics Accelerators. Implementation of ALARA in Design and Operation of Accelerators. May 2009; p 6.

203 Ibid at 6.

204 Ibid at 6 and 7.

205 29 U.S.C. §654(a)(1) and (2) (2004).

206 Morrison, Kyle W. The General Duty Clause: What is it, how does OSHA use it and what should employers know? Safety + Health [Online]; May 1, 2011.Chevron Richmond Refinery Regulatory Report January 2014

44 issue a General Duty Clause violation, the hazard must be recognized, the employer must have failed to keep the workplace free of the hazard to which his or her employees were exposed, a practical method must be available to correct the hazard, and the hazar d must be causing or likely to cause death or serious injury. 208 This duty would thus only apply if the absence or failure of one control in a series of controls
makes an accident likely to occur (emphasis added).

On the other hand, in a safety case regulatory regime, the regulator proactively reviews identified hazards and risk reduction strategies proposed by the operator to ensure that risks are being reduced to ALARP. The regulator may require the installation of an ab sent control if such a control is considered good industry practice, or if it goes further in reducing risks to ALARP. This is a key feature of the safety case approach in preventing major accidents.

Under the CAA, the General Duty Clause requires ow ners and operators “to identify hazards which may result from such releases using appropriate hazard asse ssment techniques, to design and maintain a safe facility taking such steps as are necessary to prevent releases, and to minimize the consequences of
accidental releases which do occur.” 209 Similar to OSHA, the EPA can use its General Duty Clause enforcement authority to create legally binding require ments or enforce actions for hazards that have not been specifically regulated. The EPA can use this authority proactively (before an incident) or reactively (following an incident), and can enforce the clau se where it finds the possibility of imminent and substantial endangerment. 210

According to EPA guidance on the RMP program, becau se it is the owner or operator’s duty to “prevent accidents and ensure safety at [their] source...” this ma y require steps to be taken “beyond those specified in the risk management program rule.” 211 While this principle appears to be similar to ALARP requirements of the safety case, in practice whether this is done is not subject to regulation or review. In addition, it is permissive in that it uses the word “may .” Nothing additional, such as ALARP, is required.
This will be addressed below in more detail in the discussion of implementation of the EPA RMP program in California.



## 4.3 Adaptability and Continuous Improvement

A key strength of the safety case regulatory regime is th at it provides the regulator with the tools to drive continuous improvement among facilities and ensure ri sks have been reduced to ALARP or equivalent, rather than focusing on compliance with activity-b ased regulatory requirements. Although complying with good practice may achieve ALARP, the regulator also has the ability under this regime to require facilities to go above and beyond g ood practices and standards to achieve ALARP without requiring

http://www.nsc.org/safetyhealth/Pages/5% 2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013).

207 According to the National Safety Council, General Duty Clause violations make up only about 1.5 percent of total violations issued annually by OSHA. Available at http://www.nsc.org/safetyhealth/Pages/5% 2011%20The%20General%20Duty%20Clause.aspx (accessed June 5, 2013).

208 Ibid.

209 42 U.S.C. §7412(r)(1) (1990).

210 42 U.S.C. §7412(r)(9) (1990).

211 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013).Chevron Richmond Refinery Regulatory Report January 2014

45 rulemaking. The Baker Panel 212 noted in its 2007 report (“the Ba ker Report”) on BP and its process safety performance following the 2005 BP Texas City disaster that an effective process safety management system builds upon an “improvement cycl e” that “should include, in practice, continuous reduction of process risk and improvements in safety performance according to some measurable
criteria.” 213

The Baker Panel defined “c ontinuous improvement” as

 improving controls for process hazards , including process safety knowledge and competence of workers;

 improving process safety leadership of supervisors;

 improving process engineering to identif y and then design to remove or mitigate the effects of process hazards;

 going beyond legal compliance to best practices to reduce risks;

 going beyond mere compliance with internal standards, but learning from operating experiences, incident and near miss investigations, hazard studies, audits, and other assessments to improve those internal standards; and

 identifying and implementing not only tho se external standards that must be observed, but also those that represent best practices that can lead to process safety excellence. 214

An independent review conducted of the Austra lian offshore safety case regime in 2000 echoes the importance of continuous improvement in process safety management, stating that “critical to the successful implementation of a safety case regime is the achievement of a qualita tive shift in industry and regulatory safety cultures from the minimalist complian ce of the prescriptive regime to the philosophy of best practice and continuous improvement.” 215 Recently, Lord Cullen addressed the importance of adaptability as well, when he spoke at the 2013 Oil & Gas UK Piper 25 offshore safety conference in Aberdeen, Scotland. 216 In his keynote speech, Lord Cullen quot ed the Maitland panel, which examined the UK offshore safety regime after the Macondo incident, noting that “safety cases should be living
documents [emphasis added] central to the way facilities are operated, with contents widely
understood.” 217

212 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety overs ight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/global bp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013).

213 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166.

214 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 166.

215 Department of Industry, Science and Resources; Offshore Safety and Security, Petroleum and Electricity Division. Australian Offshore Petroleum Safety Case Revi ew: Report of the Independent Review Team. 2000; p 33.

216 In June 2013, Oil & Gas UK held a large offshore safety conference in Aber deen, which marked the 25 th anniversary of the Piper Alpha di saster. For more information see http://www.oilandgasuk.co.uk/events/Piper25.cfm?frmAlias=/Piper25/ (accessed September 16, 2013).

217 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Culle n_what_have_we_learned_from_Piper_Alpha/044b5113.as

px (accessed September 16, 2013).Chevron Richmond Refinery Regulatory Report January 2014

46 As changes to regulatory requirements necessitate an extensive, lengthy rulemaking process in the US, 218 process safety-related regulations can remain static for decades, while industry standards (many of which are voluntary under the current US system), technologies, and improved procedures and practices continue to change and advance, and new chemicals come into production. In light of major accidents that have occurred, such as the BP Texas City expl osion and fire which resulted in 15 fatalities, and the Motiva Enterprises sulfuric acid tank explosion, which fa tally injured one worker and injured eight others, the CSB has made a number of key recommendations to OSHA and the EPA to revise the PSM and RMP regulations, respectively. However, agencies have failed to implement these recommendations and these regulations have remained static despite the important lessons learned from these incidents. In addition, the OSHA PSM standard’s Appendix A, which contai ns a list of toxic and reactive highly hazardous chemicals and the threshold quantity for each, was originally created using a number of older sources, including the EPA’s “Extremely Hazardous Subs tance List,” the 1982 Seveso Directive, the 1984 CIMAH regulations, and others. A number of these sources have been revised, updated, and amended throughout the years, while Appendix A has not. In fa ct, no chemicals have been added to either the PSM or the RMP programs since the rules were initiall y adopted in the 1990s, even as numerous serious process incidents have occurred involving chemicals that were not listed.

The U.S. Government Accountability Office (GAO) published a 2012 report on OSHA’s standard setting abilities, and noted that between 1981 and 2010, OS HA took anywhere from 15 months to 19 years to develop and issue 58 significant safety and h ealth standards (averaging seven years). 219 According to the report, OSHA reasoned that it must evaluate t echnological and economic feasibility of a potentialstandard using data gathered by visiting worksites in industries that will be affected, on an industry-byindustry basis. 220 This was described as “an enormous undertaking because, for example, it requires visits to multiple worksites.” 221 In addition, Executive Order 12866 222 requires that federal agencies, including OSHA, provide an assessment of the potential overall co sts and benefits for significant rules to the Office of Management and Budget (OMB). OSHA will typically be required under the Small Business Regulatory Enforcement Fairness Act of 1996 223 to initiate a panel process to receive and consider input

218 5 U.S.C. Chapter 5, sections 511-599, also known as the Administrative Procedure Act, or APA, requires that federal agencies seeking to promulgate a rule or regulation submit to a lengthy notice and comment rulemaking process that includes publishing the proposed rule making in the Federal Register; providing the public with at least 30 days to participate in the rulemaking process by submitting written comments or data, and then discussing the public comments and providing a rationa le for accepting or rejecting them. Th e OSHAct Section 6(b) specifies the procedures OSHA must use to promulgate, modify, or revoke its standards (29 U.S.C. §655(b)). These procedures include publishing the proposed rule in the Federal Register , providing interested persons an opportunity comment, and holding a public hearing upon request.

219 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 5. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

220 Ibid at 6. The Supreme Court has held that the OSHAct requires that standards be both technologically and economically feasible. Am. Textile Mfrs. Inst. V. Donovan, 452 U.S. 490, 513 n. 31 (1981). Also see United Steelworkers v. Marshall, 647 F. 2d 1189, 1301 (D.C. Cir. 1980), quoted in AFL-CIO v. OSHA, 955 F. 2d 962, 980 (11 th Cir. 1992). Assessing feasibility on an industry-by- industry basis requires that the agency research all applications of the hazard being regulated, as well as the expected cost for mitigating e xposure to that hazard, in every industry.

221 Ibid at 6.

222 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.whitehouse.gov/sites/default/files/omb/inforeg/eo12866/eo12866_10041993.pdf (accessed June 12, 2013).

223 5 U.S.C. §609(b), (d) (1996).Chevron Richmond Refinery Regulatory Report January 2014

47 from representatives of affected small businesses, which could take eight months or more. 224 Only OSHA, the EPA, and the Consumer Financial Prot ection Bureau are subject to this requirement. 225 Finally, the OSHAct directs courts to review OSHA’ s standards using a more stringent legal standard
than the Administrative Procedure Act’ s (APA’s) “arbitrary and capricious” test 226 when reviewing OSHA’s standards; 227 an OSHA standard may only be upheld if it is supported by “substantial evidence in
the record considered as a whole.” 228 According to the GAO report, OSHA officials claim this more stringent standard (known as the “substantial evidence” standard) requires a higher level of scrutiny by the courts and as a result, OSHA staff must conduct a large volume of detailed research in order to understand all industrial processes involved in the hazard being regulated, and to ensure that a given hazard control would be feasible for each process. 229 The GAO also found that although OSHA has the ability to address urgent hazards by issuing emergency temporary standards, the agency has not used this authority since 1983 because of the difficult hurdles th e agency faces in presenti ng the evidence necessary to meet the statutory requirements. 230 In summary, all of these extens ive rulemaking constraints have resulted in OSHA’s inability to undertake ma ny standard revisions or improvements.

In Spring 2013, OSHA announced its new regulatory ag enda, which stated that one of the things OSHA plans to consider is revising the PSM standard to “address gaps in safety coverage.” 231 Potential revisions include “expanding coverage and requirements for re activity hazards,” which the CSB addressed in its 2002 report entitled “Improving Reactive Hazard Management,” 232 and “expanding the scope of

224 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 6. Available at http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

225 5 U.S.C. §609(d) (1996).

226 Pursuant to the APA, agency decisions may be set aside only if “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. §706(2)(A). There is abundant case law that discusses this standard. Courts have held that a court “may reverse under the arbitrary and capricious standard only if the agency has relied on factors that Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a differe nce in view or the product of agency expertise. See Greater Yellowstone Coalition v. Lewis, 638 F. 3d 1143, 1148 (9 th Cir. 2010) (as amended) (relaying on The Lands Council v. McNair, 537 F.3d 981, 987 (9 th Cir. 2008) (en banc), overruled on other grounds by Winter v. Natural Res. Def. Council, 555 U.S. 7 (2008)).

227 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 9. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

228 29 U.S.C. §655(f).

229 GAO. Workplace Safety and Health: Multiple Challenges Lengthen OSHA’s Standard Setting; April 19, 2012; p 9. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

230 OSHA must demonstrate that workers are exposed to gr ave danger and establish that an emergency temporary standard is necessary to protect workers from that grav e danger. OSHA is also required to replace an emergency temporary standard with a permanent standard within six months using the requirements laid out in OSHAct 6(b). Ibid at 11.

231 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgenda ViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013).

232 In this report, the CSB recommended to OSHA that it amend the PSM standard “to achieve more comprehensive control of reactive hazards that could have catastro phic consequences.” The report is available at http://www.csb.gov/assets/1/19/Reac tiveHazardInvestig ationReport.pdf (accessed September 17, 2013). The recommendations start on page 89 of the report.Chevron Richmond Refinery Regulatory Report January 2014

48 paragraph (j) to cover the mechanical integrity of any safety-critical equipment....” 233 However, OSHA has proposed changes to the PSM standard before, w ith no action ultimately being taken. On April 27, 1998, OSHA announced that it was considering issuing an Advance Notice of Proposed Rulemaking 234
(ANPRM) “to address issues related to reactive chemical s raised by the explosion of a chemical plant in Lodi, New Jersey in 1995.” 235,236 On May 14, 2001, OSHA clarified its intent to publish an ANPRM “to
address the need to add reactive chemical s that are not currently covered by PSM...” 237 On December 3, 2001, however, the entry on reactives was withdrawn from the rulemaking agenda. 238 Following the devastating ammonium nitrate explosion on April 17, 2013, in West, Texas, which resulted in at least 14
fatalities and mass destruction in the town of W est, CSB Chairperson Moure-Eraso urged both OSHA and the EPA to expand their standards to include reactiv e chemicals and hazards such as ammonium nitrate. 239

On July 25, 2013, the CSB held a public meeting in Washington, DC to discuss the status of key open
recommendations the CSB has made to OSHA over the last decade to revise its PSM standard and create
a new combustible dust standard. These recommendati ons, which include revising the PSM standard to require MOC reviews for organizational changes su ch as mergers and acquisitions that may impact process safety, and ensuring PSM coverage for atmospheric storage tanks that could be involved in a potential catastrophic release, have stemmed from major CSB investigations including its BP Texas City, Motiva, ConAgra, Kleen, Imperial Sugar, and Hoegan aes investigations, as well as its Combustible Dust Study. 240 OSHA’s failure to implement these recommendations , which can be attributed to its lack of rulemaking activities over the last decade, led the CS B to reclassify seven key open recommendations as “Open-Unacceptable.” The CSB also adopted th e OSHA Combustible Dust Standard recommendation as a CSB “Most Wanted Chemical Safety Improvement.” OSHA formally responded and cited to the GAO report discussed above, noting that on average, it take s OSHA seven years to issue a standard, a process

233 See OSHA’s rulemaking abstract at http://www.reginfo.gov/public/do/eAgenda ViewRule?pubId=201304&RIN=1218-AC82 (accessed September 17, 2013).

234 Most federal agencies develop rules through “informal rulemaking.” Under the Administrative Procedure Act, or APA, informal rulemaking requires a publication of a “Notice of Proposed Rulemaking” (NPRM) in the Federal Register; opportunity for public participation by submission of written comments; consider ation by the agency of the public comments and other relevant material; and publication of a final rule not less than 30 days before its effective date, with a statement explaining the purpose of the rule. Under the APA, an agency may publish an Advance Notice of Proposed Rulemaking (ANPRM) when the agency wants to test out a proposal or solicit ideas before it drafts its NPRM. For more information see http://www.foreffectivegov.org/node/226 (accessed September 17, 2013).

235 See https://www.osha.gov/pls/oshaweb /owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=13792 (accessed September 17, 2013).

236 This incident took place on Friday, Ap ril 21, 1995, at a chemical facility occupied by Napp Technologies. The explosion and fire resulted in five fatalities.

237 See https://www.osha.gov/pls/oshaweb /owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16776 (accessed September 17, 2013).

238 See https://www.osha.gov/pls/oshaweb /owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=16946 (accessed September 17, 2013).

239 In a 2002 study entitled Improving Reactive Hazard Management , the CSB made recommendations to OSHA and the EPA to expand their regulations to include reactiv e chemicals and hazards. To date, neither agency has acted on the recommendations. See http://www.csb.gov/in-safety-message-c sb-chairperson-ra fael-moure-erasocalls-for-regulatory-covera ge-of-reactive-chemicals-following-the -west-fertilizer-exp losion-and-fire-/ (accessed September 23, 2013).

240 For more information on this meeting, see http://www.csb.gov/events/csb-public-meeting-to-vote-on-key-safetyrecommendations-and-initiate-most-wanted-program/ (accessed July 29, 2013).Chevron Richmond Refinery Regulatory Report January 2014

49 that is only getting longer. Hence, OSHA reserves rulemaking for “widespread and serious hazards.” Needed petroleum refinery and chemical process safety improvements may never fall under this category.

OSHA noted at the meeting that it would be utilizing a Request for Information 241 (RFI) to aid in the revision of its PSM standard, aimed at addressing a number of issues that have developed in the 21 years since the PSM standard was promulgated in 1992. On December 9, 2013, OSHA published its RFI in the Federal Register. 242 The RFI requests comment on potential revisions to OSHA’s PSM standard, among other regulations. The RFI identifies seventeen topi cs for potential rulemaking and enforcement changes, including clarifying the PSM exemption for atmosphe ric storage tanks and expanding PSM coverage and requirements for reactive hazards. The RFI also cites a number of CSB investigation reports and recommendations, including the CSB Reactive Hazard Study entitled Improving Reactive Hazard Management , the BP Texas City Investigation Report, and the Donaldson Enterprises, Inc., Investigation Report. 243 Although the RFI is an important opportunity to enhance the dialogue on implementation of the safety case regulatory approach to enhance process safety management and risk reduction in the US, it does not specifically mention the safety case approach. 244

On January 3, 2014, OSHA released a response to Section 6(a) of Executive Order 13650, 245 which tasked the Chemical Facility Safety and Security Working Gr oup, created by the Order and consisting of federal agencies such as OSHA, the EPA, and PHMSA, 246 with considering options to improve chemical safety regulation. The document provides separate responses from each member agency of the group, and notes that the group is seeking public input on potential ar eas where standards could be improved. According to the document, three agencies – OSHA, the EPA, and PHMSA – have all included “[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to reduce

241 An RFI is a tool used by a federal agency to help develop a proposed rule. Federal agencies generally use RFIs when they want public input on whether a new rule or changes to an existing rule are needed, and comments on what course the agency should take should it decide to move forward. More information available at http://www.dol.gov/regulations/participate.htm (accessed July 29, 2013).

242 78 Fed. Reg. 73756 (2013).

243 A full copy of the OSHA RFI is available at https://www.federalregister.g ov/articles/2013/12/09/2013- 29197/process-safety-man agement-and-prevention-of -major-chemical-accidents (accessed January 7, 2014).

244 OSHA has released on its website a separate document responding to Executive Order 13650, Section 6(a) – Solicitation of Public Input on Options for Policy, Regulation, and Standards Modernization. OSHA states in this document that it is seeking public input on potential areas where it could improve its standards, and includes “[e]valuating the implementation of best practices and lessons learned such as the ‘safety case’ regulatory model to reduce risk in complex industrial pro cesses” as an area to consider. https://www.osha.gov/chemicalexecutiv eorder/Section_6ai_Options_List.html (accessed January 7, 2014). However, the safety case regulatory model is not mentioned in the RFI that was released for public comment.

245 This document is available at https://www.osha.gov/chemicalexecutiveorder/Section_6ai_Options_List.html (accessed January 7, 2014).

246 The Chemical Facility Safety and Security Working Grou p is co-chaired by the Secr etary of Homeland Security, the Administrator of the EPA, and the Secretary of Labor. The Working Group must consist of the head or a designated representative of the Department of Justice, Department of Agriculture, and the Department of Transportation. The Working Group must also consult with representatives from the Council on Environmental Quality; the National Security Staff; the Domestic Policy Council; the Office of Science and Technology Policy; the Office of Management and Budget; the White House Office of Cabinet Affairs; and other agencies designated by the President. http://www.whitehouse.gov/th e-press-office/2013/08/01/executive -order-improving-chemical-facilitysafety-and-security (accessed Januar y 13, 2014).Chevron Richmond Refinery Regulatory Report January 2014

50 risk in complex industrial processes” in a preliminary list of options to consider for improving chemical facility and safety. 247

OSHA’s ability to adapt to process safety-related new or revised codes, sta ndards, technology, and lessons learned is mainly limited to RAGAGEP requ irements, which OSHA included in the mechanical integrity and PSI elements of its PSM standard in pa rt to “provide flexibility for the employer to choose the frequency which would provide the best assurance of equipment integrity.” 248 OSHA meant for RAGAGEP to include “both appropriate internal standards and applicable codes and standards....” 249 However, the concept of RAGAGEP only applies to 2 of the 14 PSM standard elements (mechanical integrity and PSI), 250 only addresses equipment and mechanical in tegrity, and is usually utilized by OSHA
as a mechanism to issue citations to companies post-incident.

In addition, OSHA has had difficulty enforci ng RAGAGEP citations. In a recent OSHA Review Commission proceeding, Secretary of Labor v BP Products North America, Inc., & BP-Husky Refining, LLC, 251 and United Steelworkers Local 1-346, the Administrative Law Judge (ALJ) vacated OSHA RAGAGEP citations issued to BP for violations of 29 CFR §1910.119(d)(3)(ii) 252 for failure to comply with a specific RAGAGEP, holding that OSHA impermissibly adopted a specific RAGAGEP, thereby diminishing the performance aspect of the RAGAGEP requirements contained within the OSHA PSM standard. The ALJ concluded that by citing to only one specific RAGAGEP, OSHA impermissibly adopted a prescriptive standard; in the ALJ’s view, OSHA should have acknowledged other possible RAGAGEPs for BP to comply with, including BP’s ow n internal standards. If upheld, this ruling may limit OSHA’s ability to utilize RAGAGEP as a means of requiring companies to implement industry good practices in the future. 253

The cumbersome rulemaking process and lack of flexibilit y that has resulted in stagnant and static OSHA
standards can be contrasted with the structure of the safety case regulatory regime, which facilitates adaptability and enables the regulator to improve industry safety performance and practices without requiring a major rule change. The safety case essenti ally provides the regulator with the tools to recognize more rigorous standards and practices that exist and drive a company to implement those practices to further reduce risks, as well as work with industry to improve existing standards and practices if necessary. It also enables comp anies to implement new, more efficient or safer technologies that do not necessarily meet strict prescriptive regulations, but that drive risk reduction.

This adaptability is illustrated by the HSE’s recommendations following the 2004 Buncefield incident. On December 11, 2004, a number of explosions o ccurred at Buncefield Oil Storage Depot in Hemel Hemptstead, Hertfordshire, England following the overfilling of a gasoline tank. Over 40 people were injured and there was significant offsite damage to homes and businesses. An independently chaired Major Incident Investigation Board led by Lord Newton of Braintree was set up to investigate the
incident. Between 2006 and 2008 the Board issued a number of reports and recommendations. In the

247 Ibid.

248 57 Fed. Reg. 6390-6391 (1992).

249 Ibid at 6390-6391.

250 29 CFR §§1910.119(d)(3)(ii) and (j)(4)(ii) and (iii).

251 BP Products North America, Inc. operates a refinery in Oregon, Ohio. BP-Husky is a joint venture with a business interest in the refinery.

252 29 CFR 1910.119(d)(3)(ii) requires the employer to document that equipment complies with RAGAGEP.

253 The Occupational Safety and Health Review Commission is scheduled to review the decision.Chevron Richmond Refinery Regulatory Report January 2014

51 report issued in March 2007 entitled “Recommendations on the design and operation of fuel storage sites,” the Board highlighted the adaptability of the existing regulatory regime by noting that the recommendations to improve standards and revise guidan ce should not require actual changes to the law, because the existing legal framework was “sufficient to ensure that necessary improvements are put in place.” 254 The Board followed by making its first recommendation of the report to the COMAH CA and operators of Buncefield-type sites to develop and agree on a methodology to determine safety integrity level requirements for overfill prevention systems, wh ich takes account of, among other things, nearby resources or populations. 255 The Board also recommended that the sector “develop guidance to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if
loss occurs.” 256 Another key recommendation was made to the CA to “ensure that safety reports submitted under the COMAH Regulations contain info rmation to demonstrate that good practice in human and organisational design, operation, maintena nce and testing is implemented as rigorously as for control and environmental protection engineering systems.” 257 Finally, the Board recommended in this report that the “sector agree with the Comp etent Authority on a system of leading 258 and lagging 259 performance indicators for process safety performance...” based on HSE’s guidance on Developing process safety indicators. 260

Spurred by recommendations made surrounding the Buncef ield incident, the BP Texas City incident, and the BP Grangemouth incident, 261 the COMAH CA developed an Operational Delivery Guide entitled “COMAH Competent Authority Workstream 2e: Process safety performance indicators,” 262 which was “designed to continue the promotion and developmen t of site level process safety performance indicators (PSPIs) as part of the monitoring arrangements for an effective process safety management system at major hazard sites.” 263 The guide states that by the end of March 2013 all “Buncefield-type” sites would “have effective monitoring of process safety perform ance in place and that site specific leading and lagging performance indicators have been developed...” 264 and that by the end of 2015 “all major hazard establishments and duty holders will measure their pe rformance on the control of major hazard risks by way of key leading and lagging performance indicators.” 265 It lays out in detail a six-step process for implementing a process safety measurement syst em; how inspectors will assess a duty holder’s

254 Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007; p 3. http://www.buncefieldinvestigation. gov.uk/reports/recommendations.pdf (accessed May 21, 2013).

255 Ibid at 8.

256 Ibid at 15.

257 Ibid at 19.

258 Leading indicators are measurements th at predict future performance to ensure that safety protection layers and operating discipline are being maintained, including unsafe behaviors or insufficient operating discipline equipment selection, engineering design, specification of inspection frequency, and technique. See Center for Chemical Process Safety (CCPS), Guidelines for Process Safety Metrics ; October 2009; p 20.

259 Lagging indicators are facts about previous events, such as process safety incidents, that meet the threshold of severity and should be reported as part of the process safety metric. Ibid at 20.

260 Ibid at 13.

261 Between May 29 and June 10, 2000, three incidents occurred at the BP Grangemouth Petrochemical Complex in Scotland, which is one of the largest of the 950 COMAH sites in the UK.

262 Available at http://www.hse.gov.uk/comah/guidance/proc ess-safety-perform ance-indicators.pdf (accessed May 21, 2013).

263 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 3.

264 COMAH Competent Authority, “Workstream 2e: Process safety performance indicators,” 2012; page 6.

265 Ibid at 3.Chevron Richmond Refinery Regulatory Report January 2014

52 performance; and adds that full im plementation of this program coul d take between 18 months and two and a half years from when the initial introduction takes place – all without requiring any fundamental changes to the COMAH regulations themselves.

The COMAH CA Investigation Team noted in its publication summarizing the conclusions of the Buncefield investigation that following the incident, the CA, industry, and trade unions worked together to “drive forward high standards at fuel storage sites...[which] has resulted in agreement on improved standards of safety and environmental protection for a ll UK sites storing large volumes of gasoline and to systematically upgrade sites to meet these standards....” 266

In another example following the Buncefield incident, the Board recommended significantly higher standards than were generally in place in the sector . For example, the Board recommended that fuel storage tanks be fitted with automatic overfill protecti on equipment that would cut off supply if an overfill event occurs, rather than continuing to rely on operators to interrupt flow manually in the case of an event. In response, the UK Petroleum Industry Asso ciation and the Tank Storage Association adopted the recommendation, and the British government announced th at it would require all sites to move to fully automatic shutdown systems on tanks storing gasolin e. The Process Safety Leadership Group (PSLG) was formed to help develop the details of the new ru le, and to “meet the need for an effective framework for interaction between industry, trade unions and the COMAH Competent Authority (CA)....” 267 As will be discussed in the next section, workforce involve ment is a key element of an effective safety case regulatory regime. In 2009, HSE publis hed the PSLG’s work in a document entitled Safety and Environmental Standards for Fuel Storage Sites . The document lays out precisely which tanks must utilize automatic overfill protection equipment, and also allows for duty holders to demonstrate technical reasons as to why automatic overfill protection would not be appropriate by “prepar[ing] a robust demonstration that alternative measures are capable of achieving an equivalent ALARP outcome to an overfill protection system that is automatic...” 268 This document in essence was developed as an industry good practice, and compliance with its requirements woul d likely ensure that the duty holder is complying with the law and reducing risks to ALARP. 269

This can be contrasted with an even larger release of gasoline and a subsequent explosion that occurred in the 2009 tank overfill at the Caribbean Petroleum Corpor ation near San Juan, Puerto Rico. This incident severely damaged surrounding buildings and impacted moving vehicles. However, the incident has not resulted in any re-evaluation of safety rules by the EPA or OSHA, despite the fact that tank terminals largely fall outside the PSM and RMP program regulations , (let alone the more rigorous requirements of a major hazard safety case regulatory regime, as practiced in the UK).

These post-Buncefield examples highlight one of the most important attributes of the safety case regulatory approach: it is a regulatory framework that implements a balance of goal-setting and prescriptive elements which enable the regulator to drive facilities to continuously improve practices

266 The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel He mpstead, Hertfordshir e on 11 December 2005 ; February 2011; p 3. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013).

267 Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London, 2009; p 7. http://www.hse.gov.uk/comah/bun cefield/fuel-storage-sites.pdf (accessed August 1, 2013).

268 Ibid at 29.

269 For a detailed discussion of rule-compliance and the safety case, see Hopkins, Andrew. Risk-management and rule-compliance: Decision-making in hazardous industries; Safety Science 49 (1011) 110-120.Chevron Richmond Refinery Regulatory Report January 2014

53 aimed at reducing risks to ALARP, without having to adhere to the extensive and time-consuming rulemaking requirements that exist in the US. This flexibility and adaptability encourages facilities to focus on improving practices and technology rather than on completing activity-based requirements, which can have the effect of stifling inn ovation and technological advancement.

Critics argue that because there have been significan t industry problems with the maintenance of safety critical equipment and aging equipment in the UK, 270 the safety case regime is not operating effectively. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many facilities due to company deferral of maintenanc e, insufficient testing of safety-critical elements, and a continuing industry culture of responding to di sasters. However, the HSE has worked to make improvements to these areas. In 2010, the UK HSE initiated Key Programme 4 to address the issue of aging equipment offshore and the operation of installations beyond their design life. 271 The same year, the HSE published a report intended to inform industr y and aid in the prevention of major accidents
entitled Managing Ageing Plant: A Summary Guide, 272 which provides an overview of ageing plant mechanisms and their management. This document pr esents analysis and findings for loss of containment incidents to demonstrate how aging plant equipment may be a factor. The HSE has been able to take this type of programmatic proactive approach in the UK thanks to th e safety case regime’s adaptive nature, which is lacking in the US both on and offshore. Th is is positive evidence of a competent and effective regulator with the tools under the safety case regime to identify and proactively address industry gaps in safety performance.



## 4.4 Active Workforce Participation

As the CSB noted in its Interim Report on the Chevron incident, workforce participation is a key element of process safety and effective majo r accident prevention. In one of its publications, the Center for Chemical Process Safety (CCPS) lists workforce involvement as one of 20 essential management components necessary to reduce process safety risks and prevent chemical accidents. 273 According to CCPS,

...workers are potentially the most knowledgeable people with respect to the day-to-day details of operating the process and maintaining the equipment and facilities and may be the sole source for some types of knowledge gained through their un ique experiences. Workforce involvement provides management a mechanism for tapping into this valuable expertise. 274

This CCPS publication discusses general areas of workfo rce involvement in risk assessments, inspections, audits, and performance reviews, and notes that participation leads to empowerment, management

270 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf , (accessed August 28, 2013).

271 The UK launches Key Programmes to address poor perf ormance in specific areas. Access the report entitled Key Programme 4 (KP$): Ageing and life extension at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013).

272 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013).

273 CCPS. Guidelines for Risk Based Process Safety; March 2007; p liv.

274 Ibid at 124.Chevron Richmond Refinery Regulatory Report January 2014

54 responsiveness, and process safety performance improvement. 275 The OSHA PSM standard requires employers to consult with employees and their representatives on the conduct and development of PHAs and on the development of the 13 remaining PSM el ements, and to develop a written plan of action regarding the implementation of the employ ee participation required under this section. 276 During facility inspections, OSHA inspectors must request and evaluate these written plans of action regarding the implementation of employee participation as well as interview employees and their representatives to verify that the employer is satisfying the requirements. 277

In previous investigation reports, the CSB has identif ied that workers and their representatives play a very important role in major incident prevention. For example, as will be discussed in the next section on performance indicators, the CSB recommended in its BP Texas City Final Investigation Report that BP and the United Steelworkers Union (USW) establish a jo int program to report incidents and near misses, and to ensure that recommendations made during investigations were implemented. The CSB also recommended that API and the USW work together to develop a safety standa rd addressing leading and lagging process safety indicators. 278 However, representatives from the US W have stated to the CSB that it is a constant struggle for workers and their repr esentatives to have a voice or play a role in the management of safety in US petroleum refineries.

The law in the UK also requires employers to consu lt with their employees or their safety representatives on health and safety matters. The Safety Represen tatives and Safety Committe es Regulations 1977 and the Health and Safety (Consultation with Employees) Regulations 1996 set out the legal framework for
such consultation and worker involvement at both unionized and non-unionized onshore facilities. 279 However, these regulations go further than the OSHA PSM standard in that they provide for the election of safety representatives by the workers to serve ma ny health and safety-rela ted functions, including investigating complaints and accidents and carrying out inspections. In his keynote speech at the Oil and Gas UK Piper 25 conference, Lord Cullen stated th at the safety representative positions have “important functions, such as the power to carry out investiga tions and reporting safety concerns to management, without fear of recrimination,” noting that they “help[] reinforce the principle that each employee is responsible for his own safety.” 280 The regulations also require employers to establish a safety committee when one is requested by at least two health and safety representatives. The 1996 regulations require employers to consult with employees not repr esented by safety representatives under the 1977

275 Ibid at 125.

276 29 CFR §1910.119(c) (2012).

277 See OSHA CPL 02-02-045. Process Safety Manageme nt of Highly Hazardous Chemicals – Compliance Guidelines and Enforcement Pro cedures. September 13, 1994. https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=1558&p_table=directives (accessed September 6, 2013).

278 Process safety indicators are also re ferred to as safety performance indicat ors, metrics, key process indicators, performance measures, indicators, etc...

279 The 1977 regulations apply to workplaces where the em ployer recognizes trade unions and trade unions are recognized for collective bargaining purposes. Regulations available at http://www.legislation.gov.uk/uksi/1977/500/contents/made (accessed September 4, 2013). The 1996 regulations apply to workplaces where employees ar e not in a trade union and/or the em ployer does not recognize the trade union, or the trade union does not represent those employees not in the trade union. Regulations available at http://www.legislation.gov.uk/uksi/1996/1513/contents/made (accessed September 4, 2013).

280 Finding Petroleum. Review: Lord Cullen – what have we learned from Piper Alpha? September 16, 2013. http://www.findingpetroleum.com/n/Review_Lord_Culle n_what_have_we_learned_from_Piper_Alpha/044b5113.as

px (accessed September 16, 2013).Chevron Richmond Refinery Regulatory Report January 2014

55 Regulations on a number of health and safety-related matters, such as the introduction of any measure which may substantially affect their health and safety at work, the planning and organization of health and safety training, and the health and safety c onsequences of introducing new technology. 281 The law in the UK protects employees from being penalized for ta king part in health and safety consultation. 282

The UK’s existing regulations and policies regarding worker involvement offshore were developed and strengthened as a result of the Piper Alpha incident. In the Piper Alpha Report, Lord Cullen emphasized the importance of workforce involvement in safe opera tions, and noted that a safety committee system is “the most visible instrument for the involvement of the workforce in safety.” 283 He concluded by recommending that “the regulatory body, operators and contractors should support and encourage the involvement of the offshore workforce in safety.” 284 The HSE developed guidance in response to Lord
Cullen’s recommendations entitled Play your part! How offshore wo rkers can help improve health and safety , intended to encourage workforce participation offshore. 285 The most current version of this guidance document, which was prepared by the Workforce Involvement Group, 286 located within the HSE’s Offshore Industry Advisory Committee, 287 utilizes good practice and examples of successful workforce involvement in improving health and safety with the goal of assisting operators, contractors, safety representatives, and others in effectively utiliz ing workforce involvement in their workplaces. It encourages companies to facilitate workforce i nvolvement by providing information, improving communication at all levels, good training, and ensuri ng that all workers are represented in the decisions
that affect them. 288

The Piper Alpha incident also resulted in the sw ift development of the SI971 Offshore Regulations (Safety Representatives and Safety Committees) Re gulations 1989 (“the SI971 Regulations”), which provide for the nomination and election of safety re presentatives and require offshore installations to establish safety committees. 289290 The HSE has published a guidance document entitled A guide to the

281 See HSE. Consulting employees on health and sa fety: A brief guide to the law. 2013. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 4, 2013).

282 See Employment Rights Act 1996. Section 44. Health and safety cases. http://www.legislation.gov.uk/ukpga/1996/18/section/44 (accessed September 4, 2013).

283 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 301.

284 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990; p 392.

285 See HSE. Play your part! How offshore workers can help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013).

286 The Workforce Involvement Group’s mission is to improve safety “by stimulating lateral learning and best practice across the offshore industry through involvement of the whole workforce.” It looks at ways to increase worker involvement in health and safety matters offs hore and is chaired by HSE. For more information see http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/wig.htm (accessed June 17, 2013).

287 The Offshore Industry Advisory Committee is a tr ipartite committee that includes members representing employers, employees, unions, trade associations and other government departments. It is focused solely on the offshore sector. More information is available at http://www.hse.gov.uk/aboutus/meetings/iacs/oiac/information.htm (accessed June 17, 2013).

288 HSE. Play your part! How offshore workers can help improve health and safety; 2013; p 4. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013).

289 Under Regulation 16, safety representatives are responsible for investigating potential hazards and incidents, examining causes of accidents, inves tigating complaints by any member of his or her constitu ency relating to occupational health and safety, representing members of the workforce in consultations on the offshore installation with inspectors, and consulting constituency members on any matters arising out of the Regulation. Under Regulation 17, a safety representative may inspect any part of the offshore installation or its equipment either on aChevron Richmond Refinery Regulatory Report January 2014

56 Offshore Installations (Safety Representa tives and Safety Committees) Regulations 1989 291 designed to assist duty holders, employers, installation managers , safety representatives, safety committee members
and all members of the workforce in the offshore indu stry with what the regulations require and what must be done to comply with them. The document explains that although the primary responsibility for health and safety resides with the duty holder, “all memb ers of the workforce must play their part if risks
are to be eliminated or minimized.” 292 It also emphasizes the importance of training of safety representatives, which enables them to effectively represent workers and fulfill their responsibilities and functions under these Regulations.

In April 2010, the HSE launched an inspection project to examine the effectiveness of the SI971 Regulations and the effectiveness of those regulations , as well as to collect examples of best practice to present to the offshore industry. 293 Forty-one inspections were completed in a six-month period on offshore installations operated by 25 different duty ho lders. The project helped focus on the power of safety representatives and how to strengthen their ability to effectively perform their duties. It also was well-received by the safety representatives, as it gave them encouragement and recognition, and sent a message to management on the importance of SI971 and the key role of safety representatives and committees in workplace health and safety.

The HSE has placed great emphasis and importance on the role of worker involvement and consultation in improving workplace health and safety and reducing major accident s on and offshore. In June 2009, HSE launched a new strategy entitled Be part of the solution, which lists workforce involvement as one of its main priorities, and the agency has published a significant amount of guidance on worker
involvement and consu ltation on its website. 294

The Norwegian Working Environment Act addresses the rights and duties of safety representatives and committees in Norway. It applies to nearly all workers in Norway, including onshore and offshore oil workers. The Act provides for the election of government recognized safety representatives whose duty is to “safeguard the interests or employees in matters of the working environment.” 295 These

regular basis or following an incident. According to HSE, “this can be of gr eat benefit to the duty holder because it brings an independent look at health and safety factors from the workforce viewpoint. Workers are in the front line and are often well placed to see problems and put forward practical suggestions.” HSE. A guide to the Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989; 2012; p 20. http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013).

290 Under Regulation 22, safety committees are responsible for reviewing the system of constituencies so as to ensure adequate representation of the workforce on hea lth and safety matters, reviewing training of safety representatives, reviewing the frequency of safety committee meetings and the circumstances under which they may be called, and considering causes of accidents and ma king recommendations to the installation manager.

291 Third edition published in 2012. Available at http://www.hse.gov.uk/pubns/priced/l110.pdf (accessed September 4, 2013).

292 Ibid at 7.

293 See HSE. Offshore workforce involvement and consultation: Compliance Inspection Project. Available at http://www.hse.gov.uk/offshore/si971.pdf (accessed September 4, 2013).

294 See http://www.hse.gov.uk/involvement/hsrepresentatives.htm (accessed September 4, 2013).

295 Act Relating to Working Environment, Working Hours and Employment Protection, Etc. (Working Environment Act). December 2012. Sectio n 6-1. Obligation to elect safety representatives.Chevron Richmond Refinery Regulatory Report January 2014

57 representatives have the right to information, c onsultation, and participation in inspections. 296 They also have the right to halt unsafe work until the re gulator decides when the work may continue. 297

A fundamental element in effective safety management for major accident prevention is active and equal participation from the regulator, industry, and labo r. Each entity provides unique and essential insights, and removing the participation of these entities remov es a critical voice in health and safety matters. In the UK and Norway, tripartite systems consisting of i ndustry, the regulator, and the workforce have been established to deal with safety and health issues at the highest levels beyond just site workforce representation.

The CSB investigation staff has had extensive discu ssions with worker representatives who have voiced their opinions on their systems to the CSB. Roy Furre, a Representative from the Norwegian Union of Energy Workers, spoke at the CSB’s 2010 public h earing on the Regulatory Approaches to Offshore Oil and Gas Safety, and stated that the Norwegian wo rking environment and the accompanying petroleum regulations empower unions and safety delega tes in all phases of the petroleum activities. 298 He also noted that the Norwegian petroleum regulations requi re that all necessary information about risks and decisions be given to the workers’ representatives. 299 During the CSB’s public hearing on Safety Performance Indicators in July 2012, Jake Molloy, th e Regional Organizer for the National Union of Rail, Maritime and Transport Workers in the UK, stated that the input of workers is “crucial” in major accident prevention and that “if the people operating these syst ems and delivering these results are unable for any reason to tell you what the true picture is, everything else is worthless.” 300 When speaking at a “Step Change for Safety” Conference in Aberdeen, Scotla nd, on September 5, 2012, Mr. Molloy noted that attending the public hearing in Houston was “eye openi ng” and that hearing about the US system was like
a “walk back in time.” 301



## 4.5 Process Safety Indicators that Drive Performance

As the CSB noted in both its July 2012 public hearing on Safety Performance Indicators and its Chevron Interim Report, leading and lagging process safety indicators help drive continuous process safety improvement, as long as regulators utilize these indicators to focus inspections, audits, and investigations , and organizations focus attention on them in a way that makes a difference. Process safety indicators are a significant element of process safety management systems. They measure the strengths and weaknesses of these systems to achieve and maintain safe and reliable operations 302 and, if properly defined, collected and used, can identify the success es and flaws of the system. 303

296 Ibid at Section 6-2. Duties of safety representatives.

297 Ibid at Section 6-3. The safety representa tive’s right to halt dangerous work.

298 CSB. Public Hearing: Regulatory Approaches to Offshore Oil and Gas Safety

. December 15, 2010; p 300. http://www.csb.gov/assets/1/19/Tran script_of_Public_Meeting_12_15_2010.pdf (accessed December 10, 2013).

299 Ibid at 300.

300 CSB. Public Hearing: Safety Performance Indicators. July 23, 2013; p 143. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed December 10, 2013).

301 http://www.youtube.com/watch?v=-xDzb4x8t_c (accessed December 10, 2013).

302 CCPS. Guidelines for Process Safety Metrics; October 2009; p 109.Chevron Richmond Refinery Regulatory Report January 2014

58 Lagging indicators are a “form of reactive monitoring” 304 that includes events such as major spills, fires, or gas releases. Leading indicators, on the other hand, are a “form of active monitoring,” 305 and are
described as events that do not result in severe consequences and usually address safety system performance, such as deviations from safe operating limits or timely maintenance on safety critical equipment. 306 Leading indicators “can be considered as measures of process or inputs essential to deliver the desired safety outcome.” 307 The general thinking globally is th at if companies rely primarily on lagging indicator data, which is retr ospective, they are not effectivel y managing process safety to ensure major accidents are prevented. According to the H SE, “[t]oo many organizations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong. Discovering weaknesses in control systems by having a major incident is too late and too costly.” 308 Rather, facilities must identify critical controls to monitor and set leading indicators against each one to show that the system is operating as intended.

The HSE was one of the earliest regulators to adopt process safety indicators regulations. In 1995, the agency began requiring companies to report health and safety data, and then published annual reports based on those statistics. In 2006, the HSE de veloped a step-by-step guidance document entitled Developing process safety indicators 309 to assist industry. The guid e establishes and discusses in detail six main steps necessary to implement a process safety measurement system, including developing leading and lagging indicators. It also defines leadi ng and lagging indicators for each of the controls in the risk control system. According to Jake Molloy, “[i]t is our firm belief that the most influential and effective schemes using indicators to measure im provements and major accident prevention are those initiatives generated by our regulator, the Health and Safety Executive [HSE].” 310

As discussed in the previous section, a number of large incidents, including BP Texas City and BP Grangemouth, have highlighted the need for the ch emical and other major hazard sectors to demonstrate that risks are being adequately controlled. In response to recommendations stemming from such incidents, the COMAH CA developed an Operational Delivery Guide in 2010 on process safety performance indicators setting out four stages to ai d facilities in the development of process safety indicators. The document sets out a goal that by th e end of 2015 major hazard establishments and duty holders will measure their safety performance and cont rol of risk by way of key leading and lagging performance indicators.

Following the 2005 BP Texas City incident, BP developed company-wide process safety indicators, and now includes process safety metrics in performance contracts for its US refinery managers. 311 However,

303 Ibid.

304 HSE. Developing process safety indicators: A step-by-st ep guide for chemical an d major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

305 Ibid.

306 Hopkins, Andrew. Disastrous Decisions: The Human and Or ganisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 83.

307 HSE. Developing process safety indicators: A step-by-st ep guide for chemical an d major hazard industries; 2006; p 7. http://www.hse.gov.uk/pubns/priced/hsg254.pdf (accessed October 30, 2013).

308 Ibid at 1.

309 Full title is Developing process safety indicators: A step-b y-step guide for chemic al and major hazard industries; first published in 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

310 Molloy Testimony. CSB Indicators Public Hearing Transcript; July 24, 2012; p 139.

311 Hopkins, Andrew. Disastrous Decisions: The Human and Or ganisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012; p 84.Chevron Richmond Refinery Regulatory Report January 2014

59 existing guidance in the US pertaining to safety performance indicators does not adequately aid companies in managing major hazards onshore. The CS B has noted that in virtually every incident it investigates in the US, process safety indicators are e ither not used at all or not used effectively. 312 Millions of workplaces around the US primarily measure their safety performance using OSHA recordable injury and illness rates, wh ich include slips, trips, and falls. While collecting this type of data is also necessary in hazardous operations, it is not sufficient. Injury rates do not depict the effectiveness of a high hazard facility’s process safety management program. 313 For example, the CSB noted in its BP Texas City investigation that BP’s personal injury metrics were desc ribed as being at the best level on record; yet, around this same time, in March 2005, BP Texas City experienced the devastating 15-fatality incident, which resulted from a progressive erosion of process safety performance that was not reflected in injury statistics.

Following the BP Texas City incident, a number of key recommendations were made to strengthen guidance on indicators in the US. For example, the Baker Panel 314 issued the Baker report, which recommended the incorporation of safety indicators to measure safety performance, and stated:

The Panel believes that relying exclusively or predominantly on lagging indicators to assess process safety performance is ill-advised. ... BP’s reliance on lagging, after-the-fact indicators of process safety performance rather than leading, predictive measures...impaired BP’s ability to measure, monitor and detect deteriorating or degraded process safety conditions and performance... This failure to use a set of effective performance metrics that includes leading indicators increased the likelihood that the organisation would identify the need for improvements or additional contro ls only after something had gone

wrong. 315

The Baker Panel also noted that it was not enough ju st to develop process indicators: these indicators needed to be meaningful to the co mpany. As such, the Baker Panel also recommended that “a significant proportion of total compensation of refining line ma nagers and supervisors [be] contingent on satisfactorily meeting process safety performance goals...” 316

In its final investigation report on the incident, the CSB made a recommendation to API and the USW to jointly lead development of a consensus standard for leading and lagging process safety indicators to drive performance improvements in the prevention of major incidents. API responded by issuing RP 754, Process Safety Performance Indicators for the Refining and Petrochemical Industries. However, this voluntary standard, which defines a framework of four tiered indicators that incorporate the concepts of lagging to leading measures, has significant shortc omings, as the CSB described in a two-day public

312 Donald Holmstrom. CSB Indicators Public Hearing Transcript ; July 24, 2012; p 13.

313 Ibid.

314 In the aftermath of the BP Texas City Incident, BP followed the recommendation of the CSB and formed an independent panel known as the Baker Panel to conduct a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety overs ight at its US refineries. For a copy of their findings and recommendations see http://www.bp.com/liveassets/bp_internet/globalbp/global bp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak er_panel_report.pdf (accessed August 13, 2013).

315 Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007; p 194.

316 Ibid at 251.Chevron Richmond Refinery Regulatory Report January 2014

60 hearing on Safety Performance Indicators that was held in July 2012. The CSB analysis found that the ability of RP 754 to drive performance improvement a nd inform key stakeholders will be hampered by

 lagging indicators with insufficient statistical rigor needed to allow for trending or incremental performance improvements;

 the lack of well-defined standardized and norma lized leading indicators that are needed for comparison among sites, corporations, or to national averages;

 weak employee protection requirements; public repor ting requirements that will be ineffective to adequately inform stakeholders; and

 the lack of broadly based consensus in the standard’s development process. 317

As a result, in 2012 the CSB Board designated the response to the CSB’s recommendation as “openacceptable,” 318 meaning that the recommendations recipient is moving in the right direction, but more
remains to be done.

The CSB also noted in the Chevron Interim Report the important role the public plays in monitoring safety management systems, and referenced CCPS as promoting the sharing of process safety indicators with the public:

Sharing performance metrics and resu lts broadly can engage the public as a partner in holding the organization accountable for process safety performance. Making metrics a nd performance public can be an especially powerful way of maintaining upper management commitment since it will likely be the CEO or other senior managers who will be called to account by the public if goals are not met or performance declines. Communicating process safety successes also demonstrates to employees and the public that positiv e change can be, and are being, made within an organization. 319

The Petroleum Safety Authority (PSA) in Norway provides annual reports to the public on its website assessing indicators it has collected directly from o ffshore and onshore major hazard facilities since 2000 and 2006, respectively. The PSA utilizes the indicat ors data found in these reports to identify critical safety areas that must be targeted for improvement in order to prevent near misses and accidents. 320 The onshore report, Risk level in the petroleum industry, Onshore facilities

, 321, 322 includes a description and explanation of the indicators collected and analys is of these data. In this report the PSA notes a

317 CSB Public Hearing: Safety Performance Indicators. July 23-24, 2012; p 26. http://www.csb.gov/events/csbpublic-hearing-safety-p erformance-indicators/ (accessed August 14, 2013).

318 For more information on recommendations status designations, see http://www.csb.gov/recommendations/faq/#5 (accessed June 21, 2013).

319 Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics . 2010; p 109.

320 PSA. Trends in Risk Level: Summary Report 2012 – Norwegian C ontinental Shelf. 2012; p 1.

321 See http://www.ptil.no/publications/category175.htm l?ptil_md_art_list-select_group=Category-233 . The CSB had the 2010 version of the onshore report translated into English. http://www.ptil.no/getfile.php /PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 2013. (accessed September 17, 2013).

322 The corresponding report discussing offshore indicator data is entitled Trends in Risk Level. http://www.ptil.no/getfile.php /PDF/RNNP_2012/Trends%20in%20risk%20level_2012.pdf (accessed September 17, 2013.Chevron Richmond Refinery Regulatory Report January 2014

61 decreasing trend in the number of reported hydro carbon leaks on offshore production facilities between
2007 and 2010. 323 However, it is too soon for PSA to assess trends in the onshore indicators data, because the time period for onshore data collection h as been relatively short and there are fewer data points with only eight facilities onshore. The PSA also indicated that it will take time for the onshore data to improve as indicators are refined, but recognized that the same approach has already yielded good results in the offshore sector. 324 Additional information on data and trends based on safety case regime implementation are provided in Appendix C.



## 4.6 Regulatory Assessment, Veri fication, and Intervention

To effectively oversee covered facilities and enfo rce safety case regulations, technically competent regulators review and assess 325 safety case reports and utilize preventative inspections and audits to effectively intervene before high-ri sk activities commence. According to the HSE, “[t]he assessment process is only a part of the COMAH regime and examines at face value the factual information and examines arguments and demonstra tions contained in the report against the requirements of the regulations.” 326 The HSE places great emphasis during the assessment phase on the adoption of inherently safer designs 327 and notes that “[m]ajor accident hazards should be avoided or reduced at source through the application of principles of inherent safety.” 328 Conclusions on the adequacy of the safety case report are developed at the end of the assessment process, and, if deficiencies are found, an intervention strategy for the facility is developed to addresses those deficient measu res. According to the HSE, assessment of a safety case report or document “is not a discrete activity but leads to further action under the intervention plan for the operator at that establishment.” 329 Intervention by the regulator ensures that the facility and its operations are cons istent with information provided in the safety case report, and that there are robust systems in place to “r educe the likelihood of hazards and to mitigate their consequences until the associ ated risks are ALARP.” 330,331 Under the safety case regulatory regime, the regulator has the authority to accept the safety case repor t or reject it and require additional measures to
further reduce risks.

323 PSA. Risk level in the petroleum industry, Onshore facilities. 2010; p 80.

324 Ibid.

325 According to the HSE, the “assessment reviews the documentary evidence in the report and further documentation, as appropriate, which is referred to in the report or requested by the assessor.” HSE. The Safety Report Assessment Manual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013).

326 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 9. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013).

327 Ibid at 30.

328 HSE. The Safety Report Assessment Ma nual, Sections 2 to 7. p 3. http://www.hse.gov.uk/comah/sram/s2-7.pdf (November 26, 2013).

329 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 4. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013).

330 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013).

331 According to HSE, essential consider ations to ensure ALARP are “the scope of hazard elimination, the adoptionof inherently safer designs, whether good practice has been, or is to be adopted, [and] the application of riskreducing measures where relevant good practice is not yet established.” Ibid at 30 and 31.Chevron Richmond Refinery Regulatory Report January 2014

62 Preventative inspections and audits by a technically co mpetent regulator can also result in deep challenges to industry, which does not typically happen under the PSM or RMP regulations. In the UK, the COMAH regulations authorize the CA to

organize an adequate system of insp ections of establishments or other measures of control appropriate to the type of establishment concerned...[that are] sufficient for a planned and systematic examination of the systems being employed at the establishment, whether of a technical, organisationa l or managerial nature, so as to ensure...(a) that the operator can demonstrate that he has taken appropriate measures to prevent major accidents; (b) that the operator can demonstrate that he has provide d appropriate means for limiting the consequences of major accidents both inside and outside the establishment; (c) that the information contained in any report sent to the competent authority by the operator of the establishment adequately
reflects the conditions in the establishment... 332

The CSB noted in its BP Texas City Final Investiga tion Report that in the UK, HSE inspectors thoroughlyinspect high hazard facilities annually, and all COMAHcovered facilities are inspected every five years. For the approximately ten petroleum re fineries in the UK, detailed planned inspections (ranging from 80 to 150 days) are conducted annually for each refinery by a multidisciplinary team (regulatory inspectors, process safety, mechanical engineering, electrical and instrumentation, and human factors specialists). 333

The HSE lists its offshore priorities as safety case

assessment; 334 verification; 335 inspection; investigation; and
enforcement. 336 In its business plan for 2012-2015, the HSE set out a goal of assessing 72 safety cases onshore and 100 safety cases offshore for 2013 and 2014. 337 The work required to assess a safety case report both on and offshore is very resource-intensive (a typical new offshore safety case assessment requires anywhere

332 COMAH Regulations 1999 Part 6, Regulation 19(1) and (2).

333 The CSB. Investigation Report: BP Texas City Refinery Explosion and Fire. March 2007; p 205. http://www.csb.gov/assets/1 /19/CSBFinalReportBP.pdf (accessed October 29, 2013).

334 An owner or operator (i.e . the duty holder) is required to submit a safety case to HSE for each offshore installation. HSE then assesses the safety case using both regulations and HSE’s “Assessment Principles for Offshore Safety Cases (APOSC) and must accep t it before an installation can operate. See http://www.hse.gov.uk/of fshore/aposc190306.pdf (accessed July 31, 2013).

335 Duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to put in place and keep under continual review a verification scheme by whic h assurance is obtained from an independent competent person (ICP) that safety critical elements and the PFEER (O ffshore Installations (Prevention of Fire and Explosion, and Emergency Response) specified plant are suitable and remain suitable for the life of the installation. For more information see http://www.hse.gov.uk/offshore/verification.htm (accessed July 31, 2013).

336 See http://www.hse.gov.uk/offshore/priorities.htm (accessed July 15, 2013).

337 HSE. HSE Business Plan 2012-15; June 2012; p 14. http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013).Chevron Richmond Refinery Regulatory Report January 2014

63 from 100 to 300 hours of work), and demands that the regulator hire and retain individuals with significant oil and gas experience, specifically in areas such as process safety, human factors, engineering, and organizational performance.

In Australia, the Offshore Petroleum and Greenhouse Gas Storage Act 2006 authorizes NOPSEMA to conduct planned inspections of offshore insta llations to ensure compliance with the Act. 338 NOPSEMA notes that planned inspections “are a critical examination of aspects of a facility, its systems and operations with information obtai ned from the facility safety case.” 339 Subjects of planned inspections include risk control measures related to either a Major Accident Event 340 or Occupational Health and Safety controls, or both. NOPSEMA states that it conducts at least two per year for each normally
manned offshore installation. 341 NOPSEMA distinguishes between two types of planned inspections: field-based inspections, which focus on implementati on of control measures described in a facility’s safety case, and themed audits, which deal with inspection of organizational issues by following a common theme to direct lines of questioning. 342

In a 1992 compliance directive, 343 OSHA stated that the primary enforcement model for the PSM standard would be planned, comp rehensive, and resource-intensive Program Quality Verification (PQV) inspections. 344 These inspections consist of three parts: determining if the elements of a PSM program are in place; evaluating if the programs comply with the requirements of the standard; and verifying compliance with the standard through interviews, data sampling, and field observations. However, OSHA does not make planned inspections, which have the most opportunity for prevention, a high priority. Rather, OSHA lists its inspection priorities as 1) imminent danger situations; 2) fatalities and catastrophes; 3) complaints; 4) referrals; 5) follow-ups; and 6) planned inspections. 345

The CSB noted in its BP Texas City Final Investiga tion Report that for the 10-year period prior to the Texas City incident, federal OSHA had conducted no pl anned PQV inspections in oil refineries. As a result, CSB recommended in its report that OSHA strengthen the planned enforcement of the OSHA Process Safety Management (PSM) standard by de veloping more highly tr ained and experienced inspectors to conduct more comprehensive inspections , such as the PQV audits envisioned in the 1992 directive, at facilities presenting the greatest risk of a catastrophic accident. The intent of the recommendation was to establish a permanent, ongoing planned comprehensive inspections program.

338 Offshore Petroleum and Greenhouse Gas Storage Act 2006, Sections 600 and 601. See http://www.comlaw.gov. au/Series/C2006A00014 (accessed July 15, 2013).

339 NOPSEMA. Inspection Policy; p 2. http://www.nopsema.gov.au/asse ts/document/N-02000-PL0025- Inspection.pdf (accessed July 15, 2013).

340 Australia’s Offshore Petroleum and Greenhouse Gas Storage Regulations 2009 define a Major Accident Event as “an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of person at or near the facility.” Chapter 1.5. See http://www.comlaw.gov.au/Details/F2009L04578/Html/Text#param5 (accessed July 15, 2013).

341 For more information, see http://www.nopsema.gov.au/safety/inspections/ (accessed July 15, 2013).

342 For more information, see http://www.nopsema.gov.au/assets/document/N-02000-PL0025-Inspection.pdf (accessed July 15, 2013).

343 Compliance directives are the main method OSHA uses to communicate plans, inspection methods, and compliance expectations to their Compliance Safety and He alth Officers (CSHOs) for enforcing a new regulation.

344 OSHA Instruction CPL 02-02-045 (1994).

345 “OSHA Fact Sheet: OSHA Inspections,” available at http://www.osha.gov/OshDoc/data_Gene ral_Facts/factsheet-inspections.pdf (accessed on May 20, 2013).Chevron Richmond Refinery Regulatory Report January 2014

64 Spurred in part by the CSB’s recommendations, OS HA issued the Petroleum Refinery Process Safety Management National Emphasis Pr ogram (NEP) on June 7, 2007. 346 The NEP was a federal program that established guidelines for inspecting petroleum refineri es to assure compliance with the PSM standard. Unlike the PQV approach to inspec tions, which “employs a broad, open-ended inspection strategy and uses a more global approach to identify compliance de ficiencies...,” the NEP “provide[d] a specific tool to evaluate compliance with the [PSM] standard...[whic h] identifies a particular set of requirements from the PSM standard from which CSHOs [Compliance Safety and Health Officers] are to review documents, interview employees, and verify implementation for specific processes, equipment, and procedures.” 347 The NEP inspections were meant to be more targeted and efficient than PQV inspections. However, the inspections being conducted pursuant to the NEP were ended in 2011 partly because they were very timeconsuming and resource-intensive. 348 OSHA has publicly stated 349 that NEP inspection hours were roughly 40 times greater than average OSHA inspection hours. OSHA described the NEP as its most effective emphasis program in its history, citing a di sturbing number of issues and subsequent citations.

In 1999, EPA established an audit 350 program to help ensure compliance with the RMP program. The audits were intended to provide an independent verification of the information in the RMP and include on-site inspections. Under these requirements, the implementing agency (EPA or a correlating state agency) must “periodically audit” RMPs to review their adequacy and require revisions when necessary to ensure compliance. 351

Between fiscal years (FYs) 2010 and 2012, each EPA Region responsible for implementing the RMP program was mandated by EPA to perform inspections 352 at five percent of the total number of regulated

346 Originally Directive Number CPL 03-00-004. Extended August 18, 2099 as Directive Number CPL 03-00-010 to allow more time to complete NEP inspections under the original CPL 03-00-004.

347 CPL 03-00-004, Section X(D)(1). 2007.

348 Jordan Barab, Deputy Assistant Secretary of Labor fo r Occupational Safety and Health, stated the following during a symposium at the Mary K O’Connor Process Safety Center: “As our refinery NEP comes to an end, we are engaged in a process of trying to figure out how we will a ddress refinery PSM issues in the future. Clearly OSHA's past practice of targeting inspection acc ording to injury and illness numbers is not adequate. However, because of resource limitations, we are also unable to commit to a full-time NEP.” “Saving Lives and Transforming Workplaces: OSHA and Process Safety.” Remarks for Jordan Bara b, Deputy Assistant Secretary of Labor for Occupational Safety and Health. Mary Kay O’Connor Process Safety Center International Symposium. Texas A&M University, College Station, Texas. Wednesday, October 27, 2010. https://www.osha.gov/pls/oshaweb/owadisp. show_document?p_table=SPEECHES&p_id=2311 (accessed January 13, 2014).

349 See Barab, Jordan. OSHA’s Refinery & Chemical National Emphasis Programs. Power Point presentation made at CSB Public Hearing on Process Safety Indicators; July 20, 2012. http://www.csb.gov/UserFiles/file/Bar ab%20%28OSHA%29%20PowerPoint.pdf (accessed August 14, 2013). Also

see Transcript of CSB Public Hearing on Safety Performance Indicators; p 52. http://www.csb.gov/assets/1/19/CSB_20Public_20Hearing.pdf (accessed August 14, 2013).

350 Within Part 68, the term “audit” refe rs to the process that implementing agencies may use to verify the quality of the RMP submitted to EPA and require revisions when necessa ry to ensure compliance. RMP audits will generally involve on-site verification of a facility’s underlying risk management program. Section 68.220 of the RMP rule requires implementing agencies to select facilities for au dits based on specific criteria, and to follow a specific process for resolving audit findings prior to any enfo rcement action. See EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013).

351 40 CFR §68.220 (1999).

352 RMP inspections “are different from audits in that fac ilities are not necessarily selected for inspection based on Part 68 regulatory criteria, and inspections can lead di rectly to implementing agency enforcement actions forChevron Richmond Refinery Regulatory Report January 2014

65 facilities in the regions, and a certain percentage of these facilities were required to be high-risk. 353 In FY 2010, regions were to conduct 10 per cent of the inspections at high-ri sk facilities, and in FYs 2011 and 2012, 25 percent at high-risk facilities. 354

Although EPA has acknowledged that “full compliance with the Risk Management Program regulations
cannot be determined without on-site or independent verification of all or part of the information submitted in an RMP[,]” 355 the EPA has not effectively implemented the audit and inspection elements of the Risk Management Program. As mentioned above in Section 3.2.2.3.2, the EPA Office of Inspector General (OIG) concluded in 2009 th at over half of the RMP-covered facilities identified in the US as high-risk 356 had never received an on-site inspection or audit, and over 65 percent of all active RMP facilities had not received an on-site inspection or audit since inception of the RMP program in 1999. 357 The EPA OIG also noted that of the 296 uninspect ed high-risk facilities managed by EPA, 151 of these could each impact 100,000 people or more in a worst-case accident scenario. 358



## 4.7 Independent, Competent, Well-Funded Regulator

As noted by NOPSEMA, a safety regulator “provide s ‘independent’ assurance to society, governments and industry that companies have identified the risk s to health and safety and have put appropriate measures in place to control these risks.” 359 To ensure that companies are managing risks and employing the best available standards and technologi es, the regulator must be independent, 360 well-resourced, and retain a sufficient number of technically competent, experienced, and well-trained staff that can critically assess companies’ safety case reports and performance. Without independent and competent examinations, the safety case report becomes a meani ngless document in terms of controlling risk and preventing major accidents. Offshore regulators in the UK and Australia also utilize independent third

regulatory violations. Also, RMP inspections always involve on-site verification activities.” See EPA, “Guidance for Conducting Risk Management Program Inspections under Cl ean Air Act Section 112(r).” January 2011; page 4. Available at http://www.epa.gov/osweroe1/docs/chem/clean_air_guidance.pdf (accessed June 11, 2013).

353 Criteria used to determine high-risk includes the number of people in the footprint (if it is more than 100,000); accidental releases reported in the RM P; the hazard index (percentage of chemical quantity above threshold and number of chemicals onsite); and the number of Program Levels 2 or 3. US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint ; March 2013. See http://www.condorearth.com/files/08- Enforcement_Priorities-Mary_Wesling.pdf (accessed May 14, 2013).

354 EPA OIG. Improvements Needed in EPA Training and Oversi ght for Risk Management Program Inspections; March 21, 2013; p 7. http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

355 EPA. Guidance for Conducting Risk Management Program Inspections under Clean Air Act Section 112(r); January 2011; p 4. http://www.epa.gov/osweroe1/do cs/chem/clean_air_guidance.pdf (accessed June 11, 2013).

356 A high-risk facility is one that meets one of more of the following characteristics established by the EPA Office of Emergency Management: 1) Facilities whose reported RMP worst-case scenario population exceeds 100,000 people; 2) Any RMP Program f acility with a hazard index greater than or e qual to 25; and/or 3) Facilities that have had one or more significant accidental rel eases within the previous five years. See “ EPA Office of Inspector General, “Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections.” March 21, 2013; Page 5. Available at http://www.epa.gov/oig/reports/2013/20130321-13-P-0178.pdf (accessed June 11, 2013).

357 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 15.

358 Ibid.

359 See http://www.nopsema.gov.au/safety/s afety-case/safety-case-approach/ (accessed May 31, 2013).

360 You will find a more detailed discussion of regulator independence in the CSB’s upcoming investigation report on the Macondo incident.Chevron Richmond Refinery Regulatory Report January 2014

66 party specialist safety companies recognized by the regulator. Third party inspectors review important aspects of the safety case, such as safety critical elements 361 and performance standards. 362 Third party inspections, however, do not take the place of rigorous inspections by the regulator.

As of June 2012, the HSE employed roughly 3,300 staff, of which 1,381were front-line inspectors, 363 whose responsibilities include conducting preventati ve inspections of roughly 950 COMAH facilities throughout the UK. The HSE employs roughly 105 inspectors to inspect approximately 300 offshore installations, in effect a one to three ratio. As such, the HSE, with a budget of roughly $472 million, 364 has the authority to offer higher sp ecialist salaries to attract and retain more experienced, competent personnel. According to information obtained from the HSE, in 2011 and 2012 their onshore specialist inspector pay ranged from $85,806 to $102,344, and th eir offshore inspector pay ranged from $134,387 to $148,423 at the highest grade and $116,288 to $131,499 at the next highest grade. 365

A safety case regime requires regulators to conduct prev entative facility inspections and audits against the safety case to ensure that specified controls are func tioning as intended. Regulators must be capable of interacting as equals with company risk managers when conducting these inspections. Former HSE staff
have communicated to the CSB that the HSE seek s new employees with good communication skills in addition to education and experience, as the job of a safety case regulator requires encouraging companies to aspire to make safety improvements that they ma y not want to make. One message that current and former HSE staff have repeated is that the indus try believes having competent regulatory staff adds significant value to their business. 366 In any country, competent offshore regulatory staff can persuade companies to manage risks in a rigorous manner, knowing that if not done properly, their risk management practices will be challenged. 367 This competence is also essential for companies’ confidence in the accuracy of the regulatory staff’s advice, in spections, and citations. According to a literature review on the safety case in the UK, “[s]ome compani es see as positive the requirement to have ‘someone

361 The UK HSE requires offshore installations to define “s afety critical elements,” whic h are the technical barriers in place for the prevention, detection, control, and mitigation of major accident risks. Lauder, Bob. Major Hazard (Asset Integrity) Key Performance Indicators in use in the UK Offshore Oil and Gas Industry. Paper at the CSB Indicators Public Hearing. July 24, 2012.

362 In the UK, duty holders have a duty under the Offshore Installations (Safety Case) Regulations 2005 to “put in place and keep under continual review a verification scheme by means of which assurance is obtained from an independent competent person (ICP) that safety critical elements and PFEER [O ffshore Installations ) Prevention of Fire and Explosion, and Emergency Response] specified plan t are suitable and remain suitable for the lifetime of the installation.” See http://www.hse.gov.uk/offshore/verification.htm (accessed November 14, 2013).

363 HSE. The Health and Safety Executive A nnual Report and Accounts 2011/12; July 2012; p 30. http://www.hse.gov.uk/aboutus/reports/1112/ar1112.pdf (accessed June 3, 2013).

364 For 2013/2014, HSE’s budget is listed as 308.1 £million. HSE recovers approximately 40 percent of its costs through income mainly in the nuclear, offshore, and chemi cal sectors, and the remainder is funded from Grant-inAid pursuant to the Health and Safety at Work etc. Act 1974, and fee for intervention (FFI). 364 See HSE, “HSE Business Plan 2012-15,” July 2012; page 17. Available at http://www.hse.gov.uk/aboutus/strategiesandplans/businessplans/plan1215.pdf (accessed June 3, 2013). Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/public /page/2_3021-forex.html (accessed June 4, 2013).

365 Conversion of UK Pounds to US Dollars is based on 1£ = 1.5313$. See http://wsj.com/mdc/ public/page/2_3021- forex.html (accessed June 4, 2013).

366 Based on conversations between the CSB staff and Ma gne Ognedal (Norway PSA), Ian Whewell (the UK HSE), Peter Wilkinson (Australia NOPSA [forerunner of NOPSEMA]), and John Clegg (inaugural CEO of NOPSA).

367 Peter Wilkinson, Manager Review Implementation Team, Offshore Safety Section, Australia Department of Industry, Tourism and Resources and “architect” of NOPSA. Presentation to the National Research Centre for Occupational Health and Safety, ANU (May 15, 2002).Chevron Richmond Refinery Regulatory Report January 2014

67 external to the company keeping you on your toes by regularly asking if you have done all you can,’ and that it ‘forces you to convince yourself’ that you have covered all the risks.” 368

In the US, the federal government has used extensive resources to retain the best available talent to focus on health and safety oversight of US commercial and defense nuclear facilities. 369 For instance, many nonsupervisory technical staff at the US Nuclear Regulatory Commission 370 (NRC) and the Defense Nuclear Facilities Safety Board are paid at the top of the General Schedule pay schedule. 371 Virtually all
technical staff at the Defense Nuclear Facilities Safety Board hold technical master’s degrees and approximately 25 percent hold doctoral degrees. 372

The federal government has a unique category of non-ex ecutive positions that involv e high-level research and development in the physical, biological, medical, or engineering sciences, or a closely-related field. 373 These are known as “Scientific or Professional” positions, and they are classified above the highest general schedule pay level. 374 These special salary authorizations contribute to the technical agencies’ ability to compete with private industry to recruit and retain highly competent staff. The NRC also has a type of funding mechanism that ensures that the agency’s budget adequately covers its regulator activities, as the NRC is required by law to recover at least 90 percent of its b udget through licensing and inspection fees. 375

Another method by which the NRC is able to attract and retain competent technical staff is its extensive training programs. For new inspection staff, the NRC requires a series of courses, assessments, and simulation, all of which takes approximately two years to complete. 376 Inspectors must have a bachelor’s degree in engineering or a degree in a relevant scientific field and Professional Engineer certification. 377 The agency operates a technical training center in Chattanooga, Tennessee, with various control room
simulators that mirror licensees’ facilities. The NRC staff is expected to su fficiently understand this equipment so that they are able to conduct sufficient audits and investigations. 378 Before he or she is fully qualified to conduct inspections, inspector candida tes must be recommended by the NRC inspector qualification board and certified by the regi onal administrator or division director. 379

368 Vectra Group Limited. Literature Review on the Perceived Benefits and Disadvantages of UK Safety Case Regimes; 2003; p 40.

369 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013).

370 Presentation by NRC Executive Direct or Bill Borchardt, January 2011.

371 $123,758 to $155,500 per year in 2012 in Washington, DC. See https://www.opm.gov/oca/12tables/html/dcb.asp (accessed May 15, 2013).

372 DNFSB FY2013 Budget Justification at p. 100 http://www.dnfsb.gov/sites/default/files/About/Budget%20Requests/2013/FY%202013_CONG%20BUDGET_FIN AL.PDF (accessed May 15, 2013).

373 http://www.opm.gov/ses/r ecruitment/stpositions.asp (accessed May 15, 2013).

374 http://www.opm.gov/ses/r ecruitment/stpositions.asp (accessed May 15, 2013).

375 Section 6101 “NRC User Fees and Annual Charges,” Omni bus Budget Reconciliation Act, Pub. L. 103-66. 107 Stat. 312 (Aug. 10, 1993).

376 NRC Inspection Manual, Qualification Program for Operating Reactor Program s (Ch. 1245) at 4, available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdf (accessed May 28, 2013).

377 NRC Reactor Inspector Job Posting No. R-I/DRS-2013-0001

378 See, e.g., http://www.iaea.org/ns/tutorials/re gcontrol/regb ody/reg2124.htm (accessed May 28, 2013).

379 NRC Inspection Manual, Qualifica tion Program for Operating Reactor Programs (Ch. 1245) available at http://pbadupws.nrc.gov/docs/ML1110/ML11105A153.pdfChevron Richmond Refinery Regulatory Report January 2014

68 As will be discussed in greater detail under Section 5.0, at the time of the Chevron incident, a majority of the regulators responsible for oversight of Chevron an d other petroleum refineries in California did not have sufficient, sustainable funding or staffing to oversee major accident prevention activities. An effective safety case regulatory system would necessitate that the California industry regulator be wellresourced and retain a sufficient number of competent, well-trained and experienced staff to critically assess a company’s safety case. The overall knowledge and expertise of the regulator must at a minimum match that of industry in order for the regulator to successfully assess a comp any’s safety case with the ultimate goal of preventing major accidents.Chevron Richmond Refinery Regulatory Report January 2014

69 

## 5.0 

## Oversight of Petr oleum Refineries in California

In California, there currently exists a patchwork of primarily activity-based federal, state, and local laws and regulations aimed at preventing harmful rele ases of hazardous materials at facilities such as petroleum refineries. This regulatory framework doe s not foster continuous improvement by driving companies to reduce risks of their hazardous activiti es to ALARP, nor does it have the requisite number of regulatory staff with the skills, knowledge, and experience to provide sufficient oversight.



## 5.1 Cal/OSHA

5.1.1 Background Information

Section 18 of the OSHAct 380 encourages states to develop and implement their own job safety and health programs. Twenty-five states (including California) , Puerto Rico and the Virgin Islands currently implement OSHA-approved State Plans. 381 States must set job safety and health standards that are “at least as effective as” comparable federal standards; most adopt standards that are identical to the federal
standards. 382

California was certified as an OSHA State Plan state on August 12, 1977. 383 California’s Division of Occupational Safety and Health (Cal/OSHA) administers the California Occupational Safety and Health Program. A PSM District Office 384 within Cal/OSHA enforces California’s PSM standard, which is established under Title 8, Section 5189 of the Ca lifornia Code of Regulations (CCR) and entitled Process Safety Management of Acutely Hazardous Materials

. 385,386 The PSM District Office is comprised of seven inspectors, known as A ssociate Safety Engineers, and one District Manager to regulate nearly 1,700 PSM-covered facilities in California, including 15 petroleum refineries. Only one of these individuals has a technical background, with a degree in Chemical Engineering. Appendix B of this report summarizes the key differences between the federal and California PSM standards and the safety case regulatory regime. A more detailed analysis of those differences will be provided in the remainder of Section 5.1.

The CSB in its Interim Report identified a num ber of weaknesses of Chevron’s process safety performance. In many of these causal issues, Chevron was not required to perform at a more effective level by the existing California PSM regulations. In Table 1 below, the CSB identifies the causal issues or findings, which highlight the gaps in the California and federal PSM regulations, and how each issue is more effectively managed in the safety case regulatory regime. In this section of the report, some of these examples will be examined in relation to key featur es of an effective regulatory approach such as the

380 29 U.S.C. §667 (2004).

381 These are referred to informally as OSHA State Plans. OSHA ap proves and monitors Stat e plans and provides up to 50 percent of an approved plan's operating costs

382 29 U.S.C. §667 (c)(2) (2004). Also see http://www.osha.gov/dcsp/osp/faq.html (accessed May 13, 2013).

383 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed June 17, 2013).

384 The California PSM District Offices were established in 2001 after the February 1999 Tosco refinery incident in which four workers were fatally injure d following the ignition of a highly flammable material during a turnaround operation. In January 2012 the two district offices were combined into one PSM District Office.

385 See http://www.osha.gov/dcsp/osp/stateprogs/california.html (accessed May 13, 2013).

386 8 CCR §5189 (2012).Chevron Richmond Refinery Regulatory Report January 2014

70 safety case. More information on these causal findings can also be found in the CSB Chevron Interim Report.

Process Safety Element Causal Finding California PSM Regulation  The Safety Case Regulatory Regime **

MOC Inspection recommendation to upgrade pipe to 9- Chrome not implemented. The MOC to implement the recommendation narrowed the scope allowing the 52- inch component that failed to remain in service. Implementation of 9- Chrome could have prevented the incident. 387 MOC element requires implementation of written procedures to manage changes that shall address the impact of the change on health and safety; however the element is activity based and there is no requirement to implement effective recommendations or control hazards. There is no requirement in the MOC element to consider inherent safety. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Description of MOC procedures and demonstration of their effectiveness in managing major accident hazard risk are a key requirement of the safety case. Implementation of the concept of inherent safety is required. 388

 Unless otherwise noted, California and federa l PSM requirements are nearly identical.

** Regulatory regimes such as offshore in Norway have many attributes of the safety case regulatory regime but are not called the safety case regulatory regime.

387 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 41 and 42. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013).

388 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the app lication of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical ap proach (inherent safety, prevention, control, mitigation).” Ibid at 8.Chevron Richmond Refinery Regulatory Report January 2014

71 Process Safety Element Causal Finding California PSM Regulation  The Safety Case Regulatory Regime **

MOC Chevron conducted MOCs to evaluate proposed changes to crude feed that introduced higher sulfur concentration. However, Chevron failed to thoroughly evaluate the change of increasing sulfur weight percentage in crude oil feed and to assess how it might affect corrosion rates within the 4-sidecut piping circuit. Cal/OSHA did not issue any citations for failing to consider the impact of corrosion in the MOC process when sulfur composition in the crude oil feed was increased. 389 MOC element is activitybased rather than performance based and requirements in RAGAGEP such as API 570 390 do not apply to the MOC element of PSM. Cal/OSHA did not cite Chevron for this issue. Duty holder is required to drive risk to ALARP. Duty holder must identify in the safety case report the standards that they are using to reduce risk such as API 570. The implementation of those standards can be enforced by the regulator to achieve ALARP.

PHA In its 2009 crude unit PHA,Chevron simply cited nonspecific, judgment-based qualitative safeguards such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspection programs, and providing pipe wall corrosion allowances. The effectiveness of these safeguards was neither evaluated nor documented; instead the safeguards were merely listed in the PHA. While the PHA element requires addressing the control of hazards, it does not require addressing the effectiveness of the controls or using the hierarchy of controls. For example, the standard would not require the use of improved metallurgy or inherent safety to mitigate corrosion hazards. Cal/OSHA did not cite Chevron for this issue. Requires the use of the most effective practical safeguards to achieve ALARP. The safety case requires the use of inherently safer design and the hierarchy of controls. 391

389 For more information, see CSB’s Chevron Richmond Refinery Interim Investigation Report. April 2013; p 34, 35 and 36. http://www.csb.gov/assets/1/19/Chevron_Interim_Report_Final_2013-04-17.pdf (accessed October 30, 2013).

390 API 570. Piping Inspection Code: In-service Inspection, Rating, Repair, and Alteration of Piping Systems. November 2009.

391 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the app lication of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical ap proach (inherent safety, prevention, control, mitigation).” Ibid at 8.Chevron Richmond Refinery Regulatory Report January 2014

72 Process Safety Element Causal Finding California PSM Regulation  The Safety Case Regulatory Regime **

PHA The 4-sidecut line was analyzed in the most recent crude unit PHA. Corrosion was not identified as a potential cause of a leak/rupture in the piping. Damage mechanism hazard reviews are not required by the PSM regulation. The process hazard analysis element does not require consideration of RAGAGEP such as API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry. Cal/OSHA did not cite Chevron for this issue. For example in the UK the HSE has worked with the industry to develop guidance on damage mechanism hazard reviews in the UK's offshore petrochemical industry. The implementation of best practice standards referenced by a duty holder’s safety case report may be enforced by the regulator to achieve ALARP.

Incident Investigations Chevron made recommendations following its investigation of sulfidation incidents at Richmond, Salt Lake City and Pascagoula refineries requiring 100 percent component inspection in high risk piping systems. These recommendations were not implemented in the Richmond refinery crude unit prior to the incident. In 2007 Chevron identified the inherently safer solution of improved metallurgy to prevent sulfidation corrosion but only applied it to the crude unit small spool piece that failed. Neither California nor federal PSM regulations require root cause investigations or recommendations to be developed as the result of incident investigations. While California does require taking action to prevent reoccurrence, (goes beyond federal OSHA) it does not drive risk to ALARP. Cal/OSHA did not cite Chevron for this issue. Federal PSM does not require the development of recommendations or the prevention of future incidents. Investigation of incidents is required to demonstrate legal compliance with framework legislation. ALARP requirement would require remedialaction including crosscompany learning from incident investigations. HSE can require safety case duty holder compliance with investigation report recommendations (e.g. Buncefield Report- “determine SIL level requirements for overfill protection”).Chevron Richmond Refinery Regulatory Report January 2014

73 Process Safety Element Causal Finding California PSM Regulation  The Safety Case Regulatory Regime **

Mechanical Integrity Chevron was instrumental in the development of API RP 939-C, which suggests ("should") but does not require ("shall") that 100 percent component inspection be performed. API states that the use of "shall" denotes minimum requirements in the use of the standard - API RP 939- C has no minimum requirements (no substantive "shalls" are used in the recommended practice). The mechanical integrity element of PSM requires that for inspection and testing procedures, employers follow RAGAGEP. However, API RP 939-C has no minimum requirements. Nonetheless, Cal/OSHA cited Chevron for failure to follow API RP 939-C under this mechanical integrity provision. In the federal regulatory context, this approach has been called into question by the recent administrative law judge decision in BP Products

. This case is scheduled for review by the full commission. In a safety case regime, the regulator can reject the use of weak and inadequate standards referenced in a safety case report (by rejecting the report) and can require more rigorous performance to achieve ALARP.Chevron Richmond Refinery Regulatory Report January 2014

74 Process Safety Element Causal Finding California PSM Regulation  The Safety Case Regulatory Regime **

Inherent Safety Chevron employees have recommended implementing inherently safer designs through the MOC process, incident investigations, technical reports, and past employee recommendations. However, the CSB has not identified any documented, thorough analysis of the proposed inherently safer solutions. In addition, Chevron has repeatedly failed to implement proposed inherently safer recommendations. Had Chevron implemented these recommendations, the incident could have been prevented. Neither California nor federal PSM regulations require the use or implementation of inherent safety. Cal/OSHA did not cite Chevron for this issue. In its Interim Report, the CSB made a recommendation to the California legislature and the Governor of California to use inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible in establishing safeguards for identified process hazards. Safety case requires the implementation of inherently safer systems analysis. 392

Regulator Enforcement Despite numerous safety system deficiencies the Cal/OSHA regulator failed to identify these issues prior to the incident. Cal/OSHA conducted three planned inspections prior to the incident that resulted in no citations or fines. The CSB determined Cal/OSHA lacked sufficient resources and numbers of highly qualified inspectors. California is adding 15 additional inspectors to its PSM unit. The Governor's Interagency Task Force on Refinery Safety will be proposing to implement additional recommendations from their draft report. A key feature of the safety case is a rigorous review of the safety case report that may be accepted or rejected by the regulator. Preventative audits of covered facilities are regularly performed by technically competent, well resourced regulators.

392 According to the HSE, essential considerations for determining whether a duty holder has reduced risks to ALARP include “the adoption of inherently safer designs...”. HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8-15.pdf (accessed October 30, 2013). The HSE also notes that the guidance to COMAH Regulation 4 (General Duty) “describes the app lication of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical ap proach (inherent safety, prevention, control, mitigation).” Ibid at 8.Chevron Richmond Refinery Regulatory Report January 2014

75 Process Safety Element Causal Finding California PSM Regulation  The Safety Case Regulatory Regime **

Workforce

Involvement The workers in previous loss of containment incidents raised concerns about the level of corrosion in the Crude and RLOP incidents, but their concerns were not effectively addressed prior to the August 6, 2012, incident. The workforce participation element requires an employer to develop a written plan to "ensure employee participation in process safety management...” including "consultation with employees and their representatives on the conduct and development of the elements of process safety management...” However, development of a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company's safety management system such as PHAs, MOCs, and investigation activities. Safety case sets out a legal framework for the participation of employees on health and safety-related matters, the election of safety representatives, and the establishment of safety committees to serve health and safety related functions. Workforce participation practices are documented by the duty holder and submitted to the regulator.

Table 1. CSB Causal Findings.



## 5.1.2 Analysis

5.1.2.1 ALARP

Unlike the OSHAct, the California Occupational Safety and Health Act does not have a General Duty Clause. Rather, Section 5189 was established to “elim inate to a substantial degree, the risks to which employees are exposed in petroleum refineries, chemical plants and other facilities.” 393 By focusing on the significant reduction of risk, this language s upports the principle of ALARP, which requires a showing by the company that “there are no other pr actical measures that could reasonably be taken to
reduce risks further.” 394 However, this section, which lays out the “scope and purpose” of the regulation, is not an enforceable element of the regulation th at is subject to citations, and the remaining PSM regulation elements do not lead in practice to that r esult. Rather, California’s PSM standard has remained activity-based, with many activity-based elements almo st identical to the federal PSM standard. For example, an employer must “perform a hazard anal ysis [PHA] appropriate to the complexity of the

393 8 CCR §5189 (a) (2012).

394 ALARP Guidance Note N-04-300-GN0166, Rev. 3 (Dec. 2011) available at http://www.nopsema.gov.au/assets/document/N-04300-GN0166-ALARP.pdf (accessed May 15, 2013).Chevron Richmond Refinery Regulatory Report January 2014

76 process for identifying, evaluating, and cont rolling hazards involved in the process....” 395 The PHA must address hazards of the process; engineering and administrative controls applicable to the hazards and their relationships; consequences of failure of these cont rols; facility siting; human factors; a qualitative evaluation of a range of the possible safety and hea lth effects of the failure of controls on facility employees; and the identification of any previous in cident which had a likely potential for catastrophic consequences in the workplace.” 396 This language does not support the principle of ALARP, and makes no mention of risk or continuous improvement in any way. As a result, PHAs satisfy the California PSM regulatory requirement by merely listing safeguards; th ere is no requirement to evaluate or document the effectiveness of these safeguards, or to show that th e safeguards in place are effectively reducing risks.

As discussed in the CSB’s Interim Report on the Chev ron incident, Chevron cited in its 2009 crude unit PHA non-specific, judgment-based qualitative safeguard s such as: utilizing metallurgy to minimize corrosion, having effective maintenance and inspec tion programs, and providing pipe wall corrosion
allowances. 397 The effectiveness of these safeguards was neither evaluated nor documented. Had the adequacy of these safeguards been verified, improved safeguards intended to prot ect against sulfidationinduced failure of carbon steel piping could have been recommended. In addition, while the 4-sidecut line was analyzed in this PHA, corrosion was not identified as a potential cause of a leak/rupture in the piping (emphasis added). A corrosion review, also referred to as a damage mechanism hazard review, analyzes hazards presented by all process failure mechan isms such as corrosion and cracking. This type of review, while considered to be good practice, 398 is not required by the PSM regulations either federally or in California, and as such the CSB made a recommendation in its Interim Report to require these in future California PHAs. Under a safety case regulator y regime, the regulator has the ability to drive industry to adapt new technologies and safer practices as soon as they are developed; new rulemaking is not required for immediate improvements, because comp anies are obligated to co ntinually work toward specified performance goals such as reducing risks to ALARP. Therefore, under a safety case regulatory regime the regulator could require these types of review s to be conducted to reduce risk without requiring additional legislation.

Cal/OSHA does not typically review a company’s PHA as part of its routine oversight of process safety management unless there is a specific complaint, accide nt, or targeted inspection. Nor does it “accept” a company’s PHA and proposed hazard mitigations. Therefore, prior to the August 2012 incident, Cal/OSHA inspectors did not require any additional inform ation or analysis to be provided in the Chevron crude unit PHA. Highlighting the reactive nature of the PSM standard, Cal/OSHA inspected the Chevron facility post-incident and issued 17 citations related to the incident and eight additional citations, with a total proposed fine of nearly $1 million. Only one citation related to PHAs, a nd it was not associated with evaluating the effectiveness of safeguards or failure to control the 4-sidecut corro sion hazard. Rather, the emphasis was that Chevron’s PHA did not adequate ly account for hazards caused by other units

395 8 CCR §5189 (e)(1) (2012).

396 8 CCR §5189 (e)(2) (A) through (G) (2012).

397 Corrosion allowance refers to extra wall thickness added as a safety factor to the de sign of a piece of equipment beyond that needed solely for mechani cal considerations such as design te mperature and pressure. This extra thickness is provided to accommodate for expected loss of wall thickness due to corrosion over the life of the equipment.

398 API RP 571, Damage Mechanisms Affecting Fixed Equipment in the Refining Industry, describes common process failure mechanism and is considered to be good practice for analyzing risks presented by process failure mechanisms such as corrosion and cracking.Chevron Richmond Refinery Regulatory Report January 2014

77 associated with the crude unit. This again high lights the lack of a requirement for Chevron to demonstrate that risks have been reduced to ALARP, or for Chevron to provide this type of analysis to
Cal/OSHA to review.



## 5.1.2.2 Adaptability and Continuous Improvement

Of the 25 Cal/OSHA citations mentioned above, two were issued to Chevron for its failure to follow API RP 939-C, Guidelines for Avoiding Sulfidation (Sul fidic) Corrosion Failures in Oil Refineries as RAGAGEP. This voluntary API standard will be discussed in greater detail in the CSB’s Final Investigation Report on the Chevron in cident. However, it is important to note for purposes of this report that API RP 939-C is a permissive and voluntary st andard merely intended to provide guidance to industry personnel on how to address sulfidation corr osion in petroleum refining operations. Existing safety guidelines use words “shall” and “should” to denote either requirements or recommendations. API RP 939-C does not use the word “shall”; as such, it contains no requirements for industry. While the regulator in a safety case regulatory regime has the aut hority to analyze and challenge the requirements of API RP 939-C with the goal of driving continuous im provement and risk reduction (note the Buncefield examples discussed in Section 4.3), in the present case Cal/OSHA utilized the voluntary practice as an opportunity to issue a citation to Chevron post-incident. Cal/OSHA did not analyze API RP 939-C to determine whether its provisions are sufficient to reduce risks and manage hazards. It also remains to be seen whether this citation will be upheld considerin g the permissive language contained within the
standard.

Chevron has investigated a number of sulfidation in cidents at its refineries over the years, including Richmond, Salt Lake City, and Pascagoula. Figure 2 shows a timeline of Chevron’s key sulfidation events. In January 2007, a failure due to sulfid ation corrosion caused a serious fire in the Chevron Richmond Refinery crude unit resulting in a CWS Level 3 alert, injuring one worker and initiating a shelter-in-place for the surrounding community. As a result of these investigations, Chevron made internal recommendations to require 100 percent com ponent inspections in high-risk piping systems. However, these recommendations were not implemented in the Richmond Refinery crude unit prior to the incident, highlighting a lack of learning from previous incidents by Chevron.Chevron Richmond Refinery Regulatory Report January 2014

78 Figure 2. Chevron's key sulfidation events between 1974 and 2013.

In addition, as a result of the January 2007 incident , Chevron informed Contra Costa Health Services’ Hazardous Materials Program 399 (CCHMP) in a letter that the crude unit piping metallurgy had been upgraded following this incident as an inherently saf er solution. However, the CSB learned that this upgrade was limited to only the immediate piping spool 400 that failed. Cal/OSHA also did not require Chevron to update the crude unit PHA to address th e findings from this incident. Under a safety case regulatory regime, the regulator would work with the company to improve its practices following such an incident. The company would also be required to update its safety case report to address these corrosion hazards and demonstrate how the company has reduced risks to ALARP.

The CSB also noted in its Chevron Interim Report th at despite internal recommendations to replace the entire #4 sidecut piping with an inherently safer, more corrosion-resistant material of construction, Chevron’s 2006 Management of Change (MOC) analysis limited the application of those recommendations. Instead of replacing the entire piping segment identified by the original recommendation, the 2006 MOC considered only the re placement of a small section. Although the recommendation was intended to more broadly apply inhe rently safer materials of construction, the final implementation under the 2006 MOC limited the a pplication of this more corrosion resistant

399 Contra Costa Health Services’ Hazar dous Materials program is designed to respond to emergencies and monitor hazardous materials within Contra Costa County. See http://cchealth.org/hazmat/ (accessed April 17, 2013). CCHSHMP also implements the CalARP and ISO programs, which will be discussed in greater detail later on.

400 A piping spool is a small, removable section of piping. In some cases, a piping spool is installed or removed in order to provide a temporary connection or complete disconnection between two piping circuits.Chevron Richmond Refinery Regulatory Report January 2014

79 metallurgy. 401 As the mere completion of an MOC and th e implementation of any action item satisfy the California PSM standard requirements, regardless of its adequacy or effectiveness, Cal/OSHA did not evaluate the MOC or cite Chevron for narrowing the scope of the MOC, despite its disregard of internal
recommendations. Neither the California nor the fede ral PSM standards allow c itations for inadequate MOCs. In addition, RAGAGEP does not apply to the MOC PSM element.

This can be contrasted with the safety case regulat ory regime in the UK, where the HSE includes the adoption of inherently safer designs as an essential c onsideration for determining whether a duty holder
has reduced risks to ALARP. 402 The HSE also notes that the guidance to COMAH Regulation 4, (the COMAH General Duty provision) “describes the applica tion of all measures necessary to reduce risk of a major accident to ALARP based on a hierarchical approach (inherent safety, prevention, control, mitigation).” 403



## 5.1.2.3 Process Safety Indicators

As the CSB has noted in its BP Texas City Investig ation Report, Chevron Interim Report, and Section 4.5 of this report, process safety indicators are a significant element of process safety management systems and are critical for reducing process safety incidents. A major goal of process safety indicators is to drive continuous process safety improve ment. Regulators can utilize these indicators to focus inspections, audits, and investigations.

Federally and in the state of California, neither the PSM standard nor the RMP rule require companies to utilize or report process safety indicators. Chevron voluntarily utilizes both leading and lagging indicators internally in its US petroleum refineri es, in a system called Operational Excellence and Reliability Intelligence (OERI), which tracks 26 di fferent process safety indicators. OERI was implemented in May 2009. However, Chevron is not required to report the status of its indicators to California regulators. Nor is Chevron held accountab le to use the indicators to drive performance or continuous improvement. As a result, the CSB made a recommendation in its Chevron Interim Report to the California State Legislature to identify and requi re the reporting of leading and lagging process safety indicators to state and local regulatory agencies, w ith the goal of improving mechanical integrity and process hazard analysis performance at all California pe troleum refineries, and preventing major chemical
incidents.



## 5.1.2.4 Inspections

As noted in Section 4.6, safety case regulators utili ze preventative inspections and audits to monitor compliance with legislation and to ensure that th e facility and its operations are consistent with information provided in the safety case. However, like federal OSHA, California regulations require Cal/OSHA to prioritize accident, complaint, and refe rral-based inspections over planned inspections. As such, Cal/OSHA’s inspection program of the nearly 1,700 PSM-regulated facilities in California,

401 As discussed in the Interim Report, only the section of piping downstream of the pumps was replaced with 9- Chrome.

402 HSE. The Safety Report Assessment Manual, Sections 8 to 15. p 30. http://www.hse.gov.uk/comah/sram/s8- 15.pdf (accessed October 30, 2013).

403 Ibid at 8.Chevron Richmond Refinery Regulatory Report January 2014

80 including 15 petroleum refineries, 404 has been reactive in nature ra ther than proactive to maximize prevention.

OSHA State Plan states 405 were strongly encouraged but not requi red to implement the federal Petroleum Refinery NEP. Cal/OSHA did not adopt th e NEP “because of its dedicated PSM Unit.” 406 Between 2006 and August 6, 2012, the Cal/OSHA PSM District Office conducted only three planned inspections of the Chevron Richmond facility, totaling only 150 inspect or hours of effort. Cal/OSHA has acknowledged that these were not PQV inspections, as envisioned in its mission statement and in the federal PSM compliance directive. None of these inspections resulte d in citations or fines. According to statistics provided by OSHA, federal NEP refinery inspec tions conducted between 2007 and the end of 2011 required roughly 1,000 inspector hours each and resulte d in an average of 11.2 violations and $76,821 in penalties per inspection. OSHA noted that hours spent on a typical federal refinery NEP inspection were 40 times greater than the average OSHA inspection. These numbers indicate a major disparity in thoroughness and comprehensiveness between the pla nned inspections conducted by Cal/OSHA and the NEP inspections conducted by OSHA and other OSHA State Plan States. The federal NEP, which represented a more robust and intensive inspection prog ram, ended in 2011 due to the stated great demand
on OSHA resources.



## 5.1.2.5 Workforce Participation

Like the federal PSM standard, California’s PSM sta ndard provides for workforce participation in a company’s process safety management program. 8 CCR §5189 (p) requires an employer to develop a written plan to “ensure employee participation in process safety management” including “consultation with employees and their representatives on the condu ct and development of the elements of process safety management...” 407 However, developing a written plan to satisfy the regulatory requirements does not ensure that workers and their representatives in practice are able to effectively participate in a company’s process safety management systems.

In its investigation of the Chevron incident, the CSB noted that the Chevron Richmond Refinery workforce and its representatives, the United Steelwo rkers (USW), had expressed concerns regarding sulfidation corrosion and broader workplace safety i ssues, but were not consis tently listened to by Chevron managers, and their concerns regarding corro sion were not adequately acted upon. In November 2011, Cal/OSHA investigated a complaint of unsaf e working conditions during the fourth quarter Richmond Lube Oil Plant (RLOP) turnaround at the Richmond Refinery. The RLOP receives feedstock from the crude unit where the August 6 th incident occurred and has similar sulfidation corrosion concerns. During the shutdown of the RLOP, a fire occurred at one of the RLOP furnaces. According to Cal/OSHA’s inspection report, Chevron employees told Cal/OSHA that “OPERATORS GET IGNORED.” Many of the employees were concerned about increased corrosion they were finding during the turnaround, and believed that increased temperatures and throughput rates had an adverse effect on

404 Also see the California Labor Code Sections 6309 to 6315 (The California Occupational Safety and Health Act of 1973).

405 Section 18 of the Occupational Safety and Health Act of 1970 encourages States to develop and operate their own job safety and health programs, referred to informally as an OSHA State Plan. OSHA approves and monitors State plans and provides up to 50 percen t of an approved plan's operating costs.

406 Department of Industrial Relations, Division of Occupational Safety and Health, California, Process Safety Management District Office. Mission Statement: Goals Reached in 2011 & Strategic Plan for 2012.

407 8 CCR §5189(p)(1) (2012).Chevron Richmond Refinery Regulatory Report January 2014

81 equipment integrity. According to the interview notes , many operators had raised issues of corrosion in the RLOP to higher level supervisors to no avail; according to one, if you raise an issue a couple of times, “you get labeled a ‘pest.’” The CSB has not iden tified evidence indicating that Cal/OSHA took further action to respond to these concerns, and Cal/OSHA did not issue any citations as a result of its investigation. 408 Post-incident, significant sulfidation corrosion was found in the RLOP and piping and equipment were replaced.

The CSB found other significant evidence that increased workforce participation could have reduced the
likelihood that unchecked corrosion would lead to th e August 2012 incident. As discussed in the CSB’s Interim Report on the Chevron incident, Chevron technical staff has considerable knowledge and expertise regarding sulfidation corrosion, specifically with respect to corrosion rate variations caused by differing silicon concentration in carbon steel piping. Chevron employees have authored industry papers on sulfidation corrosion and had significant influen ce in the development of the industry sulfidation corrosion recommended practice, API RP 939-C. In 2009, Chevron Energy Technology Company (Chevron ETC) 409 created an internal document on the subject of sulfidation corrosion. Chevron ETC metallurgists released a formal repor t dated September 30, 2009 (nearly 3 years prior to the incident) to Chevron refinery-based reliability ma nagers and chief inspectors entitled Updated Inspection Strategies for Preventing Sulfidation Corrosion Failures in Chevron Refineries

. Sulfidation experts explained in the Chevron ETC report that, “[u]ntil now, Chevron has not directly addressed the risk of low Si[licon] carbon steel...” 410 and that the report introduced a program that “seeks to close these gaps, and to maximize the effectiveness of our inspection.” The report clearly indicates that Chevron understood both the potential consequence and the high likelihood of a rupture or catastrophic
failure from sulfidation corrosion and calls out Chevron’s need for action.

The Chevron ETC report specifically recommended that inspectors perform 100 percent component inspection on high temperature carbon steel piping susceptible to sulfidation corrosion. However, this 100 percent component inspection program was not impl emented at the Richmond refinery prior to the August 6, 2012, incident. The Chevron ETC report defi ned a priority ranking system to help focus the inspection implementation efforts. The process conditions of the 4-sidecut pipe placed it in the highest priority for inspection.

Chevron ETC technical experts issued a corporate ne wsletter in 2010 that again warned of the potential consequence of sulfidation failures. In this newsletter, the 100 percent component inspection recommendation from the 2009 report was reiterated for piping systems such as the crude unit 4-sidecut piping. The newsletter stated:

Sulfidation corrosion failures ... are of great concern because of the comparatively high likelihood of ‘blowout’ or catastrophic failure. This typically happens because corrosion oc curs at a relatively uniform rate over a broad area, so a pipe can get progressively thinner until it actually bursts rather than leaking at a pit or local thin area. In addition, the

408 Post-incident, there were significant mechanical integrity improvements and piping replaced in the RLOP unit.

409 The Chevron Energy Technology Company is a separate business unit within the Chevron Corporation that provides technology solutions and technical expertise for Chevron operations worldwide. See http://richmond.chevron.com/hom e/aboutchevronrichmond.aspx (accessed April 4, 2013).

410 A 2003 corporate technical newsletter recommended 100 percent component inspection of carbon steel piping susceptible to sulfidation corrosion following a 2002 Chevron Salt Lake City sulfidation corrosion incident.Chevron Richmond Refinery Regulatory Report January 2014

82 process fluid is often above its auto ignition temperature. The
combination of these factors means that sulfidation corrosion failures frequently result in large fires. Chevron and the industry have experienced numerous failures from this mechanism and recent incidents
have reinforced the need for revi sed inspection strategies and a robust PMI (Positive Materials Identification) program.

The Chevron ETC 100 percent component inspection recommendation for high risk piping systems, established in 2009, was not implemented at Richmond, and the thin-walled low silicon 4-sidecut piping component remained in service until it ca tastrophically failed on August 6, 2012.

Chevron and Chevron ETC metallurgists, materials engineers, and piping inspectors had expertise regarding sulfidation corrosion. They educated pers onnel and advocated for identification and control of damage mechanisms, including sulfidation corrosion. However, they had limited practical influence to implement their recommendations. These individuals did not participate in the crude unit PHA and did not affect decisions concerning control of sulfidation corrosion during the crude unit turnaround

process. 411

Despite the history of sulfidation corrosion incide nts and the recommendations by Chevron’s workforce to implement better inspection methodologies, Cal/O SHA did not evaluate these recommendations or determine whether Chevron management ensured that the hazards of this damage mechanism were addressed and mitigated in Chevron’s PHAs. In add ition, Cal/OSHA issued no citations to Chevron postincident regarding the failure to address sulfidati on corrosion in its crude unit PHA. Finally, when Chevron employees raised concerns, Cal/OSHA di d not effectively address them. The examples highlighted in this section speak to the need for Calif ornia to develop more effective regulation similar to the UK legislation discussed in Section 4.4, to ensure strong workforce involvement in health and safety matters at petroleum refineries. This will not only he lp prevent incidents such as the one that occurred at Chevron, but it will also help improve communicati on and ensure that workers are represented in the
decisions that affect them.



## 5.1.2.6 Funding and Regulator Competency

Cal/OSHA has not received sufficient funding to empl oy a well-staffed, multi-disciplinary team capable of conducting thorough inspections of PSM-covered facilities in California. This is apparent when examining the lack of preventative, planned inspectio ns of petroleum refineries being conducted by the PSM team in the state. In order for a safety regul atory regime to successfully regulate with the goal of major accident prevention, there must be a technical ly competent, well-resourced regulator in place to sufficiently review, scrutinize, and challenge the hazard identification and evaluation that has been conducted and controls that have been put in place to reduce risk, to help drive continuous improvement and ensure that risks are being controlled. It is not an acceptable outcome for society that petroleum refineries with the potential for catastrophic accidents be inspected only after an accident occurs or a complaint is filed.

411 The turnaround process includes both the planning stage prior to the shutdown and the activities staged during the shutdown.Chevron Richmond Refinery Regulatory Report January 2014

83 Compensation is one important factor for recruiting and retaining technically competent personnel. The CSB found that California regulators are significantly less compensated when compared to their industry counterparts. Based on information Chevron provided to the CSB, the average annual salary of refinery personnel who would interact with a California regulator performing an audit or safety inspection is $187,630. Table 2 below provides the 2012 salaries of California regulatory personnel that the CSB determined would likely perform a safety inspec tion or a hypothetical safety case assessment. These figures indicate a substantial compensation gap between the regulator and the regulated. A Cal/OSHA PSM team of associate safety engineers receive an aver age annual salary that is 46 percent lower than the refinery employees they would likely interface with during an inspection. EPA RMP inspectors receive an annual salary that is 33 percent lower than th eir facility counterparts and Contra Costa County accidental release prevention engineers and their superv isor are paid 48 percent less than these industry personnel. 412

Entity Average Annual Salary

Refinery Personnel $187,630

Cal/OSHA $100,536

Contra Costa County $96,875

EPA $125,000

Table 2. Average 2012 salary for individuals se lected by the CSB as representative of the professional staff within each California regulator and of the refinery professional staff who interface with the regulators regarding audits or safety inspections at the Chevron Richmond Refinery.

As noted in the introduction of this report, the California State Legislature approved a 2013-2014 state budget bill (AP 110) that allows the California Depart ment of Industrial Relations to charge state petroleum refineries a fee by March 31, 2014, to supp ort an increase in funding and to pay for at least 15 new positions in Cal/OSHA’s PSM Unit. 413 The CSB considers this to be a positive step towards improving process safety management in the state of California, as it will provide the team the opportunity to conduct more thorough inspections. However, it is imperative that these additional inspectors have the skills, knowledge, and experience to provide sufficient direct oversight over PSMcovered facilities. Despite the additional funding, there remains a longstanding salary cap on associate safety engineers within Cal/OSHA. This will continue to make it difficult for Cal/OSHA to consistently attract or retain the necessary talent and e xpertise to effectively oversee these facilities.

412 Compensation information is based on salary only. It do es not take into account non-salary information such as bonuses, retirement programs, or benefit programs.

413 See http://www.caltax.org/homepage/062113_Legislature_Approves.html (accessed July 9, 2013).Chevron Richmond Refinery Regulatory Report January 2014

84 

## 5.2 U.S. Environmental Protection Agency

According to the EPA OIG, as of May 2012, only eight states and five local agencies had accepted full or partial RMP program delegation from EPA. 414 As such, EPA regions directly implement the RMP program in most states. As no state agency has re quested or received delegation to implement the RMP program within EPA Region 9, the federal EPA regional office is responsible for RMP program implementation for California as well as Arizona, Neva da, Hawaii, the Pacific Islands, and 148 Tribal
Nations.



## 5.2.1 Risk Management Plan (RMP) Program

As of March 2013, there were 1,137 RMP-covered facilities in Region 9: 957 in California; 118 in Arizona; 42 in Nevada; 16 in Hawaii; and four in Guam. 415 The Chevron Richmond Refinery has many processes covered by the RMP rule, including Program 3 processes, 416 such as the crude unit. As such, Chevron is required to submit an RMP every five year s to EPA Region 9, and EPA is expected to audit the facility against this RMP to ensure compliance. According to Chevron’s most recent RMP submitted to EPA Region 9 in October 2011, its crude unit contained 400,000 pounds of a flammable mixture of propane, pentane, butane, ethane, and methane, well above the 10,000-pound threshold quantity for
flammables. 417

EPA Region 9 employs four full-time and two part-time RMP inspectors to implement the RMP program for the roughly 1,100 RMP-covered facilities in the entire region. Region 9 staff informed the EPA OIG that to most effectively utilize th eir resources, they “place an additional focus on facilities in States, such as Arizona, that do not have their own risk management or accident prevention programs. 418 The EPA’s mandates to conduct a certain number of inspections at high-risk facilities plus a lack of resources and staffing prevent the inspectors from fully auditing many of the petroleum refineries in each state; thus, the inspectors aim to visit each refinery every three years, where they pick one process to evaluate for two to three days. These inspectors target their inspections towards a specific industry issue during these visits. For example, when they last in spected Chevron in 2010, the insp ectors focused on the issue of high temperature hydrogen attack (HTHA) due to the Tesoro incident that occurred in April 2010. 419

414 EPA OIG. Improvements Needed in EPA Training and Oversi ght for Risk Management Program Inspections; March 21, 2013; p 2.

415 US EPA Region 9 Emergency Prevention and Preparedness Program; Stanislaus County Powerpoint ; March 2013. See http://www.condorearth.com/files/08-Enforcement_Priorities- Mary_Wesling.pdf (accessed May 14, 2013).

416 Processes not eligible for Program 1 and either subject to OSHA’s PSM standard or classified in one of ten specified North American Industrial Cl assification System (NAICS) codes are placed in Program 3, which imposes OSHA’s PSM standard as the prevention program as well as additional hazard assessment, management, and emergency response requirements.

417 EPA List of Regulated Chemicals and Threshold Quantities for RMP program available at http://www.epa.gov/R5Super/cepps/pdf s/rmp-listed-chemicals-200708.pdf (accessed May 17, 2013).

418 California has its own RMP program, called CalARP. See EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Pr ogram for Airborne Chemical Releases; February 10, 2009; p 23.

419 On April 2, 2010, a heat exchanger ruptured due to hi gh temperature hydrogen attack, resulting in seven worker fatalities at the Tesoro Anacortes Refinery in Anacortes, Washington. The CSB is set to release its investigation report on this incident near the end of January 2014.Chevron Richmond Refinery Regulatory Report January 2014

85 

## 5.2.2 Implementation of the RMP Program

In order for a safety regime to function well, there mu st be a competent, well-resourced regulator in place to implement the regime. However, the EPA Re gion 9 RMP group is extr emely understaffed and underresourced, as there are only six full-time inspectors to cover over 1,100 facilities across many states. Instead of fully inspecting or auditing petroleum refi neries, the group is able to inspect one process at each refinery for two to three days every three y ears, which makes fully inspecting these facilities or auditing against the RMPs submitted by these facilities im possible. In addition, this group has other responsibilities beyond the RMP program, including the management of contracts, emergency prevention and preparedness training and outreach, and reporting vi olations under the Comp rehensive Environmental Response, Compensation, and Liability Act (CERCLA) . The CSB has learned that because this group has such limited resources, it hopes to delegate RMP inspection authority to other agencies throughout the region, as long as it maintains power to enforce violations.

Like the federal and California PSM standards, the RMP regulations provide for workforce participation 420 and require facilities to prepare a written plan of action regarding employee participation. It is the RMP program’s policy to invite employee representatives to participate in all parts of onsite inspections. EPA Region 9 RMP staff told the CSB, however, that the limited amount of time they were able to spend onsite at refineries made speaking with facility inspectors and operators a difficult task. They expressed that a lesson learned from the Chev ron incident was that EPA RMP inspectors should commit more time onsite during facility inspections and audits, which will allow them more time to speak with workers to gain a better insight into how any issues within the facility are being addressed and
resolved. 421

As mentioned above, EPA guidance on the RMP program states that the owner or operator’s duty to “prevent accidents and ensure safety at [their] sour ce...” may require steps to be taken “beyond those specified in the risk management program rule.” 422 While this principle appears to be similar to ALARP requirements of the safety case, in practice this is not required, and whether this is done is not subject to regulation or review. Similar to the PSM standard, RMP regulations require each facility with Program 3 processes to conduct a PHA as part of its prevention progr am that is “appropriate to the complexity of the process...and[] identify, evaluate, and control the hazards involved in the process.” 423 However, these regulations do not require facilities to include these analyses in the RMPs they submit to EPA. Rather, facilities with Program 2 or 3 processes are only requi red to include in the RMP very high-level, simplified information on their prevention programs a nd their PHAs. The Chevron Richmond Refinery’s most recent RMP submission from October 2011 included the following information on the PHAs for each relevant process: the date of the last PHA fo r that process; what technique was used; what major hazards were identified; what process controls were in use (i.e. automatic shutoffs, interlocks, alarms, emergency power); what mitigation sy stems were in use (i.e. dikes, fire walls, water curtain); what monitoring/detection systems were in use (i.e. process area detectors); date of the most recent review or

420 See 40 CFR §68.83 (2000).

421 This need for greater interface with worker is a professional opinion by EPA staff, but has not resulted in EPA policy modifications to ensure effective worker input in future inspections.

422 EPA Office of Solid Waste and Emergency Response. General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68); March 2009; p 7-7. See http://www.epa.gov/osweroe1/docs/chem/Toc_final.pdf (accessed May 14, 2013).

423 40 CFR §68.67(a) (1998).Chevron Richmond Refinery Regulatory Report January 2014

86 revision of training programs; and maintenance. Ch evron included one paragraph entitled “E.5. General Accidental Release Prevention Program,” which stated that PSM is applied to the entire refinery, and the PSM program is documented in Refinery Instruc tion (RI)-360, “Richmond Refinery PSM Policy.” No additional information or analysis could be located concerning the identification or control of hazards, or risk reduction, as, unlike the safety case model, there is no requirement for the company to demonstrate to the regulator that it is effectively ensuring th at the safety systems are functioning as intended.

Under the EPA RMP program, there is no regulatory requi rement to reduce risks to ALARP. In addition, there is no requirement to submit to the regulator de tailed information relating to risk reduction or hazard assessments. Finally, the Region 9 EPA RMP inspecti on team does not have the resources to fully audit petroleum refineries and other high hazard facilities subject to the RMP program. As a result, the EPA RMP program is not comprehensive or rigorous e nough to control major accident hazards and reduce risks. Instead, facilities submit high-level summary information providing evidence that the activitybased requirements contained within the RMP regul ations have been completed by the facility.



## 5.3 Unified Program

Chevron’s Richmond refinery was also subject to process safety regulatory requirements at the county and city level. The facility had to adhere to a dditional requirements above th e PSM and RMP regulations, but these requirements were not sufficient to preven t the Chevron incident. The following sections will discuss those county and city requirements.

In 1993, Chapter 418, Statutes of 1993 (Senate B ill 1082) established Chapter 6.11 of the California Health and Safety Code (HSC), which required the Secretary of the California Environmental Protection Agency (Cal/EPA) to adopt regulations creating a “unified hazardous waste and hazardous materials management” regulatory program, or Unified Program, by January 1, 1996, to consolidate and make consistent six existing hazardous materials a nd hazardous waste programs within the state. 424 The Secretary of Cal/EPA was charged with ensuring that the Unified Program was established and implemented by a Certified Unified Program Agency, or CUPA, in all counties in California. Cal/EPA adopted the Unified Program regulati ons under Title 27, Division 1 of th e California Code of Regulations, which integrated six existing programs: the Hazar dous Waste Generator and Onsite Hazardous Waste Treatment programs; the Aboveground Storage Tank program; the Underground Storage Tank program; the Hazardous Materials Release Response Plans a nd Inventory program; the California Accidental Release Prevention (CalARP) program; a nd the California Uniform Fire Code. 425 The CalARP program, which was created through Assembly Bill AB1889 with the goal of major accident prevention, will be discussed at greater length below. There are currently 83 CUPAs in the state of California that implement the Unified Program at a local level. 426



## 5.3.1.1 Contra Costa County Hazardous Materials Programs

The Chevron Richmond Refinery is located in the City of Richmond, within Contra Costa County. The local CUPA responsible for implementing the Unified Pr ogram in all areas of the country is the Contra

424 California Health and Safety Code §25404(b) (1993). Also see http://www.calepa.ca.gov/cupa/Reports/2002/ReimbAcct.pdf (accessed May 16, 2013).

425 27 CCR §15100 (a)(1) through (6) (1994).

426 See http://www.calepa.ca. gov/cupa/Documents/2012/FactSheet.pdf (accessed May 16, 2013).Chevron Richmond Refinery Regulatory Report January 2014

87 Costa Health Services’ Hazardous Materials Programs (CCHMP). 427 CCHMP is responsible for implementing the Unified Program in all areas of Contra Costa County.

CCHMP implements two programs that are relevant to this investigation: the CalARP program and the City of Richmond Industrial Safety Ordinance (R ISO). CCHMP also implements the county’s own Industrial Safety Ordinance (ISO), which covers seven facilities. CCHMP has five full-time engineers, known as accidental release prevention engineers, who are responsible for implementing these programs for the county. While all have technical degrees in e ngineering, only two of these engineers have past refinery experience.



## 5.3.1.1.1 CalARP

The California Health and Safety Code Article 2 (C hapter 6.95, Sections 255 31 – 25543.3) was amended effective January 1, 1997, to implement EPA’s RMP pr ogram at the state level through the creation of the CalARP program regulations. M odeled after EPA’s RMP program a nd California’s Risk Management and Prevention Plan, which was enacted in 1986, the CalARP regulations (Title 19, Chapter 4.5 of the CCR) were implemented with the goal of preventin g accidental releases of substances that can cause serious harm to the public and the environment, mi nimizing damage caused by a release, and to satisfy community right-to-know laws. 428 California is one of at least three states that implement a state RMP program without delegation of the federal program from EPA. 429

The CalARP regulations, including PHA requirements, are essentially duplicative in nature to EPA’s RMP program, with a few exceptions: the list of t oxic chemicals covered is 276 instead of 77; the threshold quantities of some chemicals are smaller; Ca lARP requires a seismic analysis; and there is more interaction with the public and other agencies. 430 The CalARP regulations require that businesses that produce, handle, process, distribute, or store certain chemicals over a certain threshold quantity develop a Risk Management Plan (RMP) and submit the RMP to a local CUPA for review. Like the EPA RMP program, facilities with a Program 3 process must develop a management system that includes a PHA and

emergency response program. 431 State oversight authority and responsibility for the CalARP program is with the California Emergency Management Agency. 432

The CalARP regulations apply to roughly 45 facilities in Contra Costa County, including the Chevron refinery in Richmond. Each covered facility is required to submit an updated RMP to CCHMP at least once every five years. 433 The group of CCHMP engineers reviews these plans and is required to

427 Contra Costa County’s Hazardous Materials program is responsible for responding to emergencies and monitoring hazardous materials in Contra Costa County. It is the duty of CCC to safeguard the Contra Costa County ecosystem from the release of hazardous materials and other pollutants. For more information see http://cchealth.org/hazmat/ (accessed May 21, 2013).

428 Information available at http://www.calema.ca.gov/HazardousMaterials/ Pages/Accidental-Release-Prevention- (CalARP).aspx (accessed May 16, 2013).

429 EPA OIG. Evaluation Report: EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009; p 20.

430 Information on differences between EPA’ s RMP program and CalARP available at http://cchealth.org/hazmat/diffe rences-rmp-calarp-iso.php (accessed May 16, 2013).

431 22 CCR §2735.5(f) (2004).

432 The California Emergency Management Agency is responsible for the coordination of overall state agency response to major disasters in support of local government. For more information see http://www.calema.ca.gov/Pages/default.aspx (accessed May 21, 2013).

433 22 CCR §2745.10(a)(1) (2004).Chevron Richmond Refinery Regulatory Report January 2014

88 “periodically audit RMPs” 434 against the regulations to ensure compliance. This group has told the CSB that it audits each facility at least once every three year s. It last audited Chev ron in February 2011, and has been conducting another audit in October and November 2013.

Although CCHMP is authorized to issue enforcement actions for violations uncovered during facility audits, in practice CCHMP engineers issue “ensure” action items that list the deficiencies and recommend improvements. They then work with the facility to make sure that these action items are implemented. CCHMP has rarely issued fines or citations to faciliti es for violations. If the engineers identify other gaps or areas for improvement that are not actual regulator y violations, they can issue “consider” action items, which are essentially suggestions to the facility for im provements that are not technically required to be implemented by the regulation. Whether these types of action items are issued is dependent upon the knowledge and experience of the engineer conduc ting the audit. Once CCHMP engineers have completed the audit, CCHMP issues a final audit repo rt on the facility, which they also supply to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group.



## 5.3.1.1.2 Industrial Safety Ordinance

The Contra Costa County Industrial Safety Ordinance (ISO) became effective January 15, 1999. Adopted as County Ordinance Chapter 450-8, the ISO expands on the CalARP program in Contra Costa County for facilities meeting the following criteria: 1) the fac ility is within an unincorporated area of the County; 2) the facility is either a petroleum refinery or chem ical plant; 3) the facility is required to submit a Risk Management Plan (RMP) to the EPA and the Contra Co sta County Health Service; and 4) the facility has at least one Program 3 process. 435 Seven of the 45 CalARP facilities in the county are currently required to comply with the ISO requirements.

The ISO was adopted to improve industrial safety by , among other things, requiring more comprehensive coverage of the whole facility rath er than only certain processes; providing review, inspection, auditing and safety requirements more stringent than are cu rrently in effect; requiring the development and implementation of a human factors program; and preventing and reducing the number, frequency and severity of accidental releases in Contra Costa County. 436

Facilities subject to the ISO are essentially required to treat every process as subject to the CalARP Program 3 prevention program requirements. Cove red facilities have additional requirements as well, including developing and implementing a human fa ctors program, considering inherently safer technologies and systems for new and existing facilities or processes, submitting a safety plan to CCHMP, and conducting a Management of Organiza tional Change (MOOC) prior to changes in permanent staffing levels or reorga nization in operations, maintenance, health and safety, or emergency

response. 437

434 22 CCR §2775.2(a) (2004).

435 See http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed Ja nuary 13, 2014).

436 County Ordinance Chapter 450-8.004(a)(1) through (10) (2006). http://cchealth.org/hazmat/pdf/iso/2006_iso_official_code_complete.pdf (accessed January 13, 2014).

437 Information available at http://cchealth.org/groups/hazmat/industrial_safety_ordinance_risk_management.php (accessed May 22, 2013).Chevron Richmond Refinery Regulatory Report January 2014

89 

## 5.3.1.1.3 City of Richmond Industrial Safety Ordinance

On December 18, 2001, the City of Richmond adopt ed an Industrial Safety Ordinance (RISO) under Municipal Code Chapter 6.43 that was almost identical to the ISO. In February 2013, the City of Richmond Council amended the RISO to make it equivalent to the ISO. Chevron is one of two facilities subject to RISO requirements. Pursuant to an agreement with the City of Richmond, CCHMP implements and enforces the RISO within the city.

Like the ISO, the RISO requires that a covered facility submit a safety plan to CCHMP that includes safety elements such as process safety information ( PSI), operating procedures, mechanical integrity, employee participation, and management of change (MOC). 438 CCHMP has posted a Safety Plan Guidance Document on its website to assist facilities in developing these plans. Each facility is also required to comply with safety requirements includi ng performing PHAs, and must include a description of the manner of compliance with these in the safety plan. 439 In performing a PHA, facilities are required to address the hazards of the process, identify any prev ious incident, identify controls applicable to the hazards, and identify consequences of failure of those controls, human factors, and a qualitative evaluation of a range of possible safety and health effects of failure of controls. 440

The CCHMP engineers are required to review each fac ility’s safety plan as well as audit each facility to determine compliance with ISO or RISO. CCHMP e ngineers conduct the CalARP and ISO/RISO audits concurrently at each covered facility. CCHMP generally audits each facility once every three years. To aid in the auditing process, CCHMP engineers have en tered all the CalARP program requirements into a database. They have taken each of these requireme nts and turned them into questions. When the engineers go onsite, they perform three main functions: 1) they identify and review any policy statement that directs how people should handle a particular piece of equipment; 2) they identify and review records of procedures, such as MOCs and permits; and 3) they randomly select and interview individuals about their familiarity with various aspects of different pr ograms. If the engineers find a regulatory deficiency, they issue an ensure action item to the facility.

Once the engineers have completed their facility audi t, they issue a preliminary determination to the facility. The facility has 90 days to review the draft and provide a proposed remedy with specifics on how they will fix each deficiency, and the timeline. Once the report is finalized it goes out for public comment. Following public comment, it is issued to the facility and provided to Cal/OSHA’s PSM District Office and the EPA Region 9 RMP group.



## 5.3.1.2 Analysis

Chevron submitted its most updated safety plan to CCHMP on February 25, 2013. Section 3.12 of the plan discusses PHAs and Action Items. Under this section, Chevron lists eight objectives of its PHAs, including identifying possible failures or releases, evaluating potential consequences, and proposing recommendations that would reduce the risks. Chevron also discusses its possible justifications for declining recommendations from PHAs, including the fact that an alternative measure would be sufficient, and that the recommendation may be inf easible. There was no additional information or

438 Richmond Municipal Code Section 6.43.090 (a) (2013).

439 Ibid at Sections (a) through (e) (2013).

440 Ibid at (d) (2013).Chevron Richmond Refinery Regulatory Report January 2014

90 analysis contained in this section concerning the iden tification or control of hazards, or risk reduction, as there is no requirement to do so.

The RISO and CalARP regulations require that PHAs lis t controls and possible consequences of failure of those controls, but there is no specific requirement to include evaluations of the safeguards and controls in the PHA. As CCHMP engineers are only required to audit against the regulatory requirements, they would only examine the evaluation of safeguards if such an evaluation were performed and documented in the facility’s PHAs. As noted previously, Chevro n’s most recent crude unit PHA ineffectively listed qualitative safeguards for corrosi on and mechanical integrity.

While CCHMP engineers are able to issue “consider ” action items to the facility recommending actions above and beyond regulatory requirem ents, CCHMP engineers did not do this regarding Chevron’s Crude Unit PHA or its evaluation of safeguards. After re viewing CCHMP’s most recent audit of Chevron, the CSB could find nothing referring to sulfidation corrosi on, reduction of risk, or safeguard evaluation.
While CCHMP is able to utilize these “consider” act ion items to encourage facilities to go above and beyond regulatory requirements to reduce risk, CCHMP engineers have stated to the CSB that they do not make sufficient use of this mechanism. Rather, they tend to audit against the existing regulatory requirements to ensure compliance.

Unlike the safety case regulatory approach, which requir es a reduction of risk to ALARP or equivalent, facilities covered by RISO or ISO are only required to “ consider [emphasis added] the use of inherently safer systems in the development and analysis of mitigation items resulting from a process hazard analysis [PHA] and in the design and review of new processes and facilities.” 441 Despite multiple internal recommendations to replace its piping due to the risk of sulfidation corrosion, Chevron failed to replace the piping prior to the incident with an inherently safer material. Again, th e CSB has not found evidence that CCHMP effectively encouraged Chevron to go above and beyond regulatory requirements by utilizing inherently safer systems to reduce risk.

As emphasized repeatedly in this report, a regulatory regime is only as strong as its regulators, and must employ individuals with the requi site skills, knowledge, and experien ce to provide sufficient oversight over facilities. In the case of CCHMP, there are only five engineers for nearly 45 facilities in the county, and only two have previous refinery experience. 442 In addition, while the CCHMP is funded mostly through CUPA fees, ISO fees, and other means of cost recovery, the engineers are part of a bargaining unit and their salaries are paid through the county’ s general fund, which has experienced annual budget
reductions in the millions. 443 This has unnecessarily resulted in a decrease in the CCHMP engineers’ salaries and has made it extremely difficult for CCHMP to fill a current position that has been open over three years because of its inability to offer competitive salaries to attract its engineers. Overall, CCHMP suffers from a lack of resources and funding, limiting its ability to hire additional highly qualified staff to oversee the petroleum refineries in Contra Costa County.

441 City of Richmond Municipal Code §6.43.050(g) (February 5, 2013).

442 Two of the other engineers have chemical plant experience and have led or participated in refinery compliance audits in the past ten years.Chevron Richmond Refinery Regulatory Report January 2014

91 

## 6.0 

## Conclusion

This report has focused on several aspects of the safety case regulatory approach that the CSB believes differentiate it from existing US and California pr ocess safety regulations: safety responsibility on the part of the facility, including a written case for safet y; continuous risk reduction to ALARP; adaptability and continuous improvement; active wo rkforce participation; the effective use of process safety indicators that drive performance; regulatory assessment, veri fication, and intervention; and an independent, competent, well-funded regulator. These attributes toge ther enable industry and the regulator to ensure that facilities are developing and implementing compre hensive, robust safety management systems to prevent major accidents.

Implementation of the safety case regulatory regime in California for petroleum refineries will require a commitment of extensive resources to fund a regul ator that has the requisite skills, knowledge, and experience to ensure petroleum refineries in the st ate continually assess their practices and reduce risks to ALARP. However, the CSB believes that effective implementation of this regulatory approach will achieve greater major accident prevention in Californi a and, in the process, provide greater protection for its workers and the public.

The safety case provides the adapta bility necessary to keep current with improving standards and advancing technology, without requiring lengthy and often unproductive rulemaking on the part of the regulator. With the safety case regulatory regime in place, a competent regulator will independently ensure that California refineries have taken all prac tical measures that can be reasonably taken to reduce risks. For example, the regulator would have the ability to work with these facilities to implement recommendations and lessons learned from significant pe troleum refinery incidents throughout the world without requiring extensive rulemaking or legislation, as regulators have done post-incident in the UK, Norway, and Australia. If questions remain regarding the safety case regulatory regime after reading this report, see Appendix C for additional information and discussion.

The safety case regulatory regime will require a full commitment and extensive effort by the California legislature, regulators, and California petroleum refineri es. However, the CSB believes that this effort is necessary to ensure that California, like other regi ons around the world, is effectively managing process safety and risk, and in the process, preventing major accidents such as the August 6, 2012, Chevron pipe rupture and hydrocarbon release.Chevron Richmond Refinery Regulatory Report January 2014

92 

## 7.0 

## Recommendations

Pursuant to its authority under 42 U. S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer operations at California petroleum refineries a nd protecting workers and communities from future accidents, the CSB makes the following safety recommendations: 

## California State Legislature,

Governor of California

2012-03-I-CA-R21

Develop and implement a step-by-step plan to establish a more rigorous safety management regulatory framework for petroleum refineries in the state of California based on the principles of the “safety case” framework in use in regulatory regimes such as t hose in the United Kingdom, Australia, and Norway, and as described in this report, with the following minimum components:

a. A case for safety written by the duty holder that includes a systematic analysis and documentation of all major hazards and effective control methods implemented to reduce those risks as low as reasonably practicable (ALARP);

b. A thorough review of the safety case report by technically competent regulatory personnel that requires modifications and improvements to the document as necessary prior to acceptance;

c. Audits and preventative inspections by the regulator to verify effective implementation of safety case elements;

d. A risk management approach that requi res analysis and effective implementation of safeguards, using the hierarchy of controls, to protect people and the environment from major
accident hazards. The effectiv eness of the safeguards will be demonstrated through the use of leading and lagging process safety indicators;

e. Ability to adapt and implement safety require ments in response to newly identified hazards, advances in technology, lessons learned from majo r accidents, and improved safety codes without the need for new rule-making;

f. Determines when new or improved industry standards and practices are needed and initiates programs and other activities such as forums to prompt the timely development and implementation of such standards and practices;

g. Uses a tripartite model where the regula tor, the company, and workers and their representatives play an equal and essential role in the direction of preventing major accidents;

h. A regulatory model and accompanying guidance based on the UK’s The Safety Representatives and Safety Committees Regula tions 1977 and the Health and Safety (Consultation with Employees) Regulations 1996, which set out the legal framework for the rights and responsibilities of workers and thei r representatives on health and safety-related matters, and the election of safety representatives and establishment of safety committees to serve health and safety-related functions. The elected representatives should have a legally recognized role that goes beyond consultation in activities su ch as the development of the safety case report,Chevron Richmond Refinery Regulatory Report January 2014

93 process hazard analysis, management of change, inci dent investigation, audits, and identification and effective control of hazards. The representativ es should also have the authority to stop work that is perceived to be unsafe or that presents a serious hazard until the regulator intervenes to address the safety concern. Workforce participa tion practices should be documented by the duty holder and submitted to the regulator;

i. Requires reporting of information to the public to the greatest extent feasible such as a summary of the safety case report, the process haza rd analysis, a list of safeguards implemented and standards utilized to reduce risk, and pr ocess safety indicators that demonstrate the effectiveness of the safeguards and management systems; 444

j. An independent, well-funded, well-sta ffed, technically competent regulator; and

k. A compensation system to ensure the safety case regulator has the ability to attract and retain a sufficient number of employees with the necessar y skills and experience to ensure regulator technical competency. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains comp etitive with California petroleum refineries.

2012-03-I-CA-R22

Work with the regulator, the petroleum refining industr y, labor, and other relevant stakeholders in the state of California to develop and implement a system that collects, tracks, and analyzes process safety leading and lagging indicators from operators a nd contractors to promote continuous safety improvements. At a minimum, this program shall:

a. Require the use of leading and lagging process safety indicators to actively monitor the effectiveness of process safety management systems and safeguards for major accident prevention. Include leading and lagging indicators that ar e measureable, actionable, and standardized. Require that the reported data be used for continuous process safety improvement and accident prevention;

b. Analyze data to identify trends and poor pe rformers and publish annual reports with the data at facility and corporate levels;

c. Require companies to publicly report require d indicators annually at facility and corporate levels;

d. Use process safety indicators (1) to driv e continuous improvement for major accident prevention by using the data to identify industry and facility safety trends and deficiencies and (2) to determine appropriate allocation of regulator resources and inspections; and

e. Be periodically updated to incorporate new learning from world-wide industry improvements in order to drive continuous major acci dent safety improvements in California.

444 Certain information such as the pr ocess hazard analysis may contain tr ade secret or confidential business information that would have to be identified and protected from public disclosure.Chevron Richmond Refinery Regulatory Report January 2014

94 

## The Chemical Facility Safety and Security Working Group and the Occupational Safety and Health Administration

2012-03-I-CA-R23

This report highlights significant advantages of the safety case regime over the existing Process Safety Management standard to prevent potentially catastroph ic chemical accidents that are relevant to OSHA’s response to Executive Order (EO) 13650. In the de velopment of the OSHA EO response, incorporate a written plan that includes the evaluation of i ssues raised from the findings, conclusions and recommendations in this report concerning the safety case regime.Chevron Richmond Refinery Regulatory Report January 2014

95 

## References

Australian Safety and Compensation Council. Major Hazard Facilities Annual Situation Report; 2004. http://www.safeworkaustralia.gov.au/sites/SWA/abou t/Publications/Documents/475/MHFAnSituationRe port_2004.pdf (accessed May 8, 2013).

Baker, J. The Report of the BP U.S. Refineries Independent Safety Review Panel, 2007.

Buncefield Major Incident Investigation Board. Recommendations on the design and operation of fuel storage sites; March 2007. http://www.buncefieldinvestigation. gov.uk/reports/recommendations.pdf (accessed May 21, 2013).

Center for Chemical Process Safety (CCPS). Guidelines for Developing Quantitative Safety Risk Criteria; August 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Process Safety Metrics ; October 2009.

Center for Chemical Process Safety (CCPS). Guidelines for Risk Ba sed Process Safety; March 2007.

Center for Chemical Process Safety (CCPS). Inherently Safer Chemical Processes – A Life Cycle Approach; 2 nd ed., December 2008.

Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty; November 1990.

Dole, Elizabeth. Phillips 66 Company Houston Chemical Compl ex Explosion and Fire: Implications for Safety and Health in the Petrochemical Industry, A Report to the President; April 1990. http://ncsp.tamu.edu/reports/phillips/first%20part.pdf (accessed August 6, 2013).

EPA OIG. Evaluation Report: EPA Can Improve Implem entation of the Risk Management Program for Airborne Chemical Releases; February 10, 2009.

EPA OIG. Improvements Needed in EPA Training and Oversight for Risk Management Program Inspections; March 21, 2013. http://www.epa.gov/oig/reports /2013/20130321- 13-P-0178.pdf (accessed June 11, 2013).

GAO. Workplace Safety and Health: Multiple Cha llenges Lengthen OSHA’s Standard Setting; April 19,
2012. http://gao.gov/assets/600/590210.pdf (accessed June 12, 2013).

Hopkins, Andrew. Disastrous Decisions: The Human and Organisational Causes of the Gulf of Mexico Blowout; CCH Australia Limited, 2012.

Hopkins, Andrew. Lessons from Esso’s Gas Plant Explosion at Longford; Australian National University [Online].Chevron Richmond Refinery Regulatory Report January 2014

96 http://www.sirfrt.com.au/Meetings/IMRt/South east/IMRt%20East%2000Nov3 0/Andrew%20Hopkins%2 0presentation/Lonford%20talk.PDF (accessed May 8, 2013).

Hopkins, Andrew. Managing Major Hazards: The Lessons of the Moura Mine Disaster; National Library of Australia, 1999;.

Hopkins, Andrew. The Meaning of “Safety Cas”e; February 2013.

HSE. A Guide to the Offshore Installations (Safety Case) Regulations 2005: Guidance on Regulations;
2006. http://www.hse.gov.uk/pubns/priced/l30.pdf (accessed May 7, 2013).

HSE. Assessment Principles for Offshore Safety Cases (APOSC); March 2006. http://www.hse.gov.uk/offshore/aposc190306.pdf (accessed August 6, 2013).

HSE. Assessing compliance with the law in indi vidual cases and the use of good practice; May 2003. http://www.hse.gov.uk/risk/theory/alarp2.htm (accessed June 12, 2013).

HSE. Developing process safety indicators: A step-b y-step guide for chemical and major hazard industries; 2006. http://www.hse.gov.uk/pubns/books/hsg254.htm (accessed May 28, 2013).

HSE. Planning to do business in the UK offshore oil and gas industry? What you should know about health and safety; October 2011. http://www.hse.gov.uk/offshore/guidance/entrants.pdf (accessed June 5, 2013).

HSE. Play your part! How offshore workers c an help improve health and safety; 2013. http://www.hse.gov.uk/pubns/indg421.pdf (accessed June 17, 2013).

Oil & Gas UK. Piper Alpha: Lessons Learnt; 2008. Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,
2009. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

Process Safety Leadership Group. Safety and environmental standards for fuel storage sites; London,
2009. http://www.hse.gov.uk/comah/buncefield/fuel-storage-sites.pdf (accessed August 1, 2013).

TAF Powell, SPE, UK Health & Safety Executive. US Voluntary Semp Initiative: Holy Grail or
Poisoned Chalice? Proceedings of the Offshore Technology Conference, Houston, Texas, May 8-9,
1996.

The Competent Authority. Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Heme l Hempstead, Hertfordshire on 11 December 2005 ; February 2011. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf (accessed May 21, 2013).Chevron Richmond Refinery Regulatory Report January 2014

97 Wilson, Michael P. Refinery Safety in California: Labo r, Community and Fire Agency Views; Summary Report for Office of Governor Jerry Brown, Interage ncy Task Force on Refinery Safety; March 27, 2013, Revised June 4, 2013. Citing Zimgast, Erst. (June 6, 2006). Selective U/W in Oil-Petro Segment: Loss Burden in Different Regions, USA vs. Rest of the Wo rld, History of Selective U/W, Cause of Losses. Technical report-DRAFT-EXTRACT. Risk Engineering Services, Swiss Re. http://www.lohp.org/projects/refinery_safety.html (accessed July 8, 2013).Chevron Richmond Refinery Regulatory Report January 2014

98 

## Appendix A: Significant Petrol eum Refinery Incidents in 2012

1. Tank failure at the ExxonMobil refinery in Beaumont, Texas on 11 January
2. Vessel pressure excursion at the Flint Hills refinery in St. Paul, Minnesota on 22 January
3. Hydrogen Sulfide release from mechanical integr ity failure at the Northern Tier Energy refinery in St. Paul, Minnesota on 26 January
4. Sulfuric acid release from a mechanical integrity failure at the ConocoPhillips refinery in Wood River, Illinois on 27 January
5. Hydrogen Sulfide release from mechanical inte grity failure at the Marathon refinery in Garyville, Louisiana on 31 January

6. Hydrocarbon and hydrogen fluoride release from a m echanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 31 January

7. Sulfur dioxide and hydrogen sulfide release fo llowing a vessel pressure excursion at the Alon refinery in Big Spring, Texas on 1 February
8. Hydrocarbon release from a vessel pressure excursion at the ConocoPhillips refinery in Belle Chasse, Louisiana on 1 February

9. Benzene release from a mechanical integrity failu re at the Husky refinery in Lima, Ohio on 16 February
10. Fire at the Tesoro refinery in Salt Lake City, Utah on 17 February
11. Fire at the BP refinery in Cherry Point, Washington on 17 February
12. Tank failure at the Shell refinery in Deer Park, Texas on 22 February
13. Tank failure at the Paulsboro refinery in Paulsboro, New Jersey on 23 February
14. Fire at the Citgo refinery in Corpus Christi, Texas on 24 February
15. Hydrogen Sulfide release from a mechanical integr ity failure at the Flint Hills refinery in Rosemount, Minnesota on 28 February
16. Vessel pressure excursion at the Motiva refine ry in St. Charles, Louisiana on 28 February
17. Benzene release from a mechanical integrity failu re at the Chalmette refinery in Chalmette, Louisiana on 28 February
18. Crude oil release from a mechanical integrity fa ilure at the Flint Hills refinery in North Pole, Alaska on 4 March
19. Hydrogen fluoride release from a mechanical in tegrity failure at the Citgo refinery in Corpus Christi, Texas on 6 March
20. 1 worker was fatally injured and 2 other work ers were burned at the Valero refinery in Memphis, Tennessee on 6 March
21. Fire during a hot work activity at the Tesoro refinery in Martinez, California on 7 March
22. Benzene release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 8 March
23. Heavy oil release from a mechanical integrity fa ilure at the Chevron refinery in Pascagoula, Mississippi on 13 March
24. Benzene release from a mechanical integrit y failure at the Marathon refinery in Texas City,
Texas on 14 March
25. Fire at the PBF Energy refinery in Delaware City, Delaware on 16 March
26. Hydrocarbon release from a mechanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 19 MarchChevron Richmond Refinery Regulatory Report January 2014

99 27. Hydrocarbon release from a mechanical integr ity failure at the Tesoro refinery in Anacortes, Washington on 23 March
28. Hydrocarbon release from a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 24 March
29. Fire at the ExxonMobil refinery in Billings, Montana on 25 March
30. Hydrogen fluoride release from a mechanical inte grity failure at the BP refinery in Texas City, Texas on 27 March
31. Hydrocarbon release from a mechanical integrity failure at the Total refinery in Port Arthur, Texas on 11 April
32. Fire at the ConocoPhillips refinery in Rodeo, California on 13 April
33. Hydrocarbon release from a mechanical integrit y failure at the Flint Hills refinery in Corpus Christi, Texas on 16 April
34. Crane fell over and damaged utility piping at th e Citgo refinery in Lemont, Illinois on 17 April
35. Hydrocarbon release from a mechanical integrit y failure at the Flint Hills refinery in Corpus Christi, Texas on 19 April
36. Fire at BP refinery in Texas City, Texas on 20 April
37. Hydrocarbon release from a mechanical integrit y failure at the ConocoPhillips refinery in Sweeny, Texas on 24 April
38. Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 8 May
39. 4 workers injured in fire at the Sinclair refinery in Sinclair, Wyoming on 8 May
40. Hydrocarbon release from a mechanical integrit y failure at the LyondellBasell refinery in Houston, Texas on 8 May
41. Fire at the Sunoco refinery in Philadelphia, Pennsylvania on 9 May
42. Fire at the Motiva refinery in Port Arthur, Texas on 12 May
43. Hydrogen sulfide release from a mechanical inte grity failure at the CVR Energy refinery in Wynnewood, Oklahoma on 11 May
44. Hydrogen fluoride release from a mechanical in tegrity failure at the Citgo refinery in Corpus Christi, Texas on 15 May
45. Hydrogen sulfide release from a mechanical inte grity failure at the Shell refinery in Deer Park, Texas on 17 May
46. Benzene and hydrogen sulfide re lease from a mechanical integr ity failure at the Flint Hills refinery in Corpus Christi, Texas on 21 May
47. Fire at the Montana Refining Company refinery in Great Falls, Montana on 24 May
48. Hydrocarbon release from a mechanical integrity fa ilure at the Valero refinery in Memphis, Tennessee on 25 May
49. 2 workers injured from a fire at the Sincla ir refinery in Sinclair, Wyoming on 28 May
50. Propylene release from overpressure event at the PBF Energy refinery in Delaware City, Delaware on 29 May
51. Hydrocarbon release from a mechanical integrity fa ilure at the Valery refinery in Houston, Texas on 31 May
52. Hydrogen and hydrocarbon release due to loss of containment even t at the Shell refinery in Deer Park, Texas on 7 JuneChevron Richmond Refinery Regulatory Report January 2014

100 53. Hydrogen sulfide and hydrocarbon release due to flare failure at the Motiva refinery in Norco, Louisiana on 7 June
54. Fire at the Motiva refinery in Port Arthur, Texas on 9 June
55. Hydrocarbon release due to a mech anical integrity failure at the BP refinery in Texas City,

Texas on 9 June
56. Fire at the ExxonMobil refinery in Torrance, California on 11 June
57. Fire at the Total refinery in Port Arthur, Texas on 13 June
58. Hydrogen sulfide release from a tank failure at the ConocoPhillips refinery in Rodeo,
California on 15 June
59. Hydrocarbon release at the Shell refinery in Deer Park, Texas on 20 June
60. Fire at the BP refinery in Whiting, Indiana on 21 June
61. Hydrocarbon release due to a mech anical integrity failure at the Valero refinery in Corpus Christi, Texas on 23 June
62. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 25 June
63. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 28 June
64. Propane release due to a mechanical integrity failure at the Valero refinery in McKee,
Texas on 28 June
65. Sulfuric acid release due to a mechanical inte grity failure at the Chevron refinery in El Segundo, California on 2 July

66. Hydrocarbon release due to a m echanical integrity failure at the Phillips 66 refinery in Westlake, Louisiana on 14 July

67. Fire at the Citgo refinery in Corpus Christi, Texas on 16 July
68. Fire at the Valero refinery in Meraux, Louisiana on 22 July
69. Sulfuric acid release due to a mechanical in tegrity failure at the Sunoco Point Breeze refinery in Philadelphia, Pennsylvania on 22 July
70. Fire at the BP refinery in Whiting, Indiana on 23 July
71. Hydrocarbon and hydrogen fluoride release due to a mechanical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 24 July
72. Fire at the HollyFrontier refinery in Tulsa, Oklahoma on 2 August
73. 8,614 lbs of hydrogen sulfide were released to the atmosphere due to a mechanical integrity failure on a compressor suction line at the Chevron refinery in Richmond, California on 2 August.
74. Hydrogen sulfide release from an overpressure event at the Valero refinery in Texas City, Texas on 5 August
75. Fire at the Sinclair refinery in Sinclair, Wyoming on 5 August

76. Fire at the Chevron refinery in Richm ond, California on 6 August

77. Fire at the Shell refinery in Martinez, California on 13 August
78. Hydrogen sulfide release from a mechanical in tegrity failure at the Shell refinery in Martinez, California on 14 August
79. 2 workers injured from a fire at the BP refinery in Whiting, Indiana on 14 August
80. Hydrogen sulfide release due to a mechanical in tegrity failure at the Phillips 66 refinery in Wood River, Illinois on 22 AugustChevron Richmond Refinery Regulatory Report January 2014

101 81. Fire at the Sinclair refinery in Sinclair, Wyoming on 24 August
82. Hydrocarbon release due to a mechanical integr ity failure at the LyondellBasell refinery in Houston, Texas on 25 August
83. Hydrocarbon release due to a mech anical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 26 August
84. Hydrogen sulfide and propylene release due to a mechanical integrity failure at the ExxonMobil refinery in Beaumont, Texas on 29 August
85. Fire at the Phillips 66 refinery in Rodeo, California on 29 August
86. A high pressure excursion in a vessel resu lted in a hydrocarbon release with offsite consequences at the Holly refinery in Woods Cross, Utah on 30 August
87. Worker injured following a fire at the Marathon refinery in Detroit, Michigan on 5 September
88. Chemical release with offsite consequences at the Marathon refinery in Detroit, Michigan on 8 September
89. Sulfuric acid release due to a mechanical in tegrity failure at the Tesoro refinery in Martinez, California on 10 September
90. Carbon monoxide and hydrogen sulfide release due to a mechanical integrity failure at the ExxonMobil refinery in Baytown, Texas on 11 September
91. Hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 11 September
92. Hydrocarbon release due to a m echanical integrity failure at the Chevron refinery in Pascagoula, Mississippi on 14 September
93. Unspecified leak at the Tesoro refinery in Martinez, California on 15 September
94. Hydrocarbon release due to a mech anical integrity failure at the PBF Energy refinery in Delaware City, Dela ware on 21 September
95. Hydrogen sulfide release due to a mechanical integrity failure at the Motiva refinery in Norco, Louisiana on 24 September

96. 1 worker killed and another worker injured from an explosion at the CVR Energy refinery in Wynnewood, Oklahoma on 28 September

97. Fire at the Motiva refinery in Convent, Louisiana on 1 October
98. Hydrogen fluoride release at the Placid refine ry in Port Allen, Louisiana on 1 October

99. Hydrogen sulfide release from a high pressure excursion at the Valero refinery in Port Arthur, Texas on 1 October
100. Fire at the ExxonMobil refinery in Baytown, Texas on 3 October
101. Vapor cloud release at the Hess refinery in Port Reading, New Jersey on 3 October
102. Hy drocarbon release due to a m echanical integrity failure at the Phillips 66 refinery in Rodeo, California on 8 October
103. Fire at the Citgo refinery in Corpus Christi, Texas on 9 October
104. Vapor cloud release with offsite impact from the Kern Oil refinery in Bakersfield,
California on 17 October
105. Hydrocarbon and hydrogen sulfide release from a pressure excursion at the ExxonMobil refinery in Joliet, Illinois on 19 October
106. Hydrocarbon release due to a mech anical integrity failure at the Citgo refinery in Sulfur,
Louisiana on 22 OctoberChevron Richmond Refinery Regulatory Report January 2014

102 107. Hydrogen sulfide release at the Chalmette refi nery in Chalmette, Louisiana on 23 October
108. Fire at the Tesoro refinery in Martinez, California on 21 October
109. Fire at the BP refinery in Texas City, Texas on 30 October
110. Fire at the Valero refinery in Port Arthur, Texas on 3 November
111. Benzene release due to a mechanical integrity fa ilure at the Shell refinery in Deer Park,
Texas on 8 November
112. Vapor release at the Tesoro refinery in Martinez, California on 8 November
113. Hydrogen sulfide release due to a mechanical integrity failure or a high pressure excursion at the Shell refinery in Martinez, California on 24 November
114. Hydrogen sulfide and hydrocarbon release at the Northern Tier Energy refinery in St. Paul Park, Minnesota on 27 November
115. Benzene release due to a mechanical integrity failure at the ExxonMobil refinery in Baton Rouge, Louisiana on 1 December
116. Hydrogen fluoride release that killed one work er, injured 2 other workers and 7 emergency responders at the Valero refinery in Memphis, Tennessee on 3 December
117. Hydrocarbon release due to a mech anical integrity failure at the Flint Hills refinery in Corpus Christi, Texas on 5 December
118. Hydrogen sulfide release at the Phillips 66 refinery in Wood River, Illinois on 8 December
119. Fire at the Motiva refinery in Port Arthur, Texas on 11 December
120. Benzene release due to a mechanical integrity failure at the Alon refinery in Big Spring,
Texas on 11 December
121. Hydrocarbon release due to a mechan ical integrity failure at the Shell refinery in Deer Park,
Texas on 11 December
122. Hydrocarbon release at the Shell refinery in Anacortes, Washington on 12 December
123. Hydrogen sulfide release due to a pressure ex cursion at the PBF Energy refinery in Paulsboro, New Jersey on 14 December
124. Hydrocarbon and hydrogen sulfide release due to a mechanical integrity failure at the Marathon refinery in Garyville, Louisiana on 15 December
125. Fire at the Motiva refinery in Port Arthur, Texas on 17 December Note -Incidents of hydrocarbon leaks into a cooling tower or releases to a flare system are not included in
the above list.Chevron Richmond Refinery Regulatory Report January 2014

103 

## Appendix B: Regulatory Comparison Table

OSHA PSM Standard California PSM Standard The Safety Case Regulatory Regime

Scope Covered processes excluding oil and gas well drilling and servicing Covered processes excluding oil and gas well drilling and servicing Applies to offshore and onshore oil and gas operations

Specific PSM/
Major Accident Focus Yes Yes Yes

ALARP or Equivalent No No Yes
Adaptability to New or Revised Codes, Standards, Technology, Hazard Information, Lessons Learned, etc. Limited to RAGAGEP –only addresses equipment and mechanical integrity (2 of 14 elements); RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Limited to RAGAGEP – only addresses equipment and mechanical integrity; RAGAGEP not defined in the standard or a referenced list, only a handful of standards referenced as RAGAGEP in OSHA interpretation letters Yes via safety case and supporting framework legislation

PSM Indicators Req. No No Yes for Companies

Competent Regulator

50% or more Engineers/PSM OSHA-some progress but no Cal/OSHA – some progress but no Yes

Sufficient Funding for Competent Regulatory staff OSHA-No California is increasing funding to support additional staff on Cal/OSHA PSM team Yes

Hazard Analysis Required – “shall identify, evaluate, and control the hazards involved in the process.” Required – “appropriate to the complexity of the process for identifying, evaluating, and controlling hazards involved in the process.” Is a specific aspect of SC and supporting framework regulation and is required for all onshore and offshore facilities. To meet legislative goal-setting requirements, a structured risk assessment including HA as appropriate is required from all “employers.”Chevron Richmond Refinery Regulatory Report January 2014

104 Incident Investigation Requires a report but activitybased; requires including

“ any recommendations resulting from the investigations” (what if there are none?); system required to “ resolve the incident report findings and recommendation; no explicit requirement to prevent a similar occurrence or controlling hazards. Requires a report including “any recommendations resulting from the investigation.” System required to “establish a system to promptly address and resolve the report findings and recommendations and...implement the report recommendations in a timely manner, or take action to prevent a reoccurrence.” Investigation of incidents required to demonstrate legal compliance with framework legislation. ‘Reasonably practicable’ requirement would require remedial action and cross company learning from incident investigations. HSE can require SC duty holder compliance with investigation report recommendations (e.g. Buncefield Report-“determine SIL level requirements for overfill protection”)

Management of Change Activity-based; the employer “shall establish and implement written procedures to manage changes;” “the procedures shall assure the following considerations are addressed...impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Activity-based: the employer “shall establish and implement written procedures to manage changes...;” “the procedures shall assure that the following are addressed prior to any change...technical basis for proposed change; impact of change on safety and health;” no formal hazard analysis required; no requirement that the identified safety impacts or hazards be controlled. Description of MOC procedures and demonstrations of their effectiveness in managing major accident hazard risk are a key requirement of the safety case.

Workforce Participation “Employers shall develop a written plan of action regarding the implementation of the employee participation;” Employers shall consult with employees and their representatives on the conduct and development of PHAs and the other elements of PSM in this standard.” “Employer shall develop a written plan of action to ensure employee participation in process safety management;” includes employer consultation with employees and their representatives on the conduct and development of the elements of process safety management required by this section; and providing employees and their representatives with access to all information required to be developed by this section...” Provides for the election of protected safety representative positions and safety committees.Chevron Richmond Refinery Regulatory Report January 2014

105 Inherent Safety No No Yes 

# I'

--II

- j jChevron Richmond Refinery Regulatory Report January 2014

106 

## Appendix C: Frequently Asked Questions (FAQs) Regarding the Safety Case Regu latory Approach

1. Is it true that the safety case regulatory approach leads to self-regulation by industry?

Critics of the safety case regulatory approach have noted that this type of regulatory regime is likely to result in mere industry self-regulation. 445 Critics have also noted that this is at least partly due to the fact
that there is no will in the US to ensure that re gulators have the tools, resources, and competence to effectively regulate workplaces. The CSB and those with experience in developing and implementing the safety case regulatory regime have repeatedly stated that the purpose of the safety case regulatory approach is to ensure that all hazards have been id entified, evaluated, and controlled so that risks are reduced to as low as reasonably practicable, or ALARP. In simple terms, the safety case report is a series of claims as to how an installation is being safety operated. The real strength of the safety case regulatory regime is testing the validity of those claims through strategic inte rvention by competent, well-funded regulators. Advanced performance-based regulatory regimes in the United Kingdom (UK) and Norway, for example, 446 incorporate a list of regulator-accepted standards and good practices that provide companies with the minimum performance that is expect ed. Companies must demonstrate that they meet or exceed those standards. Therefore, companies are aware of minimum performance expectations they must meet as they work to reduce risks to ALARP. If a competent re gulator is not in place, then the safety case report equates to nothing more than a lifel ess document sitting on a shelf, and the criticism of self-regulation becomes valid.

It is also important to point out that in a letter from the USW Local 5 to the CSB dated November 22, 2013, it was stated that “[t]he current system is truly a self regulated system, with the industry setting the rules, changing the rules, and monitoring themselves.” Individuals are noting that the current system in place has actually led to self-regulation despite the in tent of the PSM standard and RMP program to be performance-based.

Critics have also argued that there is a lack of tr ansparency with the safety case regime. However, under the existing PSM standard, none of the PSM elements are made public by the company or the regulator, including the process hazard analyses and management of change documents. To improve transparency, many safety case regimes collect and report indicator data, and companies are required make safety case report summaries publicly available. These are high level documents that are published online and summarize safety assessments, hazardous materials, hazards and control measures, potential major incidents, emergency response, and safety management systems.

Rather than accepting the inevitability of catastrophi c events, we should act to prevent them from happening. As discussed in this report, there is a move ment in California to improve oversight of

445 See e.g. Rena Steinzor. Lessons from the North Sea: Should “Safety Cases” Come to America? Vol. 38: 417; 2011; p 439. Available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1735537 (accessed September 4, 2013).

446 Norway requires many similar aspects of a safety case regime offshore but there are differences in implementation and style and content of the regulations. The UK implements a safety case regime both onshore and offshore.Chevron Richmond Refinery Regulatory Report January 2014

107 petroleum refineries. There has also been increased dialogue in the US in recent years surrounding the regulation of the oil and gas industry and how to make improvements. As such, the support exists to not only shift the current activity-based regulatory structure to a more goal-based safety case regulatory regime, but to also ensure that competent, well-f unded regulators are in place to implement and enforce such a regime.

2. How does the safety case regulatory regime in the US allow for changes to be made without requiring rulemaking under the Administrative Procedure Act?

The Administrative Procedure Act, or APA, was passe d in 1947, and lays out the basic framework under which federal rulemaking is c onducted. It defines “rule” as “the whole or a part of an agency statement of general or particular applicability a nd future effect designed to implement, interpret, or prescribe law or policy or describing the organization, procedur e, or practice requirements of an agency...” 447 “Rulemaking” is defined as the “agency process fo r formulating, amending, or repealing a rule.” 448 Federal agencies often impact their specific area of jurisdiction by publishing rules promulgated through notice and comment rulemaking, or informal rulemaki ng, under the APA. Unfortunately, as this report discusses at length, the rulemaking process in the US is cumbersome and some federal agencies, such as OSHA and the EPA, are subject to additional requireme nts and more stringent review standards that go above and beyond those contained in the APA. To avoid these additional burdens, many agencies provide further guidance to regulated parties through more informal means, such as answering questions and issuing policy statements, guidance, or opinion lette rs. Another way to lessen the burden on regulating agencies and their regulated entities is to adopt pe rformance or goal-based regulations rather than prescriptive regulations. Performance-based standards st ate the objective or outcome to be achieved, such as risk reduction, without describing the specific mean s of obtaining that objective. This provides the regulated entities with the freedom and flexibility to wo rk to achieve a stated goa l, such as reducing risks to as low as reasonably practicable, or ALARP, through their chosen and preferred means. 449 Performance-based standards also provide flexibilit y to the regulator; for example, in a safety case regulatory regime, should the regulator determine through assessment of the safety case report and/or inspection that the facility has not reduced risks to AL ARP with regard to a specific hazard, he or she may require that the facility take additional steps to furt her reduce risk without needing to propose and adopt a new rule or regulation to address it. The regulator must accept the safety case report in order for the facility to operate.

The Regulatory Flexibility Act was passed in 1980 during the Carter Administration. It requires agencies to prepare and make available for public comment re gulatory flexibility analyses of proposed rulemaking, and also encourages agencies to consider alternativ es to rulemaking, including “the use of performance rather than design standards...” 450 Executive Order 13272 then directed federal agencies to establish procedures and policies to comply with the Act. 451 Federal agencies have been encouraged to adopt

447 5 U.S.C. §551(4) (2011).

448 5 U.S.C. §551(5) (2011).

449 Such as reliance upon qualitative assessments, quantitative assessments, semi-quantitative risk assessments, and good practice guidance.

450 5 U.S.C. §603(3) (2010).

451 Exec. Order No. 13272, 67 Fed. Reg. 159 (August 13, 2002). http://www.gpo.gov/fdsys/pkg/FR-2002-08- 16/pdf/02-21056.pdf (accessed September 24, 2013).Chevron Richmond Refinery Regulatory Report January 2014

108 performance-based standards in th e US for decades. Recognizing the inefficient process of federal rulemaking in the US, President Clinton signed Executive Order 12866 in September of 1993, which, among other things, directed federal agencies to “identify and assess alternative forms of regulation...[and] specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt.” 452 Executive Order 13563, entitled Improving Regulation and Regulatory Review , supplemented and reaffirmed Executive Order 12866 by ordering agencies to “identify and consider regulatory approaches that re duce burdens and maintain flexibility and freedom of choice for the public.” 453 Its stated goal was to “protect public health, welfare, safety, and our environment while promoting economic growth, innovation, competitiveness, and job creation.” 454 Its seven guiding principles are as follows:

 Increase predictability and reduce uncertainty;

 Use and rely on best available science;

 Ensure public participation a nd open exchange of ideas;

 Use the most innovative and least burdensome tools;

 Consider cost benefit analysis (quantitative and qualitative);

 Ensure regulations are publicly available, c onsistent, written in plain language and easy to understand; and

 Measure results and seek to improve actual results. 455

The safety case regime aims to satisfy all of these principles.

California has adopted its own version of the APA, known as the California Administrative Procedure Act (CAPA) (California Government Code §11340 et seq. ). 456 Among its many requirements for California state agencies that adopt regulations, CA PA directs them to consider the substitution of performance standards for prescriptive standards. 457 CAPA defines “performance standard” as “a regulation that describes an objective with the criteria stated for achieving the objective.” 458

Federal agencies that are engaged in and responsible for regulating high hazards, such as NASA and the Nuclear Regulatory Commission (NRC), have adopted goal or performance-based standards that require risks to be reduced to “as safe as reasonably practicable” (ASARP) and “as low as reasonably achievable,” (ALARA), respectively. The OSHA Process Safety Management (PSM) standard also contains performance-based elements to some exte nt; for example, it provides regulated entities with flexibility in how to perform a pr ocess hazard analysis (PHA). However, it contains no risk reduction goals such as ALARP. This has resulted in an activity-based regulatory scheme that emphasizes completing activities, such as a PHA or a Management of Change (MOC) analysis, rather than actual risk reduction. Without a risk reduction goal such as ALARP in place, the PSM standard will not have the

452 Exec. Order No. 12866, 48 Fed. Reg. 190 (September 30, 1993). http://www.archives.gov/federalregister/executive-orders/pdf/12866.pdf (accessed September 24, 2013).

453 Exec. Order No. 13563, 76 Fed. Reg. 14 (January 21, 2011). http://www.gpo.gov/fdsys/pkg/FR-2011-01- 21/pdf/2011-1385.pdf (accessed September 24, 2013).

454 Ibid.

455 Ibid.

456 Available at http://www.oal.ca.gov/administrative_procedure_act.htm (accessed September 18, 2013).

457 California Government Code, §11340.1(a) (1995).

458 California Government Code, §11342.570 (1995).Chevron Richmond Refinery Regulatory Report January 2014

109 ability to successfully drive continuous improveme nt and adaptation of in dustry safety management
advances.

3. Can the safety case regulatory approach work in the US when workforce involvement is emphasized less than other regions and unionization rates are lower than other countries?

A majority of the workforce in California petroleum refineries is unionized, as the unionization rate for the 15 petroleum refineries in California is actually 73 percent, 459 which is significantly higher than the 2012 rates for the US as a whole (11.1 percent), Australia (17.9 percent), the UK (25.8 percent), and Norway (54.7 percent). 460 Despite a declining unionization rate in the UK, the region has developed strong onshore and offshore regulations that provide for the creation of protected safety representative positions and safety committees for unionized and non-uni onized facilities. These positions are meant to create a healthier and safer workplace, and result in better decision-making regarding health and safety, increased productivity, higher workforce motivation, a stronger commitment to implementing decisions or actions (as employees have been actively involved in reaching these decisions), and greater cooperation and trust. 461 The HSE has devoted extensive time and resources to ensuring employers are complying with these regulations and understand the importance and benefits of involving workers in health and safety-related matters.

The UK also has a standard establishing the minimum level of training that elected safety representatives offshore should receive to enable them to fully perform their functions as defined in the Safety Representatives and Safety Committees Regulations – SI 1989/971. This traini ng standard, entitled the OPITO Approved Standard, was developed by an industry workgroup facilitated by OPITO. 462 In June 2013, Det Norske Veritas (DNV) 463 became accredited by OPITO to offer newly developed training courses to more than 2,000 elected safety representa tives in the offshore industry. The training, which has been driven and supported by HSE, Oil and Gas UK, and the Offshore Industry Advisory Committee’s Workforce Involvement Group, consists of four separate Modules run over the course of eight days. 464 The training covers topics such as Unders tanding and Identifying Major Accident Hazards and Investigating Incidents and Applying Root Cause Analysis.

The CSB recognizes the HSE’s effort to improve work force involvement through regulations, protected positions, and training, and has recommended in this report that California develop regulations and guidelines to establish similar protected safety positions to ensure effective workforce participation. The

459 In September 2013, the USW provided the CSB with a list of California petroleum refinery locations as of October 2012 and the existing unionization representation at those refineries. Of the 15 petroleum refineries operating in California as of October 2012, 11 of those were unionized, with USW providing the union representation at all 11 facilities.

460 For complete statistics on trade union density for countries around the world see http://stats.oecd.org/Index.aspx?QueryId=20167 (accessed September 5, 2013).

461 HSE. Consulting employees on health and safety: A brief guide to the law. 2013; p 2. http://www.hse.gov.uk/pubns/indg232.pdf (accessed September 5, 2013).

462 OPITO is an industry-owned non-profit that serves the needs of the oil and gas industry in the UK and around the world. See http://www.opito.com/ (accessed September 10, 2013).

463 DNV is an independent foundation headquartered in Oslo , Norway, that provides se rvices for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013).

464 http://www.marinelink.com/news /launches-offshore355749.aspx (accessed September 10, 2013).Chevron Richmond Refinery Regulatory Report January 2014

110 CSB believes the HSE model can also be effective in the US as these regulations require effective safety representation regardless of unionization rates.

4. Has the safety case regulatory approach resulted in fewer major accidents?

The CSB has identified a small number of independent studies conducted on the impact of the safety case regulatory approach on safety performance onshore and offshore. In 1999, a report commissioned by the HSE (“the Aberdeen Report”) which evaluated the impact of the offshore Safety Case Regulations on offshore safety was published. 465 One of the purposes of the study was to review published safety data for
trends in offshore accidents and incidents from 1990 until 1997. 466 Upon this review, it was determined there had been a decrease in accidents since the impl ementation of the offshore safety case regulations in the UK, but cautioned it was difficult to distinguish the effect of the safety case regulations from other industry activities such as the level and type of e xploration and production activity, oil prices, and industry-led initiatives. 467 The Aberdeen Report also cautione d about the difficulties in analyzing
offshore data that also hold true for the more current data presented in Figure 3. The total number of
accidents and incidents recorded can be affected by industry attitudes to ward reporting, changes in how and what data is reported, and the decrease or increase in offshore activity. As stated in the Aberdeen Report, “[d]espite these cautions, accident statistics play an important role in the analysis of the state of safety in any industry, since accidents represent the ‘botto m line’ in safety. It is therefore important to analyze the trends, but to also take the drawbacks into consideration.” 468 As discussed in this report, the reporting and analyzing leading process safety indicator s is important to gain a better understanding of how safety management systems are functioning, and thus a better idea of how well the various regimes are managing hazards and mitigating risk.

Statistics from the seven years covered by the Aberdeen Report indicated an overall decrease in reported accident rates in the UK and Norwegian databases up until 1994. From 1994 to 1997, both the UK and Norway reported a slight increase in the number of reported accidents. 469 Norway did report a drop in 1997 from 1996. The decrease reported up until 1994 fo r the UK appeared to be independent of the offshore production activities as those levels had b een on the increase during the same time period. Drilling in the UK decreased during the same time fr ame, making the cause for the decrease in reported drilling accidents unclear.

More recent reviews of accident data indicate decreasi ng trends in accident statistics. The Presidential Oil Spill Commission noted the following in its report to the President on the Macondo disaster:

[f]rom 2004 to 2009, fatalities in the offshore oil and gas industry were more than four times higher per pers on-hours worked in U.S. waters than in European waters, even though many of the same companies work in both venues. This striking statistical discrepancy reinforces the view that the problem is not an inherent trait of the business itself, but rather

465 Evaluation of the Offshore Safety Legislative Regime —A study undertaken by AUPEC Ltd. For the Safety Policy Division, Health & Safety Executive, Ref: 8938/3714, June 1999.

466 Ibid at Ch 7.

467 Ibid at Ch 7, p 7-1.

468 Ibid at Ch. 7, p 7-11.

469 This was based on the number of accidents per million man hours for the two Contin ental Shelves (Ibid, Figure 7.8)Chevron Richmond Refinery Regulatory Report January 2014

111 depends on the differing cultures a nd regulatory systems under which members of the industry operate. 470

In September 2013, Det Norske Veritas (DNV) 471 released a position paper discussing necessary improvements to reduce risk of major offshore accidents, and noted in the report that “there are no good globally accepted metrics for major accident hazards...” 472 However, DNV was able to point to UK HSE’s Hydrocarbon Releases Database System (HCR) 473 in the North Sea to provide an example of improving safety performance trends. 474 The HRC contains detailed volunt ary information of over 4,000 hydrocarbon releases offshore from close to 300 installations since 1992. The HRC data, plotted in Figure 3, show the total number of releases to be on the decline. Classifying the severity of a release is based on agreed-upon criteria with the offshore industry. 475 The UK has defined significant events to be those that, if ignited, have the potential to cause a major accident where multiple casualties could occur. The occurrence of any hydrocarbon release is undesira ble because of the potential to escalate, and so reporting data from minor incidents has also been included in Figure 3 below.

Figure 3. Hydrocarbon releases in the North Sea re ported to UK HSE as dangerous occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations. 476

470 National Commission on the BP Deepwater Horizon Oil Spill. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. Report to the President; January 2011; Ch 8 p 225.

471 DNV is an independent foundation headquartered in Oslo , Norway, that provides se rvices for managing risk around the world. For more information see http://www.dnv.com/ (accessed September 10, 2013).

472 DNV. Enhancing offshore safety and environmental performanc e: Key levers to further reduce the risk of major offshore accidents. 2013; p 5. http://www.dnv.com/industry/ oil_gas/services_solutions/offshore_safety.asp (accessed September 10, 2013).

473 https://www.hse.gov.uk/hcr3/ (accessed January 13, 2014).

474 In its position paper, DNV cited data from 1996, but UK HSE has noted that the criteri a for severity classification was refined in 1999 so data since that date is presented here.

475 Hydrocarbon Releases Syst em Internet Help File, https://www.hse.gov.uk/hcr3/help/help_public.asp (accessed September 10, 2013).

476 RIDDOR – Reporting of Injuries, Di seases and Dangerous Occurrences Regulations 1995 became effective offshore on April 1, 1996, http://www.hse.gov.uk/riddor/ (accessed September 10, 2013) 

### 0 50 100 150 200 250ReportedReleases



### Financial Year (April

‐ March) 2000/01 to 2012/13 Minor
Significant

Major

TotalChevron Richmond Refinery Regulatory Report January 2014

112 It is important to note that major accidents are lo w-probability, high-consequence events, and as such they are difficult to measure. According to Dr. Andrew Hopkins, major accidents are more difficult to define than, say, a car accident, and they are rare, making it difficult to estimate the number of major accidents prevented. 477 In addition, based on the data in existence, there is a continued need for improved data collection; key leading performance indicators deve lopment and implementation on a global scale would provide an improved glimpse into how safety is being managed for major accident prevention.

A team of three independent safety experts was as ked to conduct an independent evaluation of the operational effectiveness of the National Offshore Petroleum Safety Authority (NOPSA), which was established in January 2005 to regulate offshore health and safety in Australia (it was superseded by NOPSEMA in January 2012). The 2008 report released as a result of the evaluation noted that the team of experts received submissions identifying i ssues surrounding the safety case regime from twelve stakeholders, including the Australian Workers Un ion, the Maritime Union of Australia, and the International Association of Drilling Contractors. Th e report states that a majority of the submissions expressed that the safety case regime had “generally b een a success...” and “had led to improvements and already brought forth better consistency in many areas....” 478 The report noted that there was general stakeholder agreement “that the regul atory processes have been improved.” 479

As mentioned in Section 3.2.1.2 of the report, fo llowing the Macondo incident in April 2010, an independent review of the offshore safety case regime in the UK was conducted by a panel consisting of three independent appointees, including Professor Ge offrey Maitland at Imperial College London. A report was published discussing the review in Decembe r 2011, and it noted that, while not perfect, the offshore safety case regime was “robust and effective at identifying risks and appropriate measures for mitigation and response....” 480 The report stated the following:



### From its analysis of the existing UK framework and the information it gleaned from its discussion with those directly involved in the sector from both an operational and regulatory perspective, the Review Panel was reassured that the UK regime already incorporates a number of positive, key features which were not present in the US at the time of the Macondo incident. At a high level, the Panel notes and commends in particular:

• the UK’s “goal-setting” safety regime and its ability to foster innovation and continuous improvement in process integrity,

477 Hopkins, Andrew. The Cost-Benefit Hurdle for Safety Case Regulation: A discussion paper prepared for the US Chemical Safety Board. Add Date, Page, and Link.

478 Ognedal, Magne; Griffiths, Derek; and Lake, Bruce. Review of the National Offshore Petroleum Safety Authority Operational Activities. February-March 2008; p 14.

479 Ibid at 28.

480 Maitland, Geoffrey. Offshore Oil and Gas in the UK: an independent review of the regulatory regime. December 2011; p 4. https://www.gov.uk/government/uploads/syste m/uploads/attachment_data/file/48252/3875- offshore-oil-gas-uk-ind-rev.pdf (accessed Ja nuary 13, 2014).Chevron Richmond Refinery Regulatory Report January 2014

113 

### • the strength of the mechanisms in place for independent, third party verification in the crucial areas of well design and integrity of safety critical equipment,

• the rigour with which the potential environmental impacts of the industry are examined and of the controls and procedures in place to mitigate them,

• the detailed and comprehensive emergency response framework which exists for managing the consequences of incidents should they

occur,

• the high regard in which the UK authorities, in the form of DECC, HSE and MCA, are held both by UK operators and international observers,

• the fact that the events in the Gulf of Mexico have clearly acted as a catalyst for UK operators, working in concert with the regulators and other stakeholders, to redouble their efforts to improve safety and to strengthen response capabilities. 481

5. The UK HSE has published reports 482 showing significant industry problems with maintenance of safety critical equipment, poor understanding of the potential impact of degrading plant and utility systems on safety critical elements, and lack of understa nding of the role of asset integrity and the concept of barriers in major hazard risk control. Don’t these reports developed by the UK regulator demonstrate that the safety case is not effective and is not working?

The CSB recognizes that there have been critiques of the safety case regime and its implementation. The CSB acknowledges that the safety case is not perfect and th at no regulatory system will be perfect in its implementation. Some have noted the issue of agi ng equipment due to many issues, including the harsh conditions that exist in the North Sea. Regulators and commissions in the UK have found degradation of pipes, valves, and other equipment at many fac ilities due to company deferrals of maintenance, insufficient testing of safety-critical elements, and a continuing industry culture of responding to disasters, rather than anticipating worst-case scenario s. However, the safety case regime’s adaptive
nature has been able to address th ese concerns. The HSE has recognized asset integrity management and the issue of ageing equipment as key issues to addr ess in its inspection programs, and has developed internal processes and priorities for these areas.

In 2010, the UK HSE initiated Key Programme 4 to a ddress the issue of aging equipment offshore and the operation of installations beyond their design life. 483 The same year, the HSE published a report intended

481 Ibid at 3.

482 The HSE published a report to communicate the results and conclusions of the Asset Integrity Key Programme carried out between 2004 and 2007 by the Health and Safety Executive’s Offshore Division. See http://www.hse.gov.uk/offshore/kp3.pdf (accessed August 28, 2013).

483 The report is available at http://www.hse.gov.uk/offshore/ageing/kp4-interim-report.pdf (accessed November 1, 2013).Chevron Richmond Refinery Regulatory Report January 2014

114 to inform industry and aid in the prevention of major accidents entitled Managing Ageing Plant: A Summary Guide, 484 which provides an overview of ageing plant mechanisms and their management and presents the findings of an analysis of loss of contai nment incidents to indicate the extent to which ageing plant equipment may be a factor. This type of programmatic proactive a pproach and information dissemination is lacking in the US both on and offshore.

6. How have other countries implemented the safet y case regime? What challenges do the countries face when transitioning to a safety case approach?

From the international safety case community, the CS B has found that when transitioning to a safety case regime there are many obstacles that may hinder the transition, such as:

 Major stakeholders not being committed to the process, unconvinced of the need;

 Lack of understanding that the safety case regime is a “process” to be undertaken by the duty holder and the workforce to improve understanding of the hazards, risks, and their controls, and to put in place measures for continuous improveme nt, rather than just creation of a “document”;

 Lack of sufficient funding by government and industry; and

 Lack of the necessary legislative timetable.

The transition to a safety case regime has significant challenges for both the duty holder and the regulator, including:

 The safety case report could be treated as a check-the-box exercise;

 Documented safety management system does not reflect reality;

 Poor identification of hazards and risks;

 Poor understanding of the performance of control systems;

 Attempting to justify existing controls ra ther than to seek opportunity to improve;

 Insufficient workforce invo lvement in the process;

 The safety case process is under-resourced;

 The safety case report is “inaccessible” so the report simply lives on the shelf;

 The regulator does not use the safety case repor t to inform the inspection or audit;

 Limited requirement for the reporting of acci dents, dangerous occurrences and precursors resulting in lack of comprehensive performance data; and

 The regulator is under-resourced, technically cha llenged, poorly trained, has poor systems and procedures, and is inconsistent.

In implementing the safety case regime, there should be regard for the regulatory principles and frameworks which represent best prac tice. The underlying principles are:

 The legislation and regulation should be fit fo r purpose, not simply superimposed on existing prescriptive regulation;

484 See http://www.hse.gov.uk/research/rrpdf/rr823-summary-guide.pdf (accessed November, 1, 2013).Chevron Richmond Refinery Regulatory Report January 2014

115  Regulation should be effective and efficient; and

 Industry should move away from a culture of co mpliance with detailed prescriptive regulation to one of involving the workforce in understanding the hazards.

Some significant points worth noting from international experience in setting up the regulation are:

 Staff should be recruited against detailed job descriptions and should cover the full range of technical, management and regulatory requirements;

 Pay rates and terms and conditio ns should be sufficient to attract highly qualified staff;

 A competency framework needs to be develope d reflecting the require d knowledge, skills, and experience required to undertake;

 Appropriate training progr ams must be in place;

 An electronic dedicated safety case assessment pro cedure which captures the detail of the process to be followed and records the background to the decision-making process will be needed. This helps ensure good quality, consistent, and tran sparent assessment and provides a database of
information which is used for future validati on/topic facility inspections. It also provides a comprehensive record of the process which can be used in the event of an appeal against an assessment decision;

 An accident and dangerous occurrence data base w ill be needed to store knowledge and data to provide reference information and the capacity to analyze trends; and

 An emergency reporting and response process is necessary to ensure all significant events are properly logged and dealt with.Chevron Richmond Refinery Regulatory Report January 2014

116